fix: preserve original session coordinates through capture selection

crates/session-store/src/capture.rs

@@ -237,6 +237,7 @@ pub struct SessionEntryEvidence {
     pub segment_id: String,
     pub entry_ref: SessionEntryRef,
     pub origin: SessionEntryProvenance,
+    /// Inclusive original-source positions in `segment_id`, not view/UI order.
     pub entry_range: [u64; 2],
     pub kind: ReferenceKind,
     pub tool_part: Option<ToolPart>,
@@ -259,6 +260,7 @@ pub struct SessionCapture {
     session_id: String,
     segment_id: String,
     capture_id: String,
+    view_entry_count: u64,
     entries: Arc<Vec<CapturedHistoryEntry>>,
     overview: Vec<OverviewItem>,
     index: Vec<ReferenceEntry>,
@@ -271,6 +273,7 @@ impl SessionCapture {
         snapshot: SessionSnapshot,
     ) -> Self {
         let segment_id = segment_id.into();
+        let view_entry_count = snapshot.entries.len() as u64;
         let entries = snapshot
             .entries
             .into_iter()
@@ -341,7 +344,7 @@ impl SessionCapture {
                 })
             })
             .collect();
-        Self::from_projected(session_id.into(), segment_id, entries)
+        Self::from_projected(session_id.into(), segment_id, view_entry_count, entries)
     }
 
     pub fn new(
@@ -350,6 +353,7 @@ impl SessionCapture {
         items: Vec<Item>,
     ) -> Self {
         let segment_id = segment_id.into();
+        let view_entry_count = items.len() as u64;
         let entries = items
             .into_iter()
             .enumerate()
@@ -371,15 +375,19 @@ impl SessionCapture {
                 })
             })
             .collect();
-        Self::from_projected(session_id.into(), segment_id, entries)
+        Self::from_projected(session_id.into(), segment_id, view_entry_count, entries)
     }
 
-    pub fn from_history_entries(
+    /// Project a complete Host-fixed history whose source positions start at zero.
+    /// Select a suffix with `select_order_range` on the resulting value instead
+    /// of passing a rebased history vector: annotations do not carry source positions.
+    pub fn from_complete_history(
         session_id: impl Into<String>,
         segment_id: impl Into<String>,
         entries: Vec<HistoryEntry<SessionHistoryMetadata>>,
     ) -> Self {
         let segment_id = segment_id.into();
+        let view_entry_count = entries.len() as u64;
         let entries = entries
             .into_iter()
             .enumerate()
@@ -432,14 +440,20 @@ impl SessionCapture {
                 })
             })
             .collect();
-        Self::from_projected(session_id.into(), segment_id, entries)
+        Self::from_projected(session_id.into(), segment_id, view_entry_count, entries)
     }
 
-    fn from_projected(session_id: String, segment_id: String, dtos: Vec<CaptureEntryDto>) -> Self {
+    fn from_projected(
+        session_id: String,
+        segment_id: String,
+        view_entry_count: u64,
+        dtos: Vec<CaptureEntryDto>,
+    ) -> Self {
         let dto = CaptureDto {
             version: CAPTURE_VERSION,
             session_id: session_id.clone(),
             segment_id: segment_id.clone(),
+            view_entry_count,
             entries: dtos,
         };
         let capture_id = dto.fingerprint();
@@ -589,6 +603,7 @@ impl SessionCapture {
             session_id,
             segment_id,
             capture_id,
+            view_entry_count,
             entries: Arc::new(entries),
             overview,
             index,
@@ -604,7 +619,8 @@ impl SessionCapture {
         &self.overview
     }
 
-    pub fn source_index_for_ref(&self, reference: &SessionEntryRef) -> Option<u64> {
+    /// Capture-local UI position, not the original source position used by evidence.
+    pub fn view_order_for_ref(&self, reference: &SessionEntryRef) -> Option<u64> {
         self.index
             .iter()
             .find(|entry| entry.id == *reference)
@@ -624,12 +640,12 @@ impl SessionCapture {
         let min_entry_index = options
             .from
             .as_ref()
-            .and_then(|reference| self.source_index_for_ref(reference))
+            .and_then(|reference| self.view_order_for_ref(reference))
             .unwrap_or_else(|| options.min_entry_index.unwrap_or(0));
         let max_entry_index = options
             .through
             .as_ref()
-            .and_then(|reference| self.source_index_for_ref(reference))
+            .and_then(|reference| self.view_order_for_ref(reference))
             .unwrap_or(u64::MAX);
         let mut skipped = 0usize;
         let mut hits = Vec::new();
@@ -787,24 +803,16 @@ impl SessionCapture {
         if entry.use_policy.is_some_and(|p| !p.memory_evidence) {
             return None;
         }
-        let item = &self
+        let captured = self
             .entries
             .iter()
-            .find(|captured| captured.dto.order == entry.entry_range[0])?
-            .item;
-        let excerpt = render_item(item, entry, ReadDetail::Compact, 2 * 1024);
+            .find(|captured| captured.dto.order == entry.entry_range[0])?;
+        let excerpt = render_item(&captured.item, entry, ReadDetail::Compact, 2 * 1024);
         Some(SessionEntryEvidence {
-            segment_id: self
-                .entries
-                .iter()
-                .find(|captured| captured.dto.order == entry.entry_range[0])?
-                .dto
-                .source
-                .segment_id
-                .clone(),
+            segment_id: captured.dto.source.segment_id.clone(),
             entry_ref: entry.id.clone(),
             origin: entry.origin.clone(),
-            entry_range: entry.entry_range,
+            entry_range: [captured.dto.source.entry_index; 2],
             kind: entry.kind,
             tool_part: entry.tool_part,
             label: entry.label.clone(),

crates/session-store/src/capture/body.rs

@@ -307,6 +307,8 @@ pub struct CaptureDto {
     pub version: u32,
     pub session_id: String,
     pub segment_id: String,
+    /// Extent of view order, including positions omitted by public projection.
+    pub view_entry_count: u64,
     pub entries: Vec<CaptureEntryDto>,
 }
 
@@ -409,6 +411,9 @@ impl CaptureDto {
             {
                 return Err(CaptureError::Invalid("entry identity"));
             }
+            if entry.order >= self.view_entry_count {
+                return Err(CaptureError::Invalid("entry outside view extent"));
+            }
             if previous.is_some_and(|order| order >= entry.order) {
                 return Err(CaptureError::Invalid("entry order"));
             }
@@ -598,6 +603,7 @@ impl SessionCapture {
             version: CAPTURE_VERSION,
             session_id: self.session_id.clone(),
             segment_id: self.segment_id.clone(),
+            view_entry_count: self.view_entry_count,
             entries: self.entries.iter().map(|e| e.dto.clone()).collect(),
         }
     }
@@ -607,6 +613,7 @@ impl SessionCapture {
         Ok(Self::from_projected(
             dto.session_id,
             dto.segment_id,
+            dto.view_entry_count,
             dto.entries,
         ))
     }
@@ -618,11 +625,48 @@ impl SessionCapture {
         Self::try_from_dto(CaptureDto::decode(bytes, limits)?, limits)
     }
 
+    /// Select fixed view positions. UI order is rebased, while every original
+    /// source identity/position, body, provenance and policy stays unchanged.
+    pub fn select_order_range(&self, range: std::ops::Range<u64>) -> Result<Self, CaptureError> {
+        if range.start > range.end || range.end > self.view_entry_count {
+            return Err(CaptureError::InvalidRange);
+        }
+        let entries = self
+            .entries()
+            .filter(|entry| range.contains(&entry.order))
+            .map(|entry| {
+                let mut entry = entry.clone();
+                entry.order -= range.start;
+                entry
+            })
+            .collect();
+        Ok(Self::from_projected(
+            self.session_id.clone(),
+            self.segment_id.clone(),
+            range.end - range.start,
+            entries,
+        ))
+    }
+
+    /// Host-owned target selection may exclude entries without renumbering either
+    /// the fixed view or its original sources. No source I/O or business policy is applied.
+    pub fn retain_entries(&self, mut include: impl FnMut(&CaptureEntryDto) -> bool) -> Self {
+        Self::from_projected(
+            self.session_id.clone(),
+            self.segment_id.clone(),
+            self.view_entry_count,
+            self.entries()
+                .filter(|entry| include(entry))
+                .cloned()
+                .collect(),
+        )
+    }
+
     pub fn scoped_ref(
         &self,
         reference: &SessionEntryRef,
     ) -> Result<ScopedSessionEntryRef, CaptureError> {
-        if self.source_index_for_ref(reference).is_none() {
+        if self.view_order_for_ref(reference).is_none() {
             return Err(CaptureError::UnknownReference);
         }
         Ok(ScopedSessionEntryRef {
@@ -679,7 +723,7 @@ impl SessionCapture {
             .from
             .as_ref()
             .map(|r| {
-                self.source_index_for_ref(r)
+                self.view_order_for_ref(r)
                     .ok_or(CaptureError::UnknownReference)
             })
             .transpose()?;
@@ -687,7 +731,7 @@ impl SessionCapture {
             .through
             .as_ref()
             .map(|r| {
-                self.source_index_for_ref(r)
+                self.view_order_for_ref(r)
                     .ok_or(CaptureError::UnknownReference)
             })
             .transpose()?;
@@ -710,7 +754,7 @@ impl SessionCapture {
         match selector {
             ReadSelector::Id(id) => {
                 let reference = SessionEntryRef::parse(id).ok_or(CaptureError::UnknownReference)?;
-                self.source_index_for_ref(&reference)
+                self.view_order_for_ref(&reference)
                     .ok_or(CaptureError::UnknownReference)?;
             }
             ReadSelector::EntryRange([start, end]) => {

crates/session-store/tests/capture_contract.rs

@@ -77,7 +77,7 @@ fn public_consumer_roundtrip_retains_body_original_source_order_origin_and_indep
             Some(HistoryInputMetadata::new(usage(false, false, true), None, None).unwrap()),
         ),
     ];
-    let capture = SessionCapture::from_history_entries("synthetic-session", "selected", entries);
+    let capture = SessionCapture::from_complete_history("synthetic-session", "selected", entries);
     let mut dto = capture.to_dto();
     // The checked boundary also accepts entries retained from different original segments.
     dto.entries[0].source.segment_id = "original-a".into();
@@ -115,6 +115,7 @@ fn public_consumer_roundtrip_retains_body_original_source_order_origin_and_indep
     assert!(restored.evidence_for("Erecording").is_none());
     let evidence = restored.evidence_for("Ememory").unwrap();
     assert_eq!(evidence.segment_id, "original-b");
+    assert_eq!(evidence.entry_range, [3, 3]);
     assert!(evidence.excerpt.contains("memory-only"));
     let recorded = restored
         .slice(CapturePurpose::Recording, None, 10, 16_000)
@@ -159,7 +160,7 @@ fn common_data_drops_reasoning_raw_system_and_private_payload_even_when_unindexe
         HistoryInputMetadata::new(usage(true, true, true), Some(payload.clone()), Some(public))
             .unwrap();
     let private = HistoryInputMetadata::new(usage(true, true, true), Some(payload), None).unwrap();
-    let capture = SessionCapture::from_history_entries(
+    let capture = SessionCapture::from_complete_history(
         "s",
         "segment",
         vec![
@@ -195,7 +196,7 @@ fn common_data_drops_reasoning_raw_system_and_private_payload_even_when_unindexe
     // Filtered entries do not renumber the public source positions.
     assert_eq!(capture.to_dto().entries[0].order, 3);
     assert_eq!(
-        capture.source_index_for_ref(&SessionEntryRef::parse("Eordinary").unwrap()),
+        capture.view_order_for_ref(&SessionEntryRef::parse("Eordinary").unwrap()),
         Some(4)
     );
 }
@@ -318,6 +319,7 @@ fn malformed_dtos_and_oversized_representations_are_rejected() {
             .is_err()
     );
     let mut reversed = capture.to_dto();
+    reversed.view_entry_count = 2;
     let mut second = reversed.entries[0].clone();
     second.entry_id = "second".into();
     second.source.entry_index = 4;
@@ -325,6 +327,16 @@ fn malformed_dtos_and_oversized_representations_are_rejected() {
     reversed.entries[0].order = 1;
     reversed.entries.push(second);
     assert!(SessionCapture::try_from_dto(reversed, CaptureLimits::default()).is_err());
+    let mut duplicate_source = capture.to_dto();
+    duplicate_source.view_entry_count = 2;
+    let mut second = duplicate_source.entries[0].clone();
+    second.entry_id = "distinct-id".into();
+    second.order = 1;
+    duplicate_source.entries.push(second);
+    assert!(matches!(
+        SessionCapture::try_from_dto(duplicate_source, CaptureLimits::default()),
+        Err(CaptureError::Invalid("duplicate source position"))
+    ));
 }
 
 #[test]
@@ -503,7 +515,7 @@ fn snapshot_immutability_and_scoped_operations_reject_foreign_or_unknown_refs_an
         2
     );
     let unknown = SessionEntryRef::parse("E99999999").unwrap();
-    assert_eq!(capture.source_index_for_ref(&unknown), None);
+    assert_eq!(capture.view_order_for_ref(&unknown), None);
     assert!(matches!(
         capture.scoped_ref(&unknown),
         Err(CaptureError::UnknownReference)
@@ -592,3 +604,108 @@ fn slices_preserve_empty_and_long_result_fields_under_item_and_metadata_budgets(
         Err(CaptureError::BudgetTooSmall)
     ));
 }
+
+#[test]
+fn evidence_uses_original_segment_positions_after_roundtrip_and_view_selection() {
+    let full = SessionCapture::new(
+        "s",
+        "selected",
+        vec![
+            Item::user_message("first"),
+            Item::assistant_message("second"),
+        ],
+    );
+    let mut dto = full.to_dto();
+    dto.entries[0].source.segment_id = "original-a".into();
+    dto.entries[0].source.entry_index = 80;
+    dto.entries[1].source.segment_id = "original-b".into();
+    dto.entries[1].source.entry_index = 3;
+    let encoded = dto.encode(CaptureLimits::default()).unwrap();
+    let restored = SessionCapture::decode(&encoded, CaptureLimits::default()).unwrap();
+    for (id, segment, index, order) in [
+        ("E00000000", "original-a", 80, 0),
+        ("E00000001", "original-b", 3, 1),
+    ] {
+        let evidence = restored.evidence_for(id).unwrap();
+        assert_eq!(evidence.segment_id, segment);
+        assert_eq!(evidence.entry_range, [index; 2]);
+        let read = restored.read(ReadSelector::Id(id), ReadOptions::default());
+        assert_eq!(read.entries[0].entry_range, [order; 2]);
+    }
+    let selected = restored.select_order_range(1..2).unwrap();
+    assert_eq!(selected.overview()[0].entry_range, [0, 0]);
+    let evidence = selected.evidence_for("E00000001").unwrap();
+    assert_eq!(evidence.segment_id, "original-b");
+    assert_eq!(evidence.entry_range, [3, 3]);
+    let roundtrip = SessionCapture::decode(
+        &selected.encode(CaptureLimits::default()).unwrap(),
+        CaptureLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(roundtrip.to_dto(), selected.to_dto());
+    assert_eq!(
+        roundtrip.evidence_for("E00000001").unwrap().entry_range,
+        [3, 3]
+    );
+}
+
+#[test]
+fn fixed_history_selection_preserves_original_coordinates_and_checks_private_position_bounds() {
+    let history = vec![
+        history("old", Item::user_message("old"), None),
+        history("hidden", Item::reasoning("PRIVATE"), None),
+        history("selected", Item::user_message("selected"), None),
+        history("private-tail", Item::system_message("PRIVATE"), None),
+    ];
+    let full = SessionCapture::from_complete_history("s", "seg", history);
+    let suffix = full.select_order_range(1..4).unwrap();
+    let original = full
+        .entries()
+        .find(|entry| entry.entry_id == "selected")
+        .unwrap();
+    let selected = suffix.entries().next().unwrap();
+    assert_eq!(selected.entry_id, original.entry_id);
+    assert_eq!(selected.source, original.source);
+    assert_eq!(selected.body, original.body);
+    assert_eq!(selected.policy, original.policy);
+    assert!(suffix.evidence_for("Eold").is_none());
+    assert_eq!(suffix.search(&SearchOptions::default()).len(), 1);
+    assert_eq!(
+        suffix.view_order_for_ref(&SessionEntryRef::parse("Eselected").unwrap()),
+        Some(1)
+    );
+    assert_eq!(selected.source.entry_index, 2);
+    assert_eq!(selected.order, 1);
+    assert_eq!(suffix.to_dto().view_entry_count, 3);
+    assert_eq!(
+        suffix.evidence_for("Eselected").unwrap().entry_range,
+        [2, 2]
+    );
+    let nested = suffix.select_order_range(1..2).unwrap();
+    assert_eq!(nested.entries().next().unwrap().order, 0);
+    assert_eq!(nested.entries().next().unwrap().source, original.source);
+    let restored = SessionCapture::decode(
+        &suffix.encode(CaptureLimits::default()).unwrap(),
+        CaptureLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(restored.to_dto(), suffix.to_dto());
+    assert!(full.select_order_range(4..5).is_err());
+    let reversed = std::ops::Range { start: 3, end: 2 };
+    assert!(full.select_order_range(reversed).is_err());
+    let hidden_only = full.select_order_range(3..4).unwrap();
+    assert_eq!(hidden_only.entries().len(), 0);
+    assert_eq!(hidden_only.to_dto().view_entry_count, 1);
+    let mut invalid = full.to_dto();
+    invalid.view_entry_count = 2; // the selected entry's view order is outside this extent
+    assert!(SessionCapture::try_from_dto(invalid, CaptureLimits::default()).is_err());
+    assert_eq!(
+        full.retain_entries(|entry| entry.entry_id == "selected")
+            .entries()
+            .next()
+            .unwrap()
+            .source,
+        original.source
+    );
+    assert_eq!(full.to_dto().view_entry_count, 4);
+}