[davidrobertson]

Why

Malformed replace imports can delete existing records before validation fails. Capture redaction can leave secrets in the local spool, and shared prompt IDs can collapse distinct hook events. Adapt the independent upstream fixes while retaining the fork's runtime and storage behavior.

What changed

• Validate import sections, row keys, and access-log limits before any writes.
• Scrub structured capture values and property names without losing JSON structure or colliding fields. Preserve ordinary identifiers that contain key-like substrings.
• Derive hook event IDs from agent, task, notification, and stop-hook identity while preserving retry deduplication. Regenerate plugin scripts and required documentation counts.

Scope

• Ports upstream import preflight, structured redaction, identifier boundaries, and hook identities.
• Keeps the current runtime, graph model, capture retries, hook environment loading, and package version.
• Defers the iii 0.25 migration and broader retrieval, recovery, and integration work. The upstream comparison records the recommendation and follow-up scope.

Blast Radius

Imports now reject malformed optional sections and keyed rows under every strategy. Secret-like property names receive redacted, collision-safe names. Fresh hook events use corrected identities. Existing spool records keep their stored IDs.

Verification

• Independent regressions on the unchanged fork produced 125 failing tests. The final full suite passed 2,834 tests with four existing skips. Build, skill generation, documentation sync, skill checks, and documentation checks passed.
• Independent QA passed 201 focused tests and executed the generated plugin against an isolated HTTP 503 server. The actual pending JSONL preserved structure and contained neither the fake secret nor private text. Existing hook and CLI 404 retry checks passed.
• tsc --noEmit still fails with byte-identical baseline diagnostics. No local release gate, runtime migration, production deployment, or persistent-store upgrade was performed.