@fungi.computer/shiitake 0.2.0 → 0.3.1

package/dist/internal/woodstock/session-store.js

@@ -56,6 +56,7 @@ const EntryRowSchema = Schema.Struct({
     data_json: Schema.String,
     timestamp,
     completed_at: Schema.NullOr(timestamp),
+    damaged: Schema.Literals([0, 1]),
 });
 const CommandAdmissionRowSchema = Schema.Struct({
     id: boundedId,
@@ -100,7 +101,6 @@ const admissionColumns = (alias) => [
     .join(", ");
 const NextSequenceRowSchema = Schema.Struct({ next_sequence: sequence });
 const EntryPresenceRowSchema = Schema.Struct({ present: Schema.Literal(1) });
-const decodeSessionRow = Schema.decodeUnknownResult(SessionRowSchema, closed);
 const decodeSessionCreationReceiptRow = Schema.decodeUnknownResult(SessionCreationReceiptRowSchema, closed);
 const decodeSessionSummaryRow = Schema.decodeUnknownResult(SessionSummaryRowSchema, closed);
 const decodeSessionIdRow = Schema.decodeUnknownResult(SessionIdRowSchema, closed);
@@ -116,9 +116,29 @@ const SummaryLineageSchema = Schema.Struct({
 const decodeSummaryLineage = Schema.decodeUnknownResult(SummaryLineageSchema, closed);
 const decodeEntryRow = Schema.decodeUnknownResult(EntryRowSchema, closed);
 const decodeCommandAdmissionRow = Schema.decodeUnknownResult(CommandAdmissionRowSchema, closed);
-const decodeModelChoiceRow = Schema.decodeUnknownResult(Schema.Struct({ sequence: Schema.NullOr(sequence) }), closed);
 const decodeNextSequenceRow = Schema.decodeUnknownResult(NextSequenceRowSchema, closed);
 const decodeEntryPresenceRow = Schema.decodeUnknownResult(EntryPresenceRowSchema, closed);
+/** The columns of an entry row from `table`, with whether its Session is damaged. */
+function entryColumnsOf(table) {
+    const columns = [
+        "id",
+        "session_id",
+        "parent_id",
+        "sequence",
+        "type",
+        "role",
+        "state",
+        "request_id",
+        "work_id",
+        "data_json",
+        "timestamp",
+        "completed_at",
+    ].map((column) => `${table}.${column}`);
+    return `${columns.join(", ")},
+    EXISTS (SELECT 1 FROM session_lineage_damage AS damage
+             WHERE damage.session_id = ${table}.session_id) AS damaged`;
+}
+const entryColumns = entryColumnsOf("session_entries");
 /**
  * Page stored conversation facts without creating Sessions or opening hosts.
  *
@@ -167,6 +187,8 @@ export function readStoredSessionFactPage(owner, after) {
  * title derived from the first entered prompt.
  */
 export function readStoredSessionSummary(owner, sessionId) {
+    if (readSessionRow(owner, sessionId) === undefined)
+        return undefined;
     const raw = owner.sql
         .exec(`SELECT id, leaf_id, created_at, updated_at, metadata_json
          FROM sessions
@@ -328,12 +350,6 @@ function unavailable(message) {
 function incompatible(message) {
     return new ShiitakeError("store", "incompatible", message);
 }
-function parseSessionRow(raw) {
-    const decoded = decodeSessionRow(raw);
-    if (decoded._tag === "Failure")
-        throw unavailable("Stored Session row is invalid");
-    return decoded.success;
-}
 function requestIdFor(entry) {
     return entry.kind === "command" ||
         entry.kind === "cancellation" ||
@@ -359,11 +375,18 @@ function sameCausalIdentity(left, right) {
         left.parent?.kind === right.parent?.kind &&
         left.parent?.value === right.parent?.value);
 }
-function parseEntryRow(raw) {
+/**
+ * Decode one entry row. Every entry read selects its Session's damage with
+ * it (`entryColumns`), so a row of a Session the lineage audit refused is
+ * refused here, whichever reader asked for it.
+ */
+function parseEntryRow(owner, raw) {
     const decodedRow = decodeEntryRow(raw);
     if (decodedRow._tag === "Failure")
         throw unavailable("Stored Session entry row is invalid");
     const row = decodedRow.success;
+    if (row.damaged === 1)
+        throw brokenSession(owner, row.session_id);
     const decodedEntry = decodeStoredSessionEntry(row.data_json);
     if (decodedEntry._tag === "Failure")
         throw unavailable("Stored Session entry data is invalid");
@@ -424,20 +447,41 @@ function parseCommandAdmissionRow(raw) {
 export function hasStoredSession(owner, sessionId) {
     return readSessionRow(owner, sessionId) !== undefined;
 }
+const decodeReadableSessionRow = Schema.decodeUnknownResult(Schema.Struct({
+    ...SessionRowSchema.fields,
+    damaged: Schema.Literals([0, 1]),
+}), closed);
+/**
+ * The Session row every reader and writer of one Session starts from. A
+ * Session the lineage audit found broken is refused here, so no read of it
+ * and no write to it gets further.
+ */
 function readSessionRow(owner, sessionId) {
     const raw = owner.sql
-        .exec("SELECT id, leaf_id FROM sessions WHERE id = ?", sessionId)
+        .exec(`SELECT id, leaf_id,
+              EXISTS (SELECT 1 FROM session_lineage_damage
+                       WHERE session_id = sessions.id) AS damaged
+         FROM sessions WHERE id = ?`, sessionId)
         .toArray()[0];
-    return raw === undefined ? undefined : parseSessionRow(raw);
+    if (raw === undefined)
+        return undefined;
+    const decoded = decodeReadableSessionRow(raw);
+    if (decoded._tag === "Failure")
+        throw unavailable("Stored Session row is invalid");
+    if (decoded.success.damaged === 1)
+        throw brokenSession(owner, sessionId);
+    return Object.freeze({
+        id: decoded.success.id,
+        leaf_id: decoded.success.leaf_id,
+    });
 }
 function readEntryRow(owner, sessionId, id) {
     const raw = owner.sql
-        .exec(`SELECT id, session_id, parent_id, sequence, type, role, state,
-              request_id, work_id, data_json, timestamp, completed_at
+        .exec(`SELECT ${entryColumns}
          FROM session_entries
         WHERE session_id = ? AND id = ?`, sessionId, id)
         .toArray()[0];
-    return raw === undefined ? undefined : parseEntryRow(raw);
+    return raw === undefined ? undefined : parseEntryRow(owner, raw);
 }
 function validateCompleteSessionLeaf(owner, session) {
     if (session.leaf_id === null) {
@@ -462,12 +506,11 @@ function validateCompleteSessionLeaf(owner, session) {
 /** Read one retained Session entry by its globally unique row identity. */
 export function readSessionEntryById(owner, id) {
     const raw = owner.sql
-        .exec(`SELECT id, session_id, parent_id, sequence, type, role, state,
-              request_id, work_id, data_json, timestamp, completed_at
+        .exec(`SELECT ${entryColumns}
          FROM session_entries
         WHERE id = ?`, id)
         .toArray()[0];
-    return raw === undefined ? undefined : parseEntryRow(raw);
+    return raw === undefined ? undefined : parseEntryRow(owner, raw);
 }
 function readCommandAdmission(owner, sessionId, lookup) {
     const [column, value] = "id" in lookup
@@ -491,6 +534,36 @@ const pendingAdmissions = `FROM session_command_admissions AS a
        WHERE e.session_id = a.session_id AND e.work_id = a.work_id
          AND e.type IN ('command', 'cancellation', 'run_terminal', 'work_terminal')
     )`;
+const decodeIdentity = Schema.decodeUnknownSync(Schema.Struct({ identity: Schema.NullOr(Schema.String) }));
+/** Extract the host-selected principal without giving the engine domain grammar. */
+export function readAdmissionIdentity(owner, path, meta) {
+    const { identity } = decodeIdentity(owner.sql
+        .exec("SELECT json_extract(?, ?) AS identity", JSON.stringify(meta ?? null), path)
+        .one());
+    if (identity === null || identity.length === 0)
+        throw new ShiitakeError("runtime", "rejected", "Request author is required");
+    return { path, value: identity };
+}
+/** Immutable admission author check; used before every exact cancellation, including replay. */
+export function assertAdmissionIdentity(owner, sessionId, commandId, identity) {
+    const admission = readSessionCommandAdmission(owner, sessionId, commandId);
+    if (admission === undefined)
+        return;
+    const stored = readAdmissionIdentity(owner, identity.path, admission.entry.meta);
+    if (stored.value !== identity.value)
+        throw new ShiitakeError("runtime", "rejected", "Message author does not match");
+}
+/** Read just one newest admission; FIFO execution and oldest-first paging are unchanged. */
+export function readNewestPendingSessionCommand(owner, sessionId, identity) {
+    const raw = owner.sql
+        .exec(`SELECT ${admissionColumns("a.")} ${pendingAdmissions}
+       AND json_extract(a.data_json, '$.work') IS NULL
+       AND a.origin_kind = 'user'
+       AND (? IS NULL OR json_extract(json_extract(a.data_json, '$.meta'), ?) = ?)
+     ORDER BY a.sequence DESC LIMIT 1`, sessionId, identity?.path ?? null, identity?.path ?? null, identity?.value ?? null)
+        .toArray()[0];
+    return raw === undefined ? undefined : parseCommandAdmissionRow(raw);
+}
 const decodePendingCount = Schema.decodeUnknownSync(Schema.Struct({
     total: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
 }));
@@ -575,14 +648,22 @@ export function settleSessionControls(owner, input) {
                 });
                 continue;
             }
+            // Only a delivered control shares its failed parent's safe reason.
+            // Late, unmaterialized work was requeued above and owns its own outcome.
+            const diagnostic = input.outcome === "failed" || input.outcome === "interrupted"
+                ? input.diagnostic
+                : undefined;
+            let entry = {
+                kind: "work_terminal",
+                workId: row.entry.workId,
+                outcome: input.outcome,
+            };
+            if (diagnostic !== undefined)
+                entry = { ...entry, diagnostic };
             appendSessionEntry(owner, {
                 sessionId: input.sessionId,
                 id: sessionIds.fact.generate(),
-                entry: {
-                    kind: "work_terminal",
-                    workId: row.entry.workId,
-                    outcome: input.outcome,
-                },
+                entry,
             });
         }
     });
@@ -601,20 +682,21 @@ export function readSessionCommandAdmissionByRequest(owner, sessionId, requestId
 }
 /** Read entries correlated to one accepted work identity in Session order. */
 export function readSessionEntriesForWork(owner, sessionId, workId) {
+    // Refuse the Session before selecting entries: a damaged work may have no
+    // rows left, so decoding the result cannot establish that it is readable.
+    readSessionRow(owner, sessionId);
     return Object.freeze(owner.sql
-        .exec(`SELECT id, session_id, parent_id, sequence, type, role, state,
-                request_id, work_id, data_json, timestamp, completed_at
+        .exec(`SELECT ${entryColumns}
            FROM session_entries
           WHERE session_id = ? AND work_id = ?
           ORDER BY sequence ASC`, sessionId, workId)
         .toArray()
-        .map(parseEntryRow));
+        .map((raw) => parseEntryRow(owner, raw)));
 }
 /** Read the latest retained live-retry event for one accepted work item. */
 export function readLatestLiveRetryForWork(owner, sessionId, workId) {
     const raw = owner.sql
-        .exec(`SELECT id, session_id, parent_id, sequence, type, role, state,
-              request_id, work_id, data_json, timestamp, completed_at
+        .exec(`SELECT ${entryColumns}
          FROM session_entries
         WHERE session_id = ? AND work_id = ? AND type = 'live_retry'
         ORDER BY sequence DESC
@@ -622,7 +704,7 @@ export function readLatestLiveRetryForWork(owner, sessionId, workId) {
         .toArray()[0];
     if (raw === undefined)
         return undefined;
-    const row = parseEntryRow(raw);
+    const row = parseEntryRow(owner, raw);
     if (row.entry.kind !== "live_retry")
         throw unavailable("Stored live retry entry is invalid");
     return { event: row.entry.event, timestamp: row.timestamp };
@@ -639,10 +721,7 @@ export function hasSuccessfulToolResult(owner, sessionId, workId, toolCallId) {
 /** Most recent tool intent without a matching outcome for the running work. */
 export function readActiveToolForWork(owner, sessionId, workId) {
     const raw = owner.sql
-        .exec(`SELECT intent.id, intent.session_id, intent.parent_id,
-              intent.sequence, intent.type, intent.role, intent.state,
-              intent.request_id, intent.work_id, intent.data_json,
-              intent.timestamp, intent.completed_at
+        .exec(`SELECT ${entryColumnsOf("intent")}
          FROM session_entries AS intent
         WHERE intent.session_id = ? AND intent.work_id = ?
           AND intent.type = 'tool_intent'
@@ -659,7 +738,7 @@ export function readActiveToolForWork(owner, sessionId, workId) {
         .toArray()[0];
     if (raw === undefined)
         return undefined;
-    const row = parseEntryRow(raw);
+    const row = parseEntryRow(owner, raw);
     if (row.entry.kind !== "tool_intent")
         throw unavailable("Stored tool intent is invalid");
     return row.entry.call.name;
@@ -737,12 +816,15 @@ admitNew) {
  */
 export function deleteStoredSession(owner, input) {
     return owner.transactionSync(() => {
-        if (readSessionRow(owner, input.sessionId) === undefined)
+        // A Session the lineage audit refused can still be deleted.
+        const exists = owner.sql
+            .exec("SELECT id FROM sessions WHERE id = ?", input.sessionId)
+            .toArray().length > 0;
+        if (!exists)
             return false;
         input.assertIdleSession(input.sessionId);
         input.recordInboxDeletion(input.sessionId);
         for (const statement of [
-            "DELETE FROM session_entries WHERE session_id = ?",
             "DELETE FROM session_command_admissions WHERE session_id = ?",
             // The inbox row references the Session; it goes in the same transaction.
             "DELETE FROM session_attention WHERE session_id = ?",
@@ -750,13 +832,20 @@ export function deleteStoredSession(owner, input) {
             "DELETE FROM session_inbox WHERE session_id = ?",
             "DELETE FROM session_creation_receipts WHERE session_id = ?",
             "DELETE FROM sessions WHERE id = ?",
+            // Entries go last: only a removed Session's lineage may lose parents.
+            "DELETE FROM session_entries WHERE session_id = ?",
+            "DELETE FROM session_lineage_damage WHERE session_id = ?",
         ])
             owner.sql.exec(statement, input.sessionId);
         return true;
     });
 }
-/** The exact Woodstock SQL shape this build reads and writes. */
-const currentWoodstockSchemaVersion = 1;
+/**
+ * Version 3 keeps application tool data outside model messages/results.
+ * Older preview stores require explicit host custody; no compatibility reader
+ * or automatic rewrite runs when the store opens.
+ */
+const currentWoodstockSchemaVersion = 3;
 const currentWoodstockProtocol = "shiitake.extension/v0";
 function tableExists(owner, name) {
     const rows = owner.sql
@@ -786,10 +875,12 @@ function readWoodstockStoreProtocol(owner) {
     if (rows.length !== 1)
         return "unmarked";
     const decoded = decodeWoodstockSchemaVersionRow(rows[0]);
-    return decoded._tag === "Success" &&
-        decoded.success.version === currentWoodstockSchemaVersion
-        ? "v0"
-        : "unmarked";
+    if (decoded._tag !== "Success")
+        return "unmarked";
+    // The decoder already requires the current protocol literal.
+    if (decoded.success.version === currentWoodstockSchemaVersion)
+        return "v0";
+    return "unmarked";
 }
 /** Stamp fresh Woodstock stores; incompatible files require host-side custody. */
 function ensureWoodstockSchemaVersion(owner) {
@@ -797,7 +888,7 @@ function ensureWoodstockSchemaVersion(owner) {
     if (protocol === "v0")
         return;
     if (protocol === "unmarked")
-        throw incompatible("Woodstock store has no v0 protocol marker; a hosted store never resets itself — reset the owning Durable Object storage, or remove the old local store file before opening a fresh one");
+        throw incompatible("Woodstock store has no current v0 schema marker; incompatible storage requires explicit host custody. To reset, stop the owning host before resetting a local store, then remove its database file and the file's .owner.sqlite sidecar. Reset discards that store's data. For the Hub, a Hub Agent is erased only with its Team; Team erasure is destructive and separately authorized, never a routine single-Agent repair. No migration runs.");
     owner.sql.exec("CREATE TABLE woodstock_schema (version INTEGER NOT NULL, protocol TEXT NOT NULL)");
     owner.sql.exec("INSERT INTO woodstock_schema (version, protocol) VALUES (?, ?)", currentWoodstockSchemaVersion, currentWoodstockProtocol);
 }
@@ -820,6 +911,201 @@ function createSessionEntryTable(owner) {
     )
   `);
 }
+const lineageGuards = [
+    "session_entries_lineage_insert",
+    "session_entries_lineage_update",
+    "session_entries_lineage_delete",
+    "session_entries_damaged_session",
+    "session_entries_lineage_replace",
+    "session_entries_lineage_replace_position",
+];
+const decodeInstalledGuards = Schema.decodeUnknownResult(Schema.Struct({
+    installed: Schema.Int.pipe(Schema.check(Schema.isGreaterThanOrEqualTo(0))),
+}), closed);
+const decodeDamagedSession = Schema.decodeUnknownResult(Schema.Struct({ session_id: Schema.String }), closed);
+/** What a writer to a Session the lineage audit found broken is told. */
+const brokenSessionMessage = "Woodstock Session holds a broken lineage; a store never repairs itself — delete this Session (deleteSession), or reset the owning store";
+const decodeDamageCount = Schema.decodeUnknownResult(Schema.Struct({
+    damaged: Schema.Int.pipe(Schema.check(Schema.isGreaterThan(0))),
+    first: Schema.String,
+}), closed);
+/**
+ * The refusal of every read of, and write to, a Session the lineage audit
+ * found broken. Work settled for it carries `diagnostic`, a bounded form of
+ * the message that still names the Session and its reset.
+ */
+export class BrokenSessionError extends ShiitakeError {
+    store;
+    sessionId;
+    constructor(store, sessionId, message) {
+        super("store", "unavailable", message);
+        this.store = store;
+        this.sessionId = sessionId;
+    }
+    get diagnostic() {
+        return `${this.store}: Woodstock Session ${this.sessionId} holds a broken lineage; delete it with deleteSession("${this.sessionId}"), or reset the owning store`;
+    }
+}
+/** The refusal of one Session the lineage audit found broken, naming its store. */
+function brokenSession(owner, sessionId) {
+    const store = owner.storeName ?? "Woodstock store";
+    return new BrokenSessionError(store, sessionId, `${store}: ${brokenSessionRefusal(owner, sessionId)}`);
+}
+/**
+ * Whether the lineage audit refused this Session. Settlement asks before it
+ * records anything in the Session, which it can no longer write.
+ */
+export function sessionLineageRefused(owner, sessionId) {
+    return (owner.sql
+        .exec("SELECT session_id FROM session_lineage_damage WHERE session_id = ?", sessionId)
+        .toArray().length > 0);
+}
+/**
+ * What a reader of a broken Session is told: which Session, how many of this
+ * store's Sessions the audit found broken and the first of them, and the
+ * steps that clear it.
+ */
+function brokenSessionRefusal(owner, sessionId) {
+    const decoded = decodeDamageCount(owner.sql
+        .exec("SELECT COUNT(*) AS damaged, MIN(session_id) AS first FROM session_lineage_damage")
+        .one());
+    if (decoded._tag === "Failure")
+        throw unavailable("Stored Session lineage damage is invalid");
+    const { damaged, first } = decoded.success;
+    return `Woodstock Session ${sessionId} holds a broken lineage (this store has ${String(damaged)} damaged Session${damaged === 1 ? "" : "s"}, first ${first}); a store never repairs itself — delete this Session with deleteSession("${sessionId}"), or reset the owning store: for a Durable Object, erase all of its storage (DurableObjectStorage.deleteAll(); a Hub Agent is erased only with its Team, POST /operator/teams/:teamId/erasure-durable-objects); for a local store, remove its file and the file's .owner.sqlite sidecar`;
+}
+/**
+ * Every lineage stays whole by construction, enforced where it is written
+ * rather than re-walked where it is read. Each entry's parent is an earlier
+ * complete entry of its own Session, each Session has one complete root, the
+ * lineage columns never change, and a parent is never removed from under a
+ * child while its Session exists. So every walk from a complete leaf reaches
+ * that one root over complete rows of falling sequence, and readers walk only
+ * the rows they return.
+ *
+ * A store written while any guard was missing is audited as they are
+ * installed. Each Session that breaks them is recorded in
+ * `session_lineage_damage`, in the same pass: its inbox row turns
+ * unavailable, every read of it is refused and no entry is written to it,
+ * while every other Session opens and works as before. The guards only judge
+ * later writes, and each judges one Session, so a damaged Session never
+ * blocks installing them or writing elsewhere. Deleting the Session clears it.
+ */
+function guardSessionLineage(owner) {
+    owner.sql.exec("CREATE TABLE IF NOT EXISTS session_lineage_damage (session_id TEXT PRIMARY KEY)");
+    const installed = decodeInstalledGuards(owner.sql
+        .exec(`SELECT COUNT(*) AS installed FROM sqlite_master
+          WHERE type = 'trigger'
+            AND name IN (SELECT value FROM json_each(?))`, JSON.stringify(lineageGuards))
+        .one());
+    if (installed._tag === "Failure")
+        throw unavailable("Stored Session lineage guards are invalid");
+    if (installed.success.installed !== lineageGuards.length) {
+        const damaged = owner.sql
+            .exec(`SELECT child.session_id AS session_id
+           FROM session_entries AS child
+           LEFT JOIN session_entries AS parent ON parent.id = child.parent_id
+          WHERE child.parent_id IS NOT NULL
+            AND (parent.id IS NULL
+                 OR parent.session_id != child.session_id
+                 OR parent.state != 'complete'
+                 OR parent.sequence >= child.sequence)
+         UNION
+         SELECT session_id FROM session_entries
+          WHERE parent_id IS NULL AND state = 'complete'
+          GROUP BY session_id HAVING COUNT(*) > 1`)
+            .toArray()
+            .map((raw) => {
+            const decoded = decodeDamagedSession(raw);
+            if (decoded._tag === "Failure")
+                throw unavailable("Stored Session lineage audit is invalid");
+            return decoded.success.session_id;
+        });
+        for (const sessionId of damaged) {
+            owner.sql.exec("INSERT OR IGNORE INTO session_lineage_damage (session_id) VALUES (?)", sessionId);
+            touchSessionInbox(owner, { sessionId, title: null });
+        }
+    }
+    // SQLite fires DELETE triggers for the row an INSERT OR REPLACE removes
+    // only under PRAGMA recursive_triggers, which is off by default and which
+    // Woodstock never turns on. So the delete guard cannot see a REPLACE; this
+    // guard refuses a replacing row that would leave the replaced row's
+    // children under a streaming, later or foreign parent.
+    owner.sql.exec(`
+    CREATE TRIGGER IF NOT EXISTS session_entries_lineage_replace
+    BEFORE INSERT ON session_entries
+    WHEN EXISTS (
+      SELECT 1 FROM session_entries AS child
+       WHERE child.parent_id = NEW.id
+         AND (child.session_id != NEW.session_id
+              OR child.sequence <= NEW.sequence
+              OR NEW.state != 'complete'))
+    BEGIN
+      SELECT RAISE(ABORT, 'Session entry would strand its children');
+    END
+  `);
+    // REPLACE also resolves the UNIQUE (session_id, sequence) conflict by
+    // deleting whichever row holds that position, under any id. Refuse a
+    // replacing row whose position belongs to another row with children.
+    owner.sql.exec(`
+    CREATE TRIGGER IF NOT EXISTS session_entries_lineage_replace_position
+    BEFORE INSERT ON session_entries
+    WHEN EXISTS (
+      SELECT 1 FROM session_entries AS held
+        JOIN session_entries AS child ON child.parent_id = held.id
+       WHERE held.session_id = NEW.session_id
+         AND held.sequence = NEW.sequence
+         AND held.id != NEW.id)
+    BEGIN
+      SELECT RAISE(ABORT, 'Session entry would strand its children');
+    END
+  `);
+    owner.sql.exec(`
+    CREATE TRIGGER IF NOT EXISTS session_entries_damaged_session
+    BEFORE INSERT ON session_entries
+    WHEN EXISTS (
+      SELECT 1 FROM session_lineage_damage WHERE session_id = NEW.session_id)
+    BEGIN
+      SELECT RAISE(ABORT, '${brokenSessionMessage}');
+    END
+  `);
+    owner.sql.exec(`
+    CREATE TRIGGER IF NOT EXISTS session_entries_lineage_insert
+    BEFORE INSERT ON session_entries
+    BEGIN
+      SELECT RAISE(ABORT, 'Session entry parent is not an earlier complete entry of its Session')
+       WHERE NEW.parent_id IS NOT NULL AND NOT EXISTS (
+         SELECT 1 FROM session_entries AS parent
+          WHERE parent.id = NEW.parent_id
+            AND parent.session_id = NEW.session_id
+            AND parent.state = 'complete'
+            AND parent.sequence < NEW.sequence);
+      SELECT RAISE(ABORT, 'Session already has a root entry')
+       WHERE NEW.parent_id IS NULL AND EXISTS (
+         SELECT 1 FROM session_entries AS other
+          WHERE other.session_id = NEW.session_id
+            AND other.state = 'complete'
+            AND other.id != NEW.id);
+    END
+  `);
+    owner.sql.exec(`
+    CREATE TRIGGER IF NOT EXISTS session_entries_lineage_update
+    BEFORE UPDATE OF id, session_id, parent_id, sequence, state
+    ON session_entries
+    BEGIN
+      SELECT RAISE(ABORT, 'Session entry lineage columns are immutable');
+    END
+  `);
+    owner.sql.exec(`
+    CREATE TRIGGER IF NOT EXISTS session_entries_lineage_delete
+    BEFORE DELETE ON session_entries
+    WHEN EXISTS (SELECT 1 FROM sessions WHERE id = OLD.session_id)
+     AND EXISTS (SELECT 1 FROM session_entries WHERE parent_id = OLD.id)
+    BEGIN
+      SELECT RAISE(ABORT, 'Session entry still has children');
+    END
+  `);
+}
 /** Create the retained Session schema and private creation/admission receipts. */
 export function prepareSessionStore(owner) {
     owner.transactionSync(() => {
@@ -853,10 +1139,26 @@ export function prepareSessionStore(owner) {
        ON session_entries(session_id, request_id)
        WHERE request_id IS NOT NULL`);
         owner.sql.exec("CREATE INDEX IF NOT EXISTS idx_session_entries_work ON session_entries(work_id, sequence)");
+        // Context and preference reads look up these rare older facts directly
+        // rather than walking the history behind them.
+        owner.sql.exec(`CREATE INDEX IF NOT EXISTS idx_session_entries_model_preference
+       ON session_entries(session_id, sequence)
+       WHERE type = 'model_preference'`);
+        owner.sql.exec(`CREATE INDEX IF NOT EXISTS idx_session_entries_cancellation_target
+       ON session_entries(session_id, json_extract(data_json, '$.targetWorkId'))
+       WHERE type = 'cancellation'`);
         owner.sql
             .exec(`CREATE INDEX IF NOT EXISTS idx_session_entries_successful_tool
       ON session_entries(session_id, work_id, json_extract(data_json, '$.call.id'))
       WHERE type = 'tool_outcome' AND json_extract(data_json, '$.result.isError') = 0`);
+        guardSessionLineage(owner);
+        owner.sql.exec(`
+    CREATE TABLE IF NOT EXISTS session_request_withdrawals (
+      session_id TEXT NOT NULL,
+      request_id TEXT NOT NULL,
+      PRIMARY KEY (session_id, request_id)
+    )
+  `);
         owner.sql.exec(`
     CREATE TABLE IF NOT EXISTS session_command_admissions (
       id TEXT PRIMARY KEY,
@@ -882,7 +1184,10 @@ export function prepareSessionStore(owner) {
 }
 /** Read the nullable preference at exactly this selected lineage. */
 export function readSessionModelPreference(owner, sessionId) {
-    return lineageModelPreference(owner, readSessionLineage(owner, { sessionId }));
+    const leaf = readSessionRow(owner, sessionId)?.leaf_id;
+    return leaf === undefined || leaf === null
+        ? null
+        : lineageModelPreference(owner, sessionId, leaf);
 }
 /**
  * Woodstock order of the newest model choice on the selected lineage, or null.
@@ -892,26 +1197,7 @@ export function readLastModelChoiceSequence(owner, sessionId) {
     const leaf = readSessionRow(owner, sessionId)?.leaf_id;
     if (leaf === undefined || leaf === null)
         return null;
-    const raw = owner.sql
-        .exec(`WITH RECURSIVE branch (id, parent_id, sequence, type, state) AS (
-         SELECT id, parent_id, sequence, type, state
-           FROM session_entries
-          WHERE session_id = ? AND id = ?
-         UNION
-         SELECT parent.id, parent.parent_id, parent.sequence, parent.type,
-                parent.state
-           FROM session_entries AS parent
-           JOIN branch AS child ON parent.id = child.parent_id
-          WHERE parent.session_id = ?
-       )
-       SELECT MAX(sequence) AS sequence
-         FROM branch
-        WHERE type = 'model_preference' AND state != 'streaming'`, sessionId, leaf, sessionId)
-        .one();
-    const decoded = decodeModelChoiceRow(raw);
-    if (decoded._tag === "Failure")
-        throw unavailable("Stored model choice order is invalid");
-    return decoded.success.sequence;
+    return newestLineagePreference(owner, sessionId, leaf)?.sequence ?? null;
 }
 /** Append a decoded preference request; no command or scheduler work is minted. */
 export function setSessionModelPreference(owner, sessionId, preference) {
@@ -929,7 +1215,12 @@ export function setSessionModelPreference(owner, sessionId, preference) {
 export function setSessionTitle(owner, sessionId, title) {
     owner.transactionSync(() => {
         ensureSession(owner, sessionId);
-        owner.sql.exec("UPDATE sessions SET metadata_json = ? WHERE id = ?", title === null ? null : encodeSessionMetadata({ title }), sessionId);
+        const metadata = title === null ? null : encodeSessionMetadata({ title });
+        if (owner.sql
+            .exec("SELECT 1 FROM sessions WHERE id = ? AND metadata_json IS ?", sessionId, metadata)
+            .toArray().length > 0)
+            return;
+        owner.sql.exec("UPDATE sessions SET metadata_json = ? WHERE id = ?", metadata, sessionId);
         touchSessionInbox(owner, {
             sessionId,
             title: inboxTitle(owner, sessionId),
@@ -1022,16 +1313,8 @@ export function completeSessionLeaf(owner, input) {
         throw unavailable("Completed Session leaf is unavailable");
     return completed;
 }
-const entryColumns = `id, session_id, parent_id, sequence, type, role, state,
-       request_id, work_id, data_json, timestamp, completed_at`;
 /** Rows one bounded lineage read decodes at once. */
 export const lineageRowLimit = 200;
-/**
- * Stored bytes one model context read may decode: the retained storage
- * plane's `LLM_CONTEXT_BYTES`, now a typed refusal rather than a silent
- * truncation, because a truncated context would change the model's input.
- */
-export const contextByteLimit = 12 * 1_048_576;
 /**
  * Rows one fork copy window decodes. A fork copies the whole lineage, so a
  * wide window keeps the walks few; the byte bound still caps each window.
@@ -1047,17 +1330,22 @@ const lineageByteLimit = 4 * 1_048_576;
  * law); entry data is read afterwards for exactly the rows a reader needs.
  * The selected walk drops streaming placeholders after walking; the fork walk
  * stops at them, as a fork copies only complete history.
+ * Each walk descends from the tip only while it is above a floor sequence,
+ * so a reader of recent rows never visits the history behind them. The
+ * selected walk steps only to an older parent, so it ends without
+ * deduplicating; the fork walk keeps every link for its whole-lineage check.
  */
 const lineageWalks = {
     selected: `WITH RECURSIVE branch (id, parent_id, sequence, state) AS (
        SELECT id, parent_id, sequence, state
          FROM session_entries
         WHERE session_id = ? AND id = ?
-       UNION
+       UNION ALL
        SELECT parent.id, parent.parent_id, parent.sequence, parent.state
          FROM session_entries AS parent
          JOIN branch AS child ON parent.id = child.parent_id
-        WHERE parent.session_id = ?
+        WHERE parent.session_id = ? AND child.sequence > ?
+          AND +parent.sequence < child.sequence
      )`,
     fork: `WITH RECURSIVE branch (id, parent_id, sequence, state) AS (
        SELECT id, parent_id, sequence, state
@@ -1067,7 +1355,8 @@ const lineageWalks = {
        SELECT parent.id, parent.parent_id, parent.sequence, parent.state
          FROM session_entries AS parent
          JOIN branch AS child ON parent.id = child.parent_id
-        WHERE parent.session_id = ? AND parent.state != 'streaming'
+        WHERE parent.session_id = ? AND child.sequence > ?
+          AND parent.state != 'streaming'
      )`,
 };
 const lineageFailures = {
@@ -1091,18 +1380,23 @@ const decodeLineageCheck = Schema.decodeUnknownResult(Schema.Struct({
     newest_id: Schema.NullOr(boundedId),
     newest_sequence: Schema.NullOr(sequence),
 }), closed);
-const decodeLineageSize = Schema.decodeUnknownResult(Schema.Struct({ sequence, bytes: count }), closed);
-const decodeContextBytes = Schema.decodeUnknownResult(Schema.Struct({ bytes: count }), closed);
 const decodeLineageSequence = Schema.decodeUnknownResult(Schema.Struct({ sequence }), closed);
-const decodeFirstKept = Schema.decodeUnknownResult(Schema.Struct({ first_kept: boundedId }), closed);
 const decodeLineageWorkId = Schema.decodeUnknownResult(Schema.Struct({ work_id: boundedId }), closed);
 const decodeLineageDiagnostic = Schema.decodeUnknownResult(Schema.Struct({ work_id: boundedId, diagnostic: Schema.String }), closed);
-function lineageQuery(owner, lineage, query, ...bindings) {
+/**
+ * Run one query over the lineage rows above `floor`: the walk descends from
+ * the tip while its rows are above it, so only those rows, and the first at
+ * or below it, are visited.
+ */
+function lineageQuery(owner, lineage, floor, query, ...bindings) {
     return owner.sql
-        .exec(`${lineageWalks[lineage.walk]} ${query}`, lineage.sessionId, lineage.tipId, lineage.sessionId, ...bindings)
+        .exec(`${lineageWalks[lineage.walk]} ${query}`, lineage.sessionId, lineage.tipId, lineage.sessionId, floor, ...bindings)
         .toArray();
 }
-/** Validate one root-to-tip chain in SQL, the same way decoded rows would be. */
+/**
+ * Walk and check one whole root-to-tip chain in SQL, the same way decoded
+ * rows would be. A fork copies every row of it, so it checks every row.
+ */
 function locateLineage(owner, sessionId, tipId, walk) {
     const failures = lineageFailures[walk];
     const checked = decodeLineageCheck(owner.sql
@@ -1124,7 +1418,7 @@ function locateLineage(owner, sessionId, tipId, walk) {
              WHERE previous IS NOT NULL AND parent_id IS NOT previous) AS broken,
            (SELECT id FROM kept ORDER BY sequence DESC LIMIT 1) AS newest_id,
            (SELECT sequence FROM kept ORDER BY sequence DESC LIMIT 1)
-             AS newest_sequence`, sessionId, tipId, sessionId)
+             AS newest_sequence`, sessionId, tipId, sessionId, 0)
         .one());
     if (checked._tag === "Failure")
         throw unavailable("Stored Session lineage check is invalid");
@@ -1147,38 +1441,147 @@ function locateLineage(owner, sessionId, tipId, walk) {
         newestSequence: lineage.newest_sequence,
     });
 }
-/** Locate the selected lineage; undefined when the Session has no leaf. */
+const decodeLineageEnds = Schema.decodeUnknownResult(Schema.Struct({
+    state: Schema.Literals(["complete", "streaming"]),
+    newest_sequence: sequence,
+    root_id: Schema.NullOr(boundedId),
+    root_parent_id: Schema.NullOr(Schema.String),
+}), closed);
+/**
+ * Locate a selected lineage from its two ends; undefined when the Session
+ * has no leaf. The guards make a Session's one complete root the root of
+ * every lineage in it, so neither end needs a walk.
+ */
 export function readSessionLineage(owner, input) {
-    const tip = input.leafId ?? readSessionRow(owner, input.sessionId)?.leaf_id;
+    // Read the Session row even for an explicit tip: it refuses a broken one.
+    const session = readSessionRow(owner, input.sessionId);
+    const tip = input.leafId ?? session?.leaf_id;
     if (tip === undefined || tip === null)
         return undefined;
-    return locateLineage(owner, input.sessionId, tip, "selected");
+    const failures = lineageFailures.selected;
+    const raw = owner.sql
+        .exec(`SELECT tip.state AS state, tip.sequence AS newest_sequence,
+              root.id AS root_id, root.parent_id AS root_parent_id
+         FROM session_entries AS tip
+         LEFT JOIN (
+           SELECT id, parent_id FROM session_entries
+            WHERE session_id = ? AND state = 'complete'
+            ORDER BY sequence ASC LIMIT 1
+         ) AS root
+        WHERE tip.session_id = ? AND tip.id = ?`, input.sessionId, input.sessionId, tip)
+        .toArray()[0];
+    if (raw === undefined)
+        throw unavailable(failures.empty);
+    const ends = decodeLineageEnds(raw);
+    if (ends._tag === "Failure")
+        throw unavailable("Stored Session lineage ends are invalid");
+    if (ends.success.state !== "complete" || ends.success.root_id === null)
+        throw unavailable(failures.empty);
+    if (ends.success.root_parent_id !== null)
+        throw unavailable(failures.missingParent);
+    return Object.freeze({
+        sessionId: input.sessionId,
+        walk: "selected",
+        tipId: tip,
+        rootId: ends.success.root_id,
+        newestId: tip,
+        newestSequence: ends.success.newest_sequence,
+    });
 }
 function readLineageRange(owner, lineage, oldest, newest) {
-    return Object.freeze(lineageQuery(owner, lineage, `SELECT ${entryColumns}
+    const rows = Object.freeze(lineageQuery(owner, lineage, oldest - 1, `SELECT ${entryColumns}
          FROM session_entries
         WHERE session_id = ? AND state != 'streaming'
           AND sequence BETWEEN ? AND ?
           AND id IN (SELECT id FROM branch)
-        ORDER BY sequence ASC`, lineage.sessionId, oldest, newest).map(parseEntryRow));
+        ORDER BY sequence ASC`, lineage.sessionId, oldest, newest).map((raw) => parseEntryRow(owner, raw)));
+    // The walk stopped at the range or at the root, never at a missing parent.
+    const failures = lineageFailures.selected;
+    const deepest = rows[0];
+    if (deepest !== undefined &&
+        deepest.parentId !== null &&
+        deepest.sequence !== oldest)
+        throw unavailable(failures.missingParent);
+    let previous;
+    for (const row of rows) {
+        if (previous !== undefined && row.parentId !== previous.id)
+            throw unavailable(failures.invalid);
+        previous = row;
+    }
+    return rows;
+}
+const decodeWindowSizes = Schema.decodeUnknownResult(Schema.Struct({
+    sizes: Schema.fromJsonString(Schema.Array(Schema.Tuple([sequence, count]))),
+    deepest_parent: Schema.NullOr(Schema.String),
+    deepest_sequence: Schema.NullOr(sequence),
+}), closed);
+/**
+ * Sizes of up to `rows` lineage rows inside the bounds, newest or oldest
+ * first. A newest window's walk counts its rows as it descends and stops once
+ * it holds that many; an oldest window's walk stops at `after`. Either way the
+ * walk visits the rows from the tip down to the window, never the history
+ * below it. The deepest walked row comes back with the sizes, so a walk that
+ * ended at a missing parent above where it meant to stop is refused, never
+ * read as the end of history.
+ */
+function readWindowSizes(owner, lineage, from, after, before, rows) {
+    const ends = `SELECT
+         (SELECT json_group_array(json_array(sequence, bytes)) FROM (
+            SELECT sequence, LENGTH(CAST(data_json AS BLOB)) AS bytes
+              FROM session_entries
+             WHERE ${from === "newest" ? "" : "session_id = ? AND"}
+                   state != 'streaming'
+               AND sequence > ? AND sequence < ?
+               AND id IN (SELECT id FROM branch)
+             ORDER BY sequence ${from === "newest" ? "DESC" : "ASC"}
+             LIMIT ?)) AS sizes,
+         (SELECT parent_id FROM branch ORDER BY sequence ASC LIMIT 1)
+           AS deepest_parent,
+         (SELECT sequence FROM branch ORDER BY sequence ASC LIMIT 1)
+           AS deepest_sequence`;
+    const counts = (row) => `CASE WHEN ${row}.state != 'streaming'
+               AND ${row}.sequence < ? AND ${row}.sequence > ?
+          THEN 1 ELSE 0 END`;
+    const raw = from === "newest"
+        ? owner.sql
+            .exec(`WITH RECURSIVE branch (id, parent_id, sequence, state, taken) AS (
+               SELECT id, parent_id, sequence, state,
+                      ${counts("session_entries")}
+                 FROM session_entries
+                WHERE session_id = ? AND id = ?
+               UNION ALL
+               SELECT parent.id, parent.parent_id, parent.sequence, parent.state,
+                      child.taken + ${counts("parent")}
+                 FROM session_entries AS parent
+                 JOIN branch AS child ON parent.id = child.parent_id
+                WHERE parent.session_id = ? AND +parent.sequence < child.sequence
+                  AND child.taken < ? AND child.sequence > ?
+             )
+             ${ends}`, before, after, lineage.sessionId, lineage.tipId, before, after, lineage.sessionId, rows, after, after, before, rows)
+            .toArray()
+        : lineageQuery(owner, lineage, after, ends, lineage.sessionId, after, before, rows);
+    const decoded = decodeWindowSizes(raw[0]);
+    if (decoded._tag === "Failure")
+        throw unavailable("Stored Session entry size is invalid");
+    const { sizes, deepest_parent, deepest_sequence } = decoded.success;
+    const stopped = deepest_parent === null ||
+        deepest_sequence === null ||
+        deepest_sequence <= after ||
+        (from === "newest" && sizes.length === rows);
+    if (!stopped)
+        throw unavailable(lineageFailures.selected.missingParent);
+    return Object.freeze(sizes
+        .map(([rowSequence, bytes]) => ({ sequence: rowSequence, bytes }))
+        .sort((left, right) => from === "newest"
+        ? right.sequence - left.sequence
+        : left.sequence - right.sequence));
 }
 /**
  * Read one contiguous window of a lineage, bounded by row count and by stored
  * bytes. Row sizes are measured in SQL before any entry is decoded.
  */
 export function readLineageWindow(owner, lineage, input) {
-    const sizes = lineageQuery(owner, lineage, `SELECT sequence, LENGTH(CAST(data_json AS BLOB)) AS bytes
-       FROM session_entries
-      WHERE session_id = ? AND state != 'streaming'
-        AND sequence > ? AND sequence < ?
-        AND id IN (SELECT id FROM branch)
-      ORDER BY sequence ${input.from === "newest" ? "DESC" : "ASC"}
-      LIMIT ?`, lineage.sessionId, input.after ?? 0, input.before ?? Number.MAX_SAFE_INTEGER, input.rows + 1).map((raw) => {
-        const decoded = decodeLineageSize(raw);
-        if (decoded._tag === "Failure")
-            throw unavailable("Stored Session entry size is invalid");
-        return decoded.success;
-    });
+    const sizes = readWindowSizes(owner, lineage, input.from, input.after ?? 0, input.before ?? Number.MAX_SAFE_INTEGER, input.rows + 1);
     let taken = 0;
     let bytes = 0;
     for (const size of sizes) {
@@ -1200,45 +1603,59 @@ export function readLineageWindow(owner, lineage, input) {
 }
 /** Whether a complete row with this sequence lies on the lineage. */
 export function lineageHasSequence(owner, lineage, rowSequence) {
-    return (lineageQuery(owner, lineage, `SELECT 1 AS present
+    return (lineageQuery(owner, lineage, rowSequence - 1, `SELECT 1 AS present
          FROM session_entries
         WHERE session_id = ? AND state != 'streaming' AND sequence = ?
           AND id IN (SELECT id FROM branch)`, lineage.sessionId, rowSequence).length > 0);
 }
 /** The sequence of one complete row on the lineage, if it is there. */
 export function lineageEntrySequence(owner, lineage, id) {
-    const raw = lineageQuery(owner, lineage, `SELECT sequence
-       FROM session_entries
-      WHERE session_id = ? AND state != 'streaming' AND id = ?
-        AND id IN (SELECT id FROM branch)`, lineage.sessionId, id)[0];
+    const raw = owner.sql
+        .exec(`SELECT sequence FROM session_entries
+        WHERE session_id = ? AND id = ? AND state != 'streaming'`, lineage.sessionId, id)
+        .toArray()[0];
     if (raw === undefined)
         return undefined;
     const decoded = decodeLineageSequence(raw);
     if (decoded._tag === "Failure")
         throw unavailable("Stored Session entry sequence is invalid");
-    return decoded.success.sequence;
-}
-/** The newest lineage row of one entry kind, decoded. */
-function readNewestLineageEntry(owner, lineage, kind) {
-    const raw = lineageQuery(owner, lineage, `SELECT ${entryColumns}
-       FROM session_entries
-      WHERE session_id = ? AND state != 'streaming' AND type = ?
-        AND id IN (SELECT id FROM branch)
-      ORDER BY sequence DESC
-      LIMIT 1`, lineage.sessionId, kind)[0];
-    return raw === undefined ? undefined : parseEntryRow(raw);
+    return lineageHasSequence(owner, lineage, decoded.success.sequence)
+        ? decoded.success.sequence
+        : undefined;
 }
-function lineageModelPreference(owner, lineage) {
-    const entry = lineage === undefined
+/**
+ * The newest preference on the lineage ending at `tipId`. The Session's
+ * preference rows come from their index; the walk from the tip stops at the
+ * first of them it meets, so it never passes the newest preference on this
+ * lineage, and a Session without one walks nothing. One set at the root
+ * still walks the whole lineage.
+ */
+function newestLineagePreference(owner, sessionId, tipId) {
+    const continues = (row) => `${row}.id NOT IN (SELECT id FROM targets)
+     AND ${row}.sequence > (SELECT MIN(sequence) FROM targets)`;
+    const [newest] = walkedTargets(owner.sql
+        .exec(`WITH RECURSIVE targets AS MATERIALIZED (
+           SELECT id, sequence FROM session_entries
+            WHERE session_id = ? AND type = 'model_preference'
+              AND state != 'streaming'
+         ),
+         ${targetWalk(continues("child"))}
+         ${walkSteps(continues("walk"))}`, sessionId, sessionId, tipId, sessionId)
+        .toArray());
+    return newest === undefined
         ? undefined
-        : readNewestLineageEntry(owner, lineage, "model_preference")?.entry;
+        : readEntryRow(owner, sessionId, newest);
+}
+function lineageModelPreference(owner, sessionId, tipId) {
+    const entry = newestLineagePreference(owner, sessionId, tipId)?.entry;
     return entry?.kind === "model_preference" ? entry.preference : null;
 }
 /** Latest document value on this exact lineage, not a global last write. */
 function readLineageDocument(owner, lineage, extensionId, name) {
     if (lineage === undefined)
         return undefined;
-    const raw = lineageQuery(owner, lineage, `SELECT ${entryColumns}
+    // No index finds documents yet, so this still walks the whole lineage.
+    const raw = lineageQuery(owner, lineage, 0, `SELECT ${entryColumns}
        FROM session_entries
       WHERE session_id = ? AND state != 'streaming' AND type = 'document'
         AND json_extract(data_json, '$.extensionId') = ?
@@ -1246,7 +1663,7 @@ function readLineageDocument(owner, lineage, extensionId, name) {
         AND id IN (SELECT id FROM branch)
       ORDER BY sequence DESC
       LIMIT 1`, lineage.sessionId, extensionId, name)[0];
-    const entry = raw === undefined ? undefined : parseEntryRow(raw).entry;
+    const entry = raw === undefined ? undefined : parseEntryRow(owner, raw).entry;
     if (entry === undefined)
         return undefined;
     if (entry.kind !== "document" ||
@@ -1255,10 +1672,12 @@ function readLineageDocument(owner, lineage, extensionId, name) {
         throw unavailable("Stored Session document disagrees with its row");
     return entry.valueJson;
 }
+const decodeOldestWorkRow = Schema.decodeUnknownResult(Schema.Struct({ sequence: Schema.NullOr(sequence) }), closed);
 /**
- * Look up, across the whole lineage, only the facts of the given works. A
- * diagnostic is the newest of an assistant error, a final retry error or a
- * work terminal's diagnostic; only that text is extracted, never the message.
+ * Look up, on the lineage, only the facts of the given works. Diagnostics come
+ * only from owned terminal fields, never provider message or retry text. The works'
+ * indexes give their oldest row, and the walks stop just below it, so a page
+ * of recent works never visits older history.
  */
 export function readLineageWorkFacts(owner, lineage, workIds) {
     if (workIds.size === 0)
@@ -1268,49 +1687,64 @@ export function readLineageWorkFacts(owner, lineage, workIds) {
             cancellations: new Map(),
         });
     const works = JSON.stringify([...workIds]);
-    const commands = new Set(lineageQuery(owner, lineage, `SELECT DISTINCT work_id
+    const oldest = decodeOldestWorkRow(owner.sql
+        .exec(`SELECT MIN(sequence) AS sequence FROM (
+           SELECT MIN(sequence) AS sequence
+             FROM session_entries INDEXED BY idx_session_entries_work
+            WHERE work_id IN (SELECT value FROM json_each(?))
+              AND session_id = ?
+           UNION ALL
+           SELECT MIN(sequence) FROM session_entries
+                  INDEXED BY idx_session_entries_cancellation_target
+            WHERE session_id = ? AND type = 'cancellation'
+              AND json_extract(data_json, '$.targetWorkId')
+                  IN (SELECT value FROM json_each(?))
+         )`, works, lineage.sessionId, lineage.sessionId, works)
+        .one());
+    if (oldest._tag === "Failure")
+        throw unavailable("Stored Session work order is invalid");
+    if (oldest.success.sequence === null)
+        return Object.freeze({
+            commands: new Set(),
+            diagnostics: new Map(),
+            cancellations: new Map(),
+        });
+    const floor = oldest.success.sequence - 1;
+    const commands = new Set(lineageQuery(owner, lineage, floor, `SELECT DISTINCT work_id
          FROM session_entries
-        WHERE session_id = ? AND state != 'streaming' AND type = 'command'
+        WHERE session_id = ? AND sequence > ? AND state != 'streaming' AND type = 'command'
           AND work_id IN (SELECT value FROM json_each(?))
-          AND id IN (SELECT id FROM branch)`, lineage.sessionId, works).map((raw) => {
+          AND id IN (SELECT id FROM branch)`, lineage.sessionId, floor, works).map((raw) => {
         const decoded = decodeLineageWorkId(raw);
         if (decoded._tag === "Failure")
             throw unavailable("Stored Session command work is invalid");
         return decoded.success.work_id;
     }));
     const diagnostics = new Map();
-    for (const raw of lineageQuery(owner, lineage, `SELECT work_id, diagnostic FROM (
+    for (const raw of lineageQuery(owner, lineage, floor, `SELECT work_id, diagnostic FROM (
        SELECT work_id, sequence,
-              CASE
-                WHEN type = 'work_terminal'
-                  THEN json_extract(data_json, '$.diagnostic')
-                WHEN type = 'message'
-                  THEN json_extract(data_json, '$.value.errorMessage')
-                WHEN json_extract(data_json, '$.event.type') = 'auto_retry_end'
-                  THEN json_extract(data_json, '$.event.finalError')
-              END AS diagnostic
+              json_extract(data_json, '$.diagnostic') AS diagnostic
          FROM session_entries
-        WHERE session_id = ? AND state != 'streaming'
+        WHERE session_id = ? AND sequence > ? AND state != 'streaming'
           AND work_id IN (SELECT value FROM json_each(?))
-          AND (type IN ('work_terminal', 'live_retry')
-               OR (type = 'message' AND role = 'assistant'))
+          AND type IN ('work_terminal', 'run_terminal')
           AND id IN (SELECT id FROM branch)
      )
      WHERE diagnostic IS NOT NULL
-     ORDER BY sequence ASC`, lineage.sessionId, works)) {
+     ORDER BY sequence ASC`, lineage.sessionId, floor, works)) {
         const decoded = decodeLineageDiagnostic(raw);
         if (decoded._tag === "Failure")
             throw unavailable("Stored Session diagnostic is invalid");
         diagnostics.set(decoded.success.work_id, decoded.success.diagnostic);
     }
     const cancellations = new Map();
-    for (const { entry } of lineageQuery(owner, lineage, `SELECT ${entryColumns}
+    for (const { entry } of lineageQuery(owner, lineage, floor, `SELECT ${entryColumns}
        FROM session_entries
-      WHERE session_id = ? AND state != 'streaming' AND type = 'cancellation'
+      WHERE session_id = ? AND sequence > ? AND state != 'streaming' AND type = 'cancellation'
         AND json_extract(data_json, '$.targetWorkId')
             IN (SELECT value FROM json_each(?))
         AND id IN (SELECT id FROM branch)
-      ORDER BY sequence ASC`, lineage.sessionId, works).map(parseEntryRow))
+      ORDER BY sequence ASC`, lineage.sessionId, floor, works).map((raw) => parseEntryRow(owner, raw)))
         if (entry.kind === "cancellation" && entry.meta !== undefined)
             cancellations.set(entry.targetWorkId, entry.meta);
     return Object.freeze({ commands, diagnostics, cancellations });
@@ -1327,81 +1761,245 @@ export function readSelectedPath(owner, input) {
         ? Object.freeze([])
         : readLineageRange(owner, lineage, 1, lineage.newestSequence);
 }
-function segmentQuery(owner, segment, columns, clause, ...bindings) {
-    return lineageQuery(owner, segment.lineage, `SELECT ${columns}
-       FROM session_entries
-      WHERE session_id = ? AND state != 'streaming'
-        AND id IN (SELECT id FROM branch)
-        AND sequence > ?
-        AND (? IS NULL OR work_id = ?
-             OR (type = 'command'
-                 AND json_extract(data_json, '$.targetWorkId') = ?))
-        ${clause}`, segment.lineage.sessionId, segment.after, segment.work, segment.work, segment.work, ...bindings);
+/**
+ * A walk from one row toward the root for the `targets` the statement
+ * selects first by index. `continues` decides, per row, whether the walk
+ * steps past it; a statement without targets reads only its starting row,
+ * so a missing one is still refused.
+ */
+function targetWalk(continues) {
+    return `walk (id, parent_id, sequence, state) AS (
+       SELECT id, parent_id, sequence, state
+         FROM session_entries
+        WHERE session_id = ? AND id = ?
+       UNION ALL
+       SELECT parent.id, parent.parent_id, parent.sequence, parent.state
+         FROM session_entries AS parent
+         JOIN walk AS child ON parent.id = child.parent_id
+        WHERE parent.session_id = ? AND +parent.sequence < child.sequence
+          AND ${continues}
+     )`;
 }
 /**
- * First sequence the model context reads: the latest compaction's kept
- * entry. Zero when nothing compacted, or when that entry is not on these
- * segments, where `buildSessionContext` also reads the whole path.
+ * The walked targets, newest first, then the deepest walked row, each with
+ * whether the walk meant to pass it. Only these rows reach JavaScript.
  */
-function contextStart(owner, segments) {
-    for (const segment of [...segments].reverse()) {
-        const raw = segmentQuery(owner, segment, "json_extract(data_json, '$.firstKeptEntryId') AS first_kept", "AND type = 'compaction' ORDER BY sequence DESC LIMIT 1")[0];
-        if (raw === undefined)
-            continue;
-        const latest = decodeFirstKept(raw);
-        if (latest._tag === "Failure")
-            throw unavailable("Stored Session compaction boundary is invalid");
-        for (const candidate of segments) {
-            const kept = segmentQuery(owner, candidate, "sequence", "AND id = ?", latest.success.first_kept)[0];
-            if (kept === undefined)
-                continue;
-            const decoded = decodeLineageSequence(kept);
-            if (decoded._tag === "Failure")
-                throw unavailable("Stored Session entry sequence is invalid");
-            return decoded.success.sequence;
-        }
-        return 0;
+function walkSteps(continues) {
+    return `SELECT id, parent_id, target, continues FROM (
+             SELECT id, parent_id, sequence,
+                    id IN (SELECT id FROM targets) AS target,
+                    COALESCE((${continues}), 0) AS continues
+               FROM walk
+           )
+           WHERE target = 1 OR sequence = (SELECT MIN(sequence) FROM walk)
+           ORDER BY sequence DESC`;
+}
+const flag = Schema.Literals([0, 1]);
+const decodeWalkStep = Schema.decodeUnknownResult(Schema.Struct({
+    id: boundedId,
+    parent_id: Schema.NullOr(Schema.String),
+    target: flag,
+    continues: flag,
+}), closed);
+/**
+ * The targets a bounded walk reached, newest first, once the walk is known to
+ * have ended at the root or where it meant to stop, never at a missing or
+ * out-of-order parent. Walks step only to an older parent, so they end.
+ * A walk that found not even its starting row is refused as an unavailable
+ * leaf.
+ */
+function walkedTargets(raws) {
+    const failures = lineageFailures.selected;
+    if (raws.length === 0)
+        throw unavailable(failures.empty);
+    const steps = raws.map((raw) => {
+        const decoded = decodeWalkStep(raw);
+        if (decoded._tag === "Failure")
+            throw unavailable("Stored Session walk row is invalid");
+        return decoded.success;
+    });
+    const deepest = steps.at(-1);
+    if (deepest?.continues === 1 && deepest.parent_id !== null)
+        throw unavailable(failures.missingParent);
+    return steps.flatMap((step) => (step.target === 1 ? [step.id] : []));
+}
+/** The kept head of a complete compaction row, else null. */
+function compactionHead(row) {
+    return `CASE WHEN ${row}.type = 'compaction' AND ${row}.state != 'streaming'
+               THEN json_extract(${row}.data_json, '$.head') END`;
+}
+/**
+ * The walk a settled context reads: from the tip back to the kept entry of
+ * the newest complete compaction, which `head` carries once passed, or to the
+ * root when nothing compacted or that entry is not on this lineage. It never
+ * visits the history a compaction already cut.
+ */
+const contextWalk = `WITH RECURSIVE walk (id, parent_id, sequence, state, head) AS (
+       SELECT id, parent_id, sequence, state,
+              ${compactionHead("session_entries")}
+         FROM session_entries
+        WHERE session_id = ? AND id = ?
+       UNION ALL
+       SELECT parent.id, parent.parent_id, parent.sequence, parent.state,
+              COALESCE(child.head, ${compactionHead("parent")})
+         FROM session_entries AS parent
+         JOIN walk AS child ON parent.id = child.parent_id
+        WHERE parent.session_id = ? AND +parent.sequence < child.sequence
+          AND (child.head IS NOT child.id OR child.state = 'streaming')
+     )`;
+/**
+ * The older facts that still decide a kept window: compactions of the active
+ * work and cancellations of a command inside the window. Their indexes find
+ * them; the walk down from the kept entry stops at the oldest of them, so
+ * only facts on this lineage count and a window without any walks nothing.
+ */
+function readDecidingFacts(owner, sessionId, kept, window, workId) {
+    const commands = JSON.stringify(window.flatMap(({ entry }) => entry.kind === "command" ? [entry.workId] : []));
+    const continues = (row) => `${row}.sequence > (SELECT MIN(sequence) FROM targets)`;
+    const facts = walkedTargets(owner.sql
+        .exec(`WITH RECURSIVE targets AS MATERIALIZED (
+         SELECT id, sequence FROM session_entries
+          WHERE session_id = ? AND type = 'compaction' AND work_id = ?
+            AND sequence < ? AND state != 'streaming'
+         UNION ALL
+         SELECT id, sequence
+           FROM session_entries
+                INDEXED BY idx_session_entries_cancellation_target
+          WHERE session_id = ? AND type = 'cancellation'
+            AND json_extract(data_json, '$.targetWorkId')
+                IN (SELECT value FROM json_each(?))
+            AND sequence < ? AND state != 'streaming'
+       ),
+       ${targetWalk(continues("child"))}
+       ${walkSteps(continues("walk"))}`, sessionId, workId, kept.sequence, sessionId, commands, kept.sequence, sessionId, kept.id, sessionId)
+        .toArray());
+    if (facts.length === 0)
+        return Object.freeze([]);
+    return Object.freeze(owner.sql
+        .exec(`SELECT ${entryColumns}
+           FROM session_entries
+          WHERE id IN (SELECT value FROM json_each(?))
+          ORDER BY sequence ASC`, JSON.stringify(facts))
+        .toArray()
+        .map((raw) => parseEntryRow(owner, raw)));
+}
+/**
+ * One lineage's settled window: the walk from `tipId` to the kept entry of
+ * its newest complete compaction, or to the root. `compacted` says the walk
+ * stopped at a kept entry rather than at the root. Only the walked rows are
+ * read, and they are checked the way `locateLineage` checks a whole lineage.
+ */
+function readContextWindow(owner, sessionId, tipId) {
+    const failures = lineageFailures.selected;
+    const rows = owner.sql
+        .exec(`${contextWalk}
+       SELECT ${entryColumns}
+         FROM session_entries
+        WHERE id IN (SELECT id FROM walk) AND state != 'streaming'
+        ORDER BY sequence ASC`, sessionId, tipId, sessionId)
+        .toArray()
+        .map((raw) => parseEntryRow(owner, raw));
+    const kept = rows[0];
+    if (kept === undefined)
+        throw unavailable(failures.empty);
+    let head;
+    let previous;
+    for (const row of rows) {
+        if (previous !== undefined && row.parentId !== previous.id)
+            throw unavailable(failures.invalid);
+        if (row.entry.kind === "compaction")
+            head = row.entry.head;
+        previous = row;
     }
-    return 0;
+    const compacted = head === kept.id;
+    if (!compacted && kept.parentId !== null)
+        throw unavailable(failures.missingParent);
+    return Object.freeze({ rows: Object.freeze(rows), compacted });
 }
 /**
- * The rows model context and compaction read: the latest compaction's kept
+ * Context rows of the current selected lineage for one accepted work, or,
+ * without a work, the settled context the next run starts from: the kept
  * window through the tip, preceded only by the older facts that still decide
  * it. Those are cancellations that withdrew a command inside the window, and
  * earlier compactions of the active work, whose recovery runs at most once.
+ * The read is bounded by the kept window and its deciding facts, not by the
+ * history a compaction cut.
  */
-function readContextRows(owner, segments, workId) {
-    const start = contextStart(owner, segments);
-    let stored = 0;
-    for (const segment of segments) {
-        const measured = decodeContextBytes(segmentQuery(owner, segment, "COALESCE(SUM(LENGTH(CAST(data_json AS BLOB))), 0) AS bytes", "AND sequence >= ?", start)[0]);
-        if (measured._tag === "Failure")
-            throw unavailable("Stored Session context size is invalid");
-        stored += measured.success.bytes;
-    }
-    if (stored > contextByteLimit)
-        throw new ShiitakeError("store", "context_too_large", "This Session's model context is too large to read safely. Branch or fork from an earlier entry to continue.");
-    const window = segments.flatMap((segment) => segmentQuery(owner, segment, entryColumns, "AND sequence >= ? ORDER BY sequence ASC", start).map(parseEntryRow));
-    if (start === 0)
-        return Object.freeze(window);
-    const commands = JSON.stringify(window.flatMap(({ entry }) => entry.kind === "command" ? [entry.workId] : []));
-    const prefix = segments.flatMap((segment) => segmentQuery(owner, segment, entryColumns, `AND sequence < ?
-       AND ((type = 'compaction' AND work_id = ?)
-            OR (type = 'cancellation'
-                AND json_extract(data_json, '$.targetWorkId')
-                    IN (SELECT value FROM json_each(?))))
-       ORDER BY sequence ASC`, start, workId, commands).map(parseEntryRow));
-    return Object.freeze([...prefix, ...window]);
+export function readSessionContextPath(owner, input) {
+    const leaf = readSessionRow(owner, input.sessionId)?.leaf_id;
+    if (leaf === undefined || leaf === null)
+        return Object.freeze([]);
+    const window = readContextWindow(owner, input.sessionId, leaf);
+    const kept = window.rows[0];
+    if (!window.compacted || kept === undefined)
+        return window.rows;
+    return Object.freeze([
+        ...readDecidingFacts(owner, input.sessionId, kept, window.rows, input.workId ?? null),
+        ...window.rows,
+    ]);
+}
+/** Whether a row is an older fact that decides `commands` for `workId`. */
+function decides(row, workId, commands) {
+    return ((row.entry.kind === "compaction" && row.entry.workId === workId) ||
+        (row.entry.kind === "cancellation" && commands.has(row.entry.targetWorkId)));
 }
 /**
- * Context rows of the current selected lineage for one accepted work, or,
- * without a work, the settled context the next run starts from.
+ * The context a prepared run reads: its command's own lineage through the
+ * command, then only this work's later rows on the current lineage (the
+ * tail). The newest compaction of the tail, else of the command's lineage,
+ * decides where the window starts, with the same deciding facts before it as
+ * a settled context. The command's lineage is walked only from the command
+ * down to that start, and the tail only down to the command.
  */
-export function readSessionContextPath(owner, input) {
-    const lineage = readSessionLineage(owner, { sessionId: input.sessionId });
-    return lineage === undefined
-        ? Object.freeze([])
-        : readContextRows(owner, [{ lineage, after: 0, work: null }], input.workId ?? null);
+function readRunContextRows(owner, sessionId, command, current, workId) {
+    const through = readSessionLineage(owner, { sessionId, leafId: command.id });
+    if (through === undefined)
+        throw unavailable("Accepted Session command lineage is unavailable");
+    const tail = current === undefined
+        ? []
+        : lineageQuery(owner, current, command.sequence, `SELECT ${entryColumns}
+             FROM session_entries
+            WHERE session_id = ? AND sequence > ? AND state != 'streaming'
+              AND id IN (SELECT id FROM branch)
+              AND (work_id = ?
+                   OR (type = 'command'
+                       AND json_extract(data_json, '$.targetWorkId') = ?))
+            ORDER BY sequence ASC`, sessionId, command.sequence, workId, workId).map((raw) => parseEntryRow(owner, raw));
+    let latest;
+    for (const row of tail)
+        if (row.entry.kind === "compaction")
+            latest = row.entry.head;
+    let start = 0;
+    let lineageRows;
+    if (latest === undefined) {
+        const window = readContextWindow(owner, sessionId, command.id);
+        lineageRows = window.rows;
+        if (window.compacted)
+            start = window.rows[0]?.sequence ?? 0;
+    }
+    else {
+        const head = latest;
+        start =
+            tail.find(({ id }) => id === head)?.sequence ??
+                lineageEntrySequence(owner, through, head) ??
+                0;
+        lineageRows =
+            start > command.sequence
+                ? []
+                : readLineageRange(owner, through, Math.max(start, 1), command.sequence);
+    }
+    if (start === 0)
+        return Object.freeze([...lineageRows, ...tail]);
+    const window = [
+        ...lineageRows,
+        ...tail.filter(({ sequence }) => sequence >= start),
+    ];
+    const commands = new Set(window.flatMap(({ entry }) => entry.kind === "command" ? [entry.workId] : []));
+    return Object.freeze([
+        ...readDecidingFacts(owner, sessionId, lineageRows[0] ?? command, window, workId),
+        ...tail.filter((row) => row.sequence < start && decides(row, workId, commands)),
+        ...window,
+    ]);
 }
 /** Work cancelled before delivery stays in history but never enters model context. */
 export function withdrawnWorkIds(path) {
@@ -1431,13 +2029,12 @@ export function buildSessionContext(path, activeWorkId) {
     const compactionEntry = compaction?.entry.kind === "compaction" ? compaction.entry : undefined;
     const keptIndex = compactionEntry === undefined
         ? -1
-        : path.findIndex(({ id }) => id === compactionEntry.firstKeptEntryId);
+        : path.findIndex(({ id }) => id === compactionEntry.head);
     const contextPath = keptIndex >= 0 ? path.slice(keptIndex) : path;
     const visible = contextMessageIds(contextPath, activeWorkId);
     const messages = [];
-    if (compactionEntry !== undefined && compaction !== undefined) {
-        messages.push(compactionSummaryMessage(compactionEntry.summary, compaction.timestamp));
-    }
+    if (compactionEntry !== undefined)
+        messages.push(...compactionEntry.model);
     for (const row of contextPath) {
         const prompt = promptCommand(row.entry);
         if (prompt !== undefined && !withdrawn.has(prompt.workId))
@@ -1469,9 +2066,6 @@ export function prepareSessionRun(owner, input) {
             encodeStoredSessionEntry(command.entry) !==
                 encodeStoredSessionEntry(admission.entry))
             throw unavailable("Accepted Session command disagrees with its admission");
-        const through = locateLineage(owner, input.sessionId, command.id, "selected");
-        if (through.newestId !== command.id)
-            throw unavailable("Accepted Session command lineage is unavailable");
         // The current claim owns the command. Empty placeholders from a lost
         // reader carry no recoverable text and must not survive as live progress.
         owner.sql.exec("DELETE FROM session_entries WHERE session_id = ? AND work_id = ? AND state = 'streaming' AND type = 'message_start'", input.sessionId, command.entry.workId);
@@ -1479,19 +2073,14 @@ export function prepareSessionRun(owner, input) {
         const workId = command.entry.workId;
         const current = readSessionLineage(owner, { sessionId: input.sessionId });
         // The command's own lineage, then only this work's later rows.
-        const continuedPath = readContextRows(owner, current === undefined
-            ? [{ lineage: through, after: 0, work: null }]
-            : [
-                { lineage: through, after: 0, work: null },
-                { lineage: current, after: command.sequence, work: workId },
-            ], workId);
+        const continuedPath = readRunContextRows(owner, input.sessionId, command, current, workId);
         const selectedCommand = Object.freeze({
             ...command,
             entry: command.entry,
         });
         return Object.freeze({
             command: selectedCommand,
-            modelPreference: lineageModelPreference(owner, through),
+            modelPreference: lineageModelPreference(owner, input.sessionId, command.id),
             messages: buildSessionContext(continuedPath, command.entry.workId),
             path: continuedPath,
             entryDelivery,
@@ -1500,49 +2089,125 @@ export function prepareSessionRun(owner, input) {
         });
     });
 }
+/**
+ * Whether a summary whose first kept entry is `head` still fits the selected
+ * lineage (Pi Durable §6). It is stale when `head` is not on the selected
+ * lineage or sits before the current context start, where a later compaction
+ * already cut; placing it would bring cut history back. One bounded read.
+ */
+export function compactionHeadState(owner, input) {
+    const leaf = readSessionRow(owner, input.sessionId)?.leaf_id;
+    if (leaf === undefined || leaf === null)
+        return "stale";
+    // The head is current exactly when it lies in the settled window.
+    const raw = owner.sql
+        .exec(`${contextWalk}
+       SELECT sequence
+         FROM session_entries
+        WHERE state != 'streaming' AND id = ? AND id IN (SELECT id FROM walk)`, input.sessionId, leaf, input.sessionId, input.head)
+        .toArray()[0];
+    if (raw === undefined)
+        return "stale";
+    const decoded = decodeLineageSequence(raw);
+    if (decoded._tag === "Failure")
+        throw unavailable("Stored Session entry sequence is invalid");
+    return "current";
+}
 /** Append one compaction notice on the selected lineage. */
 export function appendCompactionNoticeOwned(owner, input) {
     return owner.transactionSync(() => {
-        const entry = {
+        const common = {
             kind: "compaction_notice",
             workId: input.workId,
             trigger: input.trigger,
-            result: input.result,
         };
+        let entry;
+        if (input.result === "stale" || input.result === "insufficient") {
+            const dropped = { ...common, result: input.result };
+            entry =
+                input.usage === undefined
+                    ? dropped
+                    : { ...dropped, usage: input.usage };
+        }
+        else if (input.result === "failed") {
+            const failed = {
+                ...common,
+                result: "failed",
+            };
+            const diagnosed = input.diagnostic === undefined
+                ? failed
+                : { ...failed, diagnostic: input.diagnostic.slice(0, 200) };
+            entry =
+                input.usage === undefined
+                    ? diagnosed
+                    : { ...diagnosed, usage: input.usage };
+        }
+        else {
+            const nothing = {
+                ...common,
+                result: "nothing_to_compact",
+            };
+            entry =
+                input.diagnostic === undefined
+                    ? nothing
+                    : { ...nothing, diagnostic: input.diagnostic.slice(0, 200) };
+        }
         return appendSessionEntry(owner, {
             sessionId: input.sessionId,
             id: sessionIds.fact.generate(),
-            entry: input.diagnostic === undefined
-                ? entry
-                : { ...entry, diagnostic: input.diagnostic.slice(0, 200) },
+            entry,
         });
     });
 }
 /** Atomically append one compaction transition using the selected leaf CAS. */
 export function appendCompactionTransitionOwned(owner, input) {
-    return owner.transactionSync(() => {
-        const session = readSessionRow(owner, input.sessionId);
-        if (session?.leaf_id !== input.expectedLeafId)
-            throw new ShiitakeError("store", "conflict", "Session leaf changed during compaction");
-        const entry = {
-            kind: "compaction",
+    return owner.transactionSync(() => appendCompactionRow(owner, input));
+}
+/**
+ * Place a summary selected before now (a background compaction): the head
+ * check of `compactionHeadState` and the leaf CAS in one transaction, so a
+ * head that moved after any earlier check still makes it `stale` (Pi
+ * Durable §6). A stale summary writes nothing.
+ */
+export function placeCompactionTransitionOwned(owner, input) {
+    return owner.transactionSync(() => compactionHeadState(owner, {
+        sessionId: input.sessionId,
+        head: input.head,
+    }) === "stale"
+        ? "stale"
+        : appendCompactionRow(owner, input));
+}
+/** The leaf CAS and the compaction row; callers own the transaction. */
+function appendCompactionRow(owner, input) {
+    const session = readSessionRow(owner, input.sessionId);
+    if (session?.leaf_id !== input.expectedLeafId)
+        throw new ShiitakeError("store", "conflict", "Session leaf changed during compaction");
+    const entry = {
+        kind: "compaction",
+        workId: input.workId,
+        head: input.head,
+        model: [compactionSummaryMessage(input.summary, Date.now())],
+        data: {
+            reason: input.trigger,
             resumesRun: input.resumesRun ?? false,
-            trigger: input.trigger,
-            tokensAfter: input.tokensAfter,
-            workId: input.workId,
-            firstKeptEntryId: input.firstKeptEntryId,
-            summary: input.summary,
             tokensBefore: input.tokensBefore,
+            tokensAfter: input.tokensAfter,
             usage: input.usage,
             contextRevision: input.contextRevision,
-        };
-        return appendSessionEntry(owner, {
-            sessionId: input.sessionId,
-            id: sessionIds.fact.generate(),
-            entry: input.details === undefined
-                ? entry
-                : { ...entry, details: input.details },
-        });
+        },
+    };
+    const withReceipt = input.receipt === undefined
+        ? entry
+        : { ...entry, data: { ...entry.data, receipt: input.receipt } };
+    return appendSessionEntry(owner, {
+        sessionId: input.sessionId,
+        id: sessionIds.fact.generate(),
+        entry: input.details === undefined
+            ? withReceipt
+            : {
+                ...withReceipt,
+                data: { ...withReceipt.data, details: input.details },
+            },
     });
 }
 function isPromptParts(content) {
@@ -1656,6 +2321,32 @@ export function acceptSessionCommandOwned(owner, sessionId, input, meta, origin,
     });
     return acceptanceFromAdmission(command, "new");
 }
+/** Called only in the admission door's transaction, shared by admission and withdrawal. */
+export function assertSessionRequestNotWithdrawn(owner, sessionId, requestId) {
+    if (owner.sql
+        .exec("SELECT 1 FROM session_request_withdrawals WHERE session_id = ? AND request_id = ?", sessionId, requestId)
+        .toArray().length > 0)
+        throw new ShiitakeError("contract", "closed", "Request was withdrawn", requestId);
+}
+/** An admitted request wins; otherwise its key becomes a durable admission fence. */
+export function withdrawSessionRequestOwned(owner, sessionId, requestId) {
+    const admitted = readSessionCommandAdmissionByRequest(owner, sessionId, requestId);
+    if (admitted !== undefined)
+        return { status: "accepted", commandId: admitted.id };
+    // A held website reply records an operator line rather than scheduling work.
+    // It is already durable and must not be restored as though it were unsent.
+    const recorded = owner.sql
+        .exec("SELECT id FROM session_entries WHERE session_id = ? AND request_id = ? AND type = 'operator'", sessionId, requestId)
+        .toArray()[0];
+    if (recorded !== undefined) {
+        const decoded = decodeSessionIdRow(recorded);
+        if (decoded._tag === "Failure")
+            throw unavailable("Stored operator receipt is invalid");
+        return { status: "accepted", commandId: decoded.success.id };
+    }
+    owner.sql.exec("INSERT OR IGNORE INTO session_request_withdrawals(session_id, request_id) VALUES (?, ?)", sessionId, requestId);
+    return { status: "unknown" };
+}
 function acceptanceFromAdmission(row, delivery) {
     const accepted = Object.freeze({
         sessionId: row.sessionId,
@@ -1811,6 +2502,7 @@ export function selectSessionBranch(owner, input) {
  */
 export function appendOperatorEntry(owner, input) {
     return owner.transactionSync(() => {
+        assertSessionRequestNotWithdrawn(owner, input.sessionId, input.requestId);
         if (readSessionRow(owner, input.sessionId) === undefined)
             throw unavailable("Session is unavailable for an operator entry");
         const existing = owner.sql
@@ -1846,13 +2538,12 @@ export function appendOperatorEntry(owner, input) {
 }
 function readSessionRows(owner, sessionId) {
     return owner.sql
-        .exec(`SELECT id, session_id, parent_id, sequence, type, role, state,
-              request_id, work_id, data_json, timestamp, completed_at
+        .exec(`SELECT ${entryColumns}
          FROM session_entries
         WHERE session_id = ? AND state != 'streaming'
         ORDER BY sequence ASC`, sessionId)
         .toArray()
-        .map(parseEntryRow);
+        .map((raw) => parseEntryRow(owner, raw));
 }
 /** Link every stored row into a forest, retaining rows with no parent. */
 function buildMutableSessionForest(rows) {
@@ -1952,7 +2643,7 @@ export function forkSessionAt(owner, input) {
                 const entry = row.entry.kind === "compaction"
                     ? {
                         ...row.entry,
-                        firstKeptEntryId: idMap.get(row.entry.firstKeptEntryId) ??
+                        head: idMap.get(row.entry.head) ??
                             (() => {
                                 throw unavailable("Fork compaction boundary is unavailable");
                             })(),