[philcunliffe]

Merge and deployment order

1. hypaware-server #1611: merge and deploy the summary consumer first.
2. hypscope #452: merge and deploy the session-list consumer after the server.
3. hypaware #2817: merge and release the collectors last, after both consumers are deployed.

Keep the collector release behind both consumer deployments: older consumers would count the new session_metadata parts as conversation content.

Native generated names and user renames are currently absent from recorded sessions. Capture them in attributes.session for Claude Code/Desktop, local Codex CLI/Desktop, OpenCode, and Codex cloud/ChatGPT Work. Title revisions use deduplicated metadata parts so a late title or idle rename can update session lists without rewriting or duplicating conversation content.

Codex reads both its name index and read-only native SQLite threads.name: some Desktop-generated names exist only in the database. Metadata parts do not carry system prompts/tools/model context or become conversation predecessors. Reads and retained indexes are bounded, with no per-message filesystem lookup or new runtime dependency.

Backfill also recovers existing native names, subject to the existing provider/import window and recording controls. This does not enable disabled history imports or widen automatic import bounds. Companion server PR #1611 and dashboard PR #452 consume the metadata in daily summaries and session links; deploy consumers before producers.

Validation: full client suite passed (8,972 passed, 7 skipped), typecheck passed, focused title/projector/writer regressions passed, and npm run smoke -- backfill_claude_fixture plus npm run smoke -- backfill_codex_fixture passed through durable cache writes and SQL, including late generation and rename-back.

CPU and memory review: bounded metadata inputs/maps, unchanged-rollout skips include native name revisions, title text is stored once per metadata update, and no additional unbounded growth was found.

Related: HYP-107. Follow-ups: HYP-289: Pi names, HYP-290: OpenClaw names. LLP 0556 documents the wire contract and collector audit.

Additional local validation (2026-10-23): replayed 212 projected rows from one existing native Claude session (2026-08-07) and one native Codex session (2026-10-19) into an isolated local server and dashboard. Verified both original names, idle renames, and rename-back in the browser after reloading. The actual raw and summary list queries agreed at all three revisions; message/part/model counts and activity times stayed unchanged. Unchanged-source scans emitted zero rows. Native sources stayed read-only; rename tests used temporary copies. Benign history anchors allowed the sparse test dataset to page back to the older Claude sample.

[HypForge]

R2 at 2893e044e8a15a466c764bf33b38b090fe5a3d41: CLEAN / MEDIUM. R1 F1 P2 is closed: Codex title reads bound main plus WAL bytes and check logical size on the same read snapshot as the SELECT. The original oversized-WAL probe now refuses. Independent races confirm growth after stat is refused and a commit after the snapshot check is excluded until the next read. UX S1 is fixed: current titles carry onto each new content day, with same-day replay deduplicated. No open findings.

Checks: full client suite 8,979 pass / 0 fail / 3 skipped, title tests 8/8, typecheck, both backfill fixture smokes, independent privacy/window/entry-budget controls, snapshot race probes, LLP-number and diff/style checks passed. R1 evidence carries for unchanged paths. CPU/memory: metadata checks remain per scan, with bounded logical reads and output; the day hash adds constant work per title update. Bounded result materialization still costs memory, and the byte cap is not a wall-clock deadline. No new CPU/memory concern found.

Server-suite gate: not triggered. No CLI command, product telemetry contract, MCP codec/schema or kernel-type change. Wire-contract cross-check remains valid: session_metadata, attributes.session.title / title_updated_at, and summary title / title_updated_at; the delta changes only title-part identity input. No server-suite result is claimed.

MEDIUM reflects the collector and durable metadata path. Release order remains server #1611 live, then hypscope #452 published, then collector enqueue after release confirmation. This review does not verify those deployment prerequisites.

Finding dispositions (FLOW.md):

• F1 P2 (reviewer R1, SQLite WAL admission): fixed in 2893e04. readCodexTitleDatabase bounds main plus -wal bytes, then checks page_count * page_size and runs the SELECT inside one read transaction. WAL regression test added.
• S1 (UX review ux-452-r1, title only on its first content day): fixed in 2893e04. The metadata part identity includes the UTC content day, so a continuing session re-carries its name on each new day; same-day replay still dedups through the session-scoped projector state. Regression test added.

Wire-contract cross-check at final heads: the client writes a session_metadata part with attributes.session.title and attributes.session.title_updated_at (ISO) in src/core/backfill/session_title.js (2893e04). hypaware-server src/combine/session-summaries.js at c2951fa3 (live, #1611) reads both with JSON_EXTRACT where part_type = 'session_metadata' (lines 305-306) and keeps the newest by update time. hypscope src/queries/sessions.ts at 1202f9a2 (published, #452) excludes the part from part/message/model counts (215-218) and from the transcript (537), and picks the title by max_by(..., title_updated_at) (225-227, 308-309). All three agree.

Release ordering met: server #1611 live on c2951fa3, hypscope #452 published (Publish run 40013401476). Enqueueing after this comment.

🤖 Generated with Claude Code