[fitchmultz]

Closes #303.

Change

Reuse a successful native journal structural scan for an unchanged SessionManager generation and parse only complete appended JSONL suffix lines. Read every selected browser result from the current file; validate entry/tool-call/session/snapshot identity before exposing refs. No result body/ref-map cache and no native-producer changes.

Detect native header-generation reseeding. Fall back to the existing safe scanner/host path for rotation, truncation, metadata changes, incomplete records, invalid headers and real file/publication errors. Keep the actual native append-only contract rather than introducing a revision framework or making adversarial forged-metadata outside edits a permanent gate.

The implementation retains structural metadata per live manager, bounded by journal record count. This is explicit in session-storage docs; cold scanning already has the same peak structure.

Also fix the required verification facade silently skipping three script entrypoints through macOS /var symlinks/encoded paths: use Node's native import.meta.main. The existing 19-case CLI-path suite was RED before the supporting fix and GREEN after it; no assertions changed.

Verification

• Cheap actual native-SDK regression was RED before / GREEN after: 9/9 on locked SDK and independently installed official 1.4.0. Controlled upstream CLI proves zero wrong/stale-ref click dispatch, one fresh-ref dispatch, native generation reseed, cold/unchanged/append, same-leaf snapshots and current selected-body reads. These fixture receipts are not real Chrome evidence.
• Final npm run quality: PASS. 1,577 passing tests, 58 existing opt-in/platform skips, zero failures; corrected-checker lint/policy/origin, format, compiler, build and live generated-doc/command-reference checks pass. No new suppression or weakened fixture, timeout or check.
• node ./scripts/verify-package.mjs: PASS, 53 package paths.
• Required unchanged >1 GiB journal proof: PASS. 1,614,664,908-byte source / 1,081,015,580-byte output; 4,226 entries; three branches; 4,001 session views; 34,683 refs; both locators. Reported V8 heap limit 335,544,320 bytes and peak RSS 444,576 KiB are separate metrics. Earlier external-tool deadline expiry is retained; no test timeout changed.
• Exact-head CI: quality + all five real mutation rejection controls, official Pi 1.4.0, independently resolved maintained fork main ed4e110b431149a3d037c3b8d418f4fe7878d3ab (1.4.0), Native lifecycle Linux, macOS package and official Windows best-effort smoke all PASS. Exact SDK/bundled-CLI hashes retained. Latest fork producer source directly inspected; stable native header identity and append/rewrite promises remain.
• Normal native Linux CI produced 11 actual lifecycle/browser receipts. This is distinct from the local controlled CLI fixture. Deeper optional Windows/native jobs remain skipped, not presented as passes. An additional local interactive Pi/model smoke was not run under the owner's explicit ban on a new real model/provider campaign.
• Cursor and Pi Durable reviews PASS on 4eebef8; Pi Durable reports no new findings. No review threads remain.

Unrealistic and not patched: stealth out-of-contract old-prefix mutations with forged unchanged metadata or rewriting behind a live native manager without native reseeding. Ordinary native invalidation/file failures remain covered.