@dorokuma/herdsman 0.9.0 → 0.11.5

package/dist/src/daemon/service.js

@@ -4,6 +4,7 @@ import { env, exit } from "node:process";
 import { fileURLToPath } from "node:url";
 import { createAgentHistoryService } from "../agent-history/service.js";
 import { resolveRuntime } from "../config/runtime.js";
+import { acquireDaemonLock, daemonInstanceLockPath, removeDaemonPidFile, writeDaemonPidFile, } from "../daemon/process-manager.js";
 import { AgentContextSnapshotStore } from "../db/agent-context-snapshots.js";
 import { AgentEventStore } from "../db/agent-events.js";
 import { AgentHistoryCacheStore } from "../db/agent-history-cache.js";
@@ -13,6 +14,7 @@ import { applyMigrations } from "../db/apply-migrations.js";
 import { openSqlite } from "../db/client.js";
 import { HerdrSessionStore } from "../db/herdr-sessions.js";
 import { HerdrWorkspaceStore } from "../db/herdr-workspaces.js";
+import { StatusEventPlanStore } from "../db/status-event-plans.js";
 import { createHerdrSessionListRunner } from "../herdr/session-list.js";
 import { AgentContextService } from "../observability/agent-context-service.js";
 import { AgentIndexService } from "../observability/agent-index-service.js";
@@ -21,6 +23,63 @@ import { TurnCompletionRegistry } from "../observability/turn-completion.js";
 import { AgentEventReconciler } from "./agent-event-reconciler.js";
 import { HerdrSessionWatchManager } from "./herdr-session-watch-manager.js";
 import { ObservabilityRpcServer } from "./observability-server.js";
+/**
+ * Periodic reconcile cadence. The 7-day (settled events) and 30-day (released
+ * scopes) TTLs only converge when AgentEventReconciler.reconcile runs, so the
+ * daemon drives it on a fixed 15-minute cycle instead of only at startup.
+ * 15 minutes is deliberately coarser than the watch manager's 10s/60s refresh
+ * ticks: reconcile opens sockets to every running Herdr session, while the TTLs
+ * it enforces are days long, so a 15-minute cycle converges promptly without
+ * per-tick socket traffic.
+ */
+export const RECONCILE_INTERVAL_MS = 15 * 60 * 1000;
+/**
+ * Runs the reconcile cycle on a fixed cadence while guaranteeing at most one
+ * in-flight run: a tick that fires while the previous run is still executing is
+ * skipped. This mirrors HerdrSessionWatchManager's in-flight tick guard. SQLite
+ * writes on the daemon's single shared connection are synchronous, so the only
+ * concurrency hazard between periodic reconcile and live event writes would be
+ * two reconcile loops interleaving at their await points; the in-flight guard
+ * prevents that, keeping event writes and reconcile serialized exactly like the
+ * rest of the daemon.
+ */
+export class PeriodicReconcileScheduler {
+    #clearInterval;
+    #intervalMs;
+    #run;
+    #setInterval;
+    #handle;
+    #inFlight;
+    constructor(options) {
+        this.#clearInterval = options.clearInterval ?? clearInterval;
+        this.#intervalMs = options.intervalMs;
+        this.#run = options.run;
+        this.#setInterval = options.setInterval ?? setInterval;
+    }
+    start() {
+        if (this.#handle !== undefined)
+            return;
+        this.#handle = this.#setInterval(() => {
+            if (this.#inFlight)
+                return;
+            this.#inFlight = Promise.resolve()
+                .then(this.#run)
+                .catch((error) => {
+                console.warn("Herdsman periodic reconcile failed", error);
+            })
+                .finally(() => {
+                this.#inFlight = undefined;
+            });
+        }, this.#intervalMs);
+    }
+    async stop() {
+        if (this.#handle !== undefined) {
+            this.#clearInterval(this.#handle);
+            this.#handle = undefined;
+        }
+        await this.#inFlight?.catch(() => undefined);
+    }
+}
 export async function runObservabilityDaemonService(input = {}) {
     const runtime = resolveRuntime({ environment: input.environment });
     applyEnvironment(runtime.environment);
@@ -49,6 +108,7 @@ export async function runObservabilityDaemonService(input = {}) {
     const agentHistoryCache = new AgentHistoryCacheStore(sqlite);
     const agentContextSnapshots = new AgentContextSnapshotStore(sqlite);
     const agentOrchestratorScopes = new AgentOrchestratorScopeStore(sqlite);
+    const statusEventPlans = new StatusEventPlanStore(sqlite);
     const history = createAgentHistoryService({ cache: agentHistoryCache });
     const context = new AgentContextService({
         history,
@@ -70,17 +130,23 @@ export async function runObservabilityDaemonService(input = {}) {
             agents,
             herdrSessions,
             herdrWorkspaces,
+            sqlite,
+            statusEventPlans,
         },
         turnCompletions,
     });
+    const sessionList = input.sessionList ?? createHerdrSessionListRunner({ env: runtime.environment });
     let connectedTerminal = (_input) => false;
     const reconciler = new AgentEventReconciler({
+        agentHistoryCache,
         connectedTerminal: (input) => connectedTerminal(input),
         events: agentEvents,
         scopes: agentOrchestratorScopes,
-        sessionList: createHerdrSessionListRunner({ env: runtime.environment }),
+        sessionList,
+        statusEventPlans,
     });
     const server = new ObservabilityRpcServer({
+        ...(input.connectSocket !== undefined ? { connectSocket: input.connectSocket } : {}),
         context: daemonServices.context,
         history: daemonServices.history,
         orchestrator,
@@ -97,20 +163,114 @@ export async function runObservabilityDaemonService(input = {}) {
         onAgentContextChanged: (scope) => server.publishAgentContext(scope),
         onAgentEvent: (event) => server.publishAgentEvent(event),
         onAgentIndexRefreshed: (refreshed) => server.reconcileAgentLocations(refreshed),
-        sessionList: createHerdrSessionListRunner({ env: runtime.environment }),
+        sessionList,
     });
-    await server.start();
-    await reconciler.reconcile({ releaseStaleOwners: false });
-    await watchManager.start();
-    console.log(`Herdsman daemon listening on ${runtime.paths.socketPath}`);
+    const onUnhandledRejection = (reason) => {
+        console.error("Herdsman daemon unhandled rejection", reason);
+    };
+    const onUncaughtException = (error) => {
+        console.error("Herdsman daemon uncaught exception", error);
+    };
+    process.on("unhandledRejection", onUnhandledRejection);
+    process.on("uncaughtException", onUncaughtException);
+    const currentPid = input.pid ?? process.pid;
+    const signalTarget = input.signalTarget ?? process;
+    const doExit = input.exit ?? exit;
+    // Register signal handlers before the first await that can block (server
+    // start, reconcile): once the pid file is written the daemon must always
+    // clean it up on a graceful shutdown, even if startup is still in progress.
+    let reconcileScheduler;
+    let releaseInstanceLock;
+    const releaseInstanceLockIfHeld = () => {
+        if (releaseInstanceLock) {
+            releaseInstanceLock();
+            releaseInstanceLock = undefined;
+        }
+    };
     const stop = async () => {
-        await watchManager.stop();
-        await server.stop();
-        sqlite.close();
-        exit(0);
+        let exitCode = 0;
+        try {
+            process.off("unhandledRejection", onUnhandledRejection);
+            process.off("uncaughtException", onUncaughtException);
+            index.stopWaitingHistoryRetries();
+            await index.drainInFlightPlans();
+            await reconcileScheduler?.stop();
+            await watchManager.stop();
+            await server.stop();
+            sqlite.close();
+        }
+        catch (error) {
+            console.error("Herdsman daemon shutdown failed", error);
+            exitCode = 1;
+        }
+        finally {
+            removeDaemonPidFile(runtime.paths.pidPath, currentPid);
+            releaseInstanceLockIfHeld();
+            doExit(exitCode);
+        }
     };
-    process.once("SIGINT", stop);
-    process.once("SIGTERM", stop);
+    signalTarget.once("SIGINT", stop);
+    signalTarget.once("SIGTERM", stop);
+    try {
+        // The bare daemon entrypoint (herdsman-daemon.js) takes an instance lock
+        // distinct from the CLI operation lock so two daemon processes cannot
+        // share one HERDSMAN_HOME even when neither goes through the CLI. The lock
+        // is released on graceful stop and on every startup failure path.
+        releaseInstanceLock = acquireDaemonLock(daemonInstanceLockPath(runtime.paths.pidPath), {
+            pid: currentPid,
+        });
+        await server.start();
+        writeDaemonPidFile(runtime.paths.pidPath, currentPid);
+        await reconciler.reconcile({ releaseStaleOwners: false });
+        await index.drainPendingPlans();
+        // Periodic reconcile keeps the 7-day/30-day TTLs converging on long-running
+        // daemons; the in-flight guard inside the scheduler prevents overlapping runs.
+        reconcileScheduler = new PeriodicReconcileScheduler({
+            ...(input.reconcileClearInterval === undefined
+                ? {}
+                : { clearInterval: input.reconcileClearInterval }),
+            intervalMs: input.reconcileIntervalMs ?? RECONCILE_INTERVAL_MS,
+            // Long-lived daemons must also keep retrying runtime-failed status event
+            // plans: drainPendingPlans is idempotent (pending/running rows only,
+            // per-agent serial, attempts capped) and the periodic cadence prevents a
+            // hot loop, so piggybacking it on the reconcile cycle completes the retry
+            // path that the startup-only drain leaves open.
+            run: async () => {
+                await reconciler.reconcile({ releaseStaleOwners: false });
+                await index.drainPendingPlans();
+            },
+            ...(input.reconcileSetInterval === undefined
+                ? {}
+                : { setInterval: input.reconcileSetInterval }),
+        });
+        reconcileScheduler.start();
+        await watchManager.start();
+        console.log(`Herdsman daemon listening on ${runtime.paths.socketPath}`);
+    }
+    catch (error) {
+        process.off("unhandledRejection", onUnhandledRejection);
+        process.off("uncaughtException", onUncaughtException);
+        if (typeof signalTarget.off === "function") {
+            signalTarget.off("SIGINT", stop);
+            signalTarget.off("SIGTERM", stop);
+        }
+        try {
+            await reconcileScheduler?.stop();
+        }
+        catch { }
+        try {
+            await watchManager.stop();
+        }
+        catch { }
+        try {
+            await server.stop();
+        }
+        catch { }
+        removeDaemonPidFile(runtime.paths.pidPath, currentPid);
+        releaseInstanceLockIfHeld();
+        sqlite.close();
+        throw error;
+    }
 }
 export function resolveMigrationsFolder(startDir) {
     let current = resolve(startDir);

package/dist/src/daemon/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/daemon/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAyD,EAAE;IAE3D,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAEpD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI;QACjB,OAAO,CAAC,KAAK,CAAC,MAAM;QACpB,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,MAAM;QAC7B,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,MAAM;KAC9B,EAAE,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,eAAe,CAAC,MAAM,EAAE;QACtB,gBAAgB,EAAE,uBAAuB,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;KACnF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAG,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,uBAAuB,GAAG,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC;QACtC,OAAO;QACP,MAAM,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,wBAAwB,CAAC;QAChD,WAAW;QACX,MAAM;QACN,MAAM,EAAE,uBAAuB;KAChC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC;QAClC,OAAO,EAAE,cAAc,CAAC,OAAO;QAC/B,MAAM,EAAE;YACN,WAAW;YACX,iBAAiB;YACjB,uBAAuB;YACvB,MAAM;YACN,aAAa;YACb,eAAe;SAChB;QACD,eAAe;KAChB,CAAC,CAAC;IAEH,IAAI,iBAAiB,GAAG,CAAC,MAAwD,EAAE,EAAE,CAAC,KAAK,CAAC;IAC5F,MAAM,UAAU,GAAG,IAAI,oBAAoB,CAAC;QAC1C,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACtD,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,uBAAuB;QAC/B,WAAW,EAAE,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;KACxE,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC;QACxC,OAAO,EAAE,cAAc,CAAC,OAAO;QAC/B,OAAO,EAAE,cAAc,CAAC,OAAO;QAC/B,YAAY;QACZ,oBAAoB,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAChF,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU;QACpC,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE;QAC/D,eAAe;KAChB,CAAC,CAAC;IACH,iBAAiB,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,wBAAwB,CAAC;QAChD,MAAM;QACN,aAAa;QACb,KAAK;QACL,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC;QACnE,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACxD,qBAAqB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC;QAC/E,WAAW,EAAE,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;KACxE,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;IAC3B,OAAO,CAAC,GAAG,CAAC,gCAAgC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAExE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,CAAC,CAAC;IACV,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,IAAI,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,WAA8B;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;;YACpC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;AACH,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/daemon/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAA+B,MAAM,yBAAyB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAKpD;;;;;;;;;GASG;AACH,MAAM,OAAO,0BAA0B;IAC5B,cAAc,CAAmC;IACjD,WAAW,CAAS;IACpB,IAAI,CAAe;IACnB,YAAY,CAA0D;IAC/E,OAAO,CAA6B;IACpC,SAAS,CAA+B;IAExC,YAAY,OAKX;QACC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC;QAC7D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC;IACzD,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE;YACpC,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO;YAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE;iBAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;iBACf,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,CAAC,CAAC,CAAC;QACP,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAaI,EAAE;IAEN,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAEpD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI;QACjB,OAAO,CAAC,KAAK,CAAC,MAAM;QACpB,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,MAAM;QAC7B,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,MAAM;KAC9B,EAAE,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,eAAe,CAAC,MAAM,EAAE;QACtB,gBAAgB,EAAE,uBAAuB,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;KACnF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAG,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,uBAAuB,GAAG,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC;QACtC,OAAO;QACP,MAAM,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,wBAAwB,CAAC;QAChD,WAAW;QACX,MAAM;QACN,MAAM,EAAE,uBAAuB;KAChC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC;QAClC,OAAO,EAAE,cAAc,CAAC,OAAO;QAC/B,MAAM,EAAE;YACN,WAAW;YACX,iBAAiB;YACjB,uBAAuB;YACvB,MAAM;YACN,aAAa;YACb,eAAe;YACf,MAAM;YACN,gBAAgB;SACjB;QACD,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,IAAI,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAElF,IAAI,iBAAiB,GAAG,CAAC,MAAwD,EAAE,EAAE,CAAC,KAAK,CAAC;IAC5F,MAAM,UAAU,GAAG,IAAI,oBAAoB,CAAC;QAC1C,iBAAiB;QACjB,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACtD,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,uBAAuB;QAC/B,WAAW;QACX,gBAAgB;KACjB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC;QACxC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,cAAc,CAAC,OAAO;QAC/B,OAAO,EAAE,cAAc,CAAC,OAAO;QAC/B,YAAY;QACZ,oBAAoB,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAChF,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU;QACpC,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE;QAC/D,eAAe;KAChB,CAAC,CAAC;IACH,iBAAiB,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,wBAAwB,CAAC;QAChD,MAAM;QACN,aAAa;QACb,KAAK;QACL,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC;QACnE,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACxD,qBAAqB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC;QAC/E,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,CAAC,MAAe,EAAE,EAAE;QAC/C,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,MAAM,mBAAmB,GAAG,CAAC,KAAY,EAAE,EAAE;QAC3C,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;IACvD,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,OAAO,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IAElC,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,kBAA0D,CAAC;IAC/D,IAAI,mBAA6C,CAAC;IAClD,MAAM,yBAAyB,GAAG,GAAG,EAAE;QACrC,IAAI,mBAAmB,EAAE,CAAC;YACxB,mBAAmB,EAAE,CAAC;YACtB,mBAAmB,GAAG,SAAS,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;YACtD,KAAK,CAAC,yBAAyB,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACjC,MAAM,kBAAkB,EAAE,IAAI,EAAE,CAAC;YACjC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxD,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACvD,yBAAyB,EAAE,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAEnC,IAAI,CAAC;QACH,yEAAyE;QACzE,sEAAsE;QACtE,2EAA2E;QAC3E,kEAAkE;QAClE,mBAAmB,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;YACrF,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAChC,4EAA4E;QAC5E,+EAA+E;QAC/E,kBAAkB,GAAG,IAAI,0BAA0B,CAAC;YAClD,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,sBAAsB,EAAE,CAAC;YACpD,UAAU,EAAE,KAAK,CAAC,mBAAmB,IAAI,qBAAqB;YAC9D,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,0EAA0E;YAC1E,gDAAgD;YAChD,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1D,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAClC,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,gCAAgC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QACtD,IAAI,OAAO,YAAY,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC3C,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,kBAAkB,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACvD,yBAAyB,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,IAAI,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,WAA8B;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;;YACpC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/src/db/agent-events.d.ts

@@ -1,5 +1,24 @@
 import type { DatabaseSync } from "node:sqlite";
 import type { AgentEventRecord, AgentEventType, AgentIndexRecord, AgentQueryScope, CompactAgentHistory } from "../observability/contracts.js";
+/**
+ * A delivered event is re-listed for the same owner terminal only within this
+ * freshness window after its last delivery attempt. The window covers the
+ * crash/redelivery path (an extension that missed the first delivery re-fetches
+ * it right after reconnecting) while preventing an unacked delivered event from
+ * being re-returned indefinitely on every orchestrator.get, which would feed
+ * duplicate presentations whenever the extension's local dedup state is lost.
+ */
+export declare const REDELIVERY_FRESHNESS_MS = 300000;
+/**
+ * Persist interval for the monotonic logical clock. The clock is written to
+ * daemon_meta only when it advances by at least this much since the last
+ * persist, so read-only queries do not trigger a write+fsync on every call.
+ * The freshness window is 300s, so a 60s persist granularity does not weaken
+ * the anti-rollback semantics.
+ */
+export declare const LOGICAL_CLOCK_PERSIST_INTERVAL_MS = 60000;
+export declare const LOGICAL_CLOCK_META_KEY = "logical_now_ms";
+export declare function hasNonEmptyAssistantMessage(compactHistory: CompactAgentHistory | null | undefined): boolean;
 /** The single delivery predicate shared by pending discovery and acknowledgement. */
 export declare function isDeliverableAgentEvent(event: AgentEventRecord, agent: AgentIndexRecord | undefined, scope: {
     herdrSessionName: string;
@@ -50,7 +69,19 @@ export declare class AgentEventStore {
     }): void;
     listReconcileCandidates(limit?: number, afterId?: number): AgentEventRecord[];
     deleteReconcileCandidate(id: number): boolean;
-    deleteInvalidated(): number;
+    /**
+     * Physically removes invalidated events older than the given age, measured from
+     * coalesce(last_attempt_at, created_at) so a delivered-then-invalidated event is
+     * aged from its last delivery. A short grace window lets the owner that already
+     * received the event ack it and advance the cursor.
+     */
+    deleteInvalidatedOlderThan(ageMs: number): number;
+    /**
+     * Physically removes terminal events (acked/failed) older than the given age.
+     * These statuses are never redelivered or reconciled, so a periodic TTL bounds
+     * the table's growth without touching pending/delivered/invalidated rows.
+     */
+    deleteSettledOlderThan(ageMs: number): number;
     ackSelfOwned(input: {
         herdrSessionName: string;
         workspaceId: string;
@@ -58,6 +89,8 @@ export declare class AgentEventStore {
     }): number;
     invalidateById(id: number, reason: string): boolean;
     latestStatusTransition(agentId: string, herdrSessionName: string): AgentEventRecord | undefined;
+    hasTerminalEventAfter(agentId: string, herdrSessionName: string, afterId: number): boolean;
+    latestTerminalEvent(agentId: string, herdrSessionName: string): AgentEventRecord | undefined;
     listAfter(input: AgentQueryScope & {
         afterEventId?: number;
         limit?: number;

package/dist/src/db/agent-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-events.d.ts","sourceRoot":"","sources":["../../../src/db/agent-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAGtC,qFAAqF;AACrF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GAAG,SAAS,EACnC,KAAK,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EACxD,eAAe,EAAE,MAAM,GACtB,OAAO,CAqBT;AAQD,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAC;IACrE,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,qBAAa,eAAe;;gBAGd,MAAM,EAAE,YAAY;IAIhC,MAAM,CAAC,KAAK,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,cAAc,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;QAC5C,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,IAAI,EAAE,cAAc,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,GAAG,gBAAgB;IAgCpB,cAAc,CAAC,KAAK,EAAE;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI;IAiBR,uBAAuB,CAAC,KAAK,SAAM,EAAE,OAAO,SAAI,GAAG,gBAAgB,EAAE;IASrE,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAU7C,iBAAiB,IAAI,MAAM;IAM3B,YAAY,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAY9F,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAWnD,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAW/F,SAAS,CACP,KAAK,EAAE,eAAe,GAAG;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3F,gBAAgB,EAAE;IA0BrB,oBAAoB,CAAC,KAAK,EAAE;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,gBAAgB,GAAG,SAAS,CAAC;KAC9D,GAAG,gBAAgB,GAAG,SAAS;IA+ChC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,SAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE;IA+BnF,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAmB3C,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IA4BtF,aAAa,CAAC,KAAK,GAAE,eAAoB,GAAG,MAAM;IAkBlD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB;CAOlC;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CAsBlE"}
+{"version":3,"file":"agent-events.d.ts","sourceRoot":"","sources":["../../../src/db/agent-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,QAAS,CAAC;AAExD,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,wBAAgB,2BAA2B,CACzC,cAAc,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACrD,OAAO,CAGT;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GAAG,SAAS,EACnC,KAAK,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EACxD,eAAe,EAAE,MAAM,GACtB,OAAO,CA4BT;AAQD,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAC;IACrE,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,qBAAa,eAAe;;gBAKd,MAAM,EAAE,YAAY;IAmChC,MAAM,CAAC,KAAK,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,cAAc,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;QAC5C,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,IAAI,EAAE,cAAc,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,GAAG,gBAAgB;IAgCpB,cAAc,CAAC,KAAK,EAAE;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI;IAiBR,uBAAuB,CAAC,KAAK,SAAM,EAAE,OAAO,SAAI,GAAG,gBAAgB,EAAE;IASrE,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAU7C;;;;;OAKG;IACH,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAWjD;;;;OAIG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQ7C,YAAY,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAY9F,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAWnD,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAW/F,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAY1F,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAY5F,SAAS,CACP,KAAK,EAAE,eAAe,GAAG;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3F,gBAAgB,EAAE;IA2BrB,oBAAoB,CAAC,KAAK,EAAE;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,gBAAgB,GAAG,SAAS,CAAC;KAC9D,GAAG,gBAAgB,GAAG,SAAS;IAgDhC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,SAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE;IA+BnF,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAwE3C,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IA4BtF,aAAa,CAAC,KAAK,GAAE,eAAoB,GAAG,MAAM;IAkBlD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB;CAOlC;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CAsBlE"}

package/dist/src/db/agent-events.js

@@ -1,24 +1,51 @@
 import { isInteractivePiAgent } from "../observability/interactive-pi.js";
+/**
+ * A delivered event is re-listed for the same owner terminal only within this
+ * freshness window after its last delivery attempt. The window covers the
+ * crash/redelivery path (an extension that missed the first delivery re-fetches
+ * it right after reconnecting) while preventing an unacked delivered event from
+ * being re-returned indefinitely on every orchestrator.get, which would feed
+ * duplicate presentations whenever the extension's local dedup state is lost.
+ */
+export const REDELIVERY_FRESHNESS_MS = 300_000;
+/**
+ * Persist interval for the monotonic logical clock. The clock is written to
+ * daemon_meta only when it advances by at least this much since the last
+ * persist, so read-only queries do not trigger a write+fsync on every call.
+ * The freshness window is 300s, so a 60s persist granularity does not weaken
+ * the anti-rollback semantics.
+ */
+export const LOGICAL_CLOCK_PERSIST_INTERVAL_MS = 60_000;
+export const LOGICAL_CLOCK_META_KEY = "logical_now_ms";
+export function hasNonEmptyAssistantMessage(compactHistory) {
+    const text = compactHistory?.lastAssistantMessage?.text;
+    return typeof text === "string" && text.trim().length > 0;
+}
 /** The single delivery predicate shared by pending discovery and acknowledgement. */
 export function isDeliverableAgentEvent(event, agent, scope, ownerTerminalId) {
+    const failed = event.type === "agent.failed";
     return ((event.status === "pending" || event.status === "delivered") &&
         (event.status === "delivered" ||
             event.nextAttemptAt === null ||
             event.nextAttemptAt === undefined ||
             event.nextAttemptAt <= new Date()) &&
         (event.status === "pending" || event.deliveredToTerminalId === ownerTerminalId) &&
-        event.agentId !== null &&
-        agent !== undefined &&
+        (failed || event.agentId !== null) &&
         event.type !== "agent.status.changed" &&
         !(event.type === "agent.idle" && asRecord(event.payload).from !== "working") &&
-        !(isInteractivePiAgent(agent) && event.type === "agent.idle") &&
-        agent.paneId === event.paneId &&
-        (event.paneGeneration === null || agent.paneGeneration === event.paneGeneration) &&
-        agent.workspaceId === scope.workspaceId &&
         event.workspaceId === scope.workspaceId &&
         event.herdrSessionName === scope.herdrSessionName &&
         event.terminalId !== null &&
-        event.terminalId !== ownerTerminalId);
+        event.terminalId !== ownerTerminalId &&
+        (failed ||
+            (agent !== undefined &&
+                !(isInteractivePiAgent(agent) && event.type === "agent.idle") &&
+                !(agent.agent !== "pi" &&
+                    (event.type === "agent.idle" || event.type === "agent.done") &&
+                    !hasNonEmptyAssistantMessage(event.compactHistory)) &&
+                agent.paneId === event.paneId &&
+                (event.paneGeneration === null || agent.paneGeneration === event.paneGeneration) &&
+                agent.workspaceId === scope.workspaceId)));
 }
 function asRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value)
@@ -27,8 +54,39 @@ function asRecord(value) {
 }
 export class AgentEventStore {
     #sqlite;
+    #lastPersistedLogicalNowMs;
+    #logicalNowMs;
     constructor(sqlite) {
         this.#sqlite = sqlite;
+        const row = this.#sqlite
+            .prepare("select value from daemon_meta where key = ?")
+            .get(LOGICAL_CLOCK_META_KEY);
+        const persisted = row ? Number(row.value) : 0;
+        this.#logicalNowMs = Number.isFinite(persisted) && persisted > 0 ? persisted : 0;
+        this.#lastPersistedLogicalNowMs = this.#logicalNowMs;
+    }
+    /**
+     * Monotonic logical clock: never goes backwards, even when the wall clock
+     * is rolled back. The in-memory value is seeded from daemon_meta on
+     * construction and advanced to the wall clock when the wall clock is ahead.
+     * Persistence is throttled so read-only queries do not write+fsync every
+     * call; on crash the persisted value is only ever stale (never ahead of the
+     * last persisted value), so the anti-rollback invariant holds across
+     * restarts.
+     */
+    #now() {
+        const wallClock = Date.now();
+        if (wallClock <= this.#logicalNowMs)
+            return this.#logicalNowMs;
+        this.#logicalNowMs = wallClock;
+        if (this.#logicalNowMs - this.#lastPersistedLogicalNowMs >= LOGICAL_CLOCK_PERSIST_INTERVAL_MS) {
+            this.#lastPersistedLogicalNowMs = this.#logicalNowMs;
+            this.#sqlite
+                .prepare(`insert into daemon_meta (key, value) values (?, ?)
+           on conflict(key) do update set value = excluded.value`)
+                .run(LOGICAL_CLOCK_META_KEY, String(this.#logicalNowMs));
+        }
+        return this.#logicalNowMs;
     }
     append(input) {
         const existing = input.idempotencyKey
@@ -42,7 +100,7 @@ export class AgentEventStore {
             .prepare(`insert into agent_events
          (herdr_session_name, agent_id, pane_id, pane_generation, workspace_id, terminal_id, type, payload_json, compact_history_json, idempotency_key, deliverable, status, delivery_attempts, created_at)
          values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 'pending', 0, ?)`)
-            .run(input.herdrSessionName, input.agentId ?? null, input.paneId ?? null, input.paneGeneration ?? null, input.workspaceId ?? null, input.terminalId ?? null, input.type, JSON.stringify(input.payload), input.compactHistory ? JSON.stringify(input.compactHistory) : null, input.idempotencyKey ?? null, Date.now());
+            .run(input.herdrSessionName, input.agentId ?? null, input.paneId ?? null, input.paneGeneration ?? null, input.workspaceId ?? null, input.terminalId ?? null, input.type, JSON.stringify(input.payload), input.compactHistory ? JSON.stringify(input.compactHistory) : null, input.idempotencyKey ?? null, this.#now());
         return this.get(Number(result.lastInsertRowid));
     }
     invalidatePane(input) {
@@ -65,8 +123,27 @@ export class AgentEventStore {
             .prepare("delete from agent_events where id = ? and status in ('pending', 'delivered')")
             .run(id).changes) > 0);
     }
-    deleteInvalidated() {
-        return Number(this.#sqlite.prepare("delete from agent_events where status = 'invalidated'").run().changes);
+    /**
+     * Physically removes invalidated events older than the given age, measured from
+     * coalesce(last_attempt_at, created_at) so a delivered-then-invalidated event is
+     * aged from its last delivery. A short grace window lets the owner that already
+     * received the event ack it and advance the cursor.
+     */
+    deleteInvalidatedOlderThan(ageMs) {
+        return Number(this.#sqlite
+            .prepare(`delete from agent_events
+           where status = 'invalidated' and coalesce(last_attempt_at, created_at) < ?`)
+            .run(Date.now() - ageMs).changes);
+    }
+    /**
+     * Physically removes terminal events (acked/failed) older than the given age.
+     * These statuses are never redelivered or reconciled, so a periodic TTL bounds
+     * the table's growth without touching pending/delivered/invalidated rows.
+     */
+    deleteSettledOlderThan(ageMs) {
+        return Number(this.#sqlite
+            .prepare(`delete from agent_events where status in ('acked', 'failed') and created_at < ?`)
+            .run(Date.now() - ageMs).changes);
     }
     ackSelfOwned(input) {
         return Number(this.#sqlite
@@ -88,16 +165,35 @@ export class AgentEventStore {
             .get(agentId, herdrSessionName);
         return row ? mapAgentEvent(row) : undefined;
     }
+    hasTerminalEventAfter(agentId, herdrSessionName, afterId) {
+        const row = this.#sqlite
+            .prepare(`select 1 from agent_events
+         where agent_id = ? and herdr_session_name = ? and id > ?
+           and type in ('agent.idle', 'agent.done', 'agent.blocked')
+         limit 1`)
+            .get(agentId, herdrSessionName, afterId);
+        return Boolean(row);
+    }
+    latestTerminalEvent(agentId, herdrSessionName) {
+        const row = this.#sqlite
+            .prepare(`select * from agent_events
+         where agent_id = ? and herdr_session_name = ?
+           and type in ('agent.idle', 'agent.done', 'agent.blocked')
+         order by id desc limit 1`)
+            .get(agentId, herdrSessionName);
+        return row ? mapAgentEvent(row) : undefined;
+    }
     listAfter(input) {
         const clauses = [
             "id > ?",
-            "((status = 'pending' and (next_attempt_at is null or next_attempt_at <= ?)) or (status = 'delivered' and delivered_to_terminal_id = ? and id > ?))",
+            "((status = 'pending' and (next_attempt_at is null or next_attempt_at <= ?)) or (status = 'delivered' and delivered_to_terminal_id = ? and id > ? and last_attempt_at >= ?))",
         ];
         const params = [
             input.afterEventId ?? 0,
-            Date.now(),
+            this.#now(),
             input.ownerTerminalId ?? null,
             input.afterEventId ?? 0,
+            this.#now() - REDELIVERY_FRESHNESS_MS,
         ];
         if (input.herdrSessionName) {
             clauses.push("herdr_session_name = ?");
@@ -128,15 +224,16 @@ export class AgentEventStore {
         for (let page = 0; page < 50; page += 1) {
             const params = [
                 afterEventId,
-                Date.now(),
+                this.#now(),
                 input.ownerTerminalId,
+                this.#now() - REDELIVERY_FRESHNESS_MS,
                 input.herdrSessionName,
                 input.workspaceId,
                 input.ownerTerminalId,
             ];
             const rows = this.#sqlite
                 .prepare(`select * from agent_events
-           where id > ? and ((status = 'pending' and (next_attempt_at is null or next_attempt_at <= ?)) or (status = 'delivered' and delivered_to_terminal_id = ?)) and herdr_session_name = ? and workspace_id = ?
+           where id > ? and ((status = 'pending' and (next_attempt_at is null or next_attempt_at <= ?)) or (status = 'delivered' and delivered_to_terminal_id = ? and last_attempt_at >= ?)) and herdr_session_name = ? and workspace_id = ?
              and terminal_id is not null and terminal_id != ? and agent_id is not null
              ${agentFilter}
            order by id asc limit 1000`)
@@ -158,14 +255,14 @@ export class AgentEventStore {
     }
     reservePending(terminalId, limit = 100, ids) {
         return this.#transaction(() => {
-            const now = Date.now();
+            const now = this.#now();
             const idClause = ids && ids.length > 0 ? `and id in (${ids.map(() => "?").join(",")})` : "";
-            const params = [now, terminalId];
+            const params = [now, terminalId, now - REDELIVERY_FRESHNESS_MS];
             if (ids && ids.length > 0)
                 params.push(...ids);
             params.push(limit);
             const rows = this.#sqlite
-                .prepare(`select * from agent_events where ((status = 'pending' and (next_attempt_at is null or next_attempt_at <= ?)) or (status = 'delivered' and delivered_to_terminal_id = ?)) ${idClause} order by id asc limit ?`)
+                .prepare(`select * from agent_events where ((status = 'pending' and (next_attempt_at is null or next_attempt_at <= ?)) or (status = 'delivered' and delivered_to_terminal_id = ? and last_attempt_at >= ?)) ${idClause} order by id asc limit ?`)
                 .all(...params);
             for (const row of rows) {
                 this.#sqlite
@@ -185,18 +282,61 @@ export class AgentEventStore {
     }
     reclaimDelivered(timeoutMs) {
         return this.#transaction(() => {
-            const result = this.#sqlite
-                .prepare(`update agent_events set status = case when delivery_attempts >= 10 then 'failed' else 'pending' end, deliverable = case when delivery_attempts >= 10 then 0 else 1 end, last_failure_code = case when delivery_attempts >= 10 then 'DELIVERY_ATTEMPTS_EXCEEDED' else last_failure_code end, delivered_to_terminal_id = null, next_attempt_at = null where status = 'delivered' and last_attempt_at < ?
+            const cutoff = this.#now() - timeoutMs;
+            // The delivered event's own agent row (matched by pane) is the pane-open
+            // guard: it decides whether branch (a) and branch (b) apply.
+            const agentPaneOpen = `exists (
+        select 1 from agents
+        where agents.id = agent_events.agent_id
+          and agents.herdr_session_name = agent_events.herdr_session_name
+          and agents.workspace_id = agent_events.workspace_id
+          and agents.pane_id = agent_events.pane_id
+      )`;
+            // Branch (b): the agent pane is closed/retired, so the delivered event is
+            // invalidated instead of being reclaimed and redelivered.
+            const invalidated = this.#sqlite
+                .prepare(`update agent_events
+           set deliverable = 0, status = 'invalidated', invalidated_reason = 'PANE_CLOSED_RECLAIM'
+           where status = 'delivered' and last_attempt_at < ? and not ${agentPaneOpen}`)
+                .run(cutoff).changes;
+            // Branch (c): the pane is still open but the delivery terminal no longer
+            // holds the orchestrator scope (owner_terminal_id != delivered_to_terminal_id
+            // or no owner), so reclaim immediately without waiting for last_attempt_at
+            // timeout. If the scope is still owned by the delivery terminal (branch a),
+            // the event remains in-flight with the owner.
+            const reclaimWhere = `status = 'delivered'
+             and ${agentPaneOpen}
              and not exists (
-               select 1 from agents
-               inner join herdr_sessions on herdr_sessions.name = agents.herdr_session_name
-               where herdr_sessions.running = 1
-                 and agents.herdr_session_name = agent_events.herdr_session_name
-                 and agents.terminal_id = agent_events.delivered_to_terminal_id
-                 and agents.agent_status = 'working'
-             )`)
-                .run(Date.now() - timeoutMs);
-            return Number(result.changes);
+               select 1 from agent_orchestrator_scopes
+               where agent_orchestrator_scopes.herdr_session_name = agent_events.herdr_session_name
+                 and agent_orchestrator_scopes.workspace_id = agent_events.workspace_id
+                 and agent_orchestrator_scopes.owner_terminal_id = agent_events.delivered_to_terminal_id
+             )`;
+            const exceeded = this.#sqlite
+                .prepare(`select id, agent_id, herdr_session_name, workspace_id, delivery_attempts
+           from agent_events
+           where ${reclaimWhere} and delivery_attempts >= 10`)
+                .all();
+            const reclaimed = this.#sqlite
+                .prepare(`update agent_events
+           set status = case when delivery_attempts >= 10 then 'failed' else 'pending' end,
+               deliverable = case when delivery_attempts >= 10 then 0 else 1 end,
+               last_failure_code = case when delivery_attempts >= 10 then 'DELIVERY_ATTEMPTS_EXCEEDED' else last_failure_code end,
+               delivered_to_terminal_id = null,
+               next_attempt_at = null
+           where ${reclaimWhere}`)
+                .run().changes;
+            for (const row of exceeded) {
+                console.error("Herdsman agent event delivery attempts exceeded", {
+                    eventId: row.id,
+                    agentId: row.agent_id,
+                    herdrSessionName: row.herdr_session_name,
+                    workspaceId: row.workspace_id,
+                    deliveryAttempts: row.delivery_attempts,
+                    lastFailureCode: "DELIVERY_ATTEMPTS_EXCEEDED",
+                });
+            }
+            return Number(invalidated) + Number(reclaimed);
         });
     }
     markAcked(id, scope) {