@awak-app/simy-cli 0.5.60 → 0.5.62

package/src/desktop-host.js

@@ -1,7 +1,7 @@
 import { desktopAccessReady, desktopActionAllowed, requireDesktopAccess, validDesktopAccessPath } from './desktop-access.js';
 import { createActionDeadlineService } from './session-supervision/action-deadline.js';
 import { deliveryHookStatus, openHookSetup } from "./delivery-hooks/desktop.js";
-import { controlDelivery, verifyDelivery } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
+import { controlDelivery, verifyDelivery, createRecordReader } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
 import { createActionAssociationHost } from "./session-supervision/action-association-host.js";
 import { answerSession, continueSession, discoverSessions, enrollSession, monitorSession, trackSession, setSessionAutoContinue } from "./session-supervision/index.js";
@@ -10,7 +10,7 @@ import { analyzeContinuation, readContinuationContext } from "./session-supervis
 import { continueAnalyzedSession, createAutomaticContinuation } from "./session-supervision/automatic-continuation.js";
 import { createWindowsDesktopUpdater } from "./windows-desktop-updater.js";
 import { spawn, execFile } from "node:child_process";
-import { promisify } from "node:util";
+import { promisify, isDeepStrictEqual } from "node:util";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { realpathSync } from "node:fs";
@@ -59,6 +59,19 @@ function desktopActionError(action, error) {
 export async function startDesktopHost({ input = process.stdin, output = process.stdout, env = process.env,
   dependencies = {}, exit = (code) => { process.exitCode = code; } } = {}) {
   const emit = (event) => output.write(`${JSON.stringify(event)}\n`);
+  // A heartbeat remains a complete native frame. Only its observation time is
+  // volatile; reuse the encoded body after comparing freshly authorized data.
+  // Detach the comparison value because registries may mutate nested objects.
+  let encodedStatus = null, lastStatus = null;
+  const emitStatus = status => {
+    const { sampledAt, ...content } = status;
+    if (!lastStatus || !isDeepStrictEqual(content, lastStatus)) {
+      encodedStatus = JSON.stringify(content).slice(1, -1);
+      lastStatus = structuredClone(content);
+    }
+    const observation = sampledAt === undefined ? '' : `"sampledAt":${JSON.stringify(sampledAt)}${encodedStatus ? ',' : ''}`;
+    output.write(`{"type":"status","status":{${observation}${encodedStatus}}}\n`);
+  };
   const root = env.SIMY_HOME?.trim() || join(homedir(), ".simy");
   const webOrigin = resolveWebOrigin(null, env);
   const candidate = Boolean(env.SIMY_DESKTOP_SUPERVISOR_TOKEN);
@@ -67,8 +80,10 @@ export async function startDesktopHost({ input = process.stdin, output = process
   }
   const lock = candidate ? null : await acquireDesktopProcessLock(root, { webOrigin });
   const supervisorToken = lock?.nonce || env.SIMY_DESKTOP_SUPERVISOR_TOKEN;
+  const deliveryRoot = join(root, "delivery-hooks");
+  const recordReader = createRecordReader(deliveryRoot);
   let agent, updater, analysisManager, automaticContinuation, stopWorkflows = async () => {}, timer, closed = false, relay = null, publishing = null, publishAgain = false, scheduledPublish = null;
-  const makeActionAssociations = () => (dependencies.createActionAssociationHost || createActionAssociationHost)({ root: join(root, "delivery-hooks"), sessionRoot: root, webOrigin, onChange: () => { if (!closed) setImmediate(() => { void publish().catch(() => {}); }); } });
+  const makeActionAssociations = () => (dependencies.createActionAssociationHost || createActionAssociationHost)({ root: join(root, "delivery-hooks"), sessionRoot: root, webOrigin, list: () => recordReader.list(), onChange: () => { if (!closed) setImmediate(() => { void publish().catch(() => {}); }); } });
   let actionAssociations = makeActionAssociations();
   let currentAccess = { state: 'checking', organizationId: null, organizationName: null };
   const accessScope = access => JSON.stringify([access?.revision ?? null, access?.organizationId ?? null]);
@@ -76,6 +91,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
     const previousScope = accessScope(currentAccess);
     currentAccess = access || { state: 'unavailable', organizationId: null, organizationName: null };
     if (previousScope !== accessScope(currentAccess)) {
+      discoveryController?.abort();
+      sessionRefreshAgain = Boolean(sessionRefresh) && desktopAccessReady(currentAccess);
       for (const item of sessionStatus.sessions) automaticContinuation?.revoke(item.provider, item.session);
       sessionStatus = { sessions: [], providers: {}, refreshedAt: null }; sessionRefreshedAt = 0;
       await analysisManager?.update([]);
@@ -99,28 +116,37 @@ export async function startDesktopHost({ input = process.stdin, output = process
 
   const deadlines = createActionDeadlineService({ root: join(root, "action-deadlines") });
   const managedSupervisor = (dependencies.createManagedSupervisor || createManagedSupervisor)({ root: join(root, "delivery-hooks"),
-    authorizeDispatch: authorizeWork,
+    authorizeDispatch: authorizeWork, readRecords: () => recordReader.list(),
     beforeClaim: record => actionAssociations.prepareCached?.(record) || record });
   let shuttingDown = null;
   let commands;
   let sessionStatus = { sessions: [], providers: { codex: { discovery: "loading", reason: null }, claude: { discovery: "loading", reason: null } }, refreshedAt: null };
-  let sessionRefresh = null, sessionRefreshedAt = 0, sessionRefreshAgain = false;
+  let sessionRefresh = null, sessionRefreshedAt = 0, sessionRefreshAgain = false, discoveryController = null, discoveryStopped = false;
+  const stopDiscovery = async ({ drain = false } = {}) => {
+    discoveryController?.abort();
+    sessionRefreshAgain = false;
+    if (drain && !dependencies.discoverSessions) await sessionRefresh;
+  };
   const refreshSessions = (force = false) => {
-    if (!desktopAccessReady(currentAccess)) return { sessions: [], providers: {}, refreshedAt: null };
+    if (discoveryStopped && !closed && !relay) return sessionStatus;
+    if (closed || relay || !desktopAccessReady(currentAccess)) return { sessions: [], providers: {}, refreshedAt: null };
     if (force && sessionRefresh) sessionRefreshAgain = true;
     if (!sessionRefresh && (force || Date.now() - sessionRefreshedAt >= 15_000)) {
       const requestedScope = accessScope(currentAccess);
-      sessionRefresh = Promise.resolve().then(() => (dependencies.discoverSessions || discoverSessions)({ root: join(root, "delivery-hooks") }))
+      const controller = discoveryController = new AbortController();
+      sessionRefresh = Promise.resolve().then(() => { if (controller.signal.aborted) return null; return (dependencies.discoverSessions || discoverSessions)({ root: deliveryRoot, signal: controller.signal }); })
         .then(async value => {
+          if (closed || relay || controller.signal.aborted) return;
           const latestAccess = await accessSnapshot();
+          if (closed || relay || controller.signal.aborted) return;
           if (!desktopAccessReady(latestAccess) || accessScope(latestAccess) !== requestedScope) {
             await analysisManager.update([]);
             sessionRefreshAgain = desktopAccessReady(latestAccess);
             return;
           }
           await analysisManager.update(value.sessions); sessionStatus = value; sessionRefreshedAt = Date.now(); })
-        .catch(() => { sessionStatus = { ...sessionStatus, providers: { codex: { discovery: "unavailable", reason: "Conversation discovery unavailable." }, claude: { discovery: "unavailable", reason: "Conversation discovery unavailable." } } }; sessionRefreshedAt = Date.now(); })
-        .finally(() => { sessionRefresh = null; if (sessionRefreshAgain) { sessionRefreshAgain = false; refreshSessions(true); }
+        .catch(() => { if (closed || relay || controller.signal.aborted) return; sessionStatus = { ...sessionStatus, providers: { codex: { discovery: "unavailable", reason: "Conversation discovery unavailable." }, claude: { discovery: "unavailable", reason: "Conversation discovery unavailable." } } }; sessionRefreshedAt = Date.now(); })
+        .finally(() => { if (discoveryController === controller) discoveryController = null; sessionRefresh = null; if (sessionRefreshAgain && !closed && !relay) { sessionRefreshAgain = false; refreshSessions(true); }
           if (!closed) setImmediate(() => { void publish().catch(() => {}); }); });
     }
     return sessionStatus;
@@ -171,8 +197,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (!scheduledPublish) {
       let resolve, reject;
       const promise = new Promise((yes, no) => { resolve = yes; reject = no; });
-      scheduledPublish = { promise };
-      setTimeout(() => { scheduledPublish = null; projectStatus().then(resolve, reject); }, 75);
+      scheduledPublish = { promise, resolve, timer: setTimeout(() => { scheduledPublish = null; projectStatus().then(resolve, reject); }, 75) };
     }
     return scheduledPublish.promise;
   };
@@ -180,6 +205,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (closed || relay || !agent) return Promise.resolve();
     if (publishing) { publishAgain = true; return publishing; }
     publishing = Promise.resolve(agent.getDesktopStatus()).then(async (status) => {
+      if (closed || relay) return;
       await setAccessSnapshot(status.access);
       status.access = currentAccess;
       const requestedScope = accessScope(currentAccess);
@@ -188,39 +214,49 @@ export async function startDesktopHost({ input = process.stdin, output = process
         for (const item of sessionStatus.sessions) automaticContinuation?.revoke(item.provider, item.session);
         if (currentAccess.state !== 'checking') await analysisManager.update([]);
         status.tasks = { activeCount: status.tasks?.activeCount || 0, items: [] };
+        status.sqmChecks = { activeCount: 0, items: [] };
         status.sqmTasks = { activeCount: status.sqmTasks?.activeCount || 0, items: [] };
         status.deliveryHooks = { runs: [], providers: {} };
         status.sessionSupervision = { sessions: [], providers: {}, refreshedAt: null };
-        if (!closed && !relay) emit({ type: 'status', status });
+        if (!closed && !relay) emitStatus(status);
         return;
       }
-      status.deliveryHooks = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: join(root, "delivery-hooks") }).catch(() => ({ error: "Delivery hook status unavailable", providers: {}, runs: [] }));
-      const projection = await actionAssociations.beginProjection?.();
-      await actionAssociations.decorate(status.deliveryHooks);
+      const records = await recordReader.list();
+      const projection = await actionAssociations.beginProjection?.({ records });
+      status.deliveryHooks = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: deliveryRoot, records: projection?.records || records }).catch(() => ({ error: "Delivery hook status unavailable", providers: {}, runs: [] }));
+      await actionAssociations.decorate(status.deliveryHooks, projection);
       const discovery = refreshSessions();
       automaticContinuation?.tick(discovery.sessions);
       const sessions = discovery.sessions.map(candidate => automaticContinuation.project(analysisManager.project(candidate)));
       await actionAssociations.decorateSessions?.(sessions, projection);
+      const runsBySession = new Map((status.deliveryHooks.runs || []).map(run => [`${run.provider}:${run.session}`, run]));
       for (const session of sessions) {
         const context = await actionAssociations.deadlineContext?.(session, projection);
-        if (context) session.actionDeadline = await deadlines.reconcile(context);
+        if (context) session.actionDeadline = await deadlines.reconcile(context, { displayOnly: true });
         else session.actionDeadline = { status: 'unavailable', online: false, reminder: null };
-        const run = status.deliveryHooks.runs?.find(item => item.provider === session.provider && item.session === session.session);
+        const run = runsBySession.get(`${session.provider}:${session.session}`);
         if (run) run.actionDeadline = session.actionDeadline;
       }
       status.sessionSupervision = { ...discovery, sessions };
       const latestAccess = await accessSnapshot();
-      if (!desktopAccessReady(latestAccess) || accessScope(latestAccess) !== requestedScope) { publishAgain = true; return; }
-      if (!closed && !relay) emit({ type: "status", status });
+      if (!desktopAccessReady(latestAccess) || accessScope(latestAccess) !== requestedScope ||
+        actionAssociations.validateProjection && !await actionAssociations.validateProjection(projection)) { publishAgain = true; return; }
+      if (!closed && !relay) emitStatus(status);
     }).finally(() => { publishing = null; if (publishAgain && !closed) { publishAgain = false; setImmediate(() => { void publish().catch(() => {}); }); } });
     return publishing;
   };
   const stopAgent = async () => {
     clearInterval(timer);
+    discoveryStopped = true;
+    await stopDiscovery({ drain: true });
+    encodedStatus = null; lastStatus = null;
+    if (scheduledPublish) { clearTimeout(scheduledPublish.timer); scheduledPublish.resolve(); scheduledPublish = null; }
+    await publishing?.catch(() => {});
     await actionAssociations.close();
     await automaticContinuation?.close();
     await analysisManager?.close();
     await managedSupervisor.close();
+    await recordReader.close();
     await stopWorkflows();
     if (agent) await createAgentShutdown(agent)();
   };
@@ -262,6 +298,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
     updater.on?.("change", () => { void publish().catch(() => {}); });
     updater.start({ registry: agent.registry, restartDaemon: async (targetVersion, installation) => {
       if (!installation?.entryPath || !installation?.executablePath) throw new Error("Signed update runtime is unavailable.");
+      discoveryStopped = true;
+      await stopDiscovery({ drain: true });
       // The candidate shares this cache. Stop inference before it starts so a
       // signed handoff cannot create two analysis writers or duplicate calls.
       await automaticContinuation.close();
@@ -276,7 +314,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           env: { ...env, SIMY_DESKTOP_SUPERVISOR_TOKEN: supervisorToken },
         }); } catch (error) {
           actionAssociations = makeActionAssociations();
-          analysisManager = await makeAnalysisManager(); automaticContinuation = makeAutomaticContinuation(); refreshSessions(true); throw error;
+          analysisManager = await makeAnalysisManager(); automaticContinuation = makeAutomaticContinuation(); discoveryStopped = false; refreshSessions(true); throw error;
         }
       const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
       let accepted = false;
@@ -321,18 +359,25 @@ export async function startDesktopHost({ input = process.stdin, output = process
         lines.close(); await stopUpdateCandidate(child);
         if (!closed && !relay) {
           actionAssociations = makeActionAssociations();
-          analysisManager = await makeAnalysisManager(); automaticContinuation = makeAutomaticContinuation(); refreshSessions(true);
+          analysisManager = await makeAnalysisManager(); automaticContinuation = makeAutomaticContinuation(); discoveryStopped = false; refreshSessions(true);
         }
         throw error;
       }
     } });
     await refreshPlugins();
     await publish();
-    void actionAssociations.tick().then(publish).catch(() => {});
+    const maintenance = new Map();
+    const tick = worker => {
+      if (closed || relay || maintenance.has(worker)) return;
+      const pending = Promise.resolve().then(() => worker.tick()).then(() => { if (!closed && !relay) return publish(); }).catch(() => {}).finally(() => maintenance.delete(worker));
+      maintenance.set(worker, pending);
+    };
+    tick(actionAssociations);
+    tick(managedSupervisor);
     timer = setInterval(() => {
       if (desktopAccessReady(currentAccess)) {
-        void actionAssociations.tick().then(publish).catch(() => {});
-        void managedSupervisor.tick().then(publish).catch(() => {});
+        tick(actionAssociations);
+        tick(managedSupervisor);
       }
       void publish().catch(() => emit({ type: "error", message: "SIMY status could not be refreshed." }));
     }, 3_000);

package/src/runner.js

@@ -86,7 +86,7 @@ const PR_PREPARATION_IDS = new Set(PR_PREPARATION_CHECKS.map((row) => row.id));
 
 export { LocalRunRegistry };
 
-export function createRun({ runId, request, session, apiOrigin, localStateRoot = null }) {
+export function createRun({ runId, request, session, apiOrigin, localStateRoot = null, sqmHistoryRoot = null }) {
   const emitter = new EventEmitter();
   const normalizedRequest = {
     ...request,
@@ -111,6 +111,7 @@ export function createRun({ runId, request, session, apiOrigin, localStateRoot =
     session,
     apiOrigin,
     localStateRoot,
+    sqmHistoryRoot,
     status: "queued",
     lastOutput: "",
     startedAt: null,
@@ -160,7 +161,7 @@ export function createRun({ runId, request, session, apiOrigin, localStateRoot =
   };
 }
 
-export function restoreRun({ snapshot, session, apiOrigin, localPath = null, localStateRoot = null }) {
+export function restoreRun({ snapshot, session, apiOrigin, localPath = null, localStateRoot = null, sqmHistoryRoot = null }) {
   if (!snapshot || typeof snapshot !== "object" || !snapshot.charter) {
     throw new Error("Cannot restore an invalid agentic loop snapshot.");
   }
@@ -170,6 +171,7 @@ export function restoreRun({ snapshot, session, apiOrigin, localPath = null, loc
     session,
     apiOrigin,
     localStateRoot,
+    sqmHistoryRoot,
     request: {
       backend: charter.backend === "claude" ? "claude" : "codex",
       execution_target: normalizeDesktopExecutionTarget(charter.execution_target),
@@ -678,6 +680,8 @@ async function runLocalCodingRun(
       token: run.session?.token,
       endpoint: sqmBundleEndpoint(run.session),
       evidenceEndpoint: sqmEvidenceEndpoint(run.session),
+      webOrigin: run.apiOrigin,
+      historyRoot: run.sqmHistoryRoot,
       accountId: run.session?.account_id || run.session?.auth_user_id || run.session?.device_id,
       organizationId: run.session?.organization_id || run.session?.org_id,
       deviceId: run.session?.device_id,
@@ -751,6 +755,8 @@ export async function recheckLocalCodingRun(run, { collectEvidence } = {}) {
       token: run.session?.token,
       endpoint: sqmBundleEndpoint(run.session),
       evidenceEndpoint: sqmEvidenceEndpoint(run.session),
+      webOrigin: run.apiOrigin,
+      historyRoot: run.sqmHistoryRoot,
       accountId: run.session?.account_id || run.session?.auth_user_id || run.session?.device_id,
       organizationId: run.session?.organization_id || run.session?.org_id,
       deviceId: run.session?.device_id,

package/src/session-supervision/action-association-api.js

@@ -43,7 +43,7 @@ async function boundedJson(response) {
 // login cannot associate work in the newly selected account.
 export function createActionAssociationApi({ webOrigin, sessionRoot,
   fetchImpl = fetch, readSessionImpl = readSession, now = Date.now, timeoutMs = 10_000 } = {}) {
-  const identity = session => createHash('sha256').update(`${webOrigin}\0${session.token}`).digest('hex');
+  const identity = session => createHash('sha256').update(JSON.stringify([webOrigin, session.token, session.organization_id ?? null, session.user_id ?? null, session.account_id ?? null, session.device_id ?? null, session.api_base_url ?? null, session.expires_at])).digest('hex');
   const currentSession = async () => {
     const session = await readSessionImpl(webOrigin, sessionRoot);
     if (!isSessionValid(session, now(), webOrigin)) throw new ActionAssociationApiError('signed_out');

package/src/session-supervision/action-association-host.js

@@ -28,10 +28,11 @@ const deadlineBlocker = (record, candidate) => {
 // Association is optional metadata. Network failures never control the task's
 // work state; provider turns and their budgets remain owned by the supervisor.
 export function createActionAssociationHost({ root, sessionRoot, webOrigin, api = createActionAssociationApi({ webOrigin, sessionRoot }),
-  now = Date.now, refreshMs = 60_000, list = listRecords, read = readRecord, onChange = () => {} } = {}) {
+  now = Date.now, refreshMs = 60_000, list = listRecords, readRecords, read = readRecord, onChange = () => {} } = {}) {
   const abort = new AbortController(), views = new Map();
+  if (readRecords) list = () => readRecords();
   const ordinary = createOrdinaryAssociationStore({ root, api, webOrigin, now, onChange });
-  let auth = null, closed = false, running = null, serial = Promise.resolve();
+  let auth = null, closed = false, running = null, serial = Promise.resolve(), activeCursor = 0, historyCursor = 0;
   const enqueue = work => {
     const result = serial.then(work); serial = result.catch(() => {}); return result;
   };
@@ -44,7 +45,7 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
         if (!association || association.authRevision === next) continue;
         await updateRecord(root, record.provider, record.session, latest => {
           const local = latest?.run?.managed?.actionAssociation;
-          if (!local || latest.run.managed.taskId !== record.run.managed.taskId) return latest;
+          if (!local || local.authRevision === next || latest.run.managed.taskId !== record.run.managed.taskId) return latest;
           local.invalidated = true; local.binding = null; delete local.outbox; local.status = 'unavailable';
           return latest;
         });
@@ -57,6 +58,9 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     return eligible(record || {}) && record.run.managed.taskId === target.taskId ? record : null;
   };
   const valid = async expected => !closed && expected && await current() === expected;
+  // Called inside record locks: reading auth directly cannot recursively take
+  // the same lock through current()'s account-change invalidation pass.
+  const validateScope = expected => async () => !closed && await api.authRevision() === expected;
   const importEnvelope = async (record, envelope, expected, userCorrection = false) => {
     if (!await valid(expected)) throw new ActionAssociationApiError('account_changed');
     if (envelope.binding && envelope.binding.taskId !== record.run.managed.taskId) throw new ActionAssociationApiError('invalid_response');
@@ -64,9 +68,10 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     const local = record.run.managed.actionAssociation;
     // An empty remote binding must not erase a cached ambiguous/no-match result.
     if (userCorrection || envelope.binding || local?.binding || local?.namespace && local.namespace !== namespace) {
-      await importActionBinding({ root, ...identity(record), namespace, binding: envelope.binding, userCorrection, now: now() });
+      await importActionBinding({ root, ...identity(record), namespace, binding: envelope.binding, userCorrection, now: now(), validate: validateScope(expected) });
     }
-    await updateRecord(root, record.provider, record.session, latest => {
+    await updateRecord(root, record.provider, record.session, async latest => {
+      if (!await validateScope(expected)()) throw new ActionAssociationApiError('account_changed');
       const local = latest?.run?.managed?.actionAssociation;
       if (latest?.run?.managed?.taskId !== record.run.managed.taskId) return latest;
       latest.run.managed.actionAssociation = { ...local, authRevision: expected };
@@ -81,11 +86,12 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     const request = actionCandidateRequest(record);
     const contextRevision = request?.context.revision || null;
     if (!force && view?.auth === expected && view.contextRevision === contextRevision && now() < view.nextRefresh && (!association?.outbox || view.error)) {
-      if (queue && !view.error && view.snapshot && !association?.manualOverride && !association?.job && !association?.outbox && !TERMINAL.has(record.run.state)) await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now() });
+      if (queue && !view.error && view.snapshot && !association?.manualOverride && !association?.job && !association?.outbox && !TERMINAL.has(record.run.state)) await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
       return;
     }
     view = { ...view, auth: expected, contextRevision, nextRefresh: now() + refreshMs };
-    views.set(target.taskId, view);
+    views.delete(target.taskId); views.set(target.taskId, view);
+    while (views.size > 500) views.delete(views.keys().next().value);
     try {
       // Never publish an outbox from an earlier organization or login before a
       // scoped server response confirms who owns the current request.
@@ -100,23 +106,24 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
       const pending = latest.run.managed.actionAssociation?.outbox;
       if (pending && pending.namespace === namespace && latest.run.managed.actionAssociation.authRevision === expected) {
         if (snapshot.binding?.origin === 'automatic' && snapshot.binding.action?.id === pending.actionId && snapshot.binding.contextRevision === pending.contextRevision && snapshot.binding.candidateRevision === pending.candidateRevision) {
-          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: snapshot.binding, now: now() }); return;
+          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: snapshot.binding, now: now(), validate: validateScope(expected) }); return;
         }
         if (snapshot.contextRevision !== pending.contextRevision || snapshot.candidateRevision !== pending.candidateRevision) {
-          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, unavailable: true, now: now() });
+          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, unavailable: true, now: now(), validate: validateScope(expected) });
           view.nextRefresh = 0; return;
         }
         const payload = Object.fromEntries(['expectedRevision', 'contextRevision', 'candidateRevision', 'actionId', 'actionRevision', 'relation', 'coveredWork', 'reason', 'evidence'].map(key => [key, pending[key]]));
         const saved = await api.saveBinding(target.taskId, { ...payload, origin: 'automatic' }, { signal: abort.signal });
         if (!await valid(expected) || namespaceFor(webOrigin, saved.scope) !== namespace) return;
-        await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: saved.binding, now: now() });
+        await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: saved.binding, now: now(), validate: validateScope(expected) });
         return;
       }
       if (queue && request && !latest.run.managed.actionAssociation?.manualOverride && !TERMINAL.has(latest.run.state)) {
         // A read turn is queued only at the original session's safe boundary.
         // Blocked tasks retain candidates for auxiliary correction in the UI.
-        await prepareActionAssociation({ root, record: latest, snapshot, webOrigin, now: now() });
-        await updateRecord(root, latest.provider, latest.session, currentRecord => {
+        await prepareActionAssociation({ root, record: latest, snapshot, webOrigin, now: now(), validate: validateScope(expected) });
+        await updateRecord(root, latest.provider, latest.session, async currentRecord => {
+          if (!await validateScope(expected)()) throw new ActionAssociationApiError('account_changed');
           if (currentRecord?.run?.managed?.taskId === target.taskId && currentRecord.run.managed.actionAssociation) currentRecord.run.managed.actionAssociation.authRevision = expected;
           return currentRecord;
         });
@@ -131,43 +138,64 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
           const remote = await api.readBinding(target.taskId, { signal: abort.signal });
           const namespace = await importEnvelope(latest, remote, expected);
           const box = latest.run.managed.actionAssociation?.outbox;
-          if (box && remote.binding) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, binding: remote.binding, now: now() });
-          else if (box) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, unavailable: true, now: now() });
+          if (box && remote.binding) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, binding: remote.binding, now: now(), validate: validateScope(expected) });
+          else if (box) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, unavailable: true, now: now(), validate: validateScope(expected) });
           view.namespace = namespace; view.nextRefresh = 0;
         } catch { view.error = 'offline'; }
       } else if (hardFailure(error.code)) {
         view.candidates = []; view.snapshot = null;
-        await importActionBinding({ root, ...target, namespace: view.namespace || null, unavailable: true, now: now() });
+        await importActionBinding({ root, ...target, namespace: view.namespace || null, unavailable: true, now: now(), validate: validateScope(expected) });
       } else view.nextRefresh = now() + Math.min(refreshMs, 15_000);
     }
   }
+  function window(records, cursor, limit) {
+    const count = Math.min(limit, records.length);
+    return { records: Array.from({ length: count }, (_, i) => records[(cursor + i) % records.length]), cursor: records.length ? (cursor + count) % records.length : 0 };
+  }
   async function reconcile() {
-    const expected = await current(), records = (await list(root)).filter(eligible).slice(0, 30);
-    let cursor = 0;
-    await Promise.all(Array.from({ length: Math.min(3, records.length) }, async () => {
-    while (!closed && cursor < records.length) {
-      const record = records[cursor++];
+    const expected = await current(), all = (await list(root)).filter(eligible);
+    // Cancellation is a safety pass, independent of the optional network work
+    // budget. A large history must never hide an expired/paused matching job.
+    for (const record of all) {
+      if (closed) return;
       const managed = record.run.managed, job = managed.actionAssociation?.job;
       if (job && !managed.resumeLease && (!expected || TERMINAL.has(record.run.state) || ['paused', 'blocked'].includes(record.run.state) || record.run.state === 'recovery_required' && record.run.recoveryCause !== 'session_supervision' ||
           managedBudgetReason(record.run, now()) || now() >= record.run.deadline || record.run.continuations >= record.run.maxContinuations ||
           managed.understandingRevision !== job.understandingRevision || record.run.revision !== job.runRevision || managed.actionAssociation.invalidated)) {
-        await cancelActionAssociation({ root, ...identity(record), now: now() });
+        await cancelActionAssociation({ root, ...identity(record), expectedJobId: job.id, now: now() });
       }
-      if (!expected) {
-        if (managed.actionAssociation?.namespace) await importActionBinding({ root, ...identity(record), namespace: null, unavailable: true, now: now() });
-        continue;
+      if (!expected && managed.actionAssociation?.namespace && managed.actionAssociation.status !== 'unavailable') {
+        await importActionBinding({ root, ...identity(record), namespace: null, unavailable: true, now: now(), validate: validateScope(expected) });
       }
-      try { await sync(await fresh(identity(record)) || record, expected); } catch { /* Optional metadata never stops other task drives. */ }
     }
+    if (!expected) return;
+    const active = all.filter(record => !TERMINAL.has(record.run.state)), history = all.filter(record => TERMINAL.has(record.run.state));
+    // Prefer live work while reserving a small history window. Both cursors
+    // rotate so the first hash-sorted records cannot monopolize every tick.
+    const nextActive = window(active, activeCursor, history.length ? 24 : 30);
+    const nextHistory = window(history, historyCursor, 30 - nextActive.records.length);
+    activeCursor = nextActive.cursor; historyCursor = nextHistory.cursor;
+    const records = [...nextActive.records, ...nextHistory.records];
+    let cursor = 0;
+    await Promise.all(Array.from({ length: Math.min(3, records.length) }, async () => {
+      while (!closed && cursor < records.length) {
+        const record = records[cursor++];
+        try { await sync(await fresh(identity(record)) || record, expected); } catch { /* Optional metadata never stops other task drives. */ }
+      }
     }));
   }
   return {
     // A projection is private to one desktop frame. Mutations and deadline
     // validation still reread the exact record and current authentication.
-    async beginProjection() {
-      await current();
-      const records = await list(root);
-      return { records, byKey: new Map(records.map(record => [`${record.provider}:${record.session}`, record])) };
+    async beginProjection({ records: suppliedRecords } = {}) {
+      const authRevision = await current();
+      const records = suppliedRecords || await list(root);
+      const taskIds = new Set(records.map(record => record.run?.managed?.taskId).filter(Boolean));
+      for (const taskId of views.keys()) if (!taskIds.has(taskId)) views.delete(taskId);
+      return { records, authRevision, byKey: new Map(records.map(record => [`${record.provider}:${record.session}`, record])) };
+    },
+    async validateProjection(projection) {
+      return !closed && await current() === projection.authRevision;
     },
     async decorateSessions(sessions, projection) {
       await ordinary.decorate(sessions, projection);
@@ -176,16 +204,16 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
         const record = records.get(`${item.provider}:${item.session}`);
         return { managed: true, taskId: record.run.managed.taskId, actionAssociation: record.run.managed.actionAssociation, candidate: item };
       }) };
-      await this.decorate(status);
+      await this.decorate(status, projection);
       for (const run of status.runs) run.candidate.actionAssociation = run.actionAssociation;
       return sessions;
     },
     async deadlineContext(candidate, projection) {
-      const expected = await current(), record = projection
+      const expected = projection ? projection.authRevision : await current(), record = projection
         ? projection.byKey.get(`${candidate.provider}:${candidate.session}`)
         : await read(root, candidate.provider, candidate.session);
       const local = record?.run?.managed?.actionAssociation || record?.actionAssociation;
-      if (!expected || local?.authRevision !== expected || !candidate.actionAssociation?.canCorrect) return null;
+      if (!expected || projection && auth !== expected || local?.authRevision !== expected || !(candidate.actionAssociation?.canCorrect || candidate.actionAssociation?.canReadBinding)) return null;
       const binding = candidate.actionAssociation.binding;
       const fingerprint = value => JSON.stringify([value?.revision, value?.action?.id, value?.action?.revision, value?.action?.dueAt, value?.action?.timeZone, value?.action?.status]);
       return { namespace: local.namespace, provider: candidate.provider, session: candidate.session, taskId: candidate.taskId, binding,
@@ -195,15 +223,17 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
           if (!await valid(expected)) return false;
           const latest = await read(root, candidate.provider, candidate.session);
           const scoped = latest?.run?.managed?.actionAssociation || latest?.actionAssociation;
+          if (!await valid(expected)) return false;
           return (latest?.run?.managed?.taskId || latest?.associationTaskId) === candidate.taskId && scoped?.namespace === local.namespace && scoped?.authRevision === expected && fingerprint(scoped.binding) === fingerprint(binding);
         } };
 
     },
     async prepareCached(record) {
+      const expected = await current();
       const view = views.get(record?.run?.managed?.taskId), request = actionCandidateRequest(record);
       if (closed || !auth || !view || view.auth !== auth || view.error || !view.snapshot || !request || view.contextRevision !== request.context.revision || view.snapshot.contextRevision !== request.context.revision || view.namespace !== namespaceFor(webOrigin, view.snapshot.scope)) return record;
       try {
-        const prepared = await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now() });
+        const prepared = await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
         return prepared || record;
       } catch { return record; }
     },
@@ -212,8 +242,8 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
       if (!running) running = reconcile().finally(() => { running = null; });
       return running;
     },
-    async decorate(status) {
-      const expected = await current();
+    async decorate(status, projection) {
+      const expected = projection ? projection.authRevision : await current();
       let remainingBytes = 24 * 1024;
       const perRunBytes = Math.floor(remainingBytes / Math.max(1,(status.runs || []).filter(run => run.managed).length));
       for (const run of status.runs || []) {

package/src/session-supervision/action-association.js

@@ -3,6 +3,10 @@ import { listRecords, updateRecord, TERMINAL } from '../codex-plugins/simy/hooks
 import { associationSignals, associationRevision } from '../codex-plugins/simy/hooks/action-association.mjs';
 export { associationSignals, associationRevision, associationContract, validateAssociationResult } from '../codex-plugins/simy/hooks/action-association.mjs';
 
+async function assertScope(validate) {
+  if (validate && !await validate()) throw Object.assign(new Error('Action association account changed.'), { code: 'account_changed' });
+}
+
 function stable(run) {
   return run?.managed && (run.state === 'active' || run.state === 'recovery_required' && run.recoveryCause === 'session_supervision' && run.managed.autoRecovery === true) && !TERMINAL.has(run.state) && run.managed.phase === 'active' && !run.managed.resumeLease && (!run.managed.handoff || run.managed.handoff.status === 'received') && !run.managed.pendingApproval && !run.managed.approvedAction && !run.managed.providerWarning && !run.managed.executionUncertain && (!run.managed.executionAttempt || run.managed.executionAttempt.phase === 'checkpointed');
 }
@@ -16,8 +20,9 @@ function restoreAssociationWork(run, saved) {
   }
   managed.awaitingAssociationHook = false;
 }
-export async function queueActionAssociation({ root, provider, session, taskId, expectedRevision, candidates, candidateRevision, scope, namespace = null, remoteBinding = null, now = Date.now() }) {
-  return updateRecord(root, provider, session, record => {
+export async function queueActionAssociation({ root, provider, session, taskId, expectedRevision, candidates, candidateRevision, scope, namespace = null, remoteBinding = null, now = Date.now(), validate }) {
+  return updateRecord(root, provider, session, async record => {
+    await assertScope(validate);
     const run = record?.run, managed = run?.managed;
     if (!managed || managed.taskId !== taskId || run.revision !== expectedRevision) return record;
     if (!stable(run) || now >= run.deadline || run.continuations >= run.maxContinuations) {
@@ -45,8 +50,9 @@ export async function queueActionAssociation({ root, provider, session, taskId,
     return record;
   });
 }
-export async function importActionBinding({ root, provider, session, taskId, namespace, binding = null, unavailable = false, userCorrection = false, now = Date.now() }) {
-  return updateRecord(root, provider, session, record => {
+export async function importActionBinding({ root, provider, session, taskId, namespace, binding = null, unavailable = false, userCorrection = false, now = Date.now(), validate }) {
+  return updateRecord(root, provider, session, async record => {
+    await assertScope(validate);
     const run = record?.run, managed = run?.managed;
     if (managed?.taskId !== taskId || managed.handoff && managed.handoff.status !== 'received') return record;
     const previous = managed.actionAssociation || {};
@@ -79,7 +85,7 @@ export function actionCandidateRequest(record) {
   const context = associationSignals(record?.run?.managed?.sessionUnderstanding);
   return context ? { taskId: record.run.managed.taskId, context, limit: 10 } : null;
 }
-export async function prepareActionAssociation({ root, record, snapshot, webOrigin, now = Date.now() }) {
+export async function prepareActionAssociation({ root, record, snapshot, webOrigin, now = Date.now(), validate }) {
   const request = actionCandidateRequest(record);
   if (!request || snapshot?.schemaVersion !== 1 || snapshot.taskId !== request.taskId || snapshot.contextRevision !== request.context.revision || !snapshot.scope?.organizationId || !snapshot.scope?.userId) return null;
   if (!Array.isArray(snapshot.candidates) || snapshot.candidates.length > 10 || new Set(snapshot.candidates.map(item => item.id)).size !== snapshot.candidates.length) return null;
@@ -88,10 +94,11 @@ export async function prepareActionAssociation({ root, record, snapshot, webOrig
   }
   const namespace = JSON.stringify([new URL(webOrigin).origin,snapshot.scope.organizationId,snapshot.scope.userId]);
   return queueActionAssociation({ root, provider: record.provider, session: record.session, taskId: request.taskId, expectedRevision: record.run.revision,
-    candidates: snapshot.candidates, candidateRevision: snapshot.candidateRevision, scope: snapshot.scope, namespace, remoteBinding: snapshot.binding, now });
+    candidates: snapshot.candidates, candidateRevision: snapshot.candidateRevision, scope: snapshot.scope, namespace, remoteBinding: snapshot.binding, now, validate });
 }
-export async function settleActionAssociation({ root, provider, session, taskId, outboxId, namespace, binding = null, unavailable = false, now = Date.now() }) {
-  return updateRecord(root, provider, session, record => {
+export async function settleActionAssociation({ root, provider, session, taskId, outboxId, namespace, binding = null, unavailable = false, now = Date.now(), validate }) {
+  return updateRecord(root, provider, session, async record => {
+    await assertScope(validate);
     const association = record?.run?.managed?.actionAssociation;
     if (record?.run?.managed?.taskId !== taskId || association?.outbox?.id !== outboxId || association.outbox.namespace !== namespace || record.run.managed.handoff && record.run.managed.handoff.status !== 'received') return record;
     if (binding && binding.taskId === taskId) {
@@ -102,10 +109,10 @@ export async function settleActionAssociation({ root, provider, session, taskId,
     return record;
   });
 }
-export async function cancelActionAssociation({ root, provider, session, taskId, now = Date.now() }) {
+export async function cancelActionAssociation({ root, provider, session, taskId, expectedJobId, now = Date.now() }) {
   return updateRecord(root, provider, session, record => {
     const run = record?.run, managed = run?.managed, association = managed?.actionAssociation;
-    if (managed?.taskId !== taskId || managed.resumeLease || !association?.job) return record;
+    if (managed?.taskId !== taskId || managed.resumeLease || !association?.job || expectedJobId && association.job.id !== expectedJobId) return record;
     const saved = association.job.saved;
     restoreAssociationWork(run, saved);
     managed.awaitingAssociationHook = false; association.status = 'unavailable'; delete association.job; association.updatedAt = now;

package/src/session-supervision/action-deadline.js

@@ -150,7 +150,7 @@ export function createActionDeadlineService({
     plan: context.plan ?? null,
     recommendation: deadlineRecommendation(context),
   });
-  async function reconcile(context) {
+  async function reconcile(context, { displayOnly = false } = {}) {
     const key = identity(context),
       action = context.binding?.action;
     const bindingRevision =
@@ -164,6 +164,14 @@ export function createActionDeadlineService({
       action?.status,
       terminal.has(context.taskStatus),
     ]);
+    if (displayOnly) {
+      // Host display already owns a frame-scoped record/auth snapshot and an
+      // authorization exit fence. An unchanged durable deadline needs no write
+      // transaction or per-session authorization read; project still evaluates
+      // the current time and fresh local decisions on every heartbeat.
+      const previous = await store.read(key);
+      if (previous?.fingerprint === fingerprint && previous.status !== 'unavailable') return project(previous, context);
+    }
     const state = await transact(context, (previous) => {
       if (context.online === false) return previous;
       // Tombstones retain the last authoritative revision, so old snapshots