tinker-agent 2.5.0 → 2.7.0

package/src/session/session-store.ts

@@ -1,39 +1,16 @@
 import path from "node:path";
-import {
-  chmod,
-  lstat,
-  mkdir,
-  open,
-  readFile,
-  readdir,
-  realpath,
-  rename,
-  rmdir,
-  unlink,
-} from "node:fs/promises";
+import { chmod, mkdir, open, readdir, rename, rmdir } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { Database } from "bun:sqlite";
-import { parseMessageId } from "../ids/runtime-id";
 import type {
   ContextRevisionId,
   ContextSurfaceId,
   IterationId,
   MessageId,
-  ProtocolFrameId,
   RuntimeIdFactory,
   SessionId,
-  ToolCallId,
   TurnId,
 } from "../ids/runtime-id";
-import {
-  createModelContextProfile,
-  type ModelContextProfile,
-} from "../model/model-context-profile";
-import {
-  MODEL_MESSAGE_PROTOCOL_ADAPTERS,
-  type ModelMessageProtocol,
-} from "../model/model-client";
-import type { ToolDefinition, ToolRawResult } from "../tools/types";
 import { sha256, stableJsonStringify } from "../model/model-request-preflight";
 import {
   canonicalHomeRoot,
@@ -59,9 +36,7 @@ import {
   SWAP_TOOL_IMAGE_FORMAT,
 } from "../context/context-swap-renderer";
 import {
-  SUPPORTED_TOOL_OBSERVATION_FORMATS,
   contentHash,
-  immutableCanonicalClone,
   immutableRecord,
   interruptedCompletionInputs,
   observationForCompletion,
@@ -76,7 +51,6 @@ import {
   contextSurfaceChangeManifestHash,
   contextSurfaceChanges,
   validateStoredContextSurface,
-  type ContextSurfaceChanges,
   type StoredContextSurfaceV8,
 } from "../context/context-surface";
 import type {
@@ -85,25 +59,16 @@ import type {
   StoredContextOverrideV8,
   SwapOverride,
 } from "../context/context-revision";
-import type { IterationIdentity, ToolCall, ToolResultContent } from "../agent/types";
+import type { IterationIdentity } from "../agent/types";
 import {
   canonicalToolResultContentHash,
   toolResultDisplayText,
   validateToolResultContent,
 } from "../agent/tool-result-content";
-import {
-  parseImageAssetId,
-  parseImageAttachmentId,
-  validateImageAssetRef,
-  validateOriginalImageName,
-  validateUserMessage,
-  type ImageAssetRef,
-  type UserImageAttachment,
-} from "../image/image-types";
+import { validateUserMessage, type ImageAssetRef } from "../image/image-types";
 import { ImageAssetStore } from "../image/image-asset-store";
 import type { MeasuredContextAnchor } from "../agent/context-meter";
 import type { ProjectInstructionManifest } from "../instructions/project-instructions";
-import { SUPPORTED_RECALL_RETIREMENT_CONTRACT_VERSIONS } from "../context/recall-retirement-contract";
 import type {
   ActiveTurnBoundary,
   ClosedTurnBoundary,
@@ -135,305 +100,87 @@ import {
   verifySessionSchema,
   verifySqliteIntegrity,
 } from "./session-schema";
-import type { AgentEvent } from "../events/types";
-import { renderObservationLogEvent } from "../events/observation-text-log";
-import {
-  SKILL_FILE_MAX_BYTES,
-  SKILL_RESOURCE_MAX_DEPTH,
-  SKILL_RESOURCE_MAX_ENTRIES,
-  type SkillScope,
-} from "../skills/skill-loader";
-import type {
-  ActiveSkillManifestEntry,
-  SkillCatalogManifestEntry,
-} from "../skills/skill-catalog";
 import {
   SKILL_ACTIVATION_RECEIPT_FORMAT,
   SKILL_POLICY_VERSION,
   renderSkillActivationReceipt,
 } from "../skills/skill-context";
 import {
-  IMAGE_INPUT_POLICY,
-  IMAGE_INPUT_POLICY_VERSION,
-} from "../image/image-input-policy";
-
-export type SessionMediaCompatibility = {
-  readonly policyVersion: string;
-  readonly policySha256: string;
-  readonly inputModalities: readonly ("text" | "image")[];
-  readonly toolResultModalities: readonly ("text" | "image")[];
-};
-
-export type CompletedTurnMessageSnapshot =
-  | {
-      readonly ordinal: number;
-      readonly role: "user";
-      readonly content: string;
-    }
-  | {
-      readonly ordinal: number;
-      readonly role: "assistant";
-      readonly content: string | null;
-      readonly reasoningContent?: string | null;
-    }
-  | {
-      readonly ordinal: number;
-      readonly role: "tool";
-      readonly name: string;
-      readonly content: string;
-    };
-
-export type CompletedTurnSnapshot = {
-  readonly messages: readonly CompletedTurnMessageSnapshot[];
-};
-
-export type SessionCompatibilityContract = {
-  modelName: string;
-  profileName?: string;
-  includeReasoningContent: boolean;
-  contextProfile: ModelContextProfile;
-  messageProtocol: ModelMessageProtocol;
-  media: SessionMediaCompatibility;
-};
-
-export type StoredSessionMetaV10 = {
-  schemaVersion: 10;
-  schemaFingerprint: string;
-  initializationState: "creating" | "ready";
-  sessionId: SessionId;
-  workspaceRoot: string;
-  modelName: string;
-  systemPromptSha256: string;
-  projectInstruction?: ProjectInstructionManifest;
-  sessionCompatibilityJson: string | null;
-  sessionCompatibilitySha256: string | null;
-  activeRevisionId: ContextRevisionId | null;
-  nextTurnNumber: number;
-  nextEventSequence: number;
-  openCount: number;
-  createdAt: string;
-  updatedAt: string;
-  lastOpenedAt: string;
-  lastClosedAt: string | null;
-  lastCloseReason:
-    | "oneshot_complete"
-    | "tui_exit"
-    | "session_switch"
-    | "runner_failed"
-    | "initialization_failed"
-    | null;
-};
-
-export type SessionCloseReason = NonNullable<StoredSessionMetaV10["lastCloseReason"]>;
-
-export type SessionRecoveryResult = {
-  recoveredTurnId?: TurnId;
-  recoveredFrameId?: ProtocolFrameId;
-  syntheticCompletionCount: number;
-  recallIndexRebuilt: boolean;
-};
-
-type StoredMeasuredContextState = {
-  revisionId: ContextRevisionId;
-  anchor: MeasuredContextAnchor;
-};
-
-export type CommitSwapRevisionInput = {
-  revisionId: ContextRevisionId;
-  expectedBaseRevisionId: ContextRevisionId;
-  expectedBaseRevisionNumber: number;
-  expectedCanonicalThroughOrdinal: number;
-  expectedBaseActiveOverrideManifestSha256: string;
-  policyVersion: "swap-only-v1";
-  rendererFormat: typeof SWAP_OBSERVATION_FORMAT;
-  planHash: string;
-  addedOverrides: readonly SwapOverride[];
-  nextActiveOverrideManifestSha256: string;
-  canonicalSequenceSha256: string;
-  renderedMessageSha256: string;
-  activeTurnId?: TurnId;
-};
-
-export type CommitSwapRevisionFaultStage =
-  | "before_revision_insert"
-  | "after_revision_insert"
-  | "after_first_override_insert"
-  | "after_overrides_insert"
-  | "after_measurement_delete"
-  | "after_active_update";
-
-export type CommitSwapRevisionOptions = {
-  faultInjector?: (stage: CommitSwapRevisionFaultStage) => void;
-};
-
-export type CommitSurfaceRefreshInput = {
-  revisionId: ContextRevisionId;
-  expectedBaseRevisionId: ContextRevisionId;
-  expectedBaseRevisionNumber: number;
-  expectedCanonicalThroughOrdinal: number;
-  expectedBaseActiveOverrideManifestSha256: string;
-  surface: StoredContextSurfaceV8;
-  changes: ContextSurfaceChanges;
-  changeManifestSha256: string;
-  canonicalSequenceSha256: string;
-  renderedMessageSha256: string;
-};
-
-export type CommitSurfaceRefreshFaultStage =
-  | "before_surface_insert"
-  | "after_surface_insert"
-  | "after_revision_insert"
-  | "after_measurement_delete"
-  | "after_active_update";
-
-export type CommitSurfaceRefreshOptions = {
-  faultInjector?: (stage: CommitSurfaceRefreshFaultStage) => void;
-};
-
-export type CommitPrefixRetirementRevisionInput = {
-  revisionId: ContextRevisionId;
-  expectedBaseRevisionId: ContextRevisionId;
-  expectedBaseRevisionNumber: number;
-  expectedBaseKeepFromOrdinal: number;
-  expectedCanonicalThroughOrdinal: number;
-  expectedSurfaceSha256: string;
-  expectedBaseActiveOverrideManifestSha256: string;
-  policyVersion: "recall-first-retirement-v1";
-  planHash: string;
-  nextKeepFromOrdinal: number;
-  retiredThroughOrdinal: number;
-  retiredTurnCount: number;
-  retiredFrameCount: number;
-  retiredMessageCount: number;
-  nextActiveOverrideCount: number;
-  nextActiveOverrideManifestSha256: string;
-  canonicalSequenceSha256: string;
-  renderedMessageSha256: string;
-  activeTurnId?: TurnId;
-};
-
-export type CommitPrefixRetirementRevisionFaultStage =
-  | "before_revision_insert"
-  | "after_revision_insert"
-  | "after_override_readback"
-  | "after_measurement_delete"
-  | "after_active_update"
-  | "after_snapshot_readback";
-
-export type CommitPrefixRetirementRevisionOptions = {
-  faultInjector?: (stage: CommitPrefixRetirementRevisionFaultStage) => void;
-};
-
-export type StoredSkillActivation = {
-  readonly activationMessageId: MessageId;
-  readonly toolCallId: ToolCallId;
-  readonly sessionId: SessionId;
-  readonly name: string;
-  readonly scope: SkillScope;
-  readonly skillFileSha256: string;
-  readonly state: "pending" | "dispatched" | "promoted" | "rejected";
-  readonly dispatchedIterationId?: IterationId;
-  readonly settledRevisionId?: ContextRevisionId;
-  readonly rejectionReason?: string;
-  readonly createdAt: string;
-  readonly updatedAt: string;
-};
-
-export type CommitSkillsUpdateInput = {
-  revisionId: ContextRevisionId;
-  expectedBaseRevisionId: ContextRevisionId;
-  expectedBaseRevisionNumber: number;
-  expectedCanonicalThroughOrdinal: number;
-  expectedBaseActiveOverrideManifestSha256: string;
-  surface: StoredContextSurfaceV8;
-  changes: ContextSurfaceChanges;
-  changeManifestSha256: string;
-  activationManifestSha256: string;
-  addedOverrides: readonly SwapOverride[];
-  nextActiveOverrideManifestSha256: string;
-  settlements: readonly {
-    activationMessageId: MessageId;
-    name: string;
-    state: "promoted" | "rejected";
-    rejectionReason?: string;
-  }[];
-  canonicalSequenceSha256: string;
-  renderedMessageSha256: string;
-};
-
-export type CommitSkillsUpdateFaultStage =
-  | "before_surface_insert"
-  | "after_surface_insert"
-  | "after_revision_insert"
-  | "after_first_override_insert"
-  | "after_overrides_insert"
-  | "after_activations_update"
-  | "after_measurement_delete"
-  | "after_active_update";
-
-export type CommitSkillsUpdateOptions = {
-  faultInjector?: (stage: CommitSkillsUpdateFaultStage) => void;
-};
-
-export type CloneSessionFaultStage =
-  | "after_staging_mkdir"
-  | "after_snapshot"
-  | "after_trigger_drop"
-  | "after_identity_update"
-  | "after_revision_hash_rewrite"
-  | "after_trigger_reinstall"
-  | "after_recall_validation"
-  | "after_event_rewrite"
-  | "after_observation_render"
-  | "after_artifact_validation"
-  | "before_publish_rename";
-
-export type CloneSessionStoreInput = {
-  targetSessionId: SessionId;
-  faultInjector?: (stage: CloneSessionFaultStage) => void;
-};
-
-export function skillActivationManifestSha256(
-  settlements: CommitSkillsUpdateInput["settlements"],
-): string {
-  return sha256(
-    stableJsonStringify(
-      [...settlements]
-        .sort(
-          (left, right) =>
-            compareCanonicalText(left.name, right.name) ||
-            compareCanonicalText(left.activationMessageId, right.activationMessageId),
-        )
-        .map((settlement) => ({
-          activationMessageId: settlement.activationMessageId,
-          name: settlement.name,
-          state: settlement.state,
-          ...(settlement.rejectionReason === undefined
-            ? {}
-            : { rejectionReason: settlement.rejectionReason }),
-        })),
-    ),
-  );
-}
-
-export type CreateNewSessionStoreInput = {
-  workspaceRoot: string;
-  sessionId: SessionId;
-  modelName: string;
-  systemPrompt: string;
-  projectInstruction?: ProjectInstructionManifest;
-  idFactory: RuntimeIdFactory;
-  clock?: () => string;
-  homeRoot?: string;
-};
-
-export type OpenSessionStoreInput = {
-  workspaceRoot: string;
-  sessionId: SessionId;
-  clock?: () => string;
-  allowIncomplete?: boolean;
-  homeRoot?: string;
-};
+  assertMeasuredContextAnchor,
+  enumFromSql,
+  nullableStringFromSql,
+  nullableTextFromSql,
+  numberFromSql,
+  recordFromSql,
+  sha256FromSql,
+  stringFromSql,
+  timestampFromSql,
+} from "./session-store-value-codecs";
+export { decodeStoredToolRawResult } from "./session-tool-result-codec";
+import {
+  cloneDiagnosticFiles,
+  rekeyProtocolView,
+  rekeyStoredToolCalls,
+  rewriteCloneRevisionHashes,
+  SESSION_SCOPED_TABLES,
+} from "./session-clone-helpers";
+import {
+  assertPathMissing,
+  canonicalWorkspaceRoot,
+  chmodIfExists,
+  ensureSessionsRoot,
+  removeKnownInitializationFiles,
+  safeSessionDirectory,
+  unlinkIfExists,
+  validateSecureDirectory,
+  validateSecureFile,
+  validateSecureOptionalFile,
+  validateSessionsRoot,
+} from "./session-store-filesystem";
+import {
+  skillActivationManifestSha256,
+  type CloneSessionStoreInput,
+  type CommitPrefixRetirementRevisionInput,
+  type CommitPrefixRetirementRevisionOptions,
+  type CommitSkillsUpdateInput,
+  type CommitSkillsUpdateOptions,
+  type CommitSurfaceRefreshInput,
+  type CommitSurfaceRefreshOptions,
+  type CommitSwapRevisionInput,
+  type CommitSwapRevisionOptions,
+  type CompletedTurnMessageSnapshot,
+  type CompletedTurnSnapshot,
+  type CreateNewSessionStoreInput,
+  type OpenSessionStoreInput,
+  type SessionCloseReason,
+  type SessionCompatibilityContract,
+  type SessionRecoveryResult,
+  type StoredMeasuredContextState,
+  type StoredSessionMetaV10,
+  type StoredSkillActivation,
+} from "./session-store-contracts";
+export * from "./session-store-contracts";
+export { createSessionCompatibilityContract } from "./session-compatibility-codec";
+import {
+  compatibilityContractDifferences,
+  decodeMeta,
+  normalizeSessionCompatibilityContract,
+} from "./session-compatibility-codec";
+export { decodeStoredToolCalls } from "./session-store-record-codecs";
+import {
+  decodeContextRevision,
+  decodeContextSurface,
+  decodeFrame,
+  decodeMessage,
+  decodeSkillActivation,
+  decodeStoredSwapOverride,
+  imageAssetRefFromAttachment,
+  decodeToolResult,
+  loadMessageImageAttachments,
+  loadToolMessageContentBlocks,
+  protocolPrefixView,
+  stripStoredOverride,
+} from "./session-store-record-codecs";
 
 export class SessionStore implements SessionLedgerCommitter {
   readonly sessionId: SessionId;
@@ -3742,87 +3489,6 @@ function insertPendingSkillActivation(
     );
 }
 
-export function createSessionCompatibilityContract(input: {
-  modelName: string;
-  profileName?: string;
-  includeReasoningContent: boolean;
-  contextProfile: ModelContextProfile;
-  messageProtocol: ModelMessageProtocol;
-  inputModalities: readonly ("text" | "image")[];
-  toolResultModalities: readonly ("text" | "image")[];
-}): SessionCompatibilityContract {
-  if (input.modelName.trim() === "") {
-    throw new Error("Session compatibility model name must not be empty.");
-  }
-  if (input.profileName !== undefined && input.profileName.trim() === "") {
-    throw new Error("Session compatibility profile name must not be empty.");
-  }
-  if (typeof input.includeReasoningContent !== "boolean") {
-    throw new Error("Session compatibility reasoning replay flag must be boolean.");
-  }
-  if (
-    !MODEL_MESSAGE_PROTOCOL_ADAPTERS.includes(input.messageProtocol.adapter) ||
-    input.messageProtocol.serializationVersion.trim() === ""
-  ) {
-    throw new Error("Session compatibility message protocol is invalid.");
-  }
-  const inputModalities = normalizeInputModalities(input.inputModalities);
-  const toolResultModalities = normalizeInputModalities(input.toolResultModalities);
-  if (toolResultModalities.includes("image") && !inputModalities.includes("image")) {
-    throw new Error("Session compatibility image tool results require image input.");
-  }
-  return Object.freeze({
-    modelName: input.modelName,
-    ...(input.profileName === undefined ? {} : { profileName: input.profileName }),
-    includeReasoningContent: input.includeReasoningContent,
-    contextProfile: Object.freeze(createModelContextProfile(input.contextProfile)),
-    messageProtocol: immutableCanonicalClone(input.messageProtocol),
-    media: Object.freeze({
-      policyVersion: IMAGE_INPUT_POLICY_VERSION,
-      policySha256: sha256(
-        stableJsonStringify({
-          version: IMAGE_INPUT_POLICY_VERSION,
-          ...IMAGE_INPUT_POLICY,
-        }),
-      ),
-      inputModalities,
-      toolResultModalities,
-    }),
-  });
-}
-
-function normalizeSessionCompatibilityContract(
-  contract: SessionCompatibilityContract,
-): SessionCompatibilityContract {
-  return createSessionCompatibilityContract({
-    modelName: contract.modelName,
-    ...(contract.profileName === undefined
-      ? {}
-      : { profileName: contract.profileName }),
-    includeReasoningContent: contract.includeReasoningContent,
-    contextProfile: contract.contextProfile,
-    messageProtocol: contract.messageProtocol,
-    inputModalities: contract.media.inputModalities,
-    toolResultModalities: contract.media.toolResultModalities,
-  });
-}
-
-function normalizeInputModalities(
-  modalities: readonly ("text" | "image")[],
-): readonly ("text" | "image")[] {
-  if (
-    modalities.length === 0 ||
-    modalities.some((value) => value !== "text" && value !== "image") ||
-    new Set(modalities).size !== modalities.length ||
-    !modalities.includes("text")
-  ) {
-    throw new Error("Session compatibility input modalities are invalid.");
-  }
-  return Object.freeze(
-    modalities.includes("image") ? (["text", "image"] as const) : (["text"] as const),
-  );
-}
-
 export async function resolveSessionDatabasePath(
   workspaceRoot: string,
   sessionId: SessionId,
@@ -4089,2019 +3755,182 @@ function insertContextSurface(
     );
 }
 
-function decodeFrame(rowValue: unknown): ProtocolFrame {
-  const row = recordFromSql(rowValue, "protocol frame");
-  const state = enumFromSql(row.state, ["open", "closed"] as const, "frame state");
-  const kind = enumFromSql(
-    row.kind,
-    ["system", "user", "assistant_text", "tool_exchange"] as const,
-    "frame kind",
-  );
-  const lastOrdinal = nullableNumberFromSql(row.last_ordinal, "last_ordinal");
-  const closedAt = nullableStringFromSql(row.closed_at, "closed_at");
-  return immutableRecord({
-    frameId: stringFromSql(row.frame_id, "frame_id") as ProtocolFrameId,
-    sessionId: stringFromSql(row.session_id, "session_id") as SessionId,
-    ...(row.turn_id === null
-      ? {}
-      : { turnId: stringFromSql(row.turn_id, "turn_id") as TurnId }),
-    ...(row.iteration_id === null
-      ? {}
-      : {
-          iterationId: stringFromSql(row.iteration_id, "iteration_id") as IterationId,
-        }),
-    kind,
-    state,
-    firstOrdinal: numberFromSql(row.first_ordinal, "first_ordinal"),
-    ...(lastOrdinal === null ? {} : { lastOrdinal }),
-    createdAt: timestampFromSql(row.created_at, "created_at"),
-    ...(closedAt === null ? {} : { closedAt: timestampValue(closedAt, "closed_at") }),
+function decodeMeasuredContextState(
+  value: unknown,
+  expectedSessionId: SessionId,
+): StoredMeasuredContextState {
+  const row = recordFromSql(value, "context measurement state");
+  const sessionId = stringFromSql(row.session_id, "session_id") as SessionId;
+  if (sessionId !== expectedSessionId) {
+    throw new Error(
+      `Context measurement session ID ${sessionId} does not match store.`,
+    );
+  }
+  const promptTokens = numberFromSql(row.prompt_tokens, "prompt_tokens");
+  const completionTokens = numberFromSql(row.completion_tokens, "completion_tokens");
+  const totalTokens = numberFromSql(row.total_tokens, "total_tokens");
+  if (totalTokens !== promptTokens + completionTokens) {
+    throw new Error(
+      "Context measurement total_tokens must equal prompt_tokens + completion_tokens.",
+    );
+  }
+  timestampFromSql(row.updated_at, "updated_at");
+  return Object.freeze({
+    revisionId: stringFromSql(row.revision_id, "revision_id") as ContextRevisionId,
+    anchor: Object.freeze({
+      totalTokens,
+      promptTokens,
+      completionTokens,
+      segmentCount: numberFromSql(row.segment_count, "segment_count"),
+      prefixHash: sha256FromSql(row.prefix_hash, "prefix_hash"),
+      requestConfigHash: sha256FromSql(row.request_config_hash, "request_config_hash"),
+      toolSchemaHash: sha256FromSql(row.tool_schema_hash, "tool_schema_hash"),
+    }),
   });
 }
 
-function loadMessageImageAttachments(
-  database: Database,
-): Map<string, readonly UserImageAttachment[]> {
-  const rows = database
-    .query(
-      `SELECT mia.*, ia.mime_type, ia.byte_length, ia.width, ia.height,
-              ia.created_at AS asset_created_at
-       FROM message_image_attachments mia
-       JOIN image_assets ia ON ia.asset_id = mia.asset_id
-       JOIN messages m ON m.message_id = mia.message_id
-       ORDER BY m.ordinal, mia.position`,
-    )
-    .all();
-  const mutable = new Map<string, UserImageAttachment[]>();
-  for (const rowValue of rows) {
-    const row = recordFromSql(rowValue, "message image attachment");
-    const messageId = stringFromSql(row.message_id, "attachment message_id");
-    const attachments = mutable.get(messageId) ?? [];
-    const position = numberFromSql(row.position, "attachment position");
-    if (position !== attachments.length) {
-      throw new Error(
-        `Image attachment positions for message ${messageId} are not continuous.`,
-      );
+function assertCommitSwapRevisionInput(input: CommitSwapRevisionInput): void {
+  if (
+    input.revisionId.trim() === "" ||
+    input.expectedBaseRevisionId.trim() === "" ||
+    !Number.isSafeInteger(input.expectedBaseRevisionNumber) ||
+    input.expectedBaseRevisionNumber < 1 ||
+    !Number.isSafeInteger(input.expectedCanonicalThroughOrdinal) ||
+    input.expectedCanonicalThroughOrdinal < 1 ||
+    input.addedOverrides.length < 1 ||
+    input.policyVersion !== "swap-only-v1" ||
+    input.rendererFormat !== SWAP_OBSERVATION_FORMAT
+  ) {
+    throw new Error("Commit swap revision input is invalid.");
+  }
+  for (const [name, hash] of [
+    [
+      "expectedBaseActiveOverrideManifestSha256",
+      input.expectedBaseActiveOverrideManifestSha256,
+    ],
+    ["planHash", input.planHash],
+    ["nextActiveOverrideManifestSha256", input.nextActiveOverrideManifestSha256],
+    ["canonicalSequenceSha256", input.canonicalSequenceSha256],
+    ["renderedMessageSha256", input.renderedMessageSha256],
+  ] as const) {
+    if (!/^[0-9a-f]{64}$/.test(hash)) {
+      throw new Error(`Commit swap revision ${name} must be a SHA-256 hash.`);
     }
-    timestampFromSql(row.asset_created_at, "image asset created_at");
-    const attachment = immutableRecord<UserImageAttachment>({
-      attachmentId: parseImageAttachmentId(
-        stringFromSql(row.attachment_id, "attachment_id"),
-      ),
-      assetId: parseImageAssetId(stringFromSql(row.asset_id, "asset_id")),
-      mimeType: enumFromSql(
-        row.mime_type,
-        ["image/png", "image/jpeg", "image/webp"] as const,
-        "image mime_type",
-      ),
-      byteLength: numberFromSql(row.byte_length, "image byte_length"),
-      width: numberFromSql(row.width, "image width"),
-      height: numberFromSql(row.height, "image height"),
-      label: stringFromSql(row.label, "attachment label"),
-      range: immutableRecord({
-        start: numberFromSql(row.range_start, "attachment range_start"),
-        end: numberFromSql(row.range_end, "attachment range_end"),
-      }),
-      originalName: stringFromSql(row.original_name, "attachment original_name"),
-    });
-    validateOriginalImageName(attachment.originalName);
-    attachments.push(attachment);
-    mutable.set(messageId, attachments);
   }
-  return new Map(
-    [...mutable].map(([messageId, attachments]) => [
-      messageId,
-      Object.freeze(attachments),
-    ]),
-  );
 }
 
-function loadToolMessageContentBlocks(
-  database: Database,
-): Map<string, readonly ToolResultContent[]> {
-  const rows = database
-    .query(
-      `SELECT tcb.*, ia.mime_type, ia.byte_length, ia.width, ia.height,
-              ia.created_at AS asset_created_at
-       FROM tool_message_content_blocks tcb
-       LEFT JOIN image_assets ia ON ia.asset_id = tcb.asset_id
-       JOIN messages m ON m.message_id = tcb.message_id
-       ORDER BY m.ordinal, tcb.position`,
-    )
-    .all();
-  const mutable = new Map<string, ToolResultContent[]>();
-  for (const rowValue of rows) {
-    const row = recordFromSql(rowValue, "tool message content block");
-    const messageId = stringFromSql(row.message_id, "tool block message_id");
-    const blocks = mutable.get(messageId) ?? [];
-    const position = numberFromSql(row.position, "tool block position");
-    if (position !== blocks.length) {
-      throw new Error(
-        `Tool content block positions for message ${messageId} are not continuous.`,
-      );
-    }
-    const kind = enumFromSql(row.kind, ["text", "image"] as const, "tool block kind");
-    const block: ToolResultContent =
-      kind === "text"
-        ? immutableRecord({
-            type: "text",
-            text: stringFromSql(row.text_content, "tool block text_content"),
-          })
-        : immutableRecord({
-            type: "image",
-            asset: immutableRecord({
-              assetId: parseImageAssetId(
-                stringFromSql(row.asset_id, "tool block asset_id"),
-              ),
-              mimeType: enumFromSql(
-                row.mime_type,
-                ["image/png", "image/jpeg", "image/webp"] as const,
-                "tool block image mime_type",
-              ),
-              byteLength: numberFromSql(
-                row.byte_length,
-                "tool block image byte_length",
-              ),
-              width: numberFromSql(row.width, "tool block image width"),
-              height: numberFromSql(row.height, "tool block image height"),
-            }),
-          });
-    if (kind === "image") {
-      timestampFromSql(row.asset_created_at, "tool block image asset created_at");
+function assertCommitSurfaceRefreshInput(input: CommitSurfaceRefreshInput): void {
+  if (
+    input.revisionId.trim() === "" ||
+    input.expectedBaseRevisionId.trim() === "" ||
+    !Number.isSafeInteger(input.expectedBaseRevisionNumber) ||
+    input.expectedBaseRevisionNumber < 1 ||
+    !Number.isSafeInteger(input.expectedCanonicalThroughOrdinal) ||
+    input.expectedCanonicalThroughOrdinal < 1
+  ) {
+    throw new Error("Commit surface refresh input is invalid.");
+  }
+  for (const [name, hash] of [
+    [
+      "expectedBaseActiveOverrideManifestSha256",
+      input.expectedBaseActiveOverrideManifestSha256,
+    ],
+    ["changeManifestSha256", input.changeManifestSha256],
+    ["canonicalSequenceSha256", input.canonicalSequenceSha256],
+    ["renderedMessageSha256", input.renderedMessageSha256],
+  ] as const) {
+    if (!/^[0-9a-f]{64}$/.test(hash)) {
+      throw new Error(`Commit surface refresh ${name} must be a SHA-256 hash.`);
     }
-    blocks.push(block);
-    mutable.set(messageId, blocks);
   }
-  return new Map(
-    [...mutable].map(([messageId, blocks]) => {
-      validateToolResultContent(blocks);
-      return [messageId, Object.freeze(blocks)] as const;
-    }),
-  );
 }
 
-function decodeMessage(
-  rowValue: unknown,
-  attachments?: readonly UserImageAttachment[],
-  toolContentBlocks?: readonly ToolResultContent[],
-): CanonicalMessageRecord {
-  const row = recordFromSql(rowValue, "message");
-  const base = {
-    messageId: stringFromSql(row.message_id, "message_id") as MessageId,
-    sessionId: stringFromSql(row.session_id, "session_id") as SessionId,
-    frameId: stringFromSql(row.frame_id, "frame_id") as ProtocolFrameId,
-    ordinal: numberFromSql(row.ordinal, "ordinal"),
-    contentSha256: stringFromSql(row.content_sha256, "content_sha256"),
-    createdAt: timestampFromSql(row.created_at, "created_at"),
-  };
-  const role = enumFromSql(
-    row.role,
-    ["system", "user", "assistant", "tool"] as const,
-    "message role",
-  );
-  switch (role) {
-    case "system":
-      if (attachments !== undefined || toolContentBlocks !== undefined) {
-        throw new Error("System messages cannot have media relation rows.");
-      }
-      return immutableRecord({
-        ...base,
-        role,
-        content: stringFromSql(row.content, "content"),
-        origin: "runtime",
-      });
-    case "user": {
-      if (toolContentBlocks !== undefined) {
-        throw new Error("User messages cannot have tool content blocks.");
-      }
-      const message = {
-        ...base,
-        role,
-        turnId: stringFromSql(row.turn_id, "turn_id") as TurnId,
-        content: stringFromSql(row.content, "content"),
-        ...(attachments === undefined ? {} : { attachments }),
-        origin: "user",
-      } as const;
-      validateUserMessage({
-        role: "user",
-        content: message.content,
-        ...(message.attachments === undefined
-          ? {}
-          : { attachments: message.attachments }),
-      });
-      return immutableRecord(message);
-    }
-    case "assistant": {
-      if (attachments !== undefined || toolContentBlocks !== undefined) {
-        throw new Error("Assistant messages cannot have media relation rows.");
-      }
-      const content = nullableTextFromSql(row.content, "content");
-      const reasoningPresent = numberFromSql(
-        row.reasoning_content_present,
-        "reasoning_content_present",
-      );
-      if (reasoningPresent !== 0 && reasoningPresent !== 1) {
-        throw new Error("reasoning_content_present must be 0 or 1.");
-      }
-      const toolCalls =
-        row.tool_calls_json === null
-          ? undefined
-          : decodeStoredToolCalls(
-              stringFromSql(row.tool_calls_json, "tool_calls_json"),
-            );
-      return immutableRecord({
-        ...base,
-        role,
-        turnId: stringFromSql(row.turn_id, "turn_id") as TurnId,
-        iterationId: stringFromSql(row.iteration_id, "iteration_id") as IterationId,
-        content,
-        ...(reasoningPresent === 0
-          ? {}
-          : {
-              reasoningContent: nullableTextFromSql(
-                row.reasoning_content,
-                "reasoning_content",
-              ),
-            }),
-        ...(toolCalls === undefined ? {} : { toolCalls }),
-        provider: stringFromSql(row.provider, "provider"),
-        model: stringFromSql(row.model, "model"),
-        origin: "model",
-      });
-    }
-    case "tool": {
-      if (attachments !== undefined) {
-        throw new Error("Tool messages cannot have image attachments.");
-      }
-      if (toolContentBlocks === undefined) {
-        throw new Error("Tool messages must have persisted content blocks.");
-      }
-      validateToolResultContent(toolContentBlocks);
-      const displayText = stringFromSql(row.content, "content");
-      if (toolResultDisplayText(toolContentBlocks) !== displayText) {
-        throw new Error("Tool message display projection does not match its blocks.");
-      }
-      return immutableRecord({
-        ...base,
-        role,
-        turnId: stringFromSql(row.turn_id, "turn_id") as TurnId,
-        iterationId: stringFromSql(row.iteration_id, "iteration_id") as IterationId,
-        toolCallId: stringFromSql(row.tool_call_id, "tool_call_id") as ToolCallId,
-        providerToolCallId: stringFromSql(
-          row.provider_tool_call_id,
-          "provider_tool_call_id",
-        ),
-        name: stringFromSql(row.name, "name"),
-        content: toolContentBlocks,
-        displayText,
-        origin: enumFromSql(row.origin, ["tool", "runtime"] as const, "tool origin"),
-      });
+function assertCommitSkillsUpdateInput(input: CommitSkillsUpdateInput): void {
+  if (
+    input.revisionId.trim() === "" ||
+    input.expectedBaseRevisionId.trim() === "" ||
+    !Number.isSafeInteger(input.expectedBaseRevisionNumber) ||
+    input.expectedBaseRevisionNumber < 1 ||
+    !Number.isSafeInteger(input.expectedCanonicalThroughOrdinal) ||
+    input.expectedCanonicalThroughOrdinal < 1 ||
+    input.addedOverrides.length < 1 ||
+    input.settlements.length !== input.addedOverrides.length
+  ) {
+    throw new Error("Commit Agent Skills update input is invalid.");
+  }
+  for (const [name, hash] of [
+    [
+      "expectedBaseActiveOverrideManifestSha256",
+      input.expectedBaseActiveOverrideManifestSha256,
+    ],
+    ["changeManifestSha256", input.changeManifestSha256],
+    ["activationManifestSha256", input.activationManifestSha256],
+    ["nextActiveOverrideManifestSha256", input.nextActiveOverrideManifestSha256],
+    ["canonicalSequenceSha256", input.canonicalSequenceSha256],
+    ["renderedMessageSha256", input.renderedMessageSha256],
+  ] as const) {
+    if (!/^[0-9a-f]{64}$/.test(hash)) {
+      throw new Error(`Commit Agent Skills update ${name} must be a SHA-256 hash.`);
     }
   }
 }
 
-function imageAssetRefFromAttachment(attachment: UserImageAttachment): ImageAssetRef {
-  return Object.freeze({
-    assetId: attachment.assetId,
-    mimeType: attachment.mimeType,
-    byteLength: attachment.byteLength,
-    width: attachment.width,
-    height: attachment.height,
-  });
+function assertCommitPrefixRetirementRevisionInput(
+  input: CommitPrefixRetirementRevisionInput,
+): void {
+  if (
+    input.revisionId.trim() === "" ||
+    input.expectedBaseRevisionId.trim() === "" ||
+    input.policyVersion !== "recall-first-retirement-v1" ||
+    !Number.isSafeInteger(input.expectedBaseRevisionNumber) ||
+    input.expectedBaseRevisionNumber < 1 ||
+    !Number.isSafeInteger(input.expectedBaseKeepFromOrdinal) ||
+    input.expectedBaseKeepFromOrdinal < 1 ||
+    !Number.isSafeInteger(input.expectedCanonicalThroughOrdinal) ||
+    input.expectedCanonicalThroughOrdinal < 1 ||
+    !Number.isSafeInteger(input.nextKeepFromOrdinal) ||
+    input.nextKeepFromOrdinal <= input.expectedBaseKeepFromOrdinal ||
+    input.retiredThroughOrdinal !== input.nextKeepFromOrdinal - 1 ||
+    !Number.isSafeInteger(input.retiredTurnCount) ||
+    input.retiredTurnCount < 1 ||
+    !Number.isSafeInteger(input.retiredFrameCount) ||
+    input.retiredFrameCount < 1 ||
+    !Number.isSafeInteger(input.retiredMessageCount) ||
+    input.retiredMessageCount < 1 ||
+    !Number.isSafeInteger(input.nextActiveOverrideCount) ||
+    input.nextActiveOverrideCount < 0
+  ) {
+    throw new Error("Commit prefix retirement input is invalid.");
+  }
+  for (const [name, hash] of [
+    ["expectedSurfaceSha256", input.expectedSurfaceSha256],
+    [
+      "expectedBaseActiveOverrideManifestSha256",
+      input.expectedBaseActiveOverrideManifestSha256,
+    ],
+    ["planHash", input.planHash],
+    ["nextActiveOverrideManifestSha256", input.nextActiveOverrideManifestSha256],
+    ["canonicalSequenceSha256", input.canonicalSequenceSha256],
+    ["renderedMessageSha256", input.renderedMessageSha256],
+  ] as const) {
+    if (!/^[0-9a-f]{64}$/.test(hash)) {
+      throw new Error(`Commit prefix retirement ${name} must be a SHA-256 hash.`);
+    }
+  }
 }
 
-function decodeToolResult(rowValue: unknown): ToolResultRecord {
-  const row = recordFromSql(rowValue, "tool result");
-  const kind = enumFromSql(
-    row.completion_kind,
-    ["returned", "synthetic"] as const,
-    "completion kind",
-  );
-  let completion: ToolCompletion;
-  if (kind === "returned") {
-    completion = immutableRecord({
-      kind,
-      raw: decodeStoredToolRawResult(
-        parseJson(stringFromSql(row.raw_json, "raw_json"), "raw_json"),
-      ),
-      rawSha256: stringFromSql(row.raw_sha256, "raw_sha256"),
-      observationFormat: enumFromSql(
-        row.observation_format,
-        SUPPORTED_TOOL_OBSERVATION_FORMATS,
-        "observation format",
-      ),
-    });
-  } else {
-    const reason = enumFromSql(
-      row.synthetic_reason,
-      [
-        "cancelled_active",
-        "skipped_after_cancel",
-        "failed_active",
-        "skipped_after_failure",
-        "interrupted_active",
-        "skipped_after_interruption",
-      ] as const,
-      "synthetic reason",
-    );
-    completion = immutableRecord({
-      kind,
-      reason,
-      ...(row.synthetic_detail === null
-        ? {}
-        : {
-            detail: stringFromSql(row.synthetic_detail, "synthetic_detail"),
-          }),
-    });
+function requireActiveRevisionId(meta: StoredSessionMetaV10): ContextRevisionId {
+  if (meta.initializationState !== "ready" || meta.activeRevisionId === null) {
+    throw new Error("Session has no active context revision.");
   }
-  return immutableRecord({
-    sessionId: stringFromSql(row.session_id, "session_id") as SessionId,
-    frameId: stringFromSql(row.frame_id, "frame_id") as ProtocolFrameId,
-    toolCallId: stringFromSql(row.tool_call_id, "tool_call_id") as ToolCallId,
-    toolMessageId: stringFromSql(row.tool_message_id, "tool_message_id") as MessageId,
-    completion,
-    observationSha256: stringFromSql(row.observation_sha256, "observation_sha256"),
-    createdAt: timestampFromSql(row.created_at, "created_at"),
-  });
+  return meta.activeRevisionId;
 }
 
-function decodeContextSurface(rowValue: unknown): StoredContextSurfaceV8 {
-  const row = recordFromSql(rowValue, "context surface");
-  const projectInstruction =
-    row.project_instruction_json === null
-      ? undefined
-      : decodeProjectInstructionManifest(
-          parseJson(
-            stringFromSql(row.project_instruction_json, "project_instruction_json"),
-            "project_instruction_json",
-          ),
-        );
-  const toolDefinitions = decodeToolDefinitions(
-    parseJson(
-      stringFromSql(row.tool_definitions_json, "tool_definitions_json"),
-      "tool_definitions_json",
-    ),
-  );
-  const skillCatalog = decodeSkillCatalogManifest(
-    parseJson(
-      stringFromSql(row.skill_catalog_json, "skill_catalog_json"),
-      "skill_catalog_json",
-    ),
-  );
-  const activeSkills = decodeActiveSkillsManifest(
-    parseJson(
-      stringFromSql(row.active_skills_json, "active_skills_json"),
-      "active_skills_json",
-    ),
-  );
-  const surface = Object.freeze({
-    surfaceId: stringFromSql(row.surface_id, "surface_id") as ContextSurfaceId,
-    sessionId: stringFromSql(row.session_id, "session_id") as SessionId,
-    systemPrompt: stringFromSql(row.system_prompt, "system_prompt"),
-    systemPromptSha256: sha256FromSql(row.system_prompt_sha256, "system_prompt_sha256"),
-    recallContractVersion: enumFromSql(
-      row.recall_contract_version,
-      SUPPORTED_RECALL_RETIREMENT_CONTRACT_VERSIONS,
-      "recall_contract_version",
-    ),
-    ...(projectInstruction === undefined ? {} : { projectInstruction }),
-    skillCatalog,
-    skillCatalogSha256: sha256FromSql(row.skill_catalog_sha256, "skill_catalog_sha256"),
-    activeSkills,
-    activeSkillsSha256: sha256FromSql(row.active_skills_sha256, "active_skills_sha256"),
-    toolDefinitions,
-    toolDefinitionsSha256: sha256FromSql(
-      row.tool_definitions_sha256,
-      "tool_definitions_sha256",
-    ),
-    toolSchemaSha256: sha256FromSql(row.tool_schema_sha256, "tool_schema_sha256"),
-    requestConfigSha256: sha256FromSql(
-      row.request_config_sha256,
-      "request_config_sha256",
-    ),
-    requestMaxOutputTokens: numberFromSql(
-      row.request_max_output_tokens,
-      "request_max_output_tokens",
-    ),
-    surfaceSha256: sha256FromSql(row.surface_sha256, "surface_sha256"),
-    createdAt: timestampFromSql(row.created_at, "created_at"),
-  });
-  validateStoredContextSurface(surface);
-  return surface;
-}
-
-function decodeContextRevision(rowValue: unknown): StoredContextRevisionV8 {
-  const row = recordFromSql(rowValue, "context revision");
-  const kind = enumFromSql(
-    row.kind,
-    [
-      "initial_full",
-      "swap_only",
-      "surface_refresh",
-      "prefix_retirement",
-      "skills_update",
-    ] as const,
-    "context revision kind",
-  );
-  const common = {
-    revisionId: stringFromSql(row.revision_id, "revision_id") as ContextRevisionId,
-    sessionId: stringFromSql(row.session_id, "session_id") as SessionId,
-    surfaceId: stringFromSql(row.surface_id, "surface_id") as ContextSurfaceId,
-    surfaceSha256: sha256FromSql(row.surface_sha256, "surface_sha256"),
-    keepFromOrdinal: numberFromSql(row.keep_from_ordinal, "keep_from_ordinal"),
-    sourceThroughOrdinal: numberFromSql(
-      row.source_through_ordinal,
-      "source_through_ordinal",
-    ),
-    addedOverrideCount: numberFromSql(row.added_override_count, "added_override_count"),
-    activeOverrideCount: numberFromSql(
-      row.active_override_count,
-      "active_override_count",
-    ),
-    activeOverrideManifestSha256: sha256FromSql(
-      row.active_override_manifest_sha256,
-      "active_override_manifest_sha256",
-    ),
-    canonicalSequenceSha256: sha256FromSql(
-      row.canonical_sequence_sha256,
-      "canonical_sequence_sha256",
-    ),
-    renderedMessageSha256: sha256FromSql(
-      row.rendered_message_sha256,
-      "rendered_message_sha256",
-    ),
-    createdAt: timestampFromSql(row.created_at, "created_at"),
-  };
-  if (common.keepFromOrdinal < 1) {
-    throw new Error("Context revision keep_from_ordinal must be positive.");
-  }
-  const revisionNumber = numberFromSql(row.revision_number, "revision_number");
-  const parentRevisionId = nullableStringFromSql(
-    row.parent_revision_id,
-    "parent_revision_id",
-  ) as ContextRevisionId | null;
-  if (kind === "initial_full") {
-    if (
-      revisionNumber !== 1 ||
-      parentRevisionId !== null ||
-      common.sourceThroughOrdinal !== 1 ||
-      common.addedOverrideCount !== 0 ||
-      common.activeOverrideCount !== 0 ||
-      common.keepFromOrdinal !== 1 ||
-      row.policy_version !== null ||
-      row.renderer_format !== null ||
-      row.plan_sha256 !== null ||
-      row.change_manifest_sha256 !== null ||
-      row.activation_manifest_sha256 !== null ||
-      !hasNoRetirementFields(row)
-    ) {
-      throw new Error("Initial context revision row is invalid.");
-    }
-    return Object.freeze({
-      ...common,
-      revisionNumber: 1,
-      parentRevisionId: null,
-      kind,
-      keepFromOrdinal: 1,
-      sourceThroughOrdinal: 1,
-      addedOverrideCount: 0,
-      activeOverrideCount: 0,
-    });
-  }
-  if (
-    kind === "swap_only" &&
-    (revisionNumber < 2 ||
-      parentRevisionId === null ||
-      common.addedOverrideCount < 1 ||
-      common.activeOverrideCount < common.addedOverrideCount)
-  ) {
-    throw new Error("Swap context revision row is invalid.");
-  }
-  if (kind === "swap_only") {
-    if (
-      row.change_manifest_sha256 !== null ||
-      row.activation_manifest_sha256 !== null ||
-      !hasNoRetirementFields(row)
-    ) {
-      throw new Error("Swap context revision has a change manifest.");
-    }
-    return Object.freeze({
-      ...common,
-      revisionNumber,
-      parentRevisionId: parentRevisionId!,
-      kind,
-      policyVersion: enumFromSql(
-        row.policy_version,
-        ["swap-only-v1"] as const,
-        "context revision policy",
-      ),
-      rendererFormat: enumFromSql(
-        row.renderer_format,
-        [SWAP_OBSERVATION_FORMAT] as const,
-        "context revision renderer format",
-      ),
-      planSha256: sha256FromSql(row.plan_sha256, "plan_sha256"),
-    });
-  }
-  if (kind === "skills_update") {
-    if (
-      revisionNumber < 2 ||
-      parentRevisionId === null ||
-      common.addedOverrideCount < 1 ||
-      common.activeOverrideCount < common.addedOverrideCount ||
-      row.plan_sha256 !== null ||
-      !hasNoRetirementFields(row)
-    ) {
-      throw new Error("Agent Skills context revision row is invalid.");
-    }
-    return Object.freeze({
-      ...common,
-      revisionNumber,
-      parentRevisionId,
-      kind,
-      policyVersion: enumFromSql(
-        row.policy_version,
-        [SKILL_POLICY_VERSION] as const,
-        "Agent Skills context revision policy",
-      ),
-      rendererFormat: enumFromSql(
-        row.renderer_format,
-        [SKILL_ACTIVATION_RECEIPT_FORMAT] as const,
-        "Agent Skills context revision renderer format",
-      ),
-      changeManifestSha256: sha256FromSql(
-        row.change_manifest_sha256,
-        "change_manifest_sha256",
-      ),
-      activationManifestSha256: sha256FromSql(
-        row.activation_manifest_sha256,
-        "activation_manifest_sha256",
-      ),
-    });
-  }
-  if (kind === "prefix_retirement") {
-    const retiredThroughOrdinal = numberFromSql(
-      row.retired_through_ordinal,
-      "retired_through_ordinal",
-    );
-    const retiredTurnCount = numberFromSql(
-      row.retired_turn_count,
-      "retired_turn_count",
-    );
-    const retiredFrameCount = numberFromSql(
-      row.retired_frame_count,
-      "retired_frame_count",
-    );
-    const retiredMessageCount = numberFromSql(
-      row.retired_message_count,
-      "retired_message_count",
-    );
-    if (
-      revisionNumber < 2 ||
-      parentRevisionId === null ||
-      common.keepFromOrdinal <= 1 ||
-      common.addedOverrideCount !== 0 ||
-      retiredThroughOrdinal !== common.keepFromOrdinal - 1 ||
-      retiredTurnCount < 1 ||
-      retiredFrameCount < 1 ||
-      retiredMessageCount < 1 ||
-      row.renderer_format !== null ||
-      row.change_manifest_sha256 !== null ||
-      row.activation_manifest_sha256 !== null
-    ) {
-      throw new Error("Prefix retirement revision row is invalid.");
-    }
-    return Object.freeze({
-      ...common,
-      revisionNumber,
-      parentRevisionId,
-      kind,
-      addedOverrideCount: 0,
-      policyVersion: enumFromSql(
-        row.policy_version,
-        ["recall-first-retirement-v1"] as const,
-        "context revision policy",
-      ),
-      planSha256: sha256FromSql(row.plan_sha256, "plan_sha256"),
-      retiredThroughOrdinal,
-      retiredTurnCount,
-      retiredFrameCount,
-      retiredMessageCount,
-    });
-  }
-  if (
-    revisionNumber < 2 ||
-    parentRevisionId === null ||
-    common.addedOverrideCount !== 0 ||
-    row.policy_version !== null ||
-    row.renderer_format !== null ||
-    row.plan_sha256 !== null ||
-    row.activation_manifest_sha256 !== null ||
-    !hasNoRetirementFields(row)
-  ) {
-    throw new Error("Surface context revision row is invalid.");
-  }
-  return Object.freeze({
-    ...common,
-    revisionNumber,
-    parentRevisionId,
-    kind,
-    addedOverrideCount: 0,
-    changeManifestSha256: sha256FromSql(
-      row.change_manifest_sha256,
-      "change_manifest_sha256",
-    ),
-  });
-}
-
-function hasNoRetirementFields(row: Record<string, unknown>): boolean {
-  return (
-    row.retired_through_ordinal === null &&
-    row.retired_turn_count === null &&
-    row.retired_frame_count === null &&
-    row.retired_message_count === null
-  );
-}
-
-function decodeStoredSwapOverride(rowValue: unknown): StoredContextOverrideV8 {
-  const row = recordFromSql(rowValue, "context override");
-  if (row.representation !== "swapped") {
-    throw new Error("Context override representation must be swapped.");
-  }
-  return Object.freeze({
-    introducedRevisionId: stringFromSql(
-      row.introduced_revision_id,
-      "introduced_revision_id",
-    ) as ContextRevisionId,
-    frameId: stringFromSql(row.frame_id, "frame_id") as ProtocolFrameId,
-    messageId: stringFromSql(row.message_id, "message_id") as MessageId,
-    ordinal: numberFromSql(row.ordinal, "ordinal"),
-    rendererFormat: enumFromSql(
-      row.renderer_format,
-      [
-        SWAP_OBSERVATION_FORMAT,
-        SWAP_TOOL_IMAGE_FORMAT,
-        SKILL_ACTIVATION_RECEIPT_FORMAT,
-      ] as const,
-      "context override renderer format",
-    ),
-    source: stringFromSql(row.source, "source") as StoredContextOverrideV8["source"],
-    originalContentSha256: sha256FromSql(
-      row.original_content_sha256,
-      "original_content_sha256",
-    ),
-    renderedContent: stringFromSql(row.rendered_content, "rendered_content"),
-    renderedContentSha256: sha256FromSql(
-      row.rendered_content_sha256,
-      "rendered_content_sha256",
-    ),
-    originalBytes: numberFromSql(row.original_bytes, "original_bytes"),
-    renderedBytes: numberFromSql(row.rendered_bytes, "rendered_bytes"),
-    byteSavings: numberFromSql(row.byte_savings, "byte_savings"),
-    createdAt: timestampFromSql(row.created_at, "created_at"),
-  });
-}
-
-function stripStoredOverride(override: StoredContextOverrideV8): SwapOverride {
-  return Object.freeze({
-    frameId: override.frameId,
-    messageId: override.messageId,
-    ordinal: override.ordinal,
-    source: override.source,
-    originalContentSha256: override.originalContentSha256,
-    renderedContent: override.renderedContent,
-    renderedContentSha256: override.renderedContentSha256,
-    originalBytes: override.originalBytes,
-    renderedBytes: override.renderedBytes,
-    byteSavings: override.byteSavings,
-    ...(override.rendererFormat === SWAP_OBSERVATION_FORMAT
-      ? {}
-      : { rendererFormat: override.rendererFormat }),
-  });
-}
-
-function decodeSkillActivation(rowValue: unknown): StoredSkillActivation {
-  const row = recordFromSql(rowValue, "skill activation");
-  const state = enumFromSql(
-    row.state,
-    ["pending", "dispatched", "promoted", "rejected"] as const,
-    "skill activation state",
-  );
-  const dispatchedIterationId = nullableStringFromSql(
-    row.dispatched_iteration_id,
-    "dispatched_iteration_id",
-  ) as IterationId | null;
-  const settledRevisionId = nullableStringFromSql(
-    row.settled_revision_id,
-    "settled_revision_id",
-  ) as ContextRevisionId | null;
-  const rejectionReason = nullableStringFromSql(
-    row.rejection_reason,
-    "rejection_reason",
-  );
-  if (
-    (state === "pending" &&
-      (dispatchedIterationId !== null ||
-        settledRevisionId !== null ||
-        rejectionReason !== null)) ||
-    (state === "dispatched" &&
-      (dispatchedIterationId === null ||
-        settledRevisionId !== null ||
-        rejectionReason !== null)) ||
-    (state === "promoted" &&
-      (dispatchedIterationId === null ||
-        settledRevisionId === null ||
-        rejectionReason !== null)) ||
-    (state === "rejected" &&
-      (settledRevisionId === null ||
-        rejectionReason === null ||
-        rejectionReason.trim() === ""))
-  ) {
-    throw new Error("Skill activation lifecycle fields are invalid.");
-  }
-  return Object.freeze({
-    activationMessageId: stringFromSql(
-      row.activation_message_id,
-      "activation_message_id",
-    ) as MessageId,
-    toolCallId: stringFromSql(row.tool_call_id, "tool_call_id") as ToolCallId,
-    sessionId: stringFromSql(row.session_id, "session_id") as SessionId,
-    name: stringFromSql(row.name, "skill activation name"),
-    scope: enumFromSql(
-      row.scope,
-      ["project", "user"] as const,
-      "skill activation scope",
-    ),
-    skillFileSha256: sha256FromSql(row.skill_file_sha256, "skill_file_sha256"),
-    state,
-    ...(dispatchedIterationId === null ? {} : { dispatchedIterationId }),
-    ...(settledRevisionId === null ? {} : { settledRevisionId }),
-    ...(rejectionReason === null ? {} : { rejectionReason }),
-    createdAt: timestampFromSql(row.created_at, "created_at"),
-    updatedAt: timestampFromSql(row.updated_at, "updated_at"),
-  });
-}
-
-function protocolPrefixView(
-  canonical: ProtocolContextView,
-  throughOrdinal: number,
-): ProtocolContextView {
-  const messages = canonical.messages.filter(
-    (message) => message.ordinal <= throughOrdinal,
-  );
-  const messageIds = new Set(messages.map((message) => message.messageId));
-  return Object.freeze({
-    sessionId: canonical.sessionId,
-    faulted: false,
-    frames: Object.freeze(
-      canonical.frames.filter(
-        (frame) =>
-          frame.state === "closed" &&
-          frame.lastOrdinal !== undefined &&
-          frame.lastOrdinal <= throughOrdinal,
-      ),
-    ),
-    messages: Object.freeze(messages),
-    toolResults: Object.freeze(
-      canonical.toolResults.filter((result) => messageIds.has(result.toolMessageId)),
-    ),
-  });
-}
-
-export function decodeStoredToolCalls(json: string): readonly ToolCall[] {
-  const value = parseJson(json, "tool_calls_json");
-  if (!Array.isArray(value) || value.length === 0) {
-    throw new Error("tool_calls_json must contain a non-empty array.");
-  }
-  const calls = value.map((entry, index): ToolCall => {
-    const call = recordFromSql(entry, `tool call ${index}`);
-    assertObjectKeys(
-      call,
-      [
-        "args",
-        "argsParseError",
-        "iterationId",
-        "iterationNumber",
-        "name",
-        "providerToolCallId",
-        "rawArgs",
-        "sessionId",
-        "toolCallId",
-        "toolCallNumber",
-        "turnId",
-        "turnNumber",
-      ],
-      [
-        "args",
-        "iterationId",
-        "iterationNumber",
-        "name",
-        "providerToolCallId",
-        "sessionId",
-        "toolCallId",
-        "toolCallNumber",
-        "turnId",
-        "turnNumber",
-      ],
-      `tool call ${index}`,
-    );
-    const toolCallNumber = numberFromJson(call.toolCallNumber, "toolCallNumber");
-    return {
-      sessionId: stringFromSql(call.sessionId, "sessionId") as SessionId,
-      turnId: stringFromSql(call.turnId, "turnId") as TurnId,
-      turnNumber: numberFromJson(call.turnNumber, "turnNumber"),
-      iterationId: stringFromSql(call.iterationId, "iterationId") as IterationId,
-      iterationNumber: numberFromJson(call.iterationNumber, "iterationNumber"),
-      toolCallId: stringFromSql(call.toolCallId, "toolCallId") as ToolCallId,
-      toolCallNumber,
-      providerToolCallId: stringFromSql(call.providerToolCallId, "providerToolCallId"),
-      name: stringFromSql(call.name, "name"),
-      args: immutableCanonicalClone(call.args),
-      ...(call.rawArgs === undefined
-        ? {}
-        : { rawArgs: stringFromSql(call.rawArgs, "rawArgs") }),
-      ...(call.argsParseError === undefined
-        ? {}
-        : {
-            argsParseError: stringFromSql(call.argsParseError, "argsParseError"),
-          }),
-    };
-  });
-  return Object.freeze(calls);
-}
-
-function decodeProjectInstructionManifest(value: unknown): ProjectInstructionManifest {
-  const record = recordFromSql(value, "project instruction manifest");
-  assertObjectKeys(
-    record,
-    ["path", "byteLength", "sha256"],
-    ["path", "byteLength", "sha256"],
-    "project instruction manifest",
-  );
-  return Object.freeze({
-    path: enumFromSql(
-      record.path,
-      ["AGENTS.md", "CLAUDE.md"] as const,
-      "project instruction path",
-    ),
-    byteLength: numberFromJson(record.byteLength, "project instruction byteLength"),
-    sha256: sha256FromSql(record.sha256, "project instruction sha256"),
-  });
-}
-
-function decodeSkillCatalogManifest(
-  value: unknown,
-): readonly SkillCatalogManifestEntry[] {
-  if (!Array.isArray(value)) {
-    throw new Error("skill_catalog_json must contain an array.");
-  }
-  return Object.freeze(
-    value.map((entry, index) => {
-      const record = recordFromSql(entry, `skill catalog entry ${index}`);
-      assertObjectKeys(
-        record,
-        [
-          "name",
-          "scope",
-          "directorySha256",
-          "descriptionSha256",
-          "skillFileSha256",
-          "byteLength",
-        ],
-        [
-          "name",
-          "scope",
-          "directorySha256",
-          "descriptionSha256",
-          "skillFileSha256",
-          "byteLength",
-        ],
-        `skill catalog entry ${index}`,
-      );
-      return Object.freeze({
-        name: stringFromSql(record.name, "skill name"),
-        scope: enumFromSql(record.scope, ["project", "user"] as const, "skill scope"),
-        directorySha256: sha256FromSql(record.directorySha256, "skill directorySha256"),
-        descriptionSha256: sha256FromSql(
-          record.descriptionSha256,
-          "skill descriptionSha256",
-        ),
-        skillFileSha256: sha256FromSql(record.skillFileSha256, "skill skillFileSha256"),
-        byteLength: numberFromJson(record.byteLength, "skill byteLength"),
-      });
-    }),
-  );
-}
-
-function decodeActiveSkillsManifest(
-  value: unknown,
-): readonly ActiveSkillManifestEntry[] {
-  if (!Array.isArray(value)) {
-    throw new Error("active_skills_json must contain an array.");
-  }
-  return Object.freeze(
-    value.map((entry, index) => {
-      const record = recordFromSql(entry, `active skill entry ${index}`);
-      assertObjectKeys(
-        record,
-        [
-          "name",
-          "scope",
-          "directorySha256",
-          "descriptionSha256",
-          "skillFileSha256",
-          "byteLength",
-          "activationMessageId",
-        ],
-        [
-          "name",
-          "scope",
-          "directorySha256",
-          "descriptionSha256",
-          "skillFileSha256",
-          "byteLength",
-          "activationMessageId",
-        ],
-        `active skill entry ${index}`,
-      );
-      const [catalogEntry] = decodeSkillCatalogManifest([
-        {
-          name: record.name,
-          scope: record.scope,
-          directorySha256: record.directorySha256,
-          descriptionSha256: record.descriptionSha256,
-          skillFileSha256: record.skillFileSha256,
-          byteLength: record.byteLength,
-        },
-      ]);
-      if (catalogEntry === undefined) {
-        throw new Error(`Active skill entry ${index} is missing.`);
-      }
-      return Object.freeze({
-        ...catalogEntry,
-        activationMessageId: stringFromSql(
-          record.activationMessageId,
-          "skill activationMessageId",
-        ) as MessageId,
-      });
-    }),
-  );
-}
-
-function decodeToolDefinitions(value: unknown): readonly ToolDefinition[] {
-  if (!Array.isArray(value)) {
-    throw new Error("tool_definitions_json must contain an array.");
-  }
-  const definitions = value.map((entry, index): ToolDefinition => {
-    const record = recordFromSql(entry, `tool definition ${index}`);
-    assertObjectKeys(
-      record,
-      ["name", "description", "parameters"],
-      ["name", "description", "parameters"],
-      `tool definition ${index}`,
-    );
-    const parameters = recordFromSql(
-      record.parameters,
-      `tool definition ${index} parameters`,
-    );
-    return Object.freeze({
-      name: stringFromSql(record.name, `tool definition ${index} name`),
-      description: stringFromSql(
-        record.description,
-        `tool definition ${index} description`,
-      ),
-      parameters: immutableCanonicalClone(parameters),
-    });
-  });
-  return Object.freeze(definitions);
-}
-
-export function decodeStoredToolRawResult(value: unknown): ToolRawResult {
-  const raw = recordFromSql(value, "tool raw result");
-  const kind = enumFromSql(
-    raw.kind,
-    [
-      "read",
-      "view_image",
-      "write",
-      "edit",
-      "delete",
-      "glob",
-      "grep",
-      "bash",
-      "update_plan",
-      "task_list",
-      "task_output",
-      "task_input",
-      "task_stop",
-      "web_search",
-      "web_fetch",
-      "recall",
-      "context_maintenance",
-      "memory_search",
-      "memory_get",
-      "wait",
-      "skill",
-      "mcp",
-      "generic",
-    ] as const,
-    "tool raw result kind",
-  );
-  if (typeof raw.ok !== "boolean") {
-    throw new Error("tool raw result ok must be a boolean.");
-  }
-  if (kind === "skill") {
-    return decodeStoredSkillRawResult(raw);
-  }
-  if (kind === "view_image") {
-    return decodeStoredViewImageRawResult(raw);
-  }
-  if (kind === "context_maintenance") {
-    return decodeStoredContextMaintenanceRawResult(raw);
-  }
-  return immutableCanonicalClone(raw) as ToolRawResult;
-}
-
-function decodeStoredContextMaintenanceRawResult(
-  raw: Record<string, unknown>,
-): Extract<ToolRawResult, { kind: "context_maintenance" }> {
-  const operation = enumFromSql(
-    raw.operation,
-    ["status", "candidates", "swap"] as const,
-    "context maintenance operation",
-  );
-  if (raw.ok === false) {
-    if (operation !== "swap") {
-      assertObjectKeys(
-        raw,
-        ["kind", "ok", "operation", "error"],
-        ["kind", "ok", "operation", "error"],
-        `failed context ${operation} result`,
-      );
-      return immutableRecord({
-        kind: "context_maintenance" as const,
-        ok: false as const,
-        operation,
-        error: nonEmptyStringFromJson(raw.error, `context ${operation} error`),
-      });
-    }
-    assertObjectKeys(
-      raw,
-      ["kind", "ok", "operation", "scheduled", "rejected", "error"],
-      ["kind", "ok", "operation", "scheduled", "rejected"],
-      "failed context swap result",
-    );
-    if (!Array.isArray(raw.scheduled) || raw.scheduled.length !== 0) {
-      throw new Error("Failed context swap result must schedule no candidates.");
-    }
-    const rejected = decodeContextSwapRejected(raw.rejected);
-    const error =
-      raw.error === undefined
-        ? undefined
-        : nonEmptyStringFromJson(raw.error, "context swap error");
-    if (rejected.length === 0 && error === undefined) {
-      throw new Error("Failed context swap result must explain its failure.");
-    }
-    return immutableRecord({
-      kind: "context_maintenance" as const,
-      ok: false as const,
-      operation,
-      scheduled: Object.freeze([]),
-      rejected,
-      ...(error === undefined ? {} : { error }),
-    });
-  }
-  if (raw.ok !== true) {
-    throw new Error("Context maintenance raw result ok must be a boolean.");
-  }
-  if (operation === "status") {
-    assertObjectKeys(
-      raw,
-      [
-        "kind",
-        "ok",
-        "operation",
-        "usedInputTokens",
-        "inputBudgetTokens",
-        "pressure",
-        "triggerTokens",
-        "source",
-      ],
-      [
-        "kind",
-        "ok",
-        "operation",
-        "usedInputTokens",
-        "inputBudgetTokens",
-        "pressure",
-        "triggerTokens",
-        "source",
-      ],
-      "context status result",
-    );
-    return immutableRecord({
-      kind: "context_maintenance" as const,
-      ok: true as const,
-      operation,
-      usedInputTokens: nonNegativeJsonInteger(
-        raw.usedInputTokens,
-        "context status usedInputTokens",
-      ),
-      inputBudgetTokens: positiveJsonInteger(
-        raw.inputBudgetTokens,
-        "context status inputBudgetTokens",
-      ),
-      pressure: enumFromSql(
-        raw.pressure,
-        ["normal", "high", "critical"] as const,
-        "context status pressure",
-      ),
-      triggerTokens: positiveJsonInteger(
-        raw.triggerTokens,
-        "context status triggerTokens",
-      ),
-      source: enumFromSql(
-        raw.source,
-        [
-          "estimated_full",
-          "provider_measured",
-          "measured_plus_estimated_delta",
-        ] as const,
-        "context status source",
-      ),
-    });
-  }
-  if (operation === "candidates") {
-    assertObjectKeys(
-      raw,
-      ["kind", "ok", "operation", "total", "candidates"],
-      ["kind", "ok", "operation", "total", "candidates"],
-      "context swap candidates result",
-    );
-    if (!Array.isArray(raw.candidates) || raw.candidates.length > 50) {
-      throw new Error("Context swap candidates result has an invalid page.");
-    }
-    const candidates = raw.candidates.map((value, index) => {
-      const candidate = recordFromSql(value, `context candidate ${index}`);
-      assertObjectKeys(
-        candidate,
-        ["candidateId", "label", "ordinal", "savingsBytes"],
-        ["candidateId", "label", "ordinal", "savingsBytes"],
-        `context candidate ${index}`,
-      );
-      const label = stringFromSql(candidate.label, `context candidate ${index} label`);
-      if (
-        label === "" ||
-        label !== label.replace(/[\p{Cc}\p{Cf}\s]+/gu, " ").trim() ||
-        Buffer.byteLength(label, "utf8") > 80
-      ) {
-        throw new Error(`Context candidate ${index} label is invalid or too large.`);
-      }
-      return immutableRecord({
-        candidateId: parseMessageId(
-          stringFromSql(candidate.candidateId, `context candidate ${index} ID`),
-        ),
-        label,
-        ordinal: positiveJsonInteger(
-          candidate.ordinal,
-          `context candidate ${index} ordinal`,
-        ),
-        savingsBytes: positiveJsonInteger(
-          candidate.savingsBytes,
-          `context candidate ${index} savingsBytes`,
-        ),
-      });
-    });
-    if (
-      new Set(candidates.map((candidate) => candidate.candidateId)).size !==
-        candidates.length ||
-      candidates.some(
-        (candidate, index) =>
-          index > 0 &&
-          candidate.ordinal <= (candidates[index - 1]?.ordinal ?? candidate.ordinal),
-      )
-    ) {
-      throw new Error(
-        "Context swap candidates must have unique IDs and ascending ordinals.",
-      );
-    }
-    const total = nonNegativeJsonInteger(raw.total, "context candidates total");
-    if (total < candidates.length) {
-      throw new Error("Context candidates total is smaller than its page.");
-    }
-    return immutableRecord({
-      kind: "context_maintenance" as const,
-      ok: true as const,
-      operation,
-      total,
-      candidates: Object.freeze(candidates),
-    });
-  }
-
-  assertObjectKeys(
-    raw,
-    ["kind", "ok", "operation", "scheduled", "rejected", "note"],
-    ["kind", "ok", "operation", "scheduled", "rejected", "note"],
-    "context swap result",
-  );
-  if (!Array.isArray(raw.scheduled) || raw.scheduled.length < 1) {
-    throw new Error("Successful context swap result must schedule candidates.");
-  }
-  const scheduled = raw.scheduled.map((value, index) => {
-    const candidate = recordFromSql(value, `scheduled context candidate ${index}`);
-    assertObjectKeys(
-      candidate,
-      ["candidateId", "savingsBytes"],
-      ["candidateId", "savingsBytes"],
-      `scheduled context candidate ${index}`,
-    );
-    return immutableRecord({
-      candidateId: parseMessageId(
-        stringFromSql(candidate.candidateId, `scheduled candidate ${index} ID`),
-      ),
-      savingsBytes: positiveJsonInteger(
-        candidate.savingsBytes,
-        `scheduled candidate ${index} savingsBytes`,
-      ),
-    });
-  });
-  if (
-    scheduled.length > 16 ||
-    new Set(scheduled.map((candidate) => candidate.candidateId)).size !==
-      scheduled.length
-  ) {
-    throw new Error("Successful context swap result has invalid scheduled IDs.");
-  }
-  const rejected = decodeContextSwapRejected(raw.rejected);
-  if (
-    scheduled.length + rejected.length > 16 ||
-    scheduled.some((scheduledCandidate) =>
-      rejected.some(
-        (rejectedCandidate) =>
-          rejectedCandidate.candidateId === scheduledCandidate.candidateId,
-      ),
-    )
-  ) {
-    throw new Error("Context swap result candidate partitions are invalid.");
-  }
-  const note = stringFromSql(raw.note, "context swap note");
-  return immutableRecord({
-    kind: "context_maintenance" as const,
-    ok: true as const,
-    operation,
-    scheduled: Object.freeze(scheduled),
-    rejected,
-    note,
-  });
-}
-
-function decodeContextSwapRejected(value: unknown): readonly {
-  readonly candidateId: MessageId;
-  readonly reason: string;
-}[] {
-  if (!Array.isArray(value) || value.length > 16) {
-    throw new Error("Context swap rejected candidates must be an array of at most 16.");
-  }
-  const rejected = value.map((entry, index) => {
-    const candidate = recordFromSql(entry, `rejected context candidate ${index}`);
-    assertObjectKeys(
-      candidate,
-      ["candidateId", "reason"],
-      ["candidateId", "reason"],
-      `rejected context candidate ${index}`,
-    );
-    const reason = stringFromSql(
-      candidate.reason,
-      `rejected context candidate ${index} reason`,
-    );
-    if (!/^[a-z][a-z0-9_]{0,79}$/.test(reason)) {
-      throw new Error(`Rejected context candidate ${index} reason is invalid.`);
-    }
-    return immutableRecord({
-      candidateId: parseMessageId(
-        stringFromSql(candidate.candidateId, `rejected candidate ${index} ID`),
-      ),
-      reason,
-    });
-  });
-  if (
-    new Set(rejected.map((candidate) => candidate.candidateId)).size !== rejected.length
-  ) {
-    throw new Error("Context swap rejected candidate IDs must be unique.");
-  }
-  return Object.freeze(rejected);
-}
-
-function decodeStoredViewImageRawResult(
-  raw: Record<string, unknown>,
-): Extract<ToolRawResult, { kind: "view_image" }> {
-  assertObjectKeys(
-    raw,
-    ["kind", "ok", "filePath", "originalName", "asset", "error"],
-    ["kind", "ok", "filePath"],
-    "ViewImage raw result",
-  );
-  const filePath = stringFromSql(raw.filePath, "ViewImage filePath");
-  if (raw.ok === false) {
-    if (raw.originalName !== undefined || raw.asset !== undefined) {
-      throw new Error("Failed ViewImage raw result cannot contain image metadata.");
-    }
-    const error = stringFromSql(raw.error, "ViewImage error");
-    if (error.trim() === "") {
-      throw new Error("Failed ViewImage raw result error must not be empty.");
-    }
-    return immutableRecord({ kind: "view_image", ok: false, filePath, error });
-  }
-  if (raw.ok !== true || raw.error !== undefined || filePath.trim() === "") {
-    throw new Error("Successful ViewImage raw result is invalid.");
-  }
-  const originalName = stringFromSql(raw.originalName, "ViewImage originalName");
-  validateOriginalImageName(originalName);
-  const storedAsset = recordFromSql(raw.asset, "ViewImage asset");
-  assertObjectKeys(
-    storedAsset,
-    ["assetId", "mimeType", "byteLength", "width", "height"],
-    ["assetId", "mimeType", "byteLength", "width", "height"],
-    "ViewImage asset",
-  );
-  const asset: ImageAssetRef = immutableRecord({
-    assetId: parseImageAssetId(stringFromSql(storedAsset.assetId, "assetId")),
-    mimeType: enumFromSql(
-      storedAsset.mimeType,
-      ["image/png", "image/jpeg", "image/webp"] as const,
-      "ViewImage asset mimeType",
-    ),
-    byteLength: numberFromJson(storedAsset.byteLength, "ViewImage asset byteLength"),
-    width: numberFromJson(storedAsset.width, "ViewImage asset width"),
-    height: numberFromJson(storedAsset.height, "ViewImage asset height"),
-  });
-  validateImageAssetRef(asset);
-  return immutableRecord({
-    kind: "view_image",
-    ok: true,
-    filePath,
-    originalName,
-    asset,
-  });
-}
-
-function decodeStoredSkillRawResult(
-  raw: Record<string, unknown>,
-): Extract<ToolRawResult, { kind: "skill" }> {
-  const status = enumFromSql(
-    raw.status,
-    ["loaded", "already_loaded", "already_active", "failed"] as const,
-    "Skill raw result status",
-  );
-  const name = stringFromSql(raw.name, "Skill raw result name");
-  if (status === "failed") {
-    if (raw.ok !== false) {
-      throw new Error("Failed Skill raw result must have ok=false.");
-    }
-    assertObjectKeys(
-      raw,
-      ["kind", "ok", "status", "name", "errorCode", "error"],
-      ["kind", "ok", "status", "name", "errorCode", "error"],
-      "failed Skill raw result",
-    );
-    const errorCode = stringFromSql(raw.errorCode, "Skill errorCode");
-    const error = stringFromSql(raw.error, "Skill error");
-    if (
-      (name !== "" && !isValidSkillName(name)) ||
-      !/^[A-Z][A-Z0-9_]{0,79}$/.test(errorCode) ||
-      error.trim() === ""
-    ) {
-      throw new Error("Failed Skill raw result fields are invalid.");
-    }
-    return immutableRecord({
-      kind: "skill" as const,
-      ok: false as const,
-      status,
-      name,
-      errorCode,
-      error,
-    });
-  }
-  if (raw.ok !== true) {
-    throw new Error("Successful Skill raw result must have ok=true.");
-  }
-  const scope = enumFromSql(
-    raw.scope,
-    ["project", "user"] as const,
-    "Skill raw result scope",
-  );
-  const skillFileSha256 = sha256FromSql(raw.sha256, "Skill raw result sha256");
-  if (!isValidSkillName(name)) {
-    throw new Error("Successful Skill raw result name is invalid.");
-  }
-  if (status === "already_loaded") {
-    assertObjectKeys(
-      raw,
-      ["kind", "ok", "status", "name", "scope", "lifecycle", "sha256"],
-      ["kind", "ok", "status", "name", "scope", "lifecycle", "sha256"],
-      "already loaded Skill raw result",
-    );
-    return immutableRecord({
-      kind: "skill" as const,
-      ok: true as const,
-      status,
-      name,
-      scope,
-      lifecycle: enumFromSql(
-        raw.lifecycle,
-        ["pending", "dispatched"] as const,
-        "Skill lifecycle",
-      ),
-      sha256: skillFileSha256,
-    });
-  }
-  if (status === "already_active") {
-    assertObjectKeys(
-      raw,
-      ["kind", "ok", "status", "name", "scope", "sha256"],
-      ["kind", "ok", "status", "name", "scope", "sha256"],
-      "already active Skill raw result",
-    );
-    return immutableRecord({
-      kind: "skill" as const,
-      ok: true as const,
-      status,
-      name,
-      scope,
-      sha256: skillFileSha256,
-    });
-  }
-  assertObjectKeys(
-    raw,
-    [
-      "kind",
-      "ok",
-      "status",
-      "name",
-      "scope",
-      "directory",
-      "skillFilePath",
-      "content",
-      "byteLength",
-      "sha256",
-      "resources",
-      "resourcesTruncated",
-    ],
-    [
-      "kind",
-      "ok",
-      "status",
-      "name",
-      "scope",
-      "directory",
-      "skillFilePath",
-      "content",
-      "byteLength",
-      "sha256",
-      "resources",
-      "resourcesTruncated",
-    ],
-    "loaded Skill raw result",
-  );
-  if (
-    !Array.isArray(raw.resources) ||
-    raw.resources.some((entry) => typeof entry !== "string") ||
-    raw.resources.length > SKILL_RESOURCE_MAX_ENTRIES ||
-    typeof raw.resourcesTruncated !== "boolean"
-  ) {
-    throw new Error("Loaded Skill resource manifest is invalid.");
-  }
-  const directory = stringFromSql(raw.directory, "Skill directory");
-  const skillFilePath = stringFromSql(raw.skillFilePath, "Skill file path");
-  const content = stringFromSql(raw.content, "Skill content");
-  const byteLength = numberFromJson(raw.byteLength, "Skill byteLength");
-  const resources = raw.resources as string[];
-  if (
-    !path.isAbsolute(directory) ||
-    !path.isAbsolute(skillFilePath) ||
-    !isPathWithin(directory, skillFilePath) ||
-    byteLength < 1 ||
-    byteLength > SKILL_FILE_MAX_BYTES ||
-    Buffer.byteLength(content, "utf8") !== byteLength ||
-    sha256(content) !== skillFileSha256 ||
-    !isValidResourceManifest(resources)
-  ) {
-    throw new Error("Loaded Skill raw result snapshot is invalid.");
-  }
-  return immutableRecord({
-    kind: "skill" as const,
-    ok: true as const,
-    status,
-    name,
-    scope,
-    directory,
-    skillFilePath,
-    content,
-    byteLength,
-    sha256: skillFileSha256,
-    resources: Object.freeze([...resources]),
-    resourcesTruncated: raw.resourcesTruncated,
-  });
-}
-
-function isValidSkillName(value: string): boolean {
-  return value.length <= 64 && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value);
-}
-
-function isPathWithin(root: string, candidate: string): boolean {
-  const relative = path.relative(root, candidate);
-  return (
-    relative !== "" &&
-    relative !== ".." &&
-    !relative.startsWith(`..${path.sep}`) &&
-    !path.isAbsolute(relative)
-  );
-}
-
-function isValidResourceManifest(resources: readonly string[]): boolean {
-  let previous: string | undefined;
-  for (const resource of resources) {
-    const parts = resource.split("/");
-    if (
-      resource === "" ||
-      resource.includes("\\") ||
-      path.posix.isAbsolute(resource) ||
-      path.posix.normalize(resource) !== resource ||
-      !["assets", "references", "scripts"].includes(parts[0] ?? "") ||
-      parts.length < 2 ||
-      parts.length > SKILL_RESOURCE_MAX_DEPTH + 1 ||
-      (previous !== undefined && previous >= resource)
-    ) {
-      return false;
-    }
-    previous = resource;
-  }
-  return true;
-}
-
-function decodeMeasuredContextState(
-  value: unknown,
-  expectedSessionId: SessionId,
-): StoredMeasuredContextState {
-  const row = recordFromSql(value, "context measurement state");
-  const sessionId = stringFromSql(row.session_id, "session_id") as SessionId;
-  if (sessionId !== expectedSessionId) {
-    throw new Error(
-      `Context measurement session ID ${sessionId} does not match store.`,
-    );
-  }
-  const promptTokens = numberFromSql(row.prompt_tokens, "prompt_tokens");
-  const completionTokens = numberFromSql(row.completion_tokens, "completion_tokens");
-  const totalTokens = numberFromSql(row.total_tokens, "total_tokens");
-  if (totalTokens !== promptTokens + completionTokens) {
-    throw new Error(
-      "Context measurement total_tokens must equal prompt_tokens + completion_tokens.",
-    );
-  }
-  timestampFromSql(row.updated_at, "updated_at");
-  return Object.freeze({
-    revisionId: stringFromSql(row.revision_id, "revision_id") as ContextRevisionId,
-    anchor: Object.freeze({
-      totalTokens,
-      promptTokens,
-      completionTokens,
-      segmentCount: numberFromSql(row.segment_count, "segment_count"),
-      prefixHash: sha256FromSql(row.prefix_hash, "prefix_hash"),
-      requestConfigHash: sha256FromSql(row.request_config_hash, "request_config_hash"),
-      toolSchemaHash: sha256FromSql(row.tool_schema_hash, "tool_schema_hash"),
-    }),
-  });
-}
-
-function assertCommitSwapRevisionInput(input: CommitSwapRevisionInput): void {
-  if (
-    input.revisionId.trim() === "" ||
-    input.expectedBaseRevisionId.trim() === "" ||
-    !Number.isSafeInteger(input.expectedBaseRevisionNumber) ||
-    input.expectedBaseRevisionNumber < 1 ||
-    !Number.isSafeInteger(input.expectedCanonicalThroughOrdinal) ||
-    input.expectedCanonicalThroughOrdinal < 1 ||
-    input.addedOverrides.length < 1 ||
-    input.policyVersion !== "swap-only-v1" ||
-    input.rendererFormat !== SWAP_OBSERVATION_FORMAT
-  ) {
-    throw new Error("Commit swap revision input is invalid.");
-  }
-  for (const [name, hash] of [
-    [
-      "expectedBaseActiveOverrideManifestSha256",
-      input.expectedBaseActiveOverrideManifestSha256,
-    ],
-    ["planHash", input.planHash],
-    ["nextActiveOverrideManifestSha256", input.nextActiveOverrideManifestSha256],
-    ["canonicalSequenceSha256", input.canonicalSequenceSha256],
-    ["renderedMessageSha256", input.renderedMessageSha256],
-  ] as const) {
-    if (!/^[0-9a-f]{64}$/.test(hash)) {
-      throw new Error(`Commit swap revision ${name} must be a SHA-256 hash.`);
-    }
-  }
-}
-
-function assertCommitSurfaceRefreshInput(input: CommitSurfaceRefreshInput): void {
-  if (
-    input.revisionId.trim() === "" ||
-    input.expectedBaseRevisionId.trim() === "" ||
-    !Number.isSafeInteger(input.expectedBaseRevisionNumber) ||
-    input.expectedBaseRevisionNumber < 1 ||
-    !Number.isSafeInteger(input.expectedCanonicalThroughOrdinal) ||
-    input.expectedCanonicalThroughOrdinal < 1
-  ) {
-    throw new Error("Commit surface refresh input is invalid.");
-  }
-  for (const [name, hash] of [
-    [
-      "expectedBaseActiveOverrideManifestSha256",
-      input.expectedBaseActiveOverrideManifestSha256,
-    ],
-    ["changeManifestSha256", input.changeManifestSha256],
-    ["canonicalSequenceSha256", input.canonicalSequenceSha256],
-    ["renderedMessageSha256", input.renderedMessageSha256],
-  ] as const) {
-    if (!/^[0-9a-f]{64}$/.test(hash)) {
-      throw new Error(`Commit surface refresh ${name} must be a SHA-256 hash.`);
-    }
-  }
-}
-
-function assertCommitSkillsUpdateInput(input: CommitSkillsUpdateInput): void {
-  if (
-    input.revisionId.trim() === "" ||
-    input.expectedBaseRevisionId.trim() === "" ||
-    !Number.isSafeInteger(input.expectedBaseRevisionNumber) ||
-    input.expectedBaseRevisionNumber < 1 ||
-    !Number.isSafeInteger(input.expectedCanonicalThroughOrdinal) ||
-    input.expectedCanonicalThroughOrdinal < 1 ||
-    input.addedOverrides.length < 1 ||
-    input.settlements.length !== input.addedOverrides.length
-  ) {
-    throw new Error("Commit Agent Skills update input is invalid.");
-  }
-  for (const [name, hash] of [
-    [
-      "expectedBaseActiveOverrideManifestSha256",
-      input.expectedBaseActiveOverrideManifestSha256,
-    ],
-    ["changeManifestSha256", input.changeManifestSha256],
-    ["activationManifestSha256", input.activationManifestSha256],
-    ["nextActiveOverrideManifestSha256", input.nextActiveOverrideManifestSha256],
-    ["canonicalSequenceSha256", input.canonicalSequenceSha256],
-    ["renderedMessageSha256", input.renderedMessageSha256],
-  ] as const) {
-    if (!/^[0-9a-f]{64}$/.test(hash)) {
-      throw new Error(`Commit Agent Skills update ${name} must be a SHA-256 hash.`);
-    }
-  }
-}
-
-function assertCommitPrefixRetirementRevisionInput(
-  input: CommitPrefixRetirementRevisionInput,
-): void {
-  if (
-    input.revisionId.trim() === "" ||
-    input.expectedBaseRevisionId.trim() === "" ||
-    input.policyVersion !== "recall-first-retirement-v1" ||
-    !Number.isSafeInteger(input.expectedBaseRevisionNumber) ||
-    input.expectedBaseRevisionNumber < 1 ||
-    !Number.isSafeInteger(input.expectedBaseKeepFromOrdinal) ||
-    input.expectedBaseKeepFromOrdinal < 1 ||
-    !Number.isSafeInteger(input.expectedCanonicalThroughOrdinal) ||
-    input.expectedCanonicalThroughOrdinal < 1 ||
-    !Number.isSafeInteger(input.nextKeepFromOrdinal) ||
-    input.nextKeepFromOrdinal <= input.expectedBaseKeepFromOrdinal ||
-    input.retiredThroughOrdinal !== input.nextKeepFromOrdinal - 1 ||
-    !Number.isSafeInteger(input.retiredTurnCount) ||
-    input.retiredTurnCount < 1 ||
-    !Number.isSafeInteger(input.retiredFrameCount) ||
-    input.retiredFrameCount < 1 ||
-    !Number.isSafeInteger(input.retiredMessageCount) ||
-    input.retiredMessageCount < 1 ||
-    !Number.isSafeInteger(input.nextActiveOverrideCount) ||
-    input.nextActiveOverrideCount < 0
-  ) {
-    throw new Error("Commit prefix retirement input is invalid.");
-  }
-  for (const [name, hash] of [
-    ["expectedSurfaceSha256", input.expectedSurfaceSha256],
-    [
-      "expectedBaseActiveOverrideManifestSha256",
-      input.expectedBaseActiveOverrideManifestSha256,
-    ],
-    ["planHash", input.planHash],
-    ["nextActiveOverrideManifestSha256", input.nextActiveOverrideManifestSha256],
-    ["canonicalSequenceSha256", input.canonicalSequenceSha256],
-    ["renderedMessageSha256", input.renderedMessageSha256],
-  ] as const) {
-    if (!/^[0-9a-f]{64}$/.test(hash)) {
-      throw new Error(`Commit prefix retirement ${name} must be a SHA-256 hash.`);
-    }
-  }
-}
-
-function requireActiveRevisionId(meta: StoredSessionMetaV10): ContextRevisionId {
-  if (meta.initializationState !== "ready" || meta.activeRevisionId === null) {
-    throw new Error("Session has no active context revision.");
-  }
-  return meta.activeRevisionId;
-}
-
-function previousRevision(
-  revisions: readonly StoredContextRevisionV8[],
-  revision: StoredContextRevisionV8,
-): StoredContextRevisionV8 | undefined {
-  return revisions[revision.revisionNumber - 2];
-}
-
-function decodeMeta(
-  value: unknown,
-  expectedSessionId: SessionId,
-): StoredSessionMetaV10 {
-  const row = recordFromSql(value, "session metadata");
-  const sessionId = stringFromSql(row.session_id, "session_id") as SessionId;
-  if (sessionId !== expectedSessionId) {
-    throw new Error(`Metadata session ID ${sessionId} does not match directory.`);
-  }
-  const schemaVersion = numberFromSql(row.schema_version, "schema_version");
-  if (schemaVersion !== 10) {
-    throw new Error(
-      `Session metadata schema version must be 10; received ${schemaVersion}.`,
-    );
-  }
-  const projectInstructionFile = nullableStringFromSql(
-    row.project_instruction_file,
-    "project_instruction_file",
-  );
-  const projectInstructionByteLength = nullableNumberFromSql(
-    row.project_instruction_byte_length,
-    "project_instruction_byte_length",
-  );
-  const projectInstructionSha256 = nullableStringFromSql(
-    row.project_instruction_sha256,
-    "project_instruction_sha256",
-  );
-  if (
-    (projectInstructionFile === null) !== (projectInstructionByteLength === null) ||
-    (projectInstructionFile === null) !== (projectInstructionSha256 === null)
-  ) {
-    throw new Error("Project instruction metadata must be entirely set or null.");
-  }
-  if (
-    projectInstructionFile !== null &&
-    projectInstructionFile !== "AGENTS.md" &&
-    projectInstructionFile !== "CLAUDE.md"
-  ) {
-    throw new Error(`Invalid project instruction file ${projectInstructionFile}.`);
-  }
-  const projectInstruction: ProjectInstructionManifest | undefined =
-    projectInstructionFile === null ||
-    projectInstructionByteLength === null ||
-    projectInstructionSha256 === null
-      ? undefined
-      : {
-          path: projectInstructionFile === "AGENTS.md" ? "AGENTS.md" : "CLAUDE.md",
-          byteLength: projectInstructionByteLength,
-          sha256: sha256FromSql(projectInstructionSha256, "project_instruction_sha256"),
-        };
-  const initializationState = enumFromSql(
-    row.initialization_state,
-    ["creating", "ready"] as const,
-    "initialization_state",
-  );
-  const sessionCompatibilityJson = nullableStringFromSql(
-    row.session_compatibility_json,
-    "session_compatibility_json",
-  );
-  const sessionCompatibilitySha256 = nullableStringFromSql(
-    row.session_compatibility_sha256,
-    "session_compatibility_sha256",
-  );
-  const activeRevisionId = nullableStringFromSql(
-    row.active_revision_id,
-    "active_revision_id",
-  ) as ContextRevisionId | null;
-  const modelName = stringFromSql(row.model_name, "model_name");
-  const storedContract =
-    sessionCompatibilityJson === null
-      ? undefined
-      : decodeSessionCompatibilityContract(sessionCompatibilityJson);
-  if (
-    (sessionCompatibilityJson === null) !== (sessionCompatibilitySha256 === null) ||
-    (sessionCompatibilityJson !== null &&
-      sha256(sessionCompatibilityJson) !== sessionCompatibilitySha256) ||
-    (initializationState === "creating") !== (activeRevisionId === null) ||
-    (initializationState === "creating") !== (sessionCompatibilityJson === null) ||
-    (storedContract !== undefined &&
-      (storedContract.modelName !== modelName ||
-        stableJsonStringify(storedContract) !== sessionCompatibilityJson))
-  ) {
-    throw new Error("Session compatibility or initialization metadata is invalid.");
-  }
-  return {
-    schemaVersion,
-    schemaFingerprint: stringFromSql(row.schema_fingerprint, "schema_fingerprint"),
-    initializationState,
-    sessionId,
-    workspaceRoot: stringFromSql(row.workspace_root, "workspace_root"),
-    modelName,
-    systemPromptSha256: stringFromSql(row.system_prompt_sha256, "system_prompt_sha256"),
-    ...(projectInstruction === undefined ? {} : { projectInstruction }),
-    sessionCompatibilityJson,
-    sessionCompatibilitySha256,
-    activeRevisionId,
-    nextTurnNumber: numberFromSql(row.next_turn_number, "next_turn_number"),
-    nextEventSequence: numberFromSql(row.next_event_sequence, "next_event_sequence"),
-    openCount: numberFromSql(row.open_count, "open_count"),
-    createdAt: timestampFromSql(row.created_at, "created_at"),
-    updatedAt: timestampFromSql(row.updated_at, "updated_at"),
-    lastOpenedAt: timestampFromSql(row.last_opened_at, "last_opened_at"),
-    lastClosedAt:
-      row.last_closed_at === null
-        ? null
-        : timestampFromSql(row.last_closed_at, "last_closed_at"),
-    lastCloseReason:
-      row.last_close_reason === null
-        ? null
-        : enumFromSql(
-            row.last_close_reason,
-            [
-              "oneshot_complete",
-              "tui_exit",
-              "session_switch",
-              "runner_failed",
-              "initialization_failed",
-            ] as const,
-            "last_close_reason",
-          ),
-  };
-}
-
-function compatibilityContractDifferences(
-  storedJson: string | null,
-  current: SessionCompatibilityContract,
-): string[] {
-  if (storedJson === null) {
-    return ["sessionCompatibility"];
-  }
-  const stored = parseJson(storedJson, "session_compatibility_json");
-  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
-    return ["sessionCompatibility"];
-  }
-  const record = stored as Record<string, unknown>;
-  const fields: readonly (keyof SessionCompatibilityContract)[] = [
-    "modelName",
-    "profileName",
-    "includeReasoningContent",
-    "contextProfile",
-    "messageProtocol",
-    "media",
-  ];
-  return fields.filter((key) => {
-    const storedValue = record[key];
-    const currentValue = current[key];
-    if (storedValue === undefined || currentValue === undefined) {
-      return storedValue !== currentValue;
-    }
-    return stableJsonStringify(storedValue) !== stableJsonStringify(currentValue);
-  });
-}
-
-function decodeSessionCompatibilityContract(
-  json: string,
-): SessionCompatibilityContract {
-  const record = recordFromSql(
-    parseJson(json, "session_compatibility_json"),
-    "session compatibility contract",
-  );
-  assertObjectKeys(
-    record,
-    [
-      "modelName",
-      "profileName",
-      "includeReasoningContent",
-      "contextProfile",
-      "messageProtocol",
-      "media",
-    ],
-    [
-      "modelName",
-      "includeReasoningContent",
-      "contextProfile",
-      "messageProtocol",
-      "media",
-    ],
-    "session compatibility contract",
-  );
-  const contextProfile = recordFromSql(
-    record.contextProfile,
-    "session compatibility context profile",
-  );
-  assertObjectKeys(
-    contextProfile,
-    ["contextWindowTokens", "maxSupportedOutputTokens"],
-    ["contextWindowTokens", "maxSupportedOutputTokens"],
-    "session compatibility context profile",
-  );
-  const messageProtocol = recordFromSql(
-    record.messageProtocol,
-    "session compatibility message protocol",
-  );
-  assertObjectKeys(
-    messageProtocol,
-    ["adapter", "serializationVersion"],
-    ["adapter", "serializationVersion"],
-    "session compatibility message protocol",
-  );
-  const media = recordFromSql(record.media, "session compatibility media");
-  assertObjectKeys(
-    media,
-    ["policyVersion", "policySha256", "inputModalities", "toolResultModalities"],
-    ["policyVersion", "policySha256", "inputModalities", "toolResultModalities"],
-    "session compatibility media",
-  );
-  const inputModalities = decodeCompatibilityModalities(media.inputModalities, "input");
-  const toolResultModalities = decodeCompatibilityModalities(
-    media.toolResultModalities,
-    "tool result",
-  );
-  if (toolResultModalities.includes("image") && !inputModalities.includes("image")) {
-    throw new Error("Session compatibility image tool results require image input.");
-  }
-  if (typeof record.includeReasoningContent !== "boolean") {
-    throw new Error("Session compatibility reasoning replay flag must be boolean.");
-  }
-  const modelName = stringFromSql(record.modelName, "compatibility modelName");
-  const profileName =
-    record.profileName === undefined
-      ? undefined
-      : stringFromSql(record.profileName, "compatibility profileName");
-  const context = createModelContextProfile({
-    contextWindowTokens: numberFromJson(
-      contextProfile.contextWindowTokens,
-      "compatibility contextWindowTokens",
-    ),
-    maxSupportedOutputTokens: numberFromJson(
-      contextProfile.maxSupportedOutputTokens,
-      "compatibility maxSupportedOutputTokens",
-    ),
-  });
-  const protocol: ModelMessageProtocol = Object.freeze({
-    adapter: enumFromSql(
-      messageProtocol.adapter,
-      MODEL_MESSAGE_PROTOCOL_ADAPTERS,
-      "compatibility message adapter",
-    ),
-    serializationVersion: stringFromSql(
-      messageProtocol.serializationVersion,
-      "compatibility serializationVersion",
-    ),
-  });
-  const policyVersion = stringFromSql(
-    media.policyVersion,
-    "compatibility image policyVersion",
-  );
-  const policySha256 = stringFromSql(
-    media.policySha256,
-    "compatibility image policySha256",
-  );
-  if (!/^[0-9a-f]{64}$/.test(policySha256)) {
-    throw new Error("Session image policy hash is invalid.");
-  }
-  return Object.freeze({
-    modelName,
-    ...(record.profileName === undefined ? {} : { profileName: profileName! }),
-    includeReasoningContent: record.includeReasoningContent,
-    contextProfile: Object.freeze(context),
-    messageProtocol: protocol,
-    media: Object.freeze({
-      policyVersion,
-      policySha256,
-      inputModalities,
-      toolResultModalities,
-    }),
-  });
-}
-
-function decodeCompatibilityModalities(
-  value: unknown,
-  label: string,
-): readonly ("text" | "image")[] {
-  if (!Array.isArray(value)) {
-    throw new Error(`Session compatibility ${label} modalities must be an array.`);
-  }
-  return normalizeInputModalities(
-    value.map((modality) =>
-      enumFromSql(
-        modality,
-        ["text", "image"] as const,
-        `compatibility ${label} modality`,
-      ),
-    ),
-  );
+function previousRevision(
+  revisions: readonly StoredContextRevisionV8[],
+  revision: StoredContextRevisionV8,
+): StoredContextRevisionV8 | undefined {
+  return revisions[revision.revisionNumber - 2];
 }
 
 function openWritableDatabase(databasePath: string): Database {
@@ -6131,465 +3960,6 @@ function runTransaction<T>(database: Database, operation: () => T): T {
   }
 }
 
-const SESSION_SCOPED_TABLES = [
-  "session_meta",
-  "turns",
-  "iterations",
-  "protocol_frames",
-  "messages",
-  "tool_results",
-  "context_surfaces",
-  "context_revisions",
-  "context_overrides",
-  "skill_activations",
-  "context_measurement_state",
-] as const;
-
-function rekeyStoredToolCalls(database: Database, targetSessionId: SessionId): void {
-  const rows = database
-    .query(
-      `SELECT message_id, tool_calls_json FROM messages
-       WHERE tool_calls_json IS NOT NULL ORDER BY ordinal`,
-    )
-    .all() as Array<{ message_id: string; tool_calls_json: string }>;
-  for (const row of rows) {
-    const calls = decodeStoredToolCalls(row.tool_calls_json).map((call) => ({
-      ...call,
-      sessionId: targetSessionId,
-    }));
-    database
-      .query("UPDATE messages SET tool_calls_json = ? WHERE message_id = ?")
-      .run(stableJsonStringify(calls), row.message_id);
-  }
-}
-
-function rekeyProtocolView(
-  source: ProtocolContextView,
-  targetSessionId: SessionId,
-): ProtocolContextView {
-  return {
-    sessionId: targetSessionId,
-    faulted: source.faulted,
-    frames: source.frames.map((frame) => ({
-      ...frame,
-      sessionId: targetSessionId,
-    })),
-    messages: source.messages.map((message) => ({
-      ...message,
-      sessionId: targetSessionId,
-      ...(message.role === "assistant" && message.toolCalls !== undefined
-        ? {
-            toolCalls: message.toolCalls.map((call) => ({
-              ...call,
-              sessionId: targetSessionId,
-            })),
-          }
-        : {}),
-    })),
-    toolResults: source.toolResults.map((result) => ({
-      ...result,
-      sessionId: targetSessionId,
-    })),
-  };
-}
-
-function rewriteCloneRevisionHashes(
-  database: Database,
-  canonical: ProtocolContextView,
-): void {
-  const surfaces = database
-    .query("SELECT * FROM context_surfaces")
-    .all()
-    .map(decodeContextSurface);
-  const surfacesById = new Map(surfaces.map((surface) => [surface.surfaceId, surface]));
-  const revisions = database
-    .query("SELECT * FROM context_revisions ORDER BY revision_number")
-    .all()
-    .map(decodeContextRevision);
-  const revisionNumberById = new Map(
-    revisions.map((revision) => [revision.revisionId, revision.revisionNumber]),
-  );
-  const overrides = database
-    .query(
-      `SELECT co.* FROM context_overrides co
-       JOIN context_revisions cr ON cr.revision_id = co.introduced_revision_id
-       ORDER BY cr.revision_number, co.ordinal`,
-    )
-    .all()
-    .map(decodeStoredSwapOverride);
-  const compiler = new ContextRevisionCompiler();
-  for (const revision of revisions) {
-    const surface = surfacesById.get(revision.surfaceId);
-    if (surface === undefined) {
-      throw new Error(`Cloned revision ${revision.revisionId} has no surface.`);
-    }
-    const activeOverrides = overrides.filter(
-      (override) =>
-        (revisionNumberById.get(override.introducedRevisionId) ??
-          Number.POSITIVE_INFINITY) <= revision.revisionNumber &&
-        override.ordinal >= revision.keepFromOrdinal,
-    );
-    const prefix = protocolPrefixView(canonical, revision.sourceThroughOrdinal);
-    const compiled = compiler.compileForIdentityRekey({
-      canonical: prefix,
-      revisionId: revision.revisionId,
-      activeOverrides,
-      keepFromOrdinal: revision.keepFromOrdinal,
-      surface,
-    });
-    database
-      .query(
-        `UPDATE context_revisions
-         SET canonical_sequence_sha256 = ?, rendered_message_sha256 = ?
-         WHERE revision_id = ?`,
-      )
-      .run(
-        canonicalSequenceHash(canonical, revision.sourceThroughOrdinal),
-        renderedMessageHash(compiled.entries, revision.sourceThroughOrdinal),
-        revision.revisionId,
-      );
-  }
-}
-
-async function cloneDiagnosticFiles(input: {
-  sourceDirectory: string;
-  stagingDirectory: string;
-  sourceSessionId: SessionId;
-  targetSessionId: SessionId;
-  nextEventSequence: number;
-  faultInjector?: (stage: CloneSessionFaultStage) => void;
-}): Promise<void> {
-  const sourcePath = path.join(input.sourceDirectory, "events.jsonl");
-  try {
-    await lstat(sourcePath);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-      return;
-    }
-    throw error;
-  }
-  await validateSecureFile(sourcePath, input.sourceSessionId);
-
-  const bytes = await readFile(sourcePath);
-  const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  const rawLines = text.split("\n");
-  if (rawLines.at(-1) === "") {
-    rawLines.pop();
-  }
-  const events: AgentEvent[] = [];
-  let previousSequence = 0;
-  for (const [index, line] of rawLines.entries()) {
-    if (line === "") {
-      throw new Error(`Session event log contains an empty line at ${index + 1}.`);
-    }
-    let value: unknown;
-    try {
-      value = JSON.parse(line);
-    } catch (error) {
-      throw new Error(`Session event log has invalid JSON at line ${index + 1}.`, {
-        cause: error,
-      });
-    }
-    if (!isEventEnvelope(value)) {
-      throw new Error(
-        `Session event log has an invalid envelope at line ${index + 1}.`,
-      );
-    }
-    if (value.sessionId !== input.sourceSessionId) {
-      throw new Error(`Session event log identity changed at line ${index + 1}.`);
-    }
-    if (value.eventSequence <= previousSequence) {
-      throw new Error(
-        `Session event sequence is not strictly increasing at line ${index + 1}.`,
-      );
-    }
-    if (value.eventSequence >= input.nextEventSequence) {
-      throw new Error(
-        `Session event sequence exceeds the canonical next counter at line ${index + 1}.`,
-      );
-    }
-    previousSequence = value.eventSequence;
-    events.push({ ...value, sessionId: input.targetSessionId });
-  }
-
-  const eventText = events.map((event) => JSON.stringify(event)).join("\n");
-  await writePrivateNewFile(
-    path.join(input.stagingDirectory, "events.jsonl"),
-    eventText === "" ? "" : `${eventText}\n`,
-  );
-  input.faultInjector?.("after_event_rewrite");
-  const observationText = events
-    .map((event) => renderObservationLogEvent(event))
-    .filter((block): block is string => block !== undefined)
-    .join("");
-  await writePrivateNewFile(
-    path.join(input.stagingDirectory, "observations.md"),
-    observationText,
-  );
-  input.faultInjector?.("after_observation_render");
-}
-
-function isEventEnvelope(value: unknown): value is AgentEvent {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
-  const record = value as Record<string, unknown>;
-  return (
-    typeof record.sessionId === "string" &&
-    Number.isSafeInteger(record.eventSequence) &&
-    Number(record.eventSequence) >= 1 &&
-    typeof record.timestamp === "string" &&
-    typeof record.type === "string" &&
-    record.data !== null &&
-    typeof record.data === "object"
-  );
-}
-
-async function writePrivateNewFile(filePath: string, content: string): Promise<void> {
-  const handle = await open(filePath, "wx", 0o600);
-  try {
-    await handle.writeFile(content, "utf8");
-  } finally {
-    await handle.close();
-  }
-  await chmod(filePath, 0o600);
-}
-
-async function assertPathMissing(
-  filePath: string,
-  sessionId: SessionId,
-): Promise<void> {
-  try {
-    await lstat(filePath);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-      return;
-    }
-    throw error;
-  }
-  throw new SessionError(
-    "SESSION_ALREADY_EXISTS",
-    "clone_session",
-    `Session directory already exists: ${filePath}.`,
-    { sessionId },
-  );
-}
-
-async function canonicalWorkspaceRoot(workspaceRoot: string): Promise<string> {
-  if (!path.isAbsolute(workspaceRoot)) {
-    throw new Error("Session workspace root must be absolute.");
-  }
-  return realpath(workspaceRoot);
-}
-
-async function ensureSessionsRoot(
-  workspaceRoot: string,
-  homeRoot?: string,
-): Promise<string> {
-  const tinkerRoot = workspaceStorageRoot(
-    workspaceRoot,
-    await canonicalHomeRoot(homeRoot),
-  );
-  const sessionsRoot = path.join(tinkerRoot, "sessions");
-  await mkdir(sessionsRoot, { recursive: true, mode: 0o700 });
-  await validateSessionsRoot(sessionsRoot);
-  await chmod(tinkerRoot, 0o700);
-  await chmod(sessionsRoot, 0o700);
-  return sessionsRoot;
-}
-
-async function validateSessionsRoot(
-  sessionsRoot: string,
-  sessionId?: SessionId,
-): Promise<void> {
-  const tinkerRoot = path.dirname(sessionsRoot);
-  for (const directory of [tinkerRoot, sessionsRoot]) {
-    let stats;
-    try {
-      stats = await lstat(directory);
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-        throw new SessionError(
-          "SESSION_STORE_NOT_FOUND",
-          "validate_session_root",
-          `Session root does not exist: ${directory}.`,
-          { sessionId, cause: error },
-        );
-      }
-      throw error;
-    }
-    if (!stats.isDirectory() || stats.isSymbolicLink()) {
-      throw new SessionError(
-        "SESSION_PERMISSION_INVALID",
-        "validate_session_root",
-        `Session root must not be a symlink: ${directory}.`,
-        { sessionId },
-      );
-    }
-  }
-  if ((await realpath(sessionsRoot)) !== sessionsRoot) {
-    throw new SessionError(
-      "SESSION_PERMISSION_INVALID",
-      "validate_session_root",
-      `Session root resolves outside its canonical path: ${sessionsRoot}.`,
-      { sessionId },
-    );
-  }
-}
-
-function safeSessionDirectory(sessionsRoot: string, sessionId: SessionId): string {
-  const value = String(sessionId);
-  if (
-    value.trim() === "" ||
-    value !== value.trim() ||
-    value.includes("/") ||
-    value.includes("\\") ||
-    value === "." ||
-    value === ".."
-  ) {
-    throw new SessionError(
-      "SESSION_ID_INVALID",
-      "resolve_session_path",
-      `Unsafe session ID: ${JSON.stringify(value)}.`,
-      { sessionId },
-    );
-  }
-  const directory = path.join(sessionsRoot, value);
-  if (path.dirname(directory) !== sessionsRoot) {
-    throw new SessionError(
-      "SESSION_ID_INVALID",
-      "resolve_session_path",
-      `Session ID escapes the sessions directory: ${JSON.stringify(value)}.`,
-      { sessionId },
-    );
-  }
-  return directory;
-}
-
-async function validateSecureDirectory(
-  directory: string,
-  sessionId: SessionId,
-): Promise<void> {
-  let stats;
-  try {
-    stats = await lstat(directory);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-      throw new SessionError(
-        "SESSION_STORE_NOT_FOUND",
-        "open_session",
-        `Session directory does not exist: ${directory}.`,
-        { sessionId, cause: error },
-      );
-    }
-    throw error;
-  }
-  if (
-    !stats.isDirectory() ||
-    stats.isSymbolicLink() ||
-    (stats.mode & 0o077) !== 0 ||
-    (typeof process.getuid === "function" && stats.uid !== process.getuid())
-  ) {
-    throw new SessionError(
-      "SESSION_PERMISSION_INVALID",
-      "open_session",
-      `Session directory must be an owner-only real directory: ${directory}.`,
-      { sessionId },
-    );
-  }
-}
-
-async function validateSecureFile(
-  filePath: string,
-  sessionId: SessionId,
-): Promise<void> {
-  let stats;
-  try {
-    stats = await lstat(filePath);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-      throw new SessionError(
-        "SESSION_STORE_NOT_FOUND",
-        "open_session",
-        `Session database does not exist: ${filePath}.`,
-        { sessionId, cause: error },
-      );
-    }
-    throw error;
-  }
-  if (
-    !stats.isFile() ||
-    stats.isSymbolicLink() ||
-    (stats.mode & 0o077) !== 0 ||
-    (typeof process.getuid === "function" && stats.uid !== process.getuid())
-  ) {
-    throw new SessionError(
-      "SESSION_PERMISSION_INVALID",
-      "open_session",
-      `Session database must be an owner-only regular file: ${filePath}.`,
-      { sessionId },
-    );
-  }
-}
-
-async function validateSecureOptionalFile(
-  filePath: string,
-  sessionId: SessionId,
-): Promise<void> {
-  try {
-    await lstat(filePath);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-      return;
-    }
-    throw error;
-  }
-  await validateSecureFile(filePath, sessionId);
-}
-
-async function removeKnownInitializationFiles(sessionDirectory: string): Promise<void> {
-  for (const name of [
-    "session.sqlite-wal",
-    "session.sqlite-shm",
-    "session.sqlite",
-    "events.jsonl",
-    "observations.md",
-    "active.lock.reclaim",
-    "active.lock",
-  ]) {
-    await unlinkIfExists(path.join(sessionDirectory, name));
-  }
-  try {
-    await rmdir(sessionDirectory);
-  } catch (error) {
-    if (
-      !new Set(["ENOENT", "ENOTEMPTY"]).has((error as NodeJS.ErrnoException).code ?? "")
-    ) {
-      throw error;
-    }
-  }
-}
-
-async function chmodIfExists(filePath: string, mode: number): Promise<void> {
-  try {
-    await chmod(filePath, mode);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
-      throw error;
-    }
-  }
-}
-
-async function unlinkIfExists(filePath: string): Promise<void> {
-  try {
-    await unlink(filePath);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
-      throw error;
-    }
-  }
-}
-
 function requireSingleChange(
   database: Database,
   reportedChanges: number | bigint,
@@ -6605,161 +3975,6 @@ function requireSingleChange(
   }
 }
 
-function recordFromSql(value: unknown, name: string): Record<string, unknown> {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new Error(`${name} must be an object.`);
-  }
-  return value as Record<string, unknown>;
-}
-
-function assertObjectKeys(
-  record: Record<string, unknown>,
-  allowed: readonly string[],
-  required: readonly string[],
-  name: string,
-): void {
-  const allowedSet = new Set(allowed);
-  const unknown = Object.keys(record).filter((key) => !allowedSet.has(key));
-  const missing = required.filter((key) => !(key in record));
-  if (unknown.length > 0 || missing.length > 0) {
-    throw new Error(
-      `${name} has invalid keys; unknown=${unknown.join(",") || "none"} missing=${missing.join(",") || "none"}.`,
-    );
-  }
-}
-
-function stringFromSql(value: unknown, name: string): string {
-  if (typeof value !== "string" || value === "") {
-    throw new Error(`${name} must be a non-empty string.`);
-  }
-  return value;
-}
-
-function sha256FromSql(value: unknown, name: string): string {
-  const hash = stringFromSql(value, name);
-  if (!/^[0-9a-f]{64}$/.test(hash)) {
-    throw new Error(`${name} must be a lowercase SHA-256 digest.`);
-  }
-  return hash;
-}
-
-function assertMeasuredContextAnchor(anchor: MeasuredContextAnchor): void {
-  for (const [name, value] of [
-    ["promptTokens", anchor.promptTokens],
-    ["completionTokens", anchor.completionTokens],
-    ["totalTokens", anchor.totalTokens],
-    ["segmentCount", anchor.segmentCount],
-  ] as const) {
-    if (!Number.isSafeInteger(value) || value < 0) {
-      throw new Error(
-        `Measured context anchor ${name} must be a non-negative safe integer; received ${value}.`,
-      );
-    }
-  }
-  if (anchor.totalTokens !== anchor.promptTokens + anchor.completionTokens) {
-    throw new Error(
-      "Measured context anchor totalTokens must equal promptTokens + completionTokens.",
-    );
-  }
-  for (const [name, value] of [
-    ["prefixHash", anchor.prefixHash],
-    ["requestConfigHash", anchor.requestConfigHash],
-    ["toolSchemaHash", anchor.toolSchemaHash],
-  ] as const) {
-    if (!/^[0-9a-f]{64}$/.test(value)) {
-      throw new Error(`Measured context anchor ${name} must be a SHA-256 digest.`);
-    }
-  }
-}
-
-function nullableStringFromSql(value: unknown, name: string): string | null {
-  return value === null ? null : stringFromSql(value, name);
-}
-
-function nullableTextFromSql(value: unknown, name: string): string | null {
-  if (value === null) {
-    return null;
-  }
-  if (typeof value !== "string") {
-    throw new Error(`${name} must be a string or null.`);
-  }
-  return value;
-}
-
-function numberFromSql(value: unknown, name: string): number {
-  const number = typeof value === "bigint" ? Number(value) : value;
-  if (typeof number !== "number" || !Number.isSafeInteger(number) || number < 0) {
-    throw new Error(`${name} must be a safe non-negative integer.`);
-  }
-  return number;
-}
-
-function nullableNumberFromSql(value: unknown, name: string): number | null {
-  return value === null ? null : numberFromSql(value, name);
-}
-
-function numberFromJson(value: unknown, name: string): number {
-  if (!Number.isSafeInteger(value) || (value as number) < 1) {
-    throw new Error(`${name} must be a positive safe integer.`);
-  }
-  return value as number;
-}
-
-function safeJsonInteger(value: unknown, name: string): number {
-  if (!Number.isSafeInteger(value)) {
-    throw new Error(`${name} must be a safe integer.`);
-  }
-  return value as number;
-}
-
-function nonNegativeJsonInteger(value: unknown, name: string): number {
-  const number = safeJsonInteger(value, name);
-  if (number < 0) throw new Error(`${name} must be non-negative.`);
-  return number;
-}
-
-function positiveJsonInteger(value: unknown, name: string): number {
-  const number = safeJsonInteger(value, name);
-  if (number < 1) throw new Error(`${name} must be positive.`);
-  return number;
-}
-
-function nonEmptyStringFromJson(value: unknown, name: string): string {
-  const text = stringFromSql(value, name);
-  if (text.trim() === "") throw new Error(`${name} must not be empty.`);
-  return text;
-}
-
-function enumFromSql<const T extends readonly string[]>(
-  value: unknown,
-  values: T,
-  name: string,
-): T[number] {
-  if (typeof value !== "string" || !values.includes(value)) {
-    throw new Error(`${name} has unsupported value ${JSON.stringify(value)}.`);
-  }
-  return value;
-}
-
-function timestampFromSql(value: unknown, name: string): string {
-  return timestampValue(stringFromSql(value, name), name);
-}
-
-function timestampValue(value: string, name: string): string {
-  if (Number.isNaN(Date.parse(value)) || !value.endsWith("Z")) {
-    throw new Error(`${name} must be a UTC ISO-8601 timestamp.`);
-  }
-  return value;
-}
-
-function parseJson(value: string, name: string): unknown {
-  try {
-    return JSON.parse(value);
-  } catch (error) {
-    throw new Error(`${name} is not valid JSON.`, { cause: error });
-  }
-}
-
 function requireItem<T>(items: readonly T[], index: number, name: string): T {
   const item = items[index];
   if (item === undefined) {
@@ -6768,10 +3983,6 @@ function requireItem<T>(items: readonly T[], index: number, name: string): T {
   return item;
 }
 
-function compareCanonicalText(left: string, right: string): number {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-
 function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }