@agent-native/core 0.213.1 → 0.216.0

package/dist/server/agent-chat-plugin.js

@@ -33,7 +33,7 @@ import { attachToolSearch } from "../agent/tool-search.js";
 import { getAppConfig } from "../app-config/index.js";
 import { readAppStateForCurrentTab } from "../application-state/script-helpers.js";
 import { runChatThreadDataMigrations } from "../chat-threads/migrations.js";
-import { InlineAttachmentDataNotPersistableError, QueuedSubmissionAdmissionError, adoptThreadScopeIfUnscoped, blockQueuedSubmissionReceipt, clearQueuedSubmissionInterruptRun, createThread, forkThread, getThread, getQueuedSubmissionReceipt, listQueuedSubmissionReceipts, markQueuedSubmissionSubmitted, queuedSubmissionBehaviorMatches, recordQueuedSubmissionInterruptRun, renewQueuedSubmissionInterruptClaim, registerChatThreadsShareable, retryQueuedSubmissionReceipt, resolveRunThreadScope, resolveThreadAccess, listThreads, searchThreads, renameThread, createThreadShareLink, getThreadByShareToken, getThreadShareState, revokeThreadShareLink, setThreadArchived, setThreadPinned, setThreadScope, updateThreadData, withThreadDataLock, deleteThread, mutateThreadQueuedMessages, setThreadSourceIfMissing, isAppOwnedChatScope, isChatThreadOwnership, threadScopeMismatch, } from "../chat-threads/store.js";
+import { InlineAttachmentDataNotPersistableError, QueuedSubmissionAdmissionError, adoptThreadScopeIfUnscoped, blockQueuedSubmissionReceipt, clearQueuedSubmissionInterruptRun, createThread, forkThread, getThread, getQueuedSubmissionReceipt, getQueuedSubmissionReceiptStatus, listQueuedSubmissionReceipts, markQueuedSubmissionSubmitted, queuedSubmissionBehaviorMatches, recordQueuedSubmissionInterruptRun, renewQueuedSubmissionInterruptClaim, registerChatThreadsShareable, retryQueuedSubmissionReceipt, resolveRunThreadScope, resolveThreadAccess, resolveThreadAccessScope, listThreads, searchThreads, renameThread, createThreadShareLink, getThreadByShareToken, getThreadShareState, revokeThreadShareLink, setThreadArchived, setThreadPinned, setThreadScope, updateThreadData, withThreadDataLock, deleteThread, mutateThreadQueuedMessages, setThreadSourceIfMissing, isAppOwnedChatScope, isChatThreadOwnership, threadScopeMismatch, } from "../chat-threads/store.js";
 import { isCheckpointRestorePath } from "../checkpoints/route-match.js";
 import { createDbAdminAgentTools } from "../db-admin/agent-tools.js";
 import { isTransientDatabaseError } from "../db/client.js";
@@ -78,10 +78,12 @@ import { loadHostedHarnessConfig } from "./hosted-harness-policy.js";
 import { startIntervalJob } from "./interval-job.js";
 import { isDirectLoopbackRequest } from "./loopback.js";
 import { getModelFamilyOverlay } from "./prompts/index.js";
+import { scheduleQueuedSubmissionInboxDrain } from "./queued-submission-inbox-drain.js";
 import { mountRealtimeVoiceRoutes } from "./realtime-voice.js";
 import { runWithRequestContext, getRequestContext, getRequestOrgId, getRequestUserEmail, getRequestRunContext, ensureRequestRunContext, } from "./request-context.js";
 import { getForwardedRequestOrigin } from "./request-origin.js";
 export { handleSharedThreadRequest };
+const MAX_QUEUED_SUBMISSION_RETRIES = 5;
 export function trackAgentChatRunLifecycle(event, threadId, attemptId, userId, properties = {}, appId, trackingSource) {
     if (!threadId?.trim() ||
         !attemptId?.trim() ||
@@ -298,6 +300,33 @@ export async function runPreAgentTurnAutosave(callback, scope, run) {
     }
 }
 export { foldAgentChatRunCompletion };
+export function assertAgentChatRunProjectionUpdated(updated, threadId, runId) {
+    if (!updated) {
+        throw new Error(`Agent chat thread ${threadId} could not save the projection for run ${runId}.`);
+    }
+}
+export async function runAgentChatRunCompletionHooksAfterProjection(persistProjection, runCompletionHooks) {
+    let projectionFailed = false;
+    let projectionError;
+    try {
+        await persistProjection();
+    }
+    catch (error) {
+        projectionFailed = true;
+        projectionError = error;
+    }
+    try {
+        await runCompletionHooks();
+    }
+    catch (error) {
+        if (projectionFailed) {
+            throw new AggregateError([projectionError, error], "Agent chat projection and completion hooks failed.");
+        }
+        throw error;
+    }
+    if (projectionFailed)
+        throw projectionError;
+}
 /**
  * The model this mount runs with, when the caller does not pass one per request.
  *
@@ -429,6 +458,7 @@ export async function runA2AAgentLoopWithRunManager(runOptions, pluginOptions, t
             : undefined;
         if (reasonCode === "stale_execution_fence" ||
             reasonCode === A2A_TASK_CLAIM_LOST_ERROR_CODE) {
+            run.abortReason = "execution_lease_lost";
             run.abort.abort("execution_lease_lost");
             return;
         }
@@ -2925,7 +2955,7 @@ export function createAgentChatPlugin(options) {
                 // the frontend-triggered saves below). Without the lock, a concurrent
                 // queued-message save can clobber the assistant message we just
                 // appended here, or vice versa.
-                await withThreadDataLock(threadId, async () => {
+                await runAgentChatRunCompletionHooksAfterProjection(() => withThreadDataLock(threadId, async () => {
                     const thread = await getThread(threadId);
                     if (!thread) {
                         throw new Error(`Agent chat thread ${threadId} was not found while saving run ${run.runId}.`);
@@ -2949,14 +2979,25 @@ export function createAgentChatPlugin(options) {
                     };
                     repo = appendThreadDebugHistory(repo, debug);
                     const meta = extractThreadMeta(repo);
-                    await updateThreadData(threadId, JSON.stringify(repo), thread.title, meta.preview || thread.preview, repo.messages.length, { trustedRunSequenceResetIds: new Set([run.runId]) });
+                    const projectionUpdated = await updateThreadData(threadId, JSON.stringify(repo), thread.title, meta.preview || thread.preview, repo.messages.length, { trustedRunSequenceResetIds: new Set([run.runId]) });
+                    assertAgentChatRunProjectionUpdated(projectionUpdated, threadId, run.runId);
+                }), async () => {
+                    // Checkpoint creation is part of durable turn completion. The helper
+                    // catches and reports its own failures, so a broken app checkpoint does
+                    // not strand the run while a successful checkpoint cannot be lost when
+                    // a serverless invocation exits.
+                    await runPostAgentTurnAutosave(options?.onAgentTurnComplete, chatScope, run);
+                    await runPostAgentRunComplete(options?.onAgentRunComplete, chatScope, run, { turnContinues: endsAtContinuationBoundary(run) });
+                });
+                scheduleQueuedSubmissionInboxDrain({
+                    threadId: runThreadId,
+                    turnContinues: endsAtContinuationBoundary(run),
+                    waitUntil: getRequestRunContext()?.waitUntil,
+                    drain: drainQueuedSubmissionInbox,
+                    onError: (error) => {
+                        console.error(`[agent-chat] queued-submission follow-up drain failed for ${runThreadId}:`, error);
+                    },
                 });
-                // Checkpoint creation is part of durable turn completion. The helper
-                // catches and reports its own failures, so a broken app checkpoint does
-                // not strand the run while a successful checkpoint cannot be lost when
-                // a serverless invocation exits.
-                await runPostAgentTurnAutosave(options?.onAgentTurnComplete, chatScope, run);
-                await runPostAgentRunComplete(options?.onAgentRunComplete, chatScope, run, { turnContinues: endsAtContinuationBoundary(run) });
                 // Event triggers and local git checkpoints remain best effort and do
                 // not extend the durable chat persistence gate.
                 void (async () => {
@@ -5866,6 +5907,17 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 };
                 // ── Specific thread: GET/PUT/DELETE /threads/:id ──
                 if (threadId) {
+                    if (method === "GET" &&
+                        threadTail[0] === "queue" &&
+                        threadTail[1] &&
+                        threadTail[2] === "receipt" &&
+                        threadTail.length === 3) {
+                        const thread = await resolveThreadAccessScope(owner, threadId, "viewer", { orgId });
+                        if (!thread || !threadMatchesRequestedScope(thread)) {
+                            return threadNotFound();
+                        }
+                        return await getQueuedSubmissionReceiptStatus(threadId, threadTail[1]);
+                    }
                     if (method === "GET") {
                         const thread = await resolveThreadAccess(owner, threadId, "viewer", { orgId });
                         if (!thread || !threadMatchesRequestedScope(thread)) {
@@ -6129,7 +6181,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 mutation = { type: "append", message: queued };
                             }
                         }
-                        else if ((record?.type === "remove" || record?.type === "moveToTop") &&
+                        else if ((record?.type === "remove" ||
+                            record?.type === "cancel" ||
+                            record?.type === "moveToTop") &&
                             typeof record.messageId === "string" &&
                             record.messageId) {
                             mutation = {
@@ -6229,12 +6283,30 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 retryable: true,
                             };
                         }
+                        if (mutation.type === "append" &&
+                            result.message &&
+                            !result.alreadySubmitted &&
+                            !result.submissionExpired) {
+                            scheduleQueuedSubmissionInboxDrain({
+                                threadId,
+                                turnContinues: false,
+                                waitUntil: getRequestRunContext()?.waitUntil,
+                                drain: drainQueuedSubmissionInbox,
+                                onError: (error) => {
+                                    console.error(`[agent-chat] queued-submission append drain failed for ${threadId}:`, error);
+                                },
+                            });
+                        }
+                        if (mutation.type === "cancel" && result.submittedRunId) {
+                            await abortRunAndTurnDurably(result.submittedRunId, clientAbortReason("user"));
+                        }
                         const withoutClaim = (message) => {
                             const { promotionClaim: _claim, ...safeMessage } = message;
                             return safeMessage;
                         };
+                        const { submittedRunId: _submittedRunId, ...safeResult } = result;
                         return {
-                            ...result,
+                            ...(mutation.type === "cancel" ? safeResult : result),
                             queuedMessages: result.queuedMessages.map(withoutClaim),
                             ...(result.message
                                 ? { message: withoutClaim(result.message) }
@@ -6407,6 +6479,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     const scope = parseScopeFromQuery(query);
                     const unscopedOnly = String(query.unscoped ?? "") === "1";
                     const includeExternal = String(query.includeExternal ?? "") === "1";
+                    const includeArchived = String(query.includeArchived ?? "") === "1";
                     const ownership = query.ownership === undefined ? "all" : query.ownership;
                     if (!isChatThreadOwnership(ownership)) {
                         setResponseStatus(event, 400);
@@ -6420,6 +6493,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             scope: scope ?? undefined,
                             orgId,
                             includeExternal,
+                            includeArchived,
                             sourceAppId: options?.appId ?? null,
                             ownership,
                             offset,
@@ -6431,6 +6505,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             unscopedOnly,
                             orgId,
                             includeExternal,
+                            includeArchived,
                             sourceAppId: options?.appId ?? null,
                             ownership,
                         });
@@ -6563,7 +6638,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     return handler(event);
                 });
             };
-            const drainQueuedSubmissionInbox = async () => {
+            const drainQueuedSubmissionInbox = async (drainOptions = {}) => {
                 const result = {
                     scanned: 0,
                     claimed: 0,
@@ -6573,8 +6648,16 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     expired: 0,
                     failed: 0,
                 };
-                const pending = await listQueuedSubmissionReceipts({ limit: 25 });
+                const pending = await listQueuedSubmissionReceipts({
+                    limit: 25,
+                    ...(drainOptions.threadId ? { threadId: drainOptions.threadId } : {}),
+                });
                 result.scanned = pending.length;
+                const deferredThreads = new Set();
+                const deferReceipt = (threadId) => {
+                    result.deferred += 1;
+                    deferredThreads.add(threadId);
+                };
                 const deadlineAt = Date.now() + 30_000;
                 const maxAdmissions = 5;
                 const waitForStableIdle = async (threadId) => {
@@ -6596,10 +6679,75 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     return false;
                 };
                 for (const receipt of pending) {
+                    if (deferredThreads.has(receipt.threadId)) {
+                        result.deferred += 1;
+                        continue;
+                    }
                     if (Date.now() >= deadlineAt || result.submitted >= maxAdmissions) {
                         break;
                     }
+                    if (drainOptions.threadId &&
+                        !(await waitForStableIdle(drainOptions.threadId))) {
+                        deferReceipt(receipt.threadId);
+                        break;
+                    }
                     let claimId;
+                    let retryCount = receipt.retryCount;
+                    let recoveryMutationAttempted = false;
+                    const retryClaimedReceipt = async (countRetry = false) => {
+                        if (!claimId) {
+                            throw new Error(`Queued submission ${receipt.messageId} has no active claim to retry`);
+                        }
+                        recoveryMutationAttempted = true;
+                        let updated = await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId, ...(countRetry ? { countRetry: true } : {}) });
+                        if (!updated) {
+                            updated = await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, countRetry ? { countRetry: true } : {});
+                        }
+                        if (updated && countRetry)
+                            retryCount += 1;
+                        return updated;
+                    };
+                    const blockClaimedReceipt = async () => {
+                        if (!claimId) {
+                            throw new Error(`Queued submission ${receipt.messageId} has no active claim to block`);
+                        }
+                        recoveryMutationAttempted = true;
+                        const updated = await blockQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, {
+                            claimId,
+                        });
+                        return (updated ||
+                            (await blockQueuedSubmissionReceipt(receipt.threadId, receipt.messageId)));
+                    };
+                    const recoverClaimedReceipt = async () => {
+                        if (!claimId) {
+                            deferReceipt(receipt.threadId);
+                            return;
+                        }
+                        if (!recoveryMutationAttempted &&
+                            retryCount >= MAX_QUEUED_SUBMISSION_RETRIES) {
+                            const blocked = await blockClaimedReceipt();
+                            await mutateThreadQueuedMessages(receipt.threadId, {
+                                type: "release",
+                                messageId: receipt.messageId,
+                                claimId,
+                            });
+                            claimId = undefined;
+                            if (blocked)
+                                result.blocked += 1;
+                            else
+                                deferReceipt(receipt.threadId);
+                            return;
+                        }
+                        if (!recoveryMutationAttempted)
+                            await retryClaimedReceipt(true);
+                        await mutateThreadQueuedMessages(receipt.threadId, {
+                            type: "release",
+                            messageId: receipt.messageId,
+                            claimId,
+                        });
+                        claimId = undefined;
+                        deferReceipt(receipt.threadId);
+                    };
                     try {
                         const message = receipt.message;
                         if (!message ||
@@ -6610,7 +6758,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             if (blocked)
                                 result.blocked += 1;
                             else
-                                result.deferred += 1;
+                                deferReceipt(receipt.threadId);
                             continue;
                         }
                         const thread = await resolveThreadAccess(receipt.actor.email, receipt.threadId, "editor", { orgId: receipt.actor.orgId ?? undefined });
@@ -6619,7 +6767,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             if (blocked)
                                 result.blocked += 1;
                             else
-                                result.deferred += 1;
+                                deferReceipt(receipt.threadId);
                             continue;
                         }
                         claimId = crypto.randomUUID();
@@ -6635,14 +6783,18 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             if (error instanceof QueuedSubmissionAdmissionError &&
                                 error.code !== "queued_message_id_conflict") {
                                 claimId = undefined;
-                                result.deferred += 1;
+                                deferReceipt(receipt.threadId);
                                 continue;
                             }
                             throw error;
                         }
                         if (claim?.receiptUnavailable) {
                             claimId = undefined;
-                            result.deferred += 1;
+                            deferReceipt(receipt.threadId);
+                            continue;
+                        }
+                        if (claim?.retryDeferred) {
+                            deferReceipt(receipt.threadId);
                             continue;
                         }
                         if (claim?.receiptConflict) {
@@ -6651,7 +6803,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             continue;
                         }
                         if (claim?.claimBusy) {
-                            result.deferred += 1;
+                            deferReceipt(receipt.threadId);
                             continue;
                         }
                         if (claim?.submissionExpired) {
@@ -6663,7 +6815,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             if (blocked)
                                 result.blocked += 1;
                             else
-                                result.deferred += 1;
+                                deferReceipt(receipt.threadId);
                             continue;
                         }
                         const claimedMessage = claim.claimedMessage;
@@ -6674,7 +6826,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 result.submitted += 1;
                             }
                             else {
-                                result.deferred += 1;
+                                deferReceipt(receipt.threadId);
                             }
                             await mutateThreadQueuedMessages(receipt.threadId, {
                                 type: "release",
@@ -6684,6 +6836,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             claimId = undefined;
                             continue;
                         }
+                        retryCount = claimedReceipt.retryCount;
                         const finishInterrupt = async (runId) => {
                             if (!(await renewQueuedSubmissionInterruptClaim({
                                 threadId: receipt.threadId,
@@ -6718,28 +6871,28 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         if (claimedReceipt.interruptRunId) {
                             const stableIdle = await finishInterrupt(claimedReceipt.interruptRunId);
                             if (!stableIdle) {
-                                await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
+                                await retryClaimedReceipt();
                                 await mutateThreadQueuedMessages(receipt.threadId, {
                                     type: "release",
                                     messageId: receipt.messageId,
                                     claimId,
                                 });
                                 claimId = undefined;
-                                result.deferred += 1;
+                                deferReceipt(receipt.threadId);
                                 continue;
                             }
                         }
                         const active = await getActiveRunForThreadAsync(receipt.threadId);
                         if (active?.inFlight) {
                             if (claimedMessage.interruptActiveRun !== true) {
-                                await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
+                                await retryClaimedReceipt();
                                 await mutateThreadQueuedMessages(receipt.threadId, {
                                     type: "release",
                                     messageId: receipt.messageId,
                                     claimId,
                                 });
                                 claimId = undefined;
-                                result.deferred += 1;
+                                deferReceipt(receipt.threadId);
                                 continue;
                             }
                             const recorded = await recordQueuedSubmissionInterruptRun({
@@ -6749,25 +6902,25 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 claimId,
                             });
                             if (!recorded) {
-                                await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
+                                await retryClaimedReceipt();
                                 await mutateThreadQueuedMessages(receipt.threadId, {
                                     type: "release",
                                     messageId: receipt.messageId,
                                     claimId,
                                 });
                                 claimId = undefined;
-                                result.deferred += 1;
+                                deferReceipt(receipt.threadId);
                                 continue;
                             }
                             if (!(await finishInterrupt(active.runId))) {
-                                await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
+                                await retryClaimedReceipt();
                                 await mutateThreadQueuedMessages(receipt.threadId, {
                                     type: "release",
                                     messageId: receipt.messageId,
                                     claimId,
                                 });
                                 claimId = undefined;
-                                result.deferred += 1;
+                                deferReceipt(receipt.threadId);
                                 continue;
                             }
                         }
@@ -6788,6 +6941,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 ...(claimedMessage.requestAttachments !== undefined
                                     ? { requestAttachments: claimedMessage.requestAttachments }
                                     : {}),
+                                ...(claimedMessage.references !== undefined
+                                    ? { references: claimedMessage.references }
+                                    : {}),
                                 ...(claimedMessage.metadata !== undefined
                                     ? { metadata: claimedMessage.metadata }
                                     : {}),
@@ -6813,6 +6969,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             orgId: receipt.actor.orgId ?? null,
                             orgScope: receipt.actor.orgScope ?? null,
                         };
+                        seedAgentRunOwnerContext(admissionEvent, ownerContext);
                         let admissionResponse;
                         try {
                             admissionResponse = await runWithAgentRunContext({
@@ -6827,9 +6984,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 afterError = await getQueuedSubmissionReceipt(receipt.threadId, receipt.messageId);
                             }
                             catch (receiptError) {
-                                result.failed += 1;
                                 console.error(`[agent-chat] could not verify queued submission ${receipt.messageId} after admission failed:`, { error, receiptError });
-                                claimId = undefined;
+                                await recoverClaimedReceipt();
+                                result.failed += 1;
                                 continue;
                             }
                             if (afterError?.state === "submitted") {
@@ -6837,14 +6994,34 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 claimId = undefined;
                                 continue;
                             }
-                            await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
+                            const nonRetryableError = error !== null &&
+                                typeof error === "object" &&
+                                "retryable" in error &&
+                                error.retryable === false;
+                            const retryLimitReached = (afterError?.retryCount ?? 0) >= MAX_QUEUED_SUBMISSION_RETRIES;
+                            if (nonRetryableError || retryLimitReached) {
+                                const blocked = await blockClaimedReceipt();
+                                await mutateThreadQueuedMessages(receipt.threadId, {
+                                    type: "release",
+                                    messageId: receipt.messageId,
+                                    claimId,
+                                });
+                                claimId = undefined;
+                                if (blocked)
+                                    result.blocked += 1;
+                                else
+                                    deferReceipt(receipt.threadId);
+                                console.error(`[agent-chat] queued submission admission could not be retried for ${receipt.messageId}:`, error);
+                                continue;
+                            }
+                            await retryClaimedReceipt(true);
                             await mutateThreadQueuedMessages(receipt.threadId, {
                                 type: "release",
                                 messageId: receipt.messageId,
                                 claimId,
                             });
                             claimId = undefined;
-                            result.deferred += 1;
+                            deferReceipt(receipt.threadId);
                             console.error(`[agent-chat] queued submission admission failed for ${receipt.messageId}:`, error);
                             continue;
                         }
@@ -6869,18 +7046,18 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             admittedReceipt = await getQueuedSubmissionReceipt(receipt.threadId, receipt.messageId);
                         }
                         catch (error) {
-                            result.failed += 1;
                             console.error(`[agent-chat] could not verify queued submission ${receipt.messageId} after admission returned:`, error);
-                            claimId = undefined;
                             await stream
                                 ?.cancel()
                                 .catch((cancelError) => console.error(`[agent-chat] could not cancel stream for unverified queued submission ${receipt.messageId}:`, cancelError));
+                            await recoverClaimedReceipt();
+                            result.failed += 1;
                             continue;
                         }
                         if (responseRunId &&
                             (responseStatus < 400 || admittedReceipt?.state === "submitted")) {
                             if (admittedReceipt?.state !== "submitted") {
-                                await blockQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, { claimId });
+                                await blockClaimedReceipt();
                                 result.failed += 1;
                                 console.error(`[agent-chat] run ${responseRunId} started without a submitted receipt for ${receipt.messageId}`);
                             }
@@ -6897,21 +7074,38 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             await stream?.cancel().catch(() => { });
                             continue;
                         }
-                        if (responseStatus >= 500 ||
-                            responseCode === "run_slot_busy" ||
-                            responseBody?.retryable === true) {
-                            await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
+                        if (responseCode === "run_slot_busy") {
+                            // The thread's run slot is still held by a run that is ending. That
+                            // is a wait, not a failed admission: release the claim without
+                            // spending a retry or setting a backoff, so the completion drain
+                            // for that run can claim this receipt. A backoff here would make
+                            // that drain skip it until the recurring sweep.
+                            await mutateThreadQueuedMessages(receipt.threadId, {
+                                type: "release",
+                                messageId: receipt.messageId,
+                                claimId,
+                            });
+                            claimId = undefined;
+                            deferReceipt(receipt.threadId);
+                            await stream?.cancel().catch(() => { });
+                            continue;
+                        }
+                        const retryableAdmission = responseBody?.retryable === true ||
+                            (responseBody?.retryable !== false && responseStatus >= 500);
+                        if (retryableAdmission &&
+                            retryCount < MAX_QUEUED_SUBMISSION_RETRIES) {
+                            await retryClaimedReceipt(true);
                             await mutateThreadQueuedMessages(receipt.threadId, {
                                 type: "release",
                                 messageId: receipt.messageId,
                                 claimId,
                             });
                             claimId = undefined;
-                            result.deferred += 1;
+                            deferReceipt(receipt.threadId);
                             await stream?.cancel().catch(() => { });
                             continue;
                         }
-                        const blocked = await blockQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, { claimId });
+                        const blocked = await blockClaimedReceipt();
                         await mutateThreadQueuedMessages(receipt.threadId, {
                             type: "release",
                             messageId: receipt.messageId,
@@ -6921,24 +7115,18 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         if (blocked)
                             result.blocked += 1;
                         else
-                            result.deferred += 1;
+                            deferReceipt(receipt.threadId);
                         await stream?.cancel().catch(() => { });
                     }
                     catch (error) {
                         result.failed += 1;
                         console.error(`[agent-chat] queued submission drain failed for ${receipt.messageId}:`, error);
-                        if (claimId) {
-                            try {
-                                await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
-                                await mutateThreadQueuedMessages(receipt.threadId, {
-                                    type: "release",
-                                    messageId: receipt.messageId,
-                                    claimId,
-                                });
-                            }
-                            catch (releaseError) {
-                                console.error(`[agent-chat] could not release queued submission ${receipt.messageId}:`, releaseError);
-                            }
+                        try {
+                            await recoverClaimedReceipt();
+                        }
+                        catch (releaseError) {
+                            console.error(`[agent-chat] could not release queued submission ${receipt.messageId}:`, releaseError);
+                            deferReceipt(receipt.threadId);
                         }
                     }
                 }

package/dist/server/agent-engine-default-model-route.d.ts

@@ -16,9 +16,9 @@ export declare function createAgentEngineDisconnectHandler(): import("h3").Event
     error: any;
     scope?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
+    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,6 +1,6 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
     models?: undefined;
 } | {
     error?: undefined;

package/dist/server/application-state-maintenance.d.ts

@@ -0,0 +1,2 @@
+/** Server maintenance helpers stay within the current app-state namespace. */
+export { appStateListKeysByKeySuffixPrefix } from "../application-state/store.js";

package/dist/server/application-state-maintenance.js

@@ -0,0 +1,2 @@
+/** Server maintenance helpers stay within the current app-state namespace. */
+export { appStateListKeysByKeySuffixPrefix } from "../application-state/store.js";

package/dist/server/attribution.d.ts

@@ -13,6 +13,10 @@
  * acquisition; last touch answers "what brought them to sign up?" and credits
  * the post, video, or person that converted them.
  *
+ * First touch also has a durable copy, `an_fts`, that our server sets for a
+ * year (see `first-touch-route.ts`). Signup reads both first-touch cookies and
+ * keeps the one `preferFirstTouch` picks.
+ *
  * This module is intentionally pure and dependency-free so it is trivially
  * unit-testable and can never throw into the signup path. The single hard rule:
  * parsing untrusted cookie input must NEVER throw — every accessor is defensive.
@@ -80,11 +84,21 @@ export declare const LAST_TOUCH_COOKIE_NAME = "an_lt";
 export declare function parseCookieHeader(cookieHeader: string | null | undefined): Record<string, string>;
 export declare function decodeFirstTouchValue(value: string | null | undefined): FirstTouchAttribution | null;
 export declare function decodeLastTouchValue(value: string | null | undefined): LastTouchAttribution | null;
+/**
+ * Decode the year-long `an_fts` cookie. A value from another format version
+ * is unreadable here, so it holds no touch.
+ */
+export declare function decodeFirstTouchServerValue(value: string | null | undefined): FirstTouchAttribution | null;
 /**
  * Read the `an_ft` first-touch attribution out of a raw `Cookie:` header.
  * Returns `null` when the cookie is absent or unparseable. Never throws.
  */
 export declare function readFirstTouchAttribution(cookieHeader: string | null | undefined): FirstTouchAttribution | null;
+/**
+ * The `an_fts` cookie value for a first touch, dropping the lowest-priority
+ * fields until `name=value` fits its budget.
+ */
+export declare function encodeFirstTouchServerCookieValue(touch: FirstTouchAttribution): string;
 /**
  * Read the `an_lt` last-touch attribution out of a raw `Cookie:` header.
  * Returns `null` when the cookie is absent or unparseable. Never throws.