feat: add durable transcript import

[NicholaiVogel]

Summary

Adds durable, resumable transcript import for Signet exports, with staged uploads, crash recovery, replay-safe canonical evidence, agent-scoped ownership, reconciliation, purge/audit retention, CLI support, and dashboard controls. Closes #1814.

Changes

• Add migrations 146–148 for transcript import jobs, replay file slots, and attempt provenance.
• Add daemon upload, inventory, worker, recovery, reconciliation, source purge, and DB-owner transaction paths.
• Add signet-export-v1 adaptation and replay/crash/lease/transaction regression coverage.
• Add CLI and dashboard import controls plus API and user documentation.
• Add the real-daemon acceptance eval with 48 bounded lifecycle, safety, recovery, and retention checks.

Type

• feat — new user-facing feature (bumps minor)
• fix — bug fix
• refactor — restructure without behavior change
• chore — build, deps, config, docs
• perf — performance improvement
• test — test coverage

Packages affected

• @signet/core
• @signet/daemon
• @signet/cli / dashboard
• @signet/sdk
• @signet/connector-*
• @signet/web
• predictor
• Other: web/docs

Screenshots

UI changes are included in the dashboard. The local rendered artifact is available at /mnt/work/hermes-scratch/1814-dashboard.png (SHA-256: dd0e5394828ffb3d86ff7c2c1ea624c0618f694f92dabbb51484291095338ef2), but authenticated GitHub-hosted attachment upload was unavailable in this workflow. GitHub-hosted attachment remains needed before merge; no fabricated URL is included.

PR Readiness (MANDATORY)

• Spec alignment validated (INDEX.md + dependencies.yaml)
• Agent scoping verified on all new/changed data queries
• Input/config validation and bounds checks added
• Error handling and fallback paths tested (no silent swallow)
• Security checks applied to admin/mutation endpoints
• Docs updated for API/spec/status changes
• Regression tests added for each bug fix
• Lint/typecheck/tests pass locally

Migration Notes (if applicable)

• Migration is idempotent
• Rollback / compatibility note included in PR description

Testing

• Version check: bun scripts/version-sync.ts --check — pass; all versions aligned at 0.214.45.
• Focused final regression suites: 136 pass, 0 fail across 11 files; event-loop fixture: 23 pass, 0 fail.
• Full build: bun run build — pass.
• Lint: bun run lint — exit 0; existing warnings only.
• Acceptance eval: bun run eval:transcript-import — pass, 48/48 checks.
• Root typecheck: fails on the unchanged baseline platform/daemon/src/inference-oauth.ts with one missing ProviderAuthInteraction export and three implicit-any errors. An isolated origin/main worktree, after a clean install and core build, reproduces the same baseline area plus clean-worktree generated-package resolution errors; the PR changes do not introduce these inference-oauth errors.
• Doc drift: bun scripts/doc-drift.ts remains non-zero on origin/main for pre-existing route/package-table drift; this branch additionally reports the newly documented transcript-import route/migration differences. No unrelated doc-drift cleanup was included.
• Adversarial review found three issues; all were fixed. A second review found a transaction precondition bug; it was fixed and the focused suites and 48/48 eval were rerun.

AI disclosure

• No AI tools were used in this PR
• AI tools were used (see Assisted-by disclosure below)

AI assistance was used for implementation support, test review, and verification. The author reviewed the complete diff and understands the shipped behavior. Assisted-by: Hermes Agent / GPT-5.6 Luna (native git and gh only); no Codex harness was used.

Notes

• Owner-boundary follow-up commit routes transcript DB work through dbOwnerTransaction; the rebased real-daemon eval passes 48/48 checks.

• Branch was rebased onto origin/main at 5069b5f67 after resolving DB-owner and event-loop ledger conflicts; all feature/fix commits were preserved.

• Final branch diff is 48 intended files; worktree is clean after the root build, with generated dist drift removed. This PR is intentionally a single vertical change for [Feature]: Resumable transcript JSONL import through Sources #1814.

• The root typecheck and doc-drift baseline failures are disclosed above rather than claimed as passing.

• Do not merge from this workflow.

Closes #1814

[NicholaiVogel]

Backlog triage, September 4, 2026.

Superseded by #1838, which explicitly carries the transcript-import feature plus lifecycle, recovery, filesystem, and platform-contract repairs. Keep #1838 and feature tracker #1814 open. Closing this older parallel PR without merging or deleting its branch.