@cydm/happy-elves 0.1.0-beta.490 → 0.1.0-beta.494

package/apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-cli",
-  "version": "0.1.0-beta.490",
+  "version": "0.1.0-beta.494",
   "private": true,
   "type": "module"
 }

package/apps/daemon/dist/direct/server.js

@@ -168,7 +168,7 @@ class DirectState {
         if (!ticketToken || !await this.authorizeTicket(ticketToken)) {
             throw directAuthError("DIRECT_AUTH_REQUIRED", "Direct snapshot requires a valid short-lived ticket");
         }
-        return await this.packetSnapshot();
+        return await this.packetSnapshot("routing");
     }
     async handleText(connection, raw) {
         let message;
@@ -216,7 +216,7 @@ class DirectState {
             nodeId,
             nodeKind: "controller",
         });
-        connection.sendWireMessage(await this.packetSnapshot());
+        connection.sendWireMessage(await this.packetSnapshot(message.snapshotMode ?? "full"));
     }
     async handlePacketMessage(connection, message) {
         if (!await this.connectionAuthorized(connection))
@@ -600,32 +600,34 @@ class DirectState {
             }
         }
     }
-    async packetSnapshot() {
-        const retainedPackets = [
-            await this.retainedPacket(`node:${this.config.machineId}:manifest`, {
-                type: "machine:register",
-                encryptedMetadata: await this.encryptedMachineMetadata(),
-                capabilities: await this.capabilities(),
-            }),
-        ];
+    async packetSnapshot(snapshotMode = "full") {
+        const manifestPacket = await this.retainedPacket(`node:${this.config.machineId}:manifest`, {
+            type: "machine:register",
+            encryptedMetadata: await this.encryptedMachineMetadata(),
+            capabilities: await this.capabilities(),
+        });
         for (const stored of await loadSessionProjections().catch(() => [])) {
             if (!sessions.has(stored.sessionId))
                 sessions.set(stored.sessionId, stored);
         }
-        for (const session of sessions.values()) {
-            retainedPackets.push(await this.retainedPacket(`node:${this.config.machineId}:session:${session.sessionId}`, {
-                type: "machine:sessionReady",
-                requestId: `req_direct_projection_${this.config.machineId}_${session.sessionId}_${Date.now()}`,
-                sessionId: session.sessionId,
-                ...sessionReadyProjectionFields(session),
-                encryptedMetadata: await encryptedSessionMetadata(this.config, session.sessionId, session, projectionMetadataExtra(session)),
-            }));
-        }
+        const sessionRoutes = [...sessions.keys()].map((sessionId) => ({ sessionId, nodeId: this.config.machineId }));
+        const retainedPackets = [manifestPacket];
+        if (snapshotMode === "full")
+            for (const session of sessions.values()) {
+                retainedPackets.push(await this.retainedPacket(`node:${this.config.machineId}:session:${session.sessionId}`, {
+                    type: "machine:sessionReady",
+                    requestId: `req_direct_projection_${this.config.machineId}_${session.sessionId}_${Date.now()}`,
+                    sessionId: session.sessionId,
+                    ...sessionReadyProjectionFields(session),
+                    encryptedMetadata: await encryptedSessionMetadata(this.config, session.sessionId, session, projectionMetadataExtra(session)),
+                }));
+            }
         return {
             type: "server:snapshot",
             cursor: this.packetSeq,
             presence: [this.presence()],
             retainedPackets,
+            ...(sessionRoutes.length > 0 ? { sessionRoutes } : {}),
         };
     }
     presence() {

package/apps/daemon/dist/relay/connection.js

@@ -84,6 +84,22 @@ export async function handleServerMessage(ws, config, message) {
                 capability: message.capability,
             },
         });
+        // A detached relay operation failure is recoverable only after the
+        // authenticated stream is recreated.  Keeping this socket open would
+        // leave durable packets stranded: the relay has already rejected the
+        // replay/live send, while the daemon's normal outbox drain is only
+        // kicked on a new socket.  Close the stream for storage-generation
+        // failures so start() performs its bounded reconnect loop.  Do not do
+        // this for ordinary command validation errors.
+        if (shouldReconnectAfterRelayError(message.code) && ws.readyState === WebSocket.OPEN) {
+            try {
+                ws.close();
+            }
+            catch {
+                // The close event/error path still performs cleanup if the socket
+                // implementation rejects a redundant close.
+            }
+        }
         return;
     }
     if (message.type === "machine:createSession") {
@@ -268,6 +284,14 @@ async function handleRelayWireMessage(ws, config, message) {
                 packetId: message.packetId,
             },
         });
+        if (shouldReconnectAfterRelayError(message.code) && ws.readyState === WebSocket.OPEN) {
+            try {
+                ws.close();
+            }
+            catch {
+                // Cleanup is also driven by the close/error listeners below.
+            }
+        }
         return;
     }
     if (message.type !== "server:packet")
@@ -338,6 +362,9 @@ async function handleRelayWireMessage(ws, config, message) {
         ackIncomingPacket(ws, message);
     }
 }
+function shouldReconnectAfterRelayError(code) {
+    return code === "RELAY_STORAGE_TIMEOUT" || code === "RELAY_STORAGE_UNAVAILABLE" || code === "RELAY_STORAGE_CLOSED";
+}
 function errorCode(error) {
     if (!error || typeof error !== "object")
         return undefined;

package/apps/daemon/dist/runtime/headless-event-projector.js

@@ -86,11 +86,14 @@ export function mapHeadlessRuntimeEvent(event, state = createHeadlessRuntimeEven
         return text ? [{ type: "text_delta", text, stream: "thought", tag: "reasoning", ...itemIdentity }] : [];
     }
     if (event.method === "item/toolCall" || event.method === "item/toolResult" || event.method === "item/fileChange") {
+        const providerItem = recordFromUnknown(params.item);
+        const status = stringFromRecord(params, "status") ?? (providerItem ? stringFromRecord(providerItem, "status") : undefined);
         return [{
                 type: "tool_call",
                 ...itemIdentity,
                 title: providerToolTitle(params) ?? titleFromMethod(event.method),
                 tag: event.method,
+                ...(status ? { status } : {}),
                 toolCallId: providerToolId(params),
                 text: readableToolPayload(event.method, params),
             }];
@@ -797,6 +800,15 @@ function historicalEventFromItem(item) {
 export function historicalEventsFromThread(items, turns, limit, runtimeEvents = []) {
     const events = [];
     const userPromptKeys = new Set();
+    // Canonical ThreadItems are authoritative for text and for any tool item
+    // the provider materialized.  Some HE providers intentionally keep
+    // orchestration calls only in the event log, though (for example a
+    // delegate.batch call is represented by item/toolCall but is omitted from
+    // thread/items/list).  Keep the canonical identities separate so we can
+    // merge those runtime-only calls without re-introducing raw assistant
+    // snapshots or duplicate canonical tool rows.
+    const canonicalToolItemIds = new Set();
+    const canonicalToolCallIds = new Set();
     const addEvent = (event) => {
         if (event.payload.type === "user_prompt") {
             const key = `${event.turnId}\0${event.payload.text}`;
@@ -808,6 +820,23 @@ export function historicalEventsFromThread(items, turns, limit, runtimeEvents =
     };
     for (const item of items) {
         const event = historicalEventFromItem(item);
+        const turnId = item.turnId ?? item.threadId;
+        if (item.type === "toolCall") {
+            canonicalToolItemIds.add(historicalToolIdentityKey(turnId, item.id));
+            canonicalToolCallIds.add(historicalToolIdentityKey(turnId, item.toolCallId));
+        }
+        else if (item.type === "command") {
+            canonicalToolItemIds.add(historicalToolIdentityKey(turnId, item.id));
+            canonicalToolCallIds.add(historicalToolIdentityKey(turnId, item.commandId));
+        }
+        else if (item.type === "approval") {
+            canonicalToolItemIds.add(historicalToolIdentityKey(turnId, item.id));
+            canonicalToolCallIds.add(historicalToolIdentityKey(turnId, item.serverRequestId));
+        }
+        else if (item.type === "subAgentActivity") {
+            canonicalToolItemIds.add(historicalToolIdentityKey(turnId, item.id));
+            canonicalToolCallIds.add(historicalToolIdentityKey(turnId, item.agentId));
+        }
         if (event)
             addEvent(event);
     }
@@ -816,15 +845,17 @@ export function historicalEventsFromThread(items, turns, limit, runtimeEvents =
         if (event)
             addEvent(event);
     }
-    // Server requests are not represented by a canonical ThreadItem until
-    // they are resolved (and some providers never materialize them as items at
-    // all). Preserve the raw option lifecycle while the canonical item/turn
-    // projection supplies text, tools, and terminal state. This keeps an
-    // authoritative turn rebuild usable for live needs-user attention without
-    // reintroducing duplicate assistant snapshots.
+    // Server requests and provider/HE tool calls are not guaranteed to be
+    // represented by canonical ThreadItems. Preserve only those non-text
+    // runtime events which are absent from the canonical identity set. Text
+    // snapshots remain canonical-only: merging them would resurrect the raw
+    // assistant history that the rebuild deliberately replaces.
     for (const event of historicalEventsFromRuntimeEvents(runtimeEvents)) {
-        if (event.payload.type === "option_request" || event.payload.type === "option_response")
-            addEvent(event);
+        if (event.payload.type === "text_delta" || event.payload.type === "done")
+            continue;
+        if (event.payload.type === "tool_call" && runtimeEventMatchesCanonicalItem(event, canonicalToolItemIds, canonicalToolCallIds))
+            continue;
+        addEvent(event);
     }
     for (const turn of turns) {
         if (!isTerminalTurn(turn))
@@ -836,6 +867,20 @@ export function historicalEventsFromThread(items, turns, limit, runtimeEvents =
         .slice(limit === undefined ? 0 : -limit)
         .map((event, index) => ({ ...event, seq: event.seq ?? index + 1 }));
 }
+function runtimeEventMatchesCanonicalItem(event, canonicalToolItemIds, canonicalToolCallIds) {
+    if (event.payload.type !== "tool_call")
+        return false;
+    if (event.itemId && canonicalToolItemIds.has(historicalToolIdentityKey(event.turnId, event.itemId)))
+        return true;
+    if (event.payload.itemId && canonicalToolItemIds.has(historicalToolIdentityKey(event.turnId, event.payload.itemId)))
+        return true;
+    if (event.payload.toolCallId && canonicalToolCallIds.has(historicalToolIdentityKey(event.turnId, event.payload.toolCallId)))
+        return true;
+    return false;
+}
+function historicalToolIdentityKey(turnId, identity) {
+    return `${turnId}\0${identity}`;
+}
 function toolEventsFromItem(item) {
     const itemIdentity = threadItemIdentity(item);
     if (item.type === "toolCall") {

package/apps/daemon/dist/runtime/headless-history-reader.js

@@ -20,13 +20,15 @@ export async function readHeadlessHistoricalEventPage(input) {
     };
 }
 async function authoritativeTurnEvents(input, runtimeEvents) {
-    // A turn result is a rebuild operation, not a best-effort concatenation of
-    // every provider notification. Read the provider's canonical item/turn
-    // projections when there is no paging anchor; this repairs older logs that
-    // contain a delta plus a repeated terminal snapshot for the same item.
-    // Identity is itemId/turnId, never text, so legitimate repeated answers
-    // from distinct items remain visible.
-    if (!input.turnId || input.before || input.beforeItemId || input.afterItemId)
+    // A transcript replacement is a canonical rebuild, not a best-effort
+    // concatenation of every provider notification. Read the provider's
+    // canonical item/turn projections when there is no paging anchor; the
+    // projector selectively merges runtime-only non-text tool/option events
+    // by identity. This repairs older logs that contain removed items, a delta
+    // plus a repeated terminal snapshot for the same item, or a late native
+    // reconciliation. Identity is itemId/turnId, never text, so legitimate
+    // repeated answers from distinct items remain visible.
+    if (input.before || input.beforeItemId || input.afterItemId)
         return undefined;
     // A few internal readers (and older provider adapters during rolling
     // upgrades) only expose the event reader.  Canonical rebuild is an
@@ -39,8 +41,8 @@ async function authoritativeTurnEvents(input, runtimeEvents) {
         listAllThreadItems(input.client, input.threadId, input.turnId),
         listAllThreadTurns(input.client, input.threadId),
     ]);
-    const turn = turns.find((candidate) => candidate.id === input.turnId);
-    return historicalEventsFromThread(items, turn ? [turn] : [], undefined, runtimeEvents);
+    const selectedTurns = input.turnId ? turns.filter((candidate) => candidate.id === input.turnId) : turns;
+    return historicalEventsFromThread(items, selectedTurns, undefined, runtimeEvents);
 }
 async function listAllThreadItems(client, threadId, turnId) {
     const items = [];

package/apps/daemon/dist/session/lifecycle.d.ts

@@ -1,7 +1,7 @@
 import { type MachineCommand } from "../../../../packages/shared/dist/index.js";
 import type { DaemonConfig, SessionFallback, SessionState } from "../types.js";
 import { type HistoricalBackfillMode, type HistoricalBackfillOptions, type HistoricalBackfillResult } from "./history-backfill.js";
-export { refreshNativeHistoryForLoadedSession } from "./native-history-refresh.js";
+export { invalidateNativeHistoryRefreshForLoadedSession, refreshNativeHistoryForLoadedSession, } from "./native-history-refresh.js";
 export declare function handleCreateSession(ws: WebSocket, config: DaemonConfig, command: MachineCommand): Promise<void>;
 export declare function handleImportHistoricalSession(ws: WebSocket, config: DaemonConfig, command: MachineCommand): Promise<void>;
 export declare function handleListHistoricalSessions(ws: WebSocket, config: DaemonConfig, command: MachineCommand): Promise<void>;

package/apps/daemon/dist/session/lifecycle.js

@@ -19,7 +19,7 @@ import { commandSessionMetadata, encryptedSessionMetadata, sessionFallbackFromCo
 import { closeSessionProjection, persistSessionProjection, sessionReadyProjectionFields } from "./store.js";
 import { nativeHandoffIdentity } from "./native-identity.js";
 import { refreshNativeHistoryForLoadedSession } from "./native-history-refresh.js";
-export { refreshNativeHistoryForLoadedSession } from "./native-history-refresh.js";
+export { invalidateNativeHistoryRefreshForLoadedSession, refreshNativeHistoryForLoadedSession, } from "./native-history-refresh.js";
 export async function handleCreateSession(ws, config, command) {
     if (command.type !== "machine:createSession")
         return;

package/apps/daemon/dist/session/native-history-refresh.d.ts

@@ -1,12 +1,25 @@
 import type { DaemonConfig, SessionState } from "../types.js";
+/**
+ * Mark a managed provider session's history dirty after a new Headless turn.
+ *
+ * Managed non-native sessions deliberately use a best-effort, one-read refresh cache
+ * so an ordinary read does not repeatedly interrogate the provider.  That
+ * cache must be invalidated at the turn boundary: the provider may have
+ * canonicalized the just-finished native turn (for example, collapsing a
+ * streamed duplicate assistant item) even though the HE projection observed
+ * both live items.  The next read then performs the provider-authoritative
+ * reconciliation.  An in-flight refresh is left alone and remains the
+ * singleflight operation for this binding. A terminal generation can abandon
+ * that operation so a later read is never satisfied by an older snapshot.
+ */
+export declare function invalidateNativeHistoryRefreshForLoadedSession(session: SessionState): void;
 /**
  * Reconcile provider-native history before a loaded session is projected.
  *
- * Native sessions have always used this path.  Legacy Crew sessions were
- * persisted as `source:"orchestration"` but still carry a provider session
- * id and native-history metadata.  Those sessions must take the same
- * read-only reconciliation path after restart or before runtime truth reads;
- * otherwise an old same-turn duplicate remains visible until an internal
- * caller manually invokes the runtime operation.
+ * Native sessions have always used this path. Managed provider sessions also
+ * carry a provider session id and native-history metadata, so they must take
+ * the same read-only reconciliation path after restart or before runtime
+ * truth reads; otherwise an old same-turn duplicate remains visible until an
+ * internal caller manually invokes the runtime operation.
  */
 export declare function refreshNativeHistoryForLoadedSession(session: SessionState, config: DaemonConfig | undefined, requestId: string): Promise<SessionState>;

package/apps/daemon/dist/session/native-history-refresh.js

@@ -6,26 +6,58 @@ import { nativeHandoffIdentity } from "./native-identity.js";
 const orchestrationRefreshes = new Map();
 const orchestrationRefreshCompleted = new Set();
 const orchestrationRefreshRetryAt = new Map();
+const orchestrationRefreshGenerations = new Map();
 const orchestrationRefreshRetryDelayMs = 1_000;
+const orchestrationRefreshMaxWaitMs = 2_000;
+/**
+ * Mark a managed provider session's history dirty after a new Headless turn.
+ *
+ * Managed non-native sessions deliberately use a best-effort, one-read refresh cache
+ * so an ordinary read does not repeatedly interrogate the provider.  That
+ * cache must be invalidated at the turn boundary: the provider may have
+ * canonicalized the just-finished native turn (for example, collapsing a
+ * streamed duplicate assistant item) even though the HE projection observed
+ * both live items.  The next read then performs the provider-authoritative
+ * reconciliation.  An in-flight refresh is left alone and remains the
+ * singleflight operation for this binding. A terminal generation can abandon
+ * that operation so a later read is never satisfied by an older snapshot.
+ */
+export function invalidateNativeHistoryRefreshForLoadedSession(session) {
+    if (session.source === "native" || !session.providerSessionId)
+        return;
+    const refreshKey = `${session.runtimeBinding.profile}\0${session.runtimeBinding.threadId}`;
+    orchestrationRefreshGenerations.set(refreshKey, (orchestrationRefreshGenerations.get(refreshKey) ?? 0) + 1);
+    orchestrationRefreshCompleted.delete(refreshKey);
+    orchestrationRefreshRetryAt.delete(refreshKey);
+    const active = orchestrationRefreshes.get(refreshKey);
+    if (active) {
+        active.abandoned = true;
+        orchestrationRefreshes.delete(refreshKey);
+        // A generation change is also the cancellation boundary for an old
+        // provider read.  Drop its IPC client so the next refresh cannot inherit
+        // a request that is already past the terminal boundary.
+        void getHeadlessRuntimeManager(session.cwd).invalidateClientForBinding(session.runtimeBinding, session.cwd);
+    }
+}
 /**
  * Reconcile provider-native history before a loaded session is projected.
  *
- * Native sessions have always used this path.  Legacy Crew sessions were
- * persisted as `source:"orchestration"` but still carry a provider session
- * id and native-history metadata.  Those sessions must take the same
- * read-only reconciliation path after restart or before runtime truth reads;
- * otherwise an old same-turn duplicate remains visible until an internal
- * caller manually invokes the runtime operation.
+ * Native sessions have always used this path. Managed provider sessions also
+ * carry a provider session id and native-history metadata, so they must take
+ * the same read-only reconciliation path after restart or before runtime
+ * truth reads; otherwise an old same-turn duplicate remains visible until an
+ * internal caller manually invokes the runtime operation.
  */
 export async function refreshNativeHistoryForLoadedSession(session, config, requestId) {
     const isNative = session.source === "native";
-    const isLegacyCrew = session.source === "orchestration" && Boolean(session.providerSessionId);
-    if (!isNative && !isLegacyCrew)
+    const isManagedProviderSession = session.source !== "native" && Boolean(session.providerSessionId);
+    if (!isNative && !isManagedProviderSession)
         return session;
     const refreshKey = `${session.runtimeBinding.profile}\0${session.runtimeBinding.threadId}`;
-    if (isLegacyCrew) {
+    if (isManagedProviderSession) {
+        const generation = orchestrationRefreshGenerations.get(refreshKey) ?? 0;
         if (orchestrationRefreshCompleted.has(refreshKey))
-            return session;
+            return sessions.get(session.sessionId) ?? session;
         const retryAt = orchestrationRefreshRetryAt.get(refreshKey);
         if (retryAt !== undefined) {
             if (retryAt > Date.now())
@@ -33,21 +65,59 @@ export async function refreshNativeHistoryForLoadedSession(session, config, requ
             orchestrationRefreshRetryAt.delete(refreshKey);
         }
         const active = orchestrationRefreshes.get(refreshKey);
-        if (active)
-            return await active;
-        const operation = refreshNativeHistory(session, config, requestId, false, refreshKey);
-        orchestrationRefreshes.set(refreshKey, operation);
+        if (active) {
+            const remainingMs = Math.max(0, orchestrationRefreshMaxWaitMs - (Date.now() - active.startedAt));
+            const outcome = await Promise.race([
+                active.promise.then((result) => ({ kind: "result", result })),
+                new Promise((resolve) => setTimeout(() => resolve({ kind: "timeout" }), remainingMs)),
+            ]);
+            if (outcome.kind === "timeout") {
+                active.abandoned = true;
+                if (orchestrationRefreshes.get(refreshKey) === active)
+                    orchestrationRefreshes.delete(refreshKey);
+                orchestrationRefreshGenerations.set(refreshKey, (orchestrationRefreshGenerations.get(refreshKey) ?? 0) + 1);
+                // Disposing the client cancels the bounded IPC request instead of
+                // leaving every later official read behind the same hung promise.
+                void getHeadlessRuntimeManager(session.cwd).invalidateClientForBinding(session.runtimeBinding, session.cwd);
+                return sessions.get(session.sessionId) ?? session;
+            }
+            const result = outcome.result;
+            // A terminal turn may have invalidated the cache while the previous
+            // provider read was in flight.  Never let that old result satisfy the
+            // new generation; run one fresh read after the old singleflight settles.
+            if (!active.abandoned && active.generation !== (orchestrationRefreshGenerations.get(refreshKey) ?? 0)) {
+                if (orchestrationRefreshes.get(refreshKey) === active)
+                    orchestrationRefreshes.delete(refreshKey);
+                return await refreshNativeHistoryForLoadedSession(session, config, requestId);
+            }
+            if (active.abandoned)
+                return sessions.get(session.sessionId) ?? session;
+            return result;
+        }
+        const operation = refreshNativeHistory(session, config, requestId, false, refreshKey, generation);
+        const entry = { generation, promise: operation, startedAt: Date.now() };
+        orchestrationRefreshes.set(refreshKey, entry);
         try {
-            return await operation;
+            const result = await operation;
+            if (!entry.abandoned && generation !== (orchestrationRefreshGenerations.get(refreshKey) ?? 0)) {
+                if (orchestrationRefreshes.get(refreshKey) === entry)
+                    orchestrationRefreshes.delete(refreshKey);
+                return await refreshNativeHistoryForLoadedSession(session, config, requestId);
+            }
+            if (entry.abandoned)
+                return sessions.get(session.sessionId) ?? session;
+            return result;
         }
         finally {
-            if (orchestrationRefreshes.get(refreshKey) === operation)
+            if (orchestrationRefreshes.get(refreshKey) === entry)
                 orchestrationRefreshes.delete(refreshKey);
         }
     }
     return await refreshNativeHistory(session, config, requestId, true);
 }
-async function refreshNativeHistory(session, config, requestId, strict, orchestrationRefreshKey) {
+async function refreshNativeHistory(session, config, requestId, strict, orchestrationRefreshKey, orchestrationRefreshGeneration) {
+    const isNative = session.source === "native";
+    const isLegacyCrew = session.source === "orchestration" && Boolean(session.providerSessionId);
     const manager = getHeadlessRuntimeManager(session.cwd);
     let lastError;
     for (let attempt = 0; attempt < 2; attempt += 1) {
@@ -56,8 +126,9 @@ async function refreshNativeHistory(session, config, requestId, strict, orchestr
                 await manager.invalidateClientForBinding(session.runtimeBinding, session.cwd);
             const entry = await manager.clientForBinding(session.runtimeBinding, session.cwd);
             if (typeof entry.client.syncNativeHistory !== "function") {
-                if (orchestrationRefreshKey)
+                if (orchestrationRefreshKey && orchestrationRefreshGeneration === (orchestrationRefreshGenerations.get(orchestrationRefreshKey) ?? 0)) {
                     orchestrationRefreshCompleted.add(orchestrationRefreshKey);
+                }
                 return session;
             }
             const providerSessionId = session.providerSessionId ?? session.runtimeBinding.threadId;
@@ -69,7 +140,7 @@ async function refreshNativeHistory(session, config, requestId, strict, orchestr
                 cwd: session.cwd,
                 providerSessionId,
             });
-            if (orchestrationRefreshKey && typeof entry.client.readThread === "function" && typeof entry.client.adoptThread === "function") {
+            if (isLegacyCrew && typeof entry.client.readThread === "function" && typeof entry.client.adoptThread === "function") {
                 const current = await entry.client.readThread({ threadId: session.runtimeBinding.threadId });
                 const metadata = current.thread.providerMetadata ?? {};
                 // Legacy Crew threads may have provider history metadata but no
@@ -92,7 +163,7 @@ async function refreshNativeHistory(session, config, requestId, strict, orchestr
             }
             const synced = await entry.client.syncNativeHistory({
                 threadId: session.runtimeBinding.threadId,
-                nativeIdentity: expectedNativeIdentity,
+                ...(isNative || isLegacyCrew ? { nativeIdentity: expectedNativeIdentity } : {}),
             });
             const providerMetadata = synced.thread.providerMetadata ?? {};
             const externallyChanged = providerMetadata.nativeHistoryChangedExternally === true;
@@ -105,8 +176,9 @@ async function refreshNativeHistory(session, config, requestId, strict, orchestr
                 : session.manualHandoffProof && typeof providerMetadata.nativeHistoryVersion === "string"
                     ? { ...session.manualHandoffProof, historyVersion: providerMetadata.nativeHistoryVersion }
                     : session.manualHandoffProof;
+            const currentSession = sessions.get(session.sessionId) ?? session;
             const next = {
-                ...session,
+                ...currentSession,
                 ...(strict && isUsableString(expectedNativeIdentity) ? { nativeIdentity: expectedNativeIdentity } : {}),
                 ...(typeof providerMetadata.nativeHistoryVersion === "string" ? { nativeHistoryVersion: providerMetadata.nativeHistoryVersion } : {}),
                 ...(strict && externallyChanged
@@ -116,6 +188,13 @@ async function refreshNativeHistory(session, config, requestId, strict, orchestr
                         : {}),
                 ...(strict && session.nativeHistorySyncError ? { nativeHistorySyncError: undefined } : {}),
             };
+            // If a newer terminal generation was armed while this provider read was
+            // in flight, keep the durable provider reconciliation but do not publish
+            // this stale read as the completed daemon-side refresh.
+            const generationStillCurrent = !orchestrationRefreshKey
+                || orchestrationRefreshGeneration === (orchestrationRefreshGenerations.get(orchestrationRefreshKey) ?? 0);
+            if (!generationStillCurrent)
+                return sessions.get(session.sessionId) ?? next;
             sessions.set(session.sessionId, next);
             await persistSessionProjection(next);
             if (orchestrationRefreshKey) {
@@ -136,10 +215,13 @@ async function refreshNativeHistory(session, config, requestId, strict, orchestr
         // log remains readable when a provider cannot perform native refresh; do
         // not turn a harmless compatibility probe into a session failure.
         if (orchestrationRefreshKey) {
-            if (isDefinitelyUnsupportedLegacyRefreshError(lastError))
-                orchestrationRefreshCompleted.add(orchestrationRefreshKey);
-            else
-                orchestrationRefreshRetryAt.set(orchestrationRefreshKey, Date.now() + orchestrationRefreshRetryDelayMs);
+            const generationStillCurrent = orchestrationRefreshGeneration === (orchestrationRefreshGenerations.get(orchestrationRefreshKey) ?? 0);
+            if (generationStillCurrent) {
+                if (isDefinitelyUnsupportedLegacyRefreshError(lastError))
+                    orchestrationRefreshCompleted.add(orchestrationRefreshKey);
+                else
+                    orchestrationRefreshRetryAt.set(orchestrationRefreshKey, Date.now() + orchestrationRefreshRetryDelayMs);
+            }
         }
         return session;
     }

package/apps/daemon/dist/session/prompt.js

@@ -15,9 +15,58 @@ import { attachClaimedTurn, claimSessionTurn, releaseSessionTurn, sendCommandRes
 import { settleScheduleTurnTerminal } from "../schedule/runner.js";
 import { firstAgentDispatchListProjection } from "./he-official/orchestration-commands.js";
 import { emitEvent, runtimeEventToPayload } from "./events.js";
-import { refreshNativeHistoryForLoadedSession, replaceAuthoritativeTranscript, resumeSession, usesAuthoritativeTranscript } from "./lifecycle.js";
+import { invalidateNativeHistoryRefreshForLoadedSession, refreshNativeHistoryForLoadedSession, replaceAuthoritativeTranscript, resumeSession, usesAuthoritativeTranscript } from "./lifecycle.js";
 import { encryptedSessionMetadata, sessionFallbackFromCommand } from "./metadata.js";
 import { persistSessionProjection, withSessionHead } from "./store.js";
+// A provider can finish its canonical history read after the terminal relay
+// packet has already been emitted. Keep a short, bounded recovery window so
+// the authoritative transcript is actively replaced without requiring a new
+// official read from the user. The key is the HE turn, so a later turn cannot
+// coalesce with (or cancel) the recovery for this completed turn.
+const nativeHistoryRecoveries = new Map();
+const nativeHistoryRecoveryDelaysMs = [500, 1_500, 3_000];
+function scheduleNativeHistoryRecovery(ws, config, session, requestId, turnId) {
+    if (session.source === "native" || !session.providerSessionId)
+        return;
+    const key = `${session.sessionId}\0${turnId}`;
+    if (nativeHistoryRecoveries.has(key))
+        return;
+    const recovery = { sessionId: session.sessionId, turnId, requestId, ws, config, attempt: 0 };
+    nativeHistoryRecoveries.set(key, recovery);
+    const run = async () => {
+        if (nativeHistoryRecoveries.get(key) !== recovery)
+            return;
+        recovery.attempt += 1;
+        const current = sessions.get(session.sessionId);
+        if (!current || current.runtimeBinding.threadId !== session.runtimeBinding.threadId || sessionTurns.activeTurnId(session.sessionId)) {
+            nativeHistoryRecoveries.delete(key);
+            return;
+        }
+        try {
+            // Each attempt gets a fresh provider read. A successful early read can
+            // still precede provider canonicalization, so do not let the refresh
+            // cache suppress the later attempts.
+            invalidateNativeHistoryRefreshForLoadedSession(current);
+            const refreshed = await refreshNativeHistoryForLoadedSession(current, config, `${requestId}:history-recovery:${recovery.attempt}`);
+            const latest = sessions.get(session.sessionId) ?? refreshed;
+            await replaceAuthoritativeTranscript(ws, config, latest, undefined, {
+                replacementKind: "sync",
+                requestId: `${requestId}:history-recovery:${recovery.attempt}`,
+            });
+        }
+        catch (error) {
+            console.error(`Managed provider history recovery failed for ${session.sessionId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (recovery.attempt >= nativeHistoryRecoveryDelaysMs.length) {
+            nativeHistoryRecoveries.delete(key);
+            return;
+        }
+        recovery.timer = setTimeout(() => { void run(); }, nativeHistoryRecoveryDelaysMs[recovery.attempt]);
+        recovery.timer.unref?.();
+    };
+    recovery.timer = setTimeout(() => { void run(); }, nativeHistoryRecoveryDelaysMs[0]);
+    recovery.timer.unref?.();
+}
 export async function handlePrompt(ws, config, command) {
     if (command.type !== "machine:prompt")
         return;
@@ -371,6 +420,34 @@ export async function handlePrompt(ws, config, command) {
                 currentHead: result.currentHead,
                 lastTurnId: result.lastTurnId,
             }, { runtimeTurnId: completedRuntimeTurnId, checkpointId: completedRuntimeTurnId });
+        if (session.source !== "native" && session.providerSessionId) {
+            // A managed provider turn can stream more HE items than the provider
+            // later exposes as canonical native history. Invalidate the one-read
+            // refresh cache at the terminal boundary and reconcile before replacing
+            // the authoritative transcript, so live projections and subsequent
+            // turn.result/status reads converge without a second turn execution.
+            invalidateNativeHistoryRefreshForLoadedSession(session);
+            const nativeRefresh = refreshNativeHistoryForLoadedSession(sessions.get(command.sessionId) ?? session, config, command.requestId).catch((error) => {
+                console.error(`Legacy Crew post-turn history refresh failed for ${command.turnId}: ${error instanceof Error ? error.message : String(error)}`);
+            });
+            // Provider-native history is read-only cleanup.  It must not hold the
+            // terminal/control path hostage if the provider socket stalls; the
+            // coalesced refresh remains in flight and the next official read or
+            // recovery pass will observe it (or its bounded retry state).
+            const refreshTimeout = Symbol("native-refresh-timeout");
+            const refreshOutcome = await Promise.race([
+                nativeRefresh.then(() => true),
+                new Promise((resolve) => setTimeout(() => resolve(refreshTimeout), 2_000)),
+            ]);
+            if (refreshOutcome === refreshTimeout) {
+                // Detach the provider operation at the terminal boundary instead of
+                // leaving a stalled IPC request alive until its much longer transport
+                // timeout. The next official read/recovery pass starts a new generation.
+                invalidateNativeHistoryRefreshForLoadedSession(sessions.get(command.sessionId) ?? session);
+                scheduleNativeHistoryRecovery(ws, config, sessions.get(command.sessionId) ?? session, command.requestId, command.turnId);
+            }
+            session = sessions.get(command.sessionId) ?? session;
+        }
         phase = "refresh-authoritative-transcript";
         await refreshAuthoritativeTranscriptAfterTurn(ws, config, session, command.requestId, command.turnId, result.currentHead, result.lastTurnId, result.status);
         phase = "mark-terminal-pending";

package/apps/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-daemon",
-  "version": "0.1.0-beta.490",
+  "version": "0.1.0-beta.494",
   "private": true,
   "type": "module"
 }