@adhdev/daemon-core 0.9.82-rc.479 → 0.9.82-rc.480

package/dist/providers/native-history/dispatcher.d.ts

@@ -27,5 +27,18 @@ export interface NativeHistoryResult {
     sourcePath: string;
     sourceMtimeMs: number;
     nativeHistoryCoverage?: 'full' | 'partial' | 'best-effort';
+    /**
+     * True only when the resolved conversation is confirmed to belong to THIS
+     * reading session by the owner-token identity (an exact uuid bind, or a
+     * spawn-floor/birth-time pick born after this session started). False for a
+     * bare recency/newest-by-mtime pick made with no spawn floor — that pick may
+     * alias a co-located concurrent session (the antigravity coordinator↔replica
+     * crosswire), so its uuid must NEVER be recorded as a pin nor trusted to
+     * satisfy the same-pass safe-mapping identity check. Read-path callers gate
+     * the workspace-latest pin + first-read trust on this flag. Non-antigravity
+     * readers leave it undefined (their existing exact-file resolution is
+     * unaffected by this signal).
+     */
+    ownerConfirmed?: boolean;
 }
 export declare function createNativeHistoryDispatcher(reader: ReaderId): (input: NativeHistoryInput) => NativeHistoryResult | null;

package/dist/status/chat-tail-hot-sessions.d.ts

@@ -16,7 +16,47 @@ export declare function classifyHotChatSessionsForSubscriptionFlush(sessions: Ho
     recentMessageGraceMs?: number;
     activeStatuses?: ReadonlySet<string>;
     activeSessionIds?: ReadonlySet<string>;
+    /**
+     * Per-session `lastMessageAt` of the most recent completion tail that has
+     * already been flushed to subscribers. A completed-but-unseen session is
+     * kept hot for delivery REGARDLESS of the 8s recency timer, but only until
+     * its current tail has been delivered once — bounding the guaranteed
+     * delivery so a slow-finalizing turn is not re-pushed every tick forever.
+     * A newer `lastMessageAt` (fresh turn) re-arms delivery.
+     */
+    deliveredCompletionTailAt?: ReadonlyMap<string, number>;
+    /**
+     * (D8) PER-SUBSCRIPTION ACK gate — the authoritative guaranteed-delivery
+     * signal. Session ids for which at least one currently-subscribed ws has
+     * NOT yet been sent the session's finalized tail (its per-ws
+     * `lastDeliveredSignature` is empty / does not match the session's current
+     * tail). The daemon computes this from its live ws-subscription map; the
+     * classifier keeps every such session hot-for-delivery INDEPENDENT of the
+     * seen/unread badge, so a session whose unread badge cleared (or a fresh
+     * browser that re-subscribed after the single completion flush already
+     * fired) still gets its assistant-final tail delivered. Bounded because a
+     * subscriber's `lastDeliveredSignature` converges to the current tail the
+     * moment it is actually sent, dropping the session out of this set. When
+     * provided, this set is the guaranteed-delivery driver and the
+     * `deliveredCompletionTailAt` recency-watermark path is bypassed for these
+     * sessions (it stays only as the legacy opt-in for callers that don't pass
+     * a per-subscription set).
+     */
+    underDeliveredSessionIds?: ReadonlySet<string>;
 }): {
     active: Set<string>;
     finalizing: Set<string>;
+    guaranteedDelivery: Set<string>;
+};
+/**
+ * Detect sessions that just transitioned from an active/generating state into
+ * a settled/completed-but-unseen state, so their finalized completion tail can
+ * be flushed exactly once regardless of the recency window. Pure: the caller
+ * owns the `previousStatus` map and updates it from the returned `nextStatus`.
+ */
+export declare function detectNewlySettledCompletedSessions(sessions: HotChatSessionLike[], previousStatus: ReadonlyMap<string, string>, options?: {
+    activeStatuses?: ReadonlySet<string>;
+}): {
+    settled: Set<string>;
+    nextStatus: Map<string, string>;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.479",
+  "version": "0.9.82-rc.480",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.479",
-    "@adhdev/session-host-core": "0.9.82-rc.479",
+    "@adhdev/mesh-shared": "0.9.82-rc.480",
+    "@adhdev/session-host-core": "0.9.82-rc.480",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/cli-adapters/cli-state-engine.ts

@@ -458,6 +458,42 @@ export class CliStateEngine {
         this.idleFinishCandidate = null;
     }
 
+    /**
+     * Poll-driven static-idle confirm (D4). A hosted CLI session (e.g. a fresh
+     * antigravity coordinator) whose boot banner drove the FSM into 'generating'
+     * can then sit at a STATIC ready prompt emitting no further PTY output. Every
+     * output-driven busy→idle re-eval (handleOutput/resolveStartupState/settle)
+     * is starved because there is no new output, and the startup-settle loop has
+     * hard-stopped past spawnAt+10s — so currentStatus stays frozen at generating
+     * and the dashboard disables Send. This is the ONE path that can release that
+     * wedge from the read-only status poll.
+     *
+     * Safety: this must NEVER flip a real generating turn to idle. The gate is
+     * done by the caller (getStatus) reusing resolveStartupState's proven
+     * predicates: no recent PTY output for a grace window, runDetectStatus of the
+     * current screen === 'idle', and no active/parsed modal. Here we add the
+     * final structural guard: there must be NO active turn scope. A live user
+     * turn always carries a currentTurnScope (set in onTurnStarted), so this only
+     * releases the boot-banner wedge and the post-turn static-idle case, both of
+     * which have already had their scope nulled. Returns true when it transitioned.
+     */
+    confirmPollStaticIdle(reason: string): boolean {
+        if (this.currentStatus !== 'generating') return false;
+        if (this.currentTurnScope || this.activeModal) return false;
+        this.clearAllTimers();
+        this.clearIdleFinishCandidate(reason);
+        this.isWaitingForResponse = false;
+        this.responseSettleIgnoreUntil = 0;
+        this.submitRetryUsed = false;
+        this.submitRetryPromptSnippet = '';
+        this.finishRetryCount = 0;
+        this.currentTurnScope = null;
+        this.activeModal = null;
+        this.setStatus('idle', reason);
+        this.recordTrace('poll_static_idle_confirmed', { reason });
+        return true;
+    }
+
     hasActionableApproval(startupModal?: { message: string; buttons: string[] } | null): boolean {
         return !!(startupModal ?? this.activeModal);
     }

package/src/cli-adapters/provider-cli-adapter.ts

@@ -926,6 +926,46 @@ export class ProviderCliAdapter implements CliAdapter {
         const startupDetectedStatus = allowParse && this.startupParseGate && !startupModal
             ? this.runDetectStatus(this.recentOutputBuffer || this.terminalScreen.getText())
             : null;
+        // (D4) Poll-driven static-idle confirm. A hosted CLI session whose boot
+        // banner drove the FSM to 'generating' can then sit at a STATIC ready
+        // prompt emitting NO further PTY output — every output-driven busy→idle
+        // re-eval is starved and the startup-settle loop has hard-stopped past
+        // spawnAt+10s, so currentStatus stays frozen at generating and the
+        // dashboard disables Send. This read-path poll is the only place that can
+        // release the wedge. Gate PRECISELY (reuse resolveStartupState's proven
+        // predicates so a real generating turn is NEVER mis-flipped):
+        //   (a) no recent output for >= statusActivityHold (the 2000ms stable
+        //       window resolveStartupState uses),
+        //   (b) runDetectStatus(current screen) === 'idle' (same detector),
+        //   (c) no active/parsed modal — an approval/choice screen is never
+        //       flipped to idle.
+        // A real generating turn keeps producing output (fresh
+        // lastNonEmptyOutputAt) and/or shows 'esc to cancel' (detects busy) → it
+        // fails (a) or (b). confirmPollStaticIdle adds the final structural guard
+        // (currentStatus==='generating' AND no currentTurnScope/activeModal), so
+        // this only releases the boot-banner wedge and the post-turn static-idle
+        // case. Direct-spawn sessions already settle idle in the startup window
+        // → this is a no-op for them.
+        if (
+            allowParse
+            && this.engine.currentStatus === 'generating'
+            && !this.engine.currentTurnScope
+            && !this.engine.activeModal
+        ) {
+            const now = Date.now();
+            const quietForMs = this.lastNonEmptyOutputAt
+                ? (now - this.lastNonEmptyOutputAt)
+                : Number.MAX_SAFE_INTEGER;
+            if (quietForMs >= this.getStatusActivityHoldMs()) {
+                const screenText = this.terminalScreen.getText();
+                const pollDetect = this.runDetectStatus(screenText || this.recentOutputBuffer);
+                const pollModal = this.runParseApproval(screenText)
+                    || this.runParseApproval(this.recentOutputBuffer);
+                if (pollDetect === 'idle' && !pollModal) {
+                    this.engine.confirmPollStaticIdle('poll_static_idle');
+                }
+            }
+        }
         let effectiveStatus = this.projectEffectiveStatus(startupModal);
         let effectiveModal = startupModal || this.engine.activeModal;
         // (fix) When we have no captured modal yet, take one more live attempt

package/src/commands/chat-commands-read.ts

@@ -134,6 +134,17 @@ export function __resetProviderSessionPinsForTest(): void {
     try { clearPersistedProviderSessionPins(); } catch { /* best-effort */ }
 }
 
+/**
+ * Test-only: read the in-memory read-pin (the mesh-session → conversation-uuid
+ * bind recorded by recordBoundProviderSessionId and mirrored to state.json
+ * sessionProviderSessionPins). Lets the antigravity-coordinator-pin tests assert
+ * that an owner-confirmed workspace-latest read recorded the pin — and that a
+ * non-owner-confirmed read did NOT. Not part of the runtime contract.
+ */
+export function __getProviderSessionPinForTest(meshSessionId: string): string | undefined {
+    return getBoundProviderSessionIdPin(meshSessionId);
+}
+
 const warnedLegacyNativeAllowlistHits = new Set<string>();
 function warnLegacyNativeAllowlistHit(providerType: string): void {
     if (warnedLegacyNativeAllowlistHits.has(providerType)) return;
@@ -155,6 +166,35 @@ function getExplicitHistorySessionId(args: any): string | undefined {
 
     return undefined;
 }
+
+/**
+ * A native-history session id is a "runtime fallback" — the daemon's own
+ * ADHDev session id (targetSessionId) standing in for a real provider-native
+ * conversation uuid — when it exactly equals targetSessionId. For an
+ * antigravity coordinator (agy takes no --session-id, so its providerSessionId
+ * never surfaces to the web), getConversationHistorySessionId falls back to the
+ * ADHDev sessionId, and the browser then sends that runtime id back as
+ * args.historySessionId. That id is NOT the on-disk conversations/<uuid>.db
+ * name (e.g. targetSessionId 28c530af vs stamped conv uuid 07f6ed3e), so a
+ * native read keyed on it can never exact-bind — it fail-closes to pty-parser
+ * (user-echo only) AND bypasses the owner-confirmed pin/live-bind resolution
+ * (which only runs when historySessionId is empty). Detect it whether it
+ * arrived EXPLICITLY (args.historySessionId === targetSessionId, the browser's
+ * poisoned read) OR only via getHistorySessionId's internal fallback (empty
+ * args), and in both cases treat historySessionId as ABSENT so the owner-
+ * confirmed native resolution engages and returns [user, assistant, ...].
+ * A REAL, DISTINCT provider conv uuid (≠ targetSessionId) is never a runtime
+ * fallback and must still exact-bind as before.
+ */
+function isRuntimeFallbackHistorySessionId(
+    candidateHistorySessionId: string | undefined,
+    targetSessionId: string | undefined,
+): boolean {
+    const target = typeof targetSessionId === 'string' ? targetSessionId.trim() : '';
+    if (!target) return false;
+    const candidate = typeof candidateHistorySessionId === 'string' ? candidateHistorySessionId.trim() : '';
+    return candidate === target;
+}
 function getHistorySessionId(h: CommandHelpers, args: any): string | undefined {
     const explicit = getExplicitHistorySessionId(args);
     if (explicit) return explicit;
@@ -1612,15 +1652,34 @@ export async function handleChatHistory(h: CommandHelpers, args: any): Promise<C
             : typeof (h.currentSession as any)?.workspace === 'string'
                 ? (h.currentSession as any).workspace
                 : undefined;
+        // Same runtime-fallback poison guard as the subscribe / history-only
+        // paths: getHistorySessionId falls back to targetSessionId (the ADHDev
+        // id) for an agy coordinator, and the browser may also send that id back
+        // explicitly. Reading native history keyed on it can never exact-bind
+        // (it is not the on-disk conv uuid). Drop it here too so the pin /
+        // workspace-latest / owner-confirmed resolution engages instead of
+        // fail-closing to pty-parser. A real DISTINCT provider uuid is preserved.
+        const targetSidForHistory = typeof args?.targetSessionId === 'string' ? args.targetSessionId.trim() : '';
+        const explicitHistorySessionIdForHistory = getExplicitHistorySessionId(args);
+        const historySessionIdIsRuntimeFallback = Boolean(
+            targetSidForHistory
+            && isRuntimeFallbackHistorySessionId(historySessionId, targetSidForHistory)
+            && (!explicitHistorySessionIdForHistory
+                || isRuntimeFallbackHistorySessionId(explicitHistorySessionIdForHistory, targetSidForHistory)),
+        );
+        const pinnedProviderSessionIdForHistory = getBoundProviderSessionIdPin(args?.targetSessionId);
+        const effectiveHistorySessionId = historySessionIdIsRuntimeFallback
+            ? (pinnedProviderSessionIdForHistory || undefined)
+            : historySessionId;
         const exactNativeHistoryScope = Boolean(
             (typeof args?.targetSessionId === 'string' && args.targetSessionId.trim())
-            || (typeof args?.historySessionId === 'string' && args.historySessionId.trim())
+            || (typeof args?.historySessionId === 'string' && args.historySessionId.trim() && !historySessionIdIsRuntimeFallback)
             || (typeof args?.providerSessionId === 'string' && args.providerSessionId.trim())
         );
         const result = supportsCliNativeTranscript(agentStr, provider) && isNativeSourceCanonicalHistory(provider?.nativeHistory)
             ? readCliProviderNativeHistory(agentStr, {
                 canonicalHistory: provider?.nativeHistory,
-                historySessionId,
+                historySessionId: effectiveHistorySessionId,
                 workspace,
                 offset: offset || 0,
                 limit: limit || 30,
@@ -1630,7 +1689,8 @@ export async function handleChatHistory(h: CommandHelpers, args: any): Promise<C
                 sessionStartedAtMs: sessionStartedAtMsFromRegistry(h, args?.targetSessionId),
                 envOverrides: sessionSpawnEnvFromAdapter(h, args?.targetSessionId),
                 instanceId: effectiveReadSessionId(h, args?.targetSessionId) || undefined,
-                pinnedProviderSessionId: getBoundProviderSessionIdPin(args?.targetSessionId),
+                pinnedProviderSessionId: pinnedProviderSessionIdForHistory,
+                allowWorkspaceLatestFallback: !pinnedProviderSessionIdForHistory && historySessionIdIsRuntimeFallback,
             })
             : readProviderChatHistory(agentStr, {
                 canonicalHistory: provider?.nativeHistory,
@@ -1649,13 +1709,26 @@ export async function handleChatHistory(h: CommandHelpers, args: any): Promise<C
                 : [];
             const historyProviderSessionId = typeof (result as any)?.providerSessionId === 'string'
                 ? (result as any).providerSessionId
-                : readHistorySessionIdFromMessages(messages) || historySessionId;
-            if (typeof (result as any)?.providerSessionId === 'string' && (result as any).providerSessionId.trim()) {
-                recordBoundProviderSessionId(h, effectiveReadSessionId(h, args?.targetSessionId), (result as any).providerSessionId.trim());
+                : readHistorySessionIdFromMessages(messages) || effectiveHistorySessionId;
+            // Mirror of the subscribe path (see handleReadChat): an antigravity
+            // workspace-latest read still surfaces the on-disk uuid, but that uuid is
+            // only safe to persist / trust when it was OWNER-token-confirmed as this
+            // session's own — a bare recency pick could be a co-located replica's
+            // conversation. Gate the pin and the same-pass identity on ownerConfirmed.
+            const resolvedProviderSessionId = typeof (result as any)?.providerSessionId === 'string'
+                ? (result as any).providerSessionId.trim()
+                : '';
+            const resultLookupIsWorkspace = lookup === 'workspace';
+            const resultOwnerConfirmed = (result as any)?.ownerConfirmed === true;
+            const ownerConfirmedUuid = resultOwnerConfirmed && typeof historyProviderSessionId === 'string' && historyProviderSessionId.trim()
+                ? historyProviderSessionId.trim()
+                : '';
+            if (resolvedProviderSessionId && (!resultLookupIsWorkspace || resultOwnerConfirmed)) {
+                recordBoundProviderSessionId(h, effectiveReadSessionId(h, args?.targetSessionId), resolvedProviderSessionId);
             }
             const safeMapping = hasSafeNativeHistoryMapping({
-                historySessionId: lookup === 'workspace' ? undefined : historySessionId,
-                providerSessionId: lookup === 'workspace' ? undefined : historyProviderSessionId,
+                historySessionId: ownerConfirmedUuid || (lookup === 'workspace' ? undefined : effectiveHistorySessionId),
+                providerSessionId: ownerConfirmedUuid || (lookup === 'workspace' ? undefined : historyProviderSessionId),
                 workspace,
                 nativeMessages: messages,
             });
@@ -1861,10 +1934,18 @@ export async function handleReadChat(h: CommandHelpers, args: any): Promise<Comm
                 // id so readCliProviderNativeHistory's pin / workspace-latest paths can
                 // engage. Mirrors the handleChatHistory path's established handling.
                 const pinnedProviderSessionIdForRead = getBoundProviderSessionIdPin(targetSessionId);
+                // Runtime fallback whether the runtime id was reached via
+                // getHistorySessionId's internal fallback (empty args) OR the
+                // browser explicitly sent historySessionId === targetSessionId
+                // (the poisoned agy-coordinator read). Both must drop the
+                // runtime id so pin / live-bind resolution engages; only a real
+                // DISTINCT provider uuid stays as an exact-bind id.
+                const explicitHistorySessionIdForRead = getExplicitHistorySessionId(args);
                 const nativeReadSessionIdIsRuntimeFallback = Boolean(
                     targetSessionId
-                    && nativeHistoryReadSessionId === targetSessionId
-                    && !getExplicitHistorySessionId(args),
+                    && isRuntimeFallbackHistorySessionId(nativeHistoryReadSessionId, targetSessionId)
+                    && (!explicitHistorySessionIdForRead
+                        || isRuntimeFallbackHistorySessionId(explicitHistorySessionIdForRead, targetSessionId)),
                 );
                 const effectiveNativeReadSessionId = nativeReadSessionIdIsRuntimeFallback
                     ? (pinnedProviderSessionIdForRead || undefined)
@@ -1899,7 +1980,23 @@ export async function handleReadChat(h: CommandHelpers, args: any): Promise<Comm
                     const resolvedProviderSessionId = typeof nativeHistory?.providerSessionId === 'string'
                         ? nativeHistory.providerSessionId.trim()
                         : '';
-                    if (resolvedProviderSessionId) {
+                    // Pin gating for the antigravity workspace-latest branch: a
+                    // coordinator session has no pin (agy takes no --session-id) and
+                    // spawnedAtMs=0 after attach-restore, so the read resolves via the
+                    // workspace-latest fallback (lookup === 'workspace') rather than an
+                    // exact bind. The dispatcher STILL surfaces the on-disk conversation
+                    // uuid there — but that uuid is only safe to persist as a pin when it
+                    // was OWNER-token-confirmed (exact uuid bind, or a spawn-floor/birth
+                    // pick). A bare recency/newest-by-mtime pick (ownerConfirmed=false)
+                    // could be a co-located replica's conversation, so recording it would
+                    // hard-wire the coordinator↔replica crosswire permanently — never pin
+                    // that. Exact-bind / session-scoped reads (lookup === 'session') are
+                    // already owner-scoped by construction, so keep pinning them as before.
+                    const resolvedLookupIsWorkspace = (nativeHistory as any)?.lookup === 'workspace';
+                    const nativeOwnerConfirmed = (nativeHistory as any)?.ownerConfirmed === true;
+                    const mayPinResolvedProviderSessionId = resolvedProviderSessionId
+                        && (!resolvedLookupIsWorkspace || nativeOwnerConfirmed);
+                    if (mayPinResolvedProviderSessionId) {
                         recordBoundProviderSessionId(h, effectiveReadSessionId(h, targetSessionId), resolvedProviderSessionId);
                     }
                 } catch (error: any) {
@@ -1918,20 +2015,44 @@ export async function handleReadChat(h: CommandHelpers, args: any): Promise<Comm
                 ? nativeHistory.providerSessionId
                 : readHistorySessionIdFromMessages(nativeMessages) || nativeHistoryReadSessionId || historySessionId;
             let lookup = nativeHistory?.lookup === 'workspace' ? 'workspace' : 'session';
-            let nativeHistorySessionForMapping = adapter.cliType === 'antigravity-cli'
-                && historyProviderSessionId
-                && nativeHistoryReadSessionId
-                && historyProviderSessionId !== nativeHistoryReadSessionId
-                ? undefined
-                : nativeHistoryReadSessionId;
+            // Owner-confirmed uuid for THIS read (antigravity): the dispatcher
+            // resolved a conversation and confirmed it is this session's own via the
+            // owner token (exact uuid bind, or a spawn-floor/birth pick) — NOT a bare
+            // recency pick. When present it is the authoritative conversation
+            // identity for the same-pass safe-mapping check below, even on a
+            // workspace-latest (lookup === 'workspace') read where the coordinator
+            // has no pin. A coordinator session hits this path (agy takes no
+            // --session-id, spawnedAtMs=0 after attach-restore); without it the
+            // safe-mapping check saw undefined identity → workspace-overlap branch →
+            // the PTY snapshot has only the user echo → fail-closed → regress to
+            // pty-parser (user-echo only). Trusting the owner-confirmed uuid lets the
+            // assistant answer reach the dashboard on the FIRST read.
+            const ownerConfirmedUuid = adapter.cliType === 'antigravity-cli'
+                && (nativeHistory as any)?.ownerConfirmed === true
+                && typeof historyProviderSessionId === 'string'
+                && historyProviderSessionId.trim()
+                ? historyProviderSessionId.trim()
+                : '';
+            let nativeHistorySessionForMapping = ownerConfirmedUuid
+                ? ownerConfirmedUuid
+                : adapter.cliType === 'antigravity-cli'
+                    && historyProviderSessionId
+                    && nativeHistoryReadSessionId
+                    && historyProviderSessionId !== nativeHistoryReadSessionId
+                    ? undefined
+                    : nativeHistoryReadSessionId;
+            // For an owner-confirmed uuid, feed the uuid as the explicit session
+            // identity to the safe-mapping check even on a workspace-latest read so
+            // the session-branch identity test runs uuid-to-uuid (messages carry the
+            // uuid as historySessionId) and trusts the assistant in this same pass.
             let safeMapping = supportsNative && nativeHistory
                 ? hasSafeNativeHistoryMapping({
-                    historySessionId: lookup === 'workspace' ? undefined : nativeHistorySessionForMapping,
-                    providerSessionId: lookup === 'workspace' ? undefined : historyProviderSessionId || providerSessionId,
+                    historySessionId: ownerConfirmedUuid || (lookup === 'workspace' ? undefined : nativeHistorySessionForMapping),
+                    providerSessionId: ownerConfirmedUuid || (lookup === 'workspace' ? undefined : historyProviderSessionId || providerSessionId),
                     workspace,
                     nativeMessages,
                     ptyMessages: returnedMessages,
-                    requireWorkspaceContentOverlap: lookup === 'workspace' && !exactNativeHistoryScope,
+                    requireWorkspaceContentOverlap: lookup === 'workspace' && !exactNativeHistoryScope && !ownerConfirmedUuid,
                 })
                 : false;
             if (skipLiveNativeHistoryWithoutProviderSession && (!safeMapping || returnedMessages.length === 0)) {
@@ -2234,10 +2355,19 @@ export async function handleReadChat(h: CommandHelpers, args: any): Promise<Comm
             // explicit id was passed) and we hold a pin from an earlier bound
             // read, prefer the pin so the query hits the real session.
             const pinnedProviderSessionIdForHistory = getBoundProviderSessionIdPin(targetSid);
+            // Runtime fallback whether historySessionId reached targetSid via
+            // getHistorySessionId's internal fallback (empty args) OR the browser
+            // explicitly sent historySessionId === targetSid (the poisoned
+            // agy-coordinator subscription / D8 refreshAuthoritativeTail read).
+            // In both cases the runtime id is NOT a real provider conv uuid, so
+            // drop it and let pin / workspace-latest / owner-confirmed resolution
+            // run. A real DISTINCT provider uuid still exact-binds unchanged.
+            const explicitHistorySessionId = getExplicitHistorySessionId(args);
             const historySessionIdIsRuntimeFallback = Boolean(
                 targetSid
-                && historySessionId === targetSid
-                && !getExplicitHistorySessionId(args),
+                && isRuntimeFallbackHistorySessionId(historySessionId, targetSid)
+                && (!explicitHistorySessionId
+                    || isRuntimeFallbackHistorySessionId(explicitHistorySessionId, targetSid)),
             );
             // When this is the runtime fallback (not a real provider id): prefer
             // the pin if we have one, else drop the runtime id entirely so the
@@ -2282,24 +2412,58 @@ export async function handleReadChat(h: CommandHelpers, args: any): Promise<Comm
             const historyProviderSessionId = typeof (history as any)?.providerSessionId === 'string'
                 ? (history as any).providerSessionId
                 : readHistorySessionIdFromMessages(historyMessages) || effectiveHistorySessionIdForRead;
-            // Refresh the pin whenever this path resolves a real provider id.
-            if (typeof (history as any)?.providerSessionId === 'string' && (history as any).providerSessionId.trim()) {
+            // Antigravity coordinator root fix (history-only path — the post-turn
+            // read a coordinator actually hits: no live adapter, no pin, agy takes no
+            // --session-id so spawnedAtMs is 0 after attach-restore → the read resolves
+            // via the workspace-latest fallback, lookup === 'workspace'). The dispatcher
+            // STILL surfaces the on-disk conversation uuid there, and flags whether it
+            // was OWNER-token-confirmed as this session's own (an exact/birth pick) vs a
+            // bare recency pick that could be a co-located replica's conversation.
+            //   • Pin the uuid on a workspace-latest read ONLY when owner-confirmed —
+            //     recording a replica's uuid would hard-wire the coordinator↔replica
+            //     crosswire permanently. Exact/session-scoped reads pin as before.
+            //   • Feed the owner-confirmed uuid as the explicit identity to the
+            //     safe-mapping check even on a workspace-latest read so the identity
+            //     test runs uuid-to-uuid and trusts the assistant on this FIRST read
+            //     (else it saw undefined identity → workspace-overlap branch → the PTY
+            //     snapshot has only the user echo → fail-closed → regress to pty-parser).
+            const historyLookupIsWorkspace = lookup === 'workspace';
+            const historyOwnerConfirmed = agentStr === 'antigravity-cli' && (history as any)?.ownerConfirmed === true;
+            const historyOwnerConfirmedUuid = historyOwnerConfirmed
+                && typeof historyProviderSessionId === 'string' && historyProviderSessionId.trim()
+                ? historyProviderSessionId.trim()
+                : '';
+            // Refresh the pin whenever this path resolves a real provider id — but for
+            // a workspace-latest antigravity read, only when the uuid is owner-confirmed.
+            if (typeof (history as any)?.providerSessionId === 'string'
+                && (history as any).providerSessionId.trim()
+                && (!historyLookupIsWorkspace || !agentStr || agentStr !== 'antigravity-cli' || historyOwnerConfirmed)) {
                 recordBoundProviderSessionId(h, effectiveReadSessionId(h, targetSid), (history as any).providerSessionId.trim());
             }
             // Use the id we actually read with (pin / real provider id), NOT the
             // raw runtime-fallback historySessionId — otherwise the mapping guard
             // compares the stamped messages' real id against the runtime id and
             // fails closed, undoing the pin reuse.
-            const mappingSessionId = effectiveHistorySessionIdForRead;
-            const safeMapping = supportsNative
+            const mappingSessionId = historyOwnerConfirmedUuid || effectiveHistorySessionIdForRead;
+            // Fail closed for an antigravity workspace-latest read whose uuid was NOT
+            // owner-confirmed: it is a bare recency/newest-by-mtime pick that could be
+            // a co-located concurrent session's (replica's) conversation. Without an
+            // owner-token confirmation we cannot prove ownership, so refuse it rather
+            // than surface a sibling's transcript (the coordinator↔replica crosswire
+            // guard). This is the same fail-closed default the design study protects —
+            // only an owner-confirmed uuid escapes it above.
+            const antigravityWorkspaceLatestUnconfirmed = agentStr === 'antigravity-cli'
+                && historyLookupIsWorkspace
+                && !historyOwnerConfirmedUuid;
+            const safeMapping = supportsNative && !antigravityWorkspaceLatestUnconfirmed
                 ? hasSafeNativeHistoryMapping({
-                    historySessionId: lookup === 'workspace' ? undefined : mappingSessionId,
-                    providerSessionId: lookup === 'workspace' ? undefined : historyProviderSessionId,
+                    historySessionId: historyOwnerConfirmedUuid || (lookup === 'workspace' ? undefined : mappingSessionId),
+                    providerSessionId: historyOwnerConfirmedUuid || (lookup === 'workspace' ? undefined : historyProviderSessionId),
                     workspace,
                     nativeMessages: historyMessages,
                 })
                 : false;
-            const trustedExactNativeIdentity = lookup !== 'workspace'
+            const trustedExactNativeIdentity = (lookup !== 'workspace' || Boolean(historyOwnerConfirmedUuid))
                 && Boolean(mappingSessionId)
                 && Boolean(historyProviderSessionId)
                 && mappingSessionId === historyProviderSessionId;

package/src/commands/chat-commands.ts

@@ -11,7 +11,7 @@
 export { READ_CHAT_PROVIDER_EVAL_TIMEOUT_MS, buildSendInputSignature } from './chat-commands-shared.js';
 export { evaluateReadChatNodeWorkspaceScope } from './chat-commands-scope.js';
 export { sanitizeDebugBundleValue, handleGetChatDebugBundle } from './chat-commands-debug-bundle.js';
-export { handleChatHistory, handleReadChat, __resetProviderSessionPinsForTest } from './chat-commands-read.js';
+export { handleChatHistory, handleReadChat, __resetProviderSessionPinsForTest, __getProviderSessionPinForTest } from './chat-commands-read.js';
 export {
     handleSendChat,
     handleListChats,

package/src/commands/cli-manager.d.ts

@@ -49,6 +49,8 @@ export interface HostedCliRuntimeDescriptor {
     workspace: string;
     cliArgs?: string[];
     providerSessionId?: string;
+    managedBy?: string;
+    startedAtMs?: number;
 }
 export declare function supportsExplicitSessionResume(resume?: ProviderResumeCapability): boolean;
 export declare class DaemonCliManager {

package/src/commands/cli-manager.ts

@@ -233,6 +233,14 @@ export interface HostedCliRuntimeDescriptor {
     cliArgs?: string[];
     providerSessionId?: string;
     managedBy?: string;
+    /**
+     * Real spawn time (ms epoch) of the underlying session-host runtime — a PAST
+     * timestamp recorded when the runtime first started. Threaded through so an
+     * attach can restore the native-history session-floor to the runtime's actual
+     * birth instead of collapsing spawnedAtMs to 0. Undefined when unrecoverable
+     * (genuine post-restart-unknown), in which case the caller keeps the 0 fallback.
+     */
+    startedAtMs?: number;
 }
 
 type CliPresentationInstance = ProviderInstance & {
@@ -294,6 +302,33 @@ function hasCliArg(args: string[], flag: string): boolean {
     return args.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
 }
 
+/**
+ * Decide the session-registry spawnedAtMs (the native-history session-floor) for a
+ * newly registered CLI instance.
+ *
+ * - Fresh launch (attachExisting=false): now (nowMs). A real live spawn floor
+ *   isolates a fresh session's own store and holds prior-session leak protection.
+ * - Attach WITH a recoverable record startedAt (a PAST timestamp): that startedAt.
+ *   Restoring a hosted runtime (coordinator / MAGI replica / hermes / claude /
+ *   codex) after a daemon restart, the real spawn time is in the past. Using it
+ *   restores each session's per-session birth-floor so co-located antigravity
+ *   runtimes resolve their OWN conversation (ownerConfirmed) instead of the
+ *   floor-less newest-by-mtime path that let a replica claim the coordinator's conv.
+ * - Attach with NO recoverable startedAt: 0 — disables the floor for this session
+ *   (recent_window_ms still bounds the look-back). NEVER use nowMs here: nowMs is in
+ *   the FUTURE relative to existing transcripts and would push the floor past every
+ *   transcript file, losing them (the ANTIGRAVITY-FINAL-MESSAGE-TAIL-GAP regression).
+ */
+export function resolveHostedSpawnedAtMs(
+    attachExisting: boolean,
+    attachStartedAtMs: number | undefined,
+    nowMs: number,
+): number {
+    if (!attachExisting) return nowMs;
+    if (typeof attachStartedAtMs === 'number' && attachStartedAtMs > 0) return attachStartedAtMs;
+    return 0;
+}
+
 function hasConfigOverride(args: string[], key: string): boolean {
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
@@ -673,6 +708,13 @@ export class DaemonCliManager {
             providerSessionId?: string;
             launchMode?: CliLaunchMode;
             extraEnv?: Record<string, string>;
+            /**
+             * On an attach (attachExisting=true), the real spawn time (ms epoch) of the
+             * session-host runtime being restored — a PAST timestamp. Used to restore the
+             * native-history session-floor to the runtime's actual birth instead of 0.
+             * See the spawnedAtMs computation below. Ignored for fresh launches.
+             */
+            attachStartedAtMs?: number;
             onProviderSessionResolved?: (info: {
                 instanceId: string;
                 providerType: string;
@@ -734,15 +776,30 @@ export class DaemonCliManager {
                 workspace: resolvedDir,
                 // attachExisting === true means we're restoring an already-spawned
                 // hosted runtime after a daemon restart, not starting a fresh PTY.
-                // The real spawn time is in the past and we don't have it on the
-                // restored descriptor; pinning spawnedAtMs to Date.now() in that
-                // case would push the native-history session-floor cutoff past
-                // every existing transcript file, so the agy/hermes/claude reader
-                // would return null even though the transcript on disk is fresh.
-                // 0 disables the floor for this session — recent_window_ms in the
-                // spec still bounds how far back we look. Fresh launches still
-                // get a proper floor so prior-session leak protection holds.
-                spawnedAtMs: attachExisting ? 0 : Date.now(),
+                //
+                // NEVER use Date.now() for the attach case: the real spawn time is in
+                // the PAST, and pinning the floor to now would push the native-history
+                // session-floor cutoff past every existing transcript file, so the
+                // agy/hermes/claude reader would return null even though the transcript
+                // on disk is fresh (the ANTIGRAVITY-FINAL-MESSAGE-TAIL-GAP regression).
+                //
+                // But collapsing to 0 for EVERY attach is also wrong: with the mesh
+                // coordinator + MAGI replicas all running as hosted runtimes sharing one
+                // workspace and attached with attachExisting=true, spawnedAtMs=0 disables
+                // the per-session native-history birth-floor for all of them. Without a
+                // floor, resolveAntigravityPath takes the floor-less newest-by-mtime
+                // branch (ownerConfirmed:false) and a replica's read can claim the
+                // coordinator's OWN conversation, which then reads as claimedByOther —
+                // regressing the coordinator chat to the pty-parser (user-only) path.
+                //
+                // So when the session-host record's REAL startedAt (a PAST timestamp) is
+                // recoverable, use it: the floor lands at the runtime's actual birth, the
+                // transcript is still found, AND each session's floor isolates its own
+                // conversation. Fall back to 0 ONLY when startedAt is unrecoverable (the
+                // genuine post-restart-unknown case) — that preserves the tail-gap
+                // protection. Fresh launches still get Date.now() so prior-session leak
+                // protection holds.
+                spawnedAtMs: resolveHostedSpawnedAtMs(attachExisting, options?.attachStartedAtMs, Date.now()),
             });
         } catch (spawnErr: any) {
             LOG.error('CLI', `[${cliType}] Spawn failed: ${spawnErr?.message}`);
@@ -1241,6 +1298,12 @@ export class DaemonCliManager {
                     {
                         providerSessionId: sessionBinding.providerSessionId,
                         launchMode: 'manual',
+                        // Thread the runtime's REAL past spawn time so the attach restores
+                        // the per-session native-history birth-floor instead of collapsing
+                        // to spawnedAtMs:0 (which disabled the antigravity per-session floor
+                        // and let MAGI replicas claim the coordinator's own conversation).
+                        // Undefined → registerCliInstance keeps the 0 fallback.
+                        attachStartedAtMs: record.startedAtMs,
                     },
                 );
                 restoredBindings.add(bindingKey);