The invariantCompile-time declaration merging does not update the durable vocabulary of another Harness build.
alpha.1 boundaryThe historical ignorable envelope is gone.

Unknown types now always fail closed; SQLite uses a separate is_packed discriminator. A cast cannot restore a removed protocol.

Incident #34168 informational plugin events made 2 otherwise healthy Sessions unreadable.

Valid framing and sequence isolated the missing ignorable: true envelope as the blocking boundary.

Incident #4811 · global blast radiusPersistence refusal happened before search extraction.

SQLite reconciliation inspected every changed artifact; one incompatible Session surfaced to callers as session history storage is unavailable.

Separate strict interpretation from corpus availability.

PersistenceRefuse one Session

An unknown required event must never be guessed or skipped.

ReconciliationIsolate one artifact

Continue compatible indexing and disclose degraded coverage.

ExtractionUnknown means no text

This defensive branch runs only after a Session can be inspected.

Three contracts must agree.

TypesLocal event map

Makes the writer compile.

EnvelopeOrigin + schema + semantics

Must travel with the stored record.

ReaderRegistered interpreter

Validates before reconstruction.

Three consumers need three decisions.

Optional observationDeclare degradation

Core replay survives; named UI or search projections may omit decoration.

Required stateInterpreter required

Absence refuses the complete Session before partial reconstruction.

Foreign recordImport deliberately

Translate a versioned foreign schema into owned semantics.

Registration minimumType + owner + schema version + semantics + validator + projections.

A mutable string set cannot resolve collisions, migrations, uninstall, HMR disposal, payload validity, or cross-backend parity.

Choose storage by semantics.

Reconstruction requiredOfficial event or compatible runtime contract

Never mark state-changing records ignorable.

Purely informational todayPlugin-owned versioned store

Key audit and telemetry records by Session ID without making resume depend on them.

Test the boundary cold.

  1. WriteExercise one disposable Session.
  2. StopEnd the owning process cleanly.
  3. ResumeStart a fresh process with the plugin.
  4. RemoveRepeat without the plugin.
  5. UpgradeRepeat on the next supported Harness.

Recover without inventing semantics.

PreserveStop writer and copy/export evidence
→
RestoreUse a trusted compatible reader
→
ContinueStart fresh from a reviewed summary if needed
No generated-list patch

It is local, regenerated, and does not travel with the Session.

No loose-read default

Skipping a required event can produce convincing corruption.

No live-log surgery

Sequence and source references may depend on the record.

Prove the lifecycle, not one happy resume.

RegistrationBefore inspection

Complete before listing, resume, search reconciliation, fork, or write.

OwnershipOne type, one owner

Duplicate claims fail atomically with both package identities.

PersistenceJSONL = SQLite

Both backends enforce the same logical metadata and decision.

Quarantine is containment, not repair.

StopClose every writer and inventory artifacts
→
FreezeProve exact identity and SHA-256
→
MoveQuarantine one directory outside the scan root
→
VerifySearch works and coverage is explicitly partial

Primary evidence.

Keep the complete registration and compatibility runbook.

The canonical guide includes the proposed registration schema, lifecycle rules, write/read authority, compatibility matrix, storage choices, search isolation, and reversible containment.

Read and star on GitHub