ArchivePaths

The record candidates for a session, in resolution order: the live vendor tree first when the cwd is known, then the kept copy. Each candidate names the paths a record would have under its root; the caller keeps the first whose main transcript exists. Rejects a non-accepted id before deriving any path.

The <id>.custody.json custody-borne facts beside a kept transcript, or a rejection when the id is not an accepted shape.

The file naming the installation whose records keptDir holds. The key is lossy, so a keeper reads this before it keeps anything there.

The directory the installation's records are kept in. Kept records are found by id alone: <id>.jsonl and the <id>/ tree sit here with the same relative layout the vendor project directory has, whatever cwd the session ran under.

Accepts an id only when it matches ValidIdPattern; otherwise rejects it with ArchiveError.InvalidSessionId so no path is derived from it. This is the single choke point every id-derived path must pass through.

The vendor project directory holding the cwd's session trees, resolved by encoding config.cwd; None when no cwd is known. A cwd containing - resolves to its own encoding; the decode direction is never used because it is ambiguous.

Accepted shape for vendor session and sub-agent ids — UUID- or agent-<hex>-shaped tokens. Validating an id against this before deriving any path keeps .., /, \, and absolute paths from ever reaching path construction, so no derived path can escape the project directory.