feat(cli): unify external session imports through Host - #5308

Reviewed exact head a9142b7bdf9369dc7ba8f63d45b176d39a89b73d.

This change replaces the CLI-local foreign-session handoff with a Runtime Host-owned catalog/import path shared by Claude Code, Codex, and OpenCode, including bounded cursor paging, durable imported Session publication, recovery, and TUI selection. The latest commit also bounds every catalog-row field before wire-budget assembly.

I found two blocking P2 correctness issues:

• outcome-unknown TUI reconciliation can claim a concurrent client import and switch to the wrong Session;
• the Codex filesystem fallback pages by creation-path traversal rather than the previous global update-time order, so recently used or newly archived Sessions can be buried behind stale rows.

Validation completed: clean install, build:test, full typecheck/lint/format/ASF checks, Storage 1266 pass / 11 skip, CLI 1053 pass / 3 skip, focused external-session tests 51/51, and a clean merge tree with current main c22768c3b0dc47518f6f8584e864f86f0b1e5379. Runtime Host full tests were 1932 pass / 19 skip / 1 fail; the only failure was the unchanged managed-Bash sandbox integration because this runner rejects both unshare and bwrap. GitHub currently exposes no hosted checks for this head.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

Reviewed exact head 85c70702958ca7dcf7f73d62a6b0a6b4739a71c9.

This follow-up makes outcome-unknown TUI imports fail closed and changes the Codex filesystem fallback to globally order active and archived rollouts by file mtime before filtering and paging. Both prior P2 findings are fixed: the TUI no longer attributes a concurrent copy to an uncertain request, and a recently updated old-path or archived rollout is no longer statically buried behind newer creation paths.

One P2 remains in the new fallback ordering: every page recomputes the mutable mtime order while the Host cursor is only a numeric offset. An active rollout that changes between page requests can move ahead of the offset, causing the next page to duplicate a previously shown row and omit the updated Session for the rest of that picker traversal. The inline comment includes a production-path reproduction.

Validation completed on Node 24.18.1: fresh workspace dependency and CLI builds; Storage 1266 pass / 11 skip; CLI 1052 pass / 3 skip; focused Codex adapter 17/17 and TUI paging/outcome-unknown 4/4; changed-file Biome; git diff --check; and a clean merge tree with current main 72cd8b1f532872ef1bcca875a7a7cae4e7b1448e. GitHub reports no hosted checks for this head. I did not exercise native packaged Desktop, Windows/macOS, or a real concurrently-writing Codex process.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

Thanks for pushing this through, and for the D1–D14 note; being explicit about every deviation from #5053 made the review tractable. Reviewed at head 85c7070. The direction is what we agreed in #5053: the scanner and the digest handoff are gone with nothing dangling, external-session.ts is the old helpers moved rather than rebuilt, the pagination contract holds end to end (I walked the four page-boundary cases; nothing skips or duplicates), D13 lives in the storage authority, restart recovery is wired, and the Codex fallback fix with its regression test checks out. Net production diff is −163 lines. So this is close, and what follows is mostly about how the last rounds of fixes were made rather than about the design.

1. The pattern behind most of what I found. I mapped each issue back to the commit that introduced it, and six of the nine commits are titled "close … findings". Almost every remaining problem comes from a review comment being fixed at the spot the reviewer pointed to instead of at the code that owns the behaviour, and the design note then documents that local choice. Three chains show it:

• A reviewer said "don't publish an empty history" → the importer got a pre-check → the pre-check disagreed with the Ledger → to make them agree, the Ledger's turn rule was forked on externalOrigin (runtime-ledger-repair.ts:95). That fork is the one real defect here, see point 2.
• A reviewer said "bound the reads" → a constant was added in each function under review: the Claude summary completes a cut record with the import's 64 MiB bound, twice, so one 126 MiB transcript takes listSessions from 57 MiB to 567 MiB resident (measured; claude-code-session-adapter.ts:640-685, and the doc comment at :72-92 still says 512 KiB); OpenCode bounds source bytes but convertTranscript holds every parsed row, so within the same 64 MiB three JSON shapes measured +155 / +333 / +536 MiB (D3's "~216 MiB" is one corpus, not a bound); and the new directory bound drops NULL rows from the picker while readSession still imports them (opencode-session-adapter.ts:264, where title on the next line already has coalesce).
• A reviewer said "don't infer ownership from a catalog delta" → the TUI went fail-closed, and Desktop's import-tasks-settings-page.tsx:676-685 still does exactly that inference and offers a button into what may be another client's Session. D2 doesn't mention that the two clients now disagree on the same Host outcome.

The ask is not to fix these three one by one. It is to redo the last rounds from the owner outward: for each bound, name the resource it protects (listing memory vs import memory) and put one bound there; for each rule, keep one rule in the authority that owns it and let callers adapt; for each client behaviour, make both clients read the same Host outcome the same way. Then ablate: for every mechanism the fix rounds added, revert it, run the suite, and keep only what fails. From my own ablations, these already don't survive: toCatalogSessionRow's tolerant skip (unreachable, 27/27 pass without it; the SQL already excludes non-text parent_id), the steering clause in isConversationTextMessage (steering rows are filtered before it runs), compareCatalogEntries and the preceding byte in readSummaryTail (dead), and the Codex/Claude parsing helpers' home in @maka/core (each now has exactly one consumer, its adapter; the Adapter is the format authority, so they belong there).

2. The one blocker: an imported Session that opens on an assistant reply can't be continued on Anthropic-family connections. Claude Code and OpenCode transcripts can start with an assistant record; on main the Ledger skipped that turn, so the history the model saw always began at a user boundary. With the D5 fork it is kept, and I traced the real path (SessionManager.sendMessage → new run → buildPriorRuntimeContext → AiSdkBackend with a recording model): the provider receives [assistant, user, assistant, user]. Nothing on that path checks the head; runtime-resume.ts's provider_resume_head_unsupported only runs for explicit resume/fork. @ai-sdk/anthropic groups by role without validating the first one, so messages[0].role is assistant on the wire, which the Messages API rejects, and every retry rebuilds the same head. That is #5053's continue-after-import criterion failing on the most common connection. main's behaviour isn't right either (it silently drops that reply), but the fix belongs where the model history is projected, not in the turn rule: keep the turn in the transcript and have the projection that already owns provider admission handle a non-user head. One rule in the Ledger, one owner for the head. I'd like a real send on an Anthropic connection recorded in the PR once that's in.

3. Tests. About 1,180 test lines were added. Several pin the local fixes above rather than an obligation, and some pass on main unchanged: keeps a transcript that opens on an assistant reply (stubs createImportedSession, asserts only the id), a native transcript turn with no user row is still not converted (a shape no native path produces), two of the three outcome-unknown TUI cases (same assertion as the first), the D7 case (the SQL, not the wrapper, makes it pass), and the (mtime, size) cache case (only size is exercised). Please run the same ablation on the tests: revert the production change each one claims to guard, and drop any that stays green. The ones that do fail on main and go through the owner are good and should stay: the cursor-advances-by-source-rows case, the two importer rejection cases (which, as an aside, also fix a live Desktop defect: main's importer had no emptiness check at all, and the PR undersells that), and the Codex page-order regression.

4. Smaller things to fold into the same pass. The TUI collapses every import failure code except source_limit_exceeded into "Could not import"; model_unavailable and source_unreadable are normal outcomes the protocol defines codes for and Desktop already classifies, so a switch on the code with three strings is enough. The picker scope should come from driver.getWorkspaceTarget() rather than the mutable sessionListScope, otherwise a host-workspace profile can label "current workspace" and query all. externalImportLimitLabel takes string with a default: return kind, which is the token leak D12 exists to prevent. discardCurrentSidePair sits inside the try after a successful switchSession, so a cleanup failure reports "could not open" on a Session that is open. The Codex ORDER BY coalesce(updated_at_ms, updated_at, …) mixes seconds and milliseconds. The benchmark script hand-copies the preflight SQL (they already differ) and its per-session memory column reads a monotone maxRSS, so every row after the first is ~0; if it stays, import the SQL from the adapter. The CHANGELOG entry went under the empty ## Unreleased instead of ## 0.2.0 - Unreleased where every other pending entry is.

Facts: the branch is 10 commits behind main but merges clean, lockfile unchanged, no hosted checks on this head. Storage, core, runtime-ledger, Host coordinator and the TUI external-session suites all pass here.

AI assistance: I used Claude Code to trace the provider path, run the memory measurements and the ablations; conclusions were checked by me.

Reviewed exact head 0a73b3794030125ea50a266ed840e251167d94a0.

Relative to the previously reviewed head, the nine existing PR commits are patch-equivalent after rebase and this head adds source-owned catalog cursors, a five-minute in-memory snapshot for the Codex filesystem fallback, explicit cursor-expiration handling, and TUI reload behavior. The prior filesystem mtime/offset finding is fixed for that fallback path.

Two blocking correctness issues remain:

• P1: an imported transcript that begins with an assistant reply is materialized into provider history with that assistant message first. An exact-head production projection plus @ai-sdk/anthropic request probe emitted wire roles ["assistant", "user"]; Anthropic-compatible Messages endpoints reject a conversation without a leading user turn, so this imported Session cannot be continued on those connections.
• P2: the preferred Codex state-database path still pages a mutable ORDER BY updated_at... result with a plain o:<offset> cursor. An exact-head HostExternalSessionCoordinator -> CodexSessionAdapter -> node:sqlite probe returned rows 19 through 04 on page one; after unseen row 01 received a newer updated_at_ms, page two repeated row 04 and never returned row 01.

Validation on Node 24.18.1: clean npm ci; build:test; Storage 1364 pass / 11 skip; CLI 1053 pass / 3 skip; focused external-session adapter/Host/protocol/TUI tests 271/271; Runtime Ledger repair 13/13; changed-file Biome; ASF headers; git diff --check; and a clean merge tree with current main 3f297e9aaac36b023e219ad3837a790064f592ea. Runtime Host full tests were 1944 pass / 19 skip / 1 fail; the only failure was the managed Bash sandbox integration because this runner rejects both unshare and bwrap, not a failure in the changed path. GitHub exposes no hosted checks for this head. I did not exercise a live Anthropic account or native Windows/macOS clients.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

Reviewed exact head 2813eff474d4b9fd4dc4b8ca43cfcb9d36b3f17b.

This follow-up moves assistant-first admission into model-history projection and gives the Codex state-database path the same query-bound snapshot cursor as the filesystem fallback. The previous imported-session Anthropic failure and mutable-offset duplicate/omission are fixed on their intended paths.

Two blocking regressions remain:

• P1: transcript repair now materializes assistant-only turns for native legacy Sessions too, while the new user-boundary projection is restricted to Sessions with externalOrigin. A native pre-ledger Session therefore produces assistant-first Anthropic wire history and cannot continue.
• P2: state-database paging now materializes and path-validates the entire matching catalog before returning the first page, replacing the previous bounded SQL page with unbounded first-page work and retaining up to 32 full snapshots.

Validation on Node 24.18.1: clean npm ci; build:test; Storage 1364 pass / 11 skip; Runtime 3479 pass / 13 skip; CLI 1053 pass / 3 skip; focused changed-path tests 249/249; changed-file Biome; ASF header audit; git diff --check; and a clean merge tree with current main 3f297e9aaac36b023e219ad3837a790064f592ea. GitHub exposes no hosted checks. I did not exercise a live Anthropic account or native Windows/macOS clients; the catalog timing data is from a synthetic local Codex state database.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

Reviewed exact head 7f4d52f876fb9b943e77353075834e2cb9aefce0.

This follow-up closes both findings from the previous head. Repaired assistant-only history is now admitted at the first model-visible user boundary for native and imported Sessions, while ordinary RuntimeEvent history is preserved. The Codex state-database catalog now keeps a WAL read transaction as the stable snapshot and reads bounded SQL batches instead of materializing the full catalog before returning page one.

I found no remaining P0-P3 issue in the new increment. The 2,000-row first-page regression exercises the bounded path, and the focused production-path coverage includes native repaired history replay and stable state-database pagination.

Validation on Node 24.18.1: clean npm ci; build:test; 228 focused Runtime/Storage tests; git diff --check; and a clean merge tree with current main 3f297e9aaac36b023e219ad3837a790064f592ea. GitHub exposes no hosted checks. I did not exercise a live Anthropic account, sustained concurrent Codex writes while a five-minute read snapshot remains open, or native Windows/macOS clients.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

Reviewed exact head ae1f5a1ccfea5350eb55e9da0caa1c94ada57dea.

This follow-up removes the unsafe Desktop catalog-delta attribution for outcome-unknown imports, preserves the corresponding TUI outcome and error distinctions, normalizes mixed Codex timestamp units, and moves format-specific parsing helpers back into their adapters. Those changes address the previously raised issues, but the Desktop fail-closed rule can still be bypassed through batch import; I found one P2 inline.

Validation on Node 24.18.1: clean install; build:test; 338 focused Desktop/CLI/Storage tests; full workspace typecheck; changed-file Biome; git diff --check; and a clean merge tree against current main (0d9ea7576a49c2f3173aa2cbe99ded53f82deaab). GitHub exposes no hosted checks. I did not exercise a real commit-outcome disconnect, a live external client, or native packaged Desktop.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

Thanks for turning this around so quickly. Reviewed at head ae1f5a1, rebased and mergeable. The blocker from last round is fixed at the right owner: one turn rule in RuntimeLedgerRepair, and provider admission in model-history.ts scoped by refs.storedMessageId, which only the repair backfill ever writes. I re-ran the real path (SessionManager.sendMessage → buildPriorRuntimeContext → AiSdkBackend with a recording model) for an imported transcript opening on an assistant reply, a native pre-ledger Session with an assistant-only turn, a thinking-only opening, and the continuation lane: all user-led on the wire. I also tried the coarse rule ("drop everything before the first user event"): 22 genuine ai-sdk-backend failures, because the prior context is routinely a budgeted/folded slice that legitimately starts on an assistant event. So the provenance scope is required, not extra. The session-manager regression goes red with the option off. Every item from points 1, 3 and 4 last round is done as asked. Good.

Two things stand out in this head, and they're the same shape as last time: each review round added machinery and tests at the spot the reviewer pointed to, and the ablation only covered what was named. Production is net −374 against main, which is the right direction, but the Codex adapter went from +100 to +423 lines and PR-authored test lines from about 1,180 to 1,670.

1. The Codex snapshot cursor goes past what #5053 decided. Decision B asks to reuse the Host paged catalog and keep the underlying reads bounded. What three rounds of "rows shift between pages" produced instead is a second paging interface (listSessionPage, page item type, ExternalSessionCursorExpiredError), an adapter-owned snapshot table with random tokens, a 5-minute sliding TTL and a 32-entry LRU, a new protocol error cursor_expired, a TUI clear-and-reload state with three locale strings, and for state_*.sqlite a BEGIN read transaction held open across pages on Codex's live database. About 290 production lines across five packages, defended by four tests. Measured on the WAL path: while a page is held, wal_checkpoint(TRUNCATE) returns busy and 2,000 writer commits left 2,000 frames unreclaimable; a user who opens the picker, reads page one and presses Escape pins Codex's WAL for the full five minutes, and nothing disposes the reader when the picker closes. On Windows the open handle also stops Codex rotating its state file. The TTL and LRU, the only bound on that hold, have no regression: with both removed the Codex suite is still 20/20.

The obligation the picker actually has is: no duplicate, stable order, bounded first page. Keyset paging meets all three with zero server state: order by (sort_ts DESC, id DESC), cursor is the last seen pair, WHERE sort < ? OR (sort = ? AND id < ?), carried in the existing opaque cursor string. Filesystem fallback does the same over (mtime, path). What it gives up is "a row updated mid-traversal stays at its old position", which nothing in #5053 asks for, and which Claude and OpenCode don't offer either since they're still on numeric offsets. The strongest test in the PR (external-session-coordinator.test.ts:147, real handler, real SQLite, concurrent UPDATE) pins that stronger guarantee rather than the obligation. I'd like the paging shape decided before anything else in this round, because cursor_expired, the TUI reload path, the WAL hold, the journal-mode source switch (non-WAL installs silently get the filesystem corpus with different titles and timestamps) and about 240 test lines all go with it.

2. Ablate everything added since 85c7070, not only what was named. You removed the five tests I listed and nine Desktop mechanism tests, but the twelve fix commits each brought their own, +664 lines, and several defend an intermediate revision of this PR rather than an obligation:

• Heavy and redundant: opencode-session-adapter.test.ts:205 pushes 2,048×2 rows into real SQLite (1.2 s, slowest test in the workspace) to prove what :326 proves with maxRows: 1 in 2.5 ms; disabling the row check reds both. codex-session-adapter.test.ts:584 seeds 2,000 rollouts plus a state DB and asserts snapshotMs < boundedMs * 8 + 50; a wall-clock ratio on a shared CI box isn't a contract, and it doesn't observe "no materialisation" at all. If the obligation survives, count reader calls on 20 rows.
• Green on main already: claude-code-session-adapter.test.ts:682 (guards a record count that no longer exists anywhere, with a 2,002-record fixture), opencode-session-adapter.test.ts:183 (defends a title bound against an earlier draft), :405 (readOnly: true predates this PR).
• Subsumed: claude-code…:612 and :630 by :654, which goes red under the same head and tail ablations; external-session-importer.test.ts:141 by :166; model-history-timeline.test.ts:28 by the session-manager regression (neutering the option reds both); the for (const externalOrigin of …) loop in session-manager.test.ts:8496 runs 115 lines of setup twice for a rule that doesn't branch on it.
• Unreachable by its own comment: external-session-coordinator.test.ts:409 covers the over-budget page branch (:444-460) that :443 proves can't be reached; delete the branch, its export, the per-item cursor type and the test together (about 35 lines, ablation run, one failure and it's that test).

That's roughly 330 test lines now and 570 if the snapshot goes, leaving a keep list where each test proves one obligation through its owner and is red on old behaviour. On the production side, same pass: OPENCODE_TRANSCRIPT_MAX_CONVERTED_BYTES has no reachable trigger (preflight already caps source at 64 MiB; measured amplification at the worst row shape is about 1.6×, so the ceiling is ~100 MiB against a 256 MiB cap) and is only fired by the test-only option; since Claude and Codex carry the same construct on main, either take all three out in a follow-up or leave all three, but don't add a test for one. Also the duplicate .slice(0, MAX_ITEMS) at coordinator.ts:230 (already enforced at :212), claudeAssistantText passthrough, repairedAssistantIndex scanning the full ledger on every caller when only one sets the option (move both findIndex inside the if), the two TUI decoders of the same {operation, code} envelope, and doc comments that narrate this PR's revision history (claude-code…:80-85, opencode…:74-78).

3. Three defects, each with a small fix at the owner.

• P2, Codex ordering. codexThreadQuery (codex-session-adapter.ts:1090) multiplies every non-_ms column by 1000 unconditionally; normalizeEpochMs (:1271), which produces the updatedAt shown for the same row, multiplies only below 1e12. When updated_at holds milliseconds, an hour-old Session sorts first and the newest falls off page one. One CASE WHEN col >= 1000000000000 THEN col ELSE col * 1000 END fixes it (verified, 20/20), or delete the JS branch if seconds is the only supported unit; one rule either way. The current regression passes with either threshold, so it can't tell.
• P2, Claude scoped catalog. When neither summary window yields a record (one record over 512 KiB, e.g. a pasted file as the opening prompt), readTranscriptSummary degrades to cwd: '', which then fails the workspace clause in externalSessionMatchesQuery, and the catalog is always workspace-scoped. The comment says the fallback "must not hide a real source Session"; it does, completely. The adapter already knows the projects/<encoded-cwd> directory; decode that for the degenerate row.
• P2, Desktop batch import. hqhq1025's finding stands: importSelected() (import-tasks-settings-page.tsx:676) builds targets from marked without consulting uncertainImports, and the checkboxes and button aren't gated on it. The underlying issue is that this lock is client-local and the TUI has none at all, so the two clients diverge again on the same Host outcome. The Host already keys in-flight imports by (adapterId, sourceSessionId); retaining a settled-unknown entry there is the owner-level fix, but it's a protocol change and I wouldn't block on it. For this PR: filter the batch targets the same way as the single path, or drop the Desktop lock to match the TUI, and say which.

P3s, no action needed unless convenient: an imported transcript with no user event at all replays as empty context while the UI shows the full conversation (firstUserIndex < 0 → []), worth a test; a malformed numeric cursor is handled three different ways by the three adapters (Claude loops on page one with NaN), validate once in the coordinator; the final page released on hasMore: false can still hand back a cursor when the wire budget truncates it.

Facts: 5 behind main, merges clean, lockfile unchanged, no hosted checks on this head. Storage, core, runtime-host, runtime and CLI focused suites pass here.

AI assistance: I used Claude Code to run the provider-path probes, the WAL and memory measurements, and the ablations; conclusions are mine.

Reviewed exact head ddd24e32fe89561314b949c9f26d3a7741eff6c9.

The previous assistant-first history failure and mutable offset pagination defect are fixed. This revision also consistently blocks duplicate uncertain/in-flight imports in Desktop and the TUI. The current head is still not ready because the new stateless Codex cursor has two reachable omission cases, and invalid opaque cursors are reported as storage failures.

Validation completed on Node 24.18.1: clean install, build:test, full workspace typecheck, 45 focused Storage/Runtime Host tests, CLI 214/214, Desktop import page 35/35, the assistant-first production regression, protocol/model-history 17/17, changed-file Biome, ASF headers, git diff --check, and a clean merge tree with current main dd15b63c60039a77ed980b27c3306af08ad1b9ee. GitHub reports MERGEABLE/BLOCKED with no hosted status checks.

Not covered: a real concurrent Codex process rotating state databases, or packaged Desktop interaction.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

Reviewed exact head 6dd58dfb16a1e3abbfbd2567880e093d031a1b48.

I found no new P0-P3 issue in this revision. The three findings from the previous head are resolved on the production paths:

• Codex filesystem fallback now uses the same comparator for ordering and keyset continuation. A tied-mtime codex_a / codex-a probe visits both rows exactly once.
• Codex database cursors now bind to the state_*.sqlite generation that issued them. After page one from state_5.sqlite, adding a newer state_6.sqlite no longer drops the remaining state_5 rows; a missing or unreadable issuing generation fails the cursor instead of silently switching corpora.
• Source-owned cursor failures use ExternalSessionCatalogCursorError, and the Host maps them to invalid_request rather than persistence_failed. Claude Code and OpenCode now expose the same opaque, query-bound paging contract through the shared offset adapter.

Validation on Node 24.18.1: clean install, build:test, full workspace typecheck, focused Storage/Core/Runtime Host tests (134/134 on the clean merge tree), full Storage (1362 pass / 11 skip), changed-file Biome, formatting, ASF headers, and git diff --check. The merge tree with current main 2c49a9986fc4cbc6f09c1afb2c9d205b67c86a7b is clean and its build plus focused tests pass. The full Runtime Host suite reached 1945 pass / 19 skip / 1 fail; the sole failure is the existing managed-Bash sandbox case on this runner, where namespace/sandbox execution is unavailable, and is outside this change.

GitHub currently reports MERGEABLE/BLOCKED with no hosted status checks. I did not test a packaged Desktop build or a real Codex process rotating its state database during an open picker. This is a feature change, so the merge decision remains with a human maintainer.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

Thanks for the sustained iteration — the keyset paging, the scoped admission rule, and the ablations all landed where they should. Reviewed at head 82f90d6d. This round is organized differently on purpose: six rounds of "close finding N" converged each time because each list was finite, but the remaining defects are not a list — they are instances of a few unstated invariants. So instead of another findings list, this review states each invariant, names its single owner, and audits all of its consumers once. The goal is that fixing the owner closes the whole class, not the instance a reviewer happened to point at.

Verified on this head before listing anything: the durable/import path is sound end to end (single transaction, hidden v0 staging, awaited recovery, idempotent rematerialization); the keyset contract is exact (no dup/skip on budget cuts, generation-bound cursors); the provider wire is user-led on the send path (traced through buildPriorRuntimeContext); the deleted scanner/digest surface left no dangling references.

Invariant 1 — every ledger→provider projection is user-led

Invariant. Any projection of RuntimeEvents into provider messages must not emit repaired backfill (refs.storedMessageId) content before the first model-visible user event. Explicit continuations are admitted separately.

Owner. buildRuntimeEventModelReplayPlan. The rule currently exists as the opt-in flag startAtFirstUserBoundary, enabled only in ai-sdk-turn.ts. An invariant that each caller must remember to request is not an invariant — it is a convention, and this PR's own history shows conventions get forgotten.

Consumer audit (every caller that can see a repaired ledger):

This defect class technically predates the PR ([assistant, user] repairable turns existed), but zero-user turns are the shape this PR introduces, so the exposure goes from corner case to target scenario. Smallest fix: make the boundary the projection's default and invert the option for the admitted continuation lane — then no present or future consumer can forget it. Alternative, weaker: pass the option at each consumer. Either way, the review criterion is the table above closing to all-yes.

P2. Also small: when the slice drops the prefix, emit a repaired_prefix_dropped diagnostic — today an assistant-only transcript silently projects to [] while the UI shows a conversation.

Invariant 2 — a catalog page is a bounded slice of one stable total order, resumable by position

Obligations. No duplicates, no silent omissions, bounded first page; the cursor names a position in the order (keyset), not a copy of the corpus; validation happens once at decode; and the error taxonomy distinguishes cursor invalid (client input, invalid_request) from source unreadable (transient, persistence_failed).

Consumer audit:

• Dead path. Codex still carries the replaced offset engine — listSessions → listCatalog → scanRolloutCatalog → walkRolloutFiles plus readCodexThreadRows's page parameter — extended this round and pinned by new tests, all unreachable in production (codex-session-adapter.ts:144,173-205,244-276,899-920). The interface the coordinator consumes is listSessionPage alone. Per repo rule the replaced mechanism leaves in the same PR; repoint the still-valuable assertions (mixed-unit ordering, filters) at listSessionPage or delete them. P2.
• Misclassified transient failure. readStateCatalogKeysetPage swallows every read error into undefined, which listCatalogKeysetPage turns into ExternalSessionCatalogCursorError on continuation pages (codex-session-adapter.ts:344,289-291 → coordinator maps invalid_request). A SQLITE_BUSY/checkpoint race while Codex writes state_N.sqlite — normal operation — hard-fails Load More on a cursor that is still valid. Return undefined only for "no usable threads table" and let read errors surface as persistence_failed. P2.
• Unbounded per-page I/O. nextRolloutCatalogBatch head-reads (≤512 KiB + parse + realpath) every post-keyset candidate on every page because traversal order is not sort order (:1068-1094). The file already contains the correct shape — scanRolloutCatalog sorts by stat-known keys first, then reads heads only until limit matches. P2 on a no-state-DB corpus, otherwise P3.
• Guarded crash path. boundedCatalogPage evaluates candidates[index-1]! at coordinator:417; index 0 would be a TypeError→persistence_failed. The "one row always fits" invariant is test-pinned, so either keep it and say so at the !, or handle index 0 explicitly. P3.

Invariant 3 — one outcome, one meaning, on every client

Invariant. "Dispatched but unanswered" has exactly two wire shapes: the Host error code commit_outcome_unknown, and RuntimeHostRequestInterruptedError with dispatch === 'dispatched'. Both mean: unconfirmed, never retried blind, never attributed to another client's import. Everything else maps by its own code.

Consumer audit: the TUI decodes both shapes (pi-tui-runner.ts:329). Desktop main maps only the operation error — an interrupted import throws through runtime-host-external-sessions-ipc-main.ts:97-121, renders as a generic failure, leaves the row eligible, and a retry can duplicate a task that did land. That is the exact fail-open case this PR exists to remove, and it makes the two clients disagree on one Host outcome again. Pre-existing, but the seam is this PR's contract and the fix is ~6 lines plus emitSessionsChanged('created'). P2.

Residual to decide, not silently accept: a post-dispatch error that is neither shape (e.g. a rejected response frame) is still treated as retryable on both clients. onboardingSave maps even non-envelope errors to outcome-unknown for this reason. Pick one and document it. P3.

Invariant 4 — source bytes cross exactly one canonicalization boundary before persistence

Invariant. Before anything is durable: titles pass sanitizeExternalSessionTitle (incl. redactSecrets), cwd is bounded and control-char-free, ts is a non-negative safe integer, and failures carry typed errors. The commitAttempted flag must sit at the durable boundary — validation failures are provably pre-commit and must never report commit_outcome_unknown or drain the host.

Audit of what crosses today:

• commitAttempted = true precedes validation inside createImportedSession (coordinator:283-287): a rolled-back transaction — non-canonical message, name sanitizing to empty, message_ts >= 0 CHECK (all three adapters pass ts < 0 through), id collision — reports unknown + requestDrain for a deterministic nothing-was-written failure. P2.
• OpenCode readSession persists row.title raw (opencode-session-adapter.ts:172) while the catalog sanitizes the same field (:458) — a secrets-shaped title is stored unredacted, and a control-char-only title throws inside name normalization after the flag above. P2.
• metadata.cwd is unbounded: Claude takes record.cwd verbatim up to the 64 MiB record cap (claude-code-session-adapter.ts:340), Codex strips control chars but caps nothing, OpenCode caps at 4 KiB in preflight only. It lands in the header and the ledger's configuration.cwd. One shared bound in the importer covers all three. P2.
• Codex limit failures throw plain Error (:731-735,752,839) so source_limit_exceeded never fires for Codex — the typed result and its UI copy exist unused. P2.
• isSourceSessionNotFound greps English text (coordinator:457): Claude throws "transcript not found" which does not match, so a delete-between-list-and-import race reports source_unreadable. One typed ExternalSessionNotFoundError in the adapters replaces the regex. P2 (pre-existing, in-seam).

Invariant 5 — state the data assumption before the algorithm depends on it

readTurnsInPages assumes turnIds are contiguous: it carries only the last-inserted group, not the group owning the page's last row (runtime-ledger-repair.ts:182-199). Codex terminal rows use payload.turn_id, which can reference an older turn — interleaved rows across a page boundary either convert one turn twice under colliding ids or persist a wrong terminal verdict. Reachability on real Codex output is unproven: please pin it with an interleaved fixture; if reachable, carry all still-open groups rather than one. P2 if proven, otherwise document the assumption.

Regression vs the deleted flow

The deleted TUI scanner let users search (SessionSearchOverlay covered title/id/cwd). The new picker is a bare SelectList (pi-tui-runner.ts:3120-3147) and the surface has no text (pi-tui-contracts.ts:207) — while the Host query and Desktop already support it. Client-side filtering cannot see unloaded pages, so parity requires the wire field. P2.

Smaller items (P3, fix if convenient): TUI drops ineligible rows entirely where Desktop disables them with a banner — pick one model; the busy guard reports "import failed" when nothing was attempted; external-session-coordinator.ts:397 keeps a dead number union member; a Desktop comment at import-tasks-settings-page.tsx:158 still documents the removed recovery mechanism; session.ts:806 still says "foreign".

How to close this

For each invariant above, the acceptance is the audit table going green — not the named line changing. If a fix lands anywhere other than the stated owner, please say why. Most of items 3–5 are pre-existing; this PR extending the surface is what exposed them, and the seam-local ones are cheap here — but it is fine to split the rest into follow-ups as long as the review says which.

Head 82f90d6d, merges clean into main 27add3049f, no hosted checks on this head. I did not exercise a packaged Desktop build or a live provider call.

AI assistance: this review used delegated agents to audit each contract boundary independently; I verified the load-bearing claims against the head source myself.

Re-reviewed at head f438e90af — the branch was rebased onto current main and gained three commits on top of what I last saw (47a7db75e protocol re-pin, 5ebd5f04c renderer ledger sync, f438e90af settle turns from their final state). I verified each invariant from the previous round against the head source rather than re-running a findings list:

The audit table went green, which is the acceptance bar this review set. What remains is one merge blocker on the PR's own test surface plus a short list of new, mostly local defects introduced by the fix commits — two P2s as inline comments.

Merge blocker — the test check fails deterministically

Storybook smoke: product-settings-pages--import-tasks-outcome-unknown-recovered asserts '已确认导入'/'Import confirmed' — copy that no longer exists anywhere in src. The story predates the §11 redesign: recoverUnknownImport used to surface a positive "confirmed" state, while the current model renders the importOutcomeUnknownTitle banner and lets the row's imported N times annotation carry the landed signal. If the removal was deliberate, update the story to assert the new semantics (banner plus the row's post-refresh annotation); if it wasn't, the positive confirmation needs restoring. Either way the check keeps failing until one of those happens.

New findings

P2 (pre-existing, in-seam) — ExternalSessionCoordinator.recover() (external-session-coordinator.ts:136-143) awaits #prepareStagedSession for each v0 header with no failure isolation: a staged session whose prepare deterministically fails and whose discardImportedSession also fails propagates out of recoverRuntimeHostDomainModules, so one bad staged session keeps the whole host from ever reaching ready. Narrow double-fault trigger, maximum blast radius. Collect the failure or quarantine the header rather than aborting all domain startup.

P3 — Emitted filesystem cursors can exceed the 512-byte wire bound on deeply nested rollout paths (encodeCatalogKeyset embeds the full base64 catalogKey; decode caps at 320B/512B): a user-managed backup tree under sessions/ fails the very page that emitted it. Bound catalogKey length at enumeration or hash it.

P3 — TUI catalog search fires a Host-side scan per keystroke (pi-tui-runner.ts:3195); responses are revision-guarded so correctness holds, but Desktop debounces 250ms for the same query. Worth the same coalescing, plus a test pinning text forwarding.

P3 — The old TUI search matched the source session id as well as title/cwd; the wire matcher covers title+cwd only (external-session.ts:146-148), so pasting a Codex UUID no longer finds the row. One-line fix in externalSessionMatchesQuery that also benefits Desktop.

P3 — projectSessionCatalogMessages(canonicalMessages) is evaluated as an argument after onCommitStarted?.() fires (session-store.ts:216-220): a deterministic throw there reports commit_outcome_unknown + drain with nothing written. Compute the projection before firing the callback.

P3 — The memory test double's import lookup lacks the transcriptLedgerVersion <> 0 filter the SQLite store applies, so tests on the double cannot reproduce staged-row invisibility — the property the recovery contract depends on.

Head f438e90af, mergeable but BLOCKED on the failing test check. I did not run the suite locally or exercise a packaged build.

AI assistance: verification used delegated agents auditing each contract boundary independently; the load-bearing claims (boundary default + continuation digest symmetry, the two P2s, the stale story) were re-verified against head source before publishing.

Approving at f438e90af. The six invariants from my earlier reviews are closed end to end (see the verification table in the previous review), and the remaining P2s are localized and follow-up-able rather than blocking — the fail-closed direction is already correct everywhere, so none of them can silently corrupt or duplicate data.

Two things still gate the merge mechanically, not on review grounds:

1. The test check is red on ImportTasksOutcomeUnknownRecovered — a stale story assertion (see previous review). Trivial fix: assert the §11 banner + imported N times annotation.
2. Suggest filing the P2s as follow-ups before merging so they don't get lost: corrupt-state-DB fallback defeat, the SQL/JS sort-key divergence, recover() failure isolation.