@gotcos/glasses-server 6.50.4 → 6.52.0

package/server/lib/query-job-coordinator.ts

@@ -18,6 +18,7 @@ import {
   type QueryJobStoreHealth,
 } from './query-job-types.js'
 import type { MaintenanceWorkLease } from './maintenance-lifecycle.js'
+import { applyTrailToolMode, type JobTrailDraft } from './job-trail.js'
 
 const CLIENT_JOB_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
 
@@ -41,6 +42,9 @@ export interface QueryJobRunnerCallbacks {
   onChunk: (text: string) => void
   onToolStatus: (text: string) => void
   onActivityLine: (line: { kind: 'input' | 'output'; text: string }) => void
+  /** One readable step of the run (6.52.0). Filtered by the job's `activityToolMode`
+   * here, redacted by the store, journaled as a `trail` event. Never on the display bus. */
+  onTrail: (draft: JobTrailDraft) => void
   /** True only when this callback durably won the answer-ready transition. */
   onAnswerReady: (text: string, linkage?: QueryJobProviderLinkage) => boolean | Promise<boolean>
   /** True only when this callback won and durably projected the terminal. */
@@ -349,6 +353,15 @@ export class QueryJobCoordinator {
           await this.store.appendActivity(active.jobId, line.kind, line.text)
         })
       },
+      onTrail: (draft) => {
+        // The user's opt-out is decided HERE, from the job's own request: `off` keeps no
+        // tool steps, `status` keeps steps without raw output (see applyTrailToolMode).
+        const allowed = applyTrailToolMode(draft, active.request.activityToolMode)
+        if (!allowed) return
+        void this.enqueueCallback(active, async () => {
+          await this.store.appendTrail(active.jobId, allowed)
+        })
+      },
       onAnswerReady: (text, linkage = {}) => this.answerReady(active, text, linkage),
       onDone: completion => this.completeActive(active, completion),
       onError: error => this.failActive(active, error),
@@ -540,8 +553,11 @@ export class QueryJobCoordinator {
     generation: number,
     after: number,
     listener: Parameters<QueryJobStore['subscribe']>[3],
+    trail?: Parameters<QueryJobStore['subscribe']>[4],
   ): Promise<QueryJobSubscription> {
-    return this.store.subscribe(jobId, generation, after, listener)
+    return trail
+      ? this.store.subscribe(jobId, generation, after, listener, trail)
+      : this.store.subscribe(jobId, generation, after, listener)
   }
 
   async shutdown(reason = 'server_shutdown'): Promise<void> {

package/server/lib/query-job-feature.ts

@@ -9,6 +9,16 @@ export function durableQueryJobsEnabled(env: NodeJS.ProcessEnv = process.env): b
   return env.COS_DURABLE_QUERY_JOBS !== '0'
 }
 
+/**
+ * The Messages trail (6.52.0) is on by default. COS_MESSAGES_TRAIL=0 is the rollback
+ * that needs no downgrade: the job runner then hands the bridges no trail callback, so
+ * no second stdout reader is attached, no `trail` event is journaled, and every stream,
+ * snapshot and answer is exactly the 6.51.0 one. Read per job, so a restart applies it.
+ */
+export function messagesTrailEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.COS_MESSAGES_TRAIL !== '0'
+}
+
 export function durableQueryJobsCapability(): {
   enabled: boolean
   protocolVersion: number

package/server/lib/query-job-runtime.ts

@@ -7,7 +7,7 @@ import { resolveQueryAttachments } from './query-attachments.js'
 import { getMediaStore } from './media-store.js'
 import { dataPath } from './data-dir.js'
 import { currentMessageEra, LEGACY_MESSAGE_ERA } from './message-era.js'
-import { durableQueryJobsEnabled } from './query-job-feature.js'
+import { durableQueryJobsEnabled, messagesTrailEnabled } from './query-job-feature.js'
 import { QueryJobCoordinator, type QueryJobRunner } from './query-job-coordinator.js'
 import { QueryJobStore } from './query-job-store.js'
 import {
@@ -33,6 +33,7 @@ import {
   type QueryJobSnapshot,
 } from './query-job-types.js'
 import { acquireMaintenanceWork } from './maintenance-lifecycle.js'
+import type { JobTrailDraft } from './job-trail.js'
 import { registerMessageReservationSource } from './message-reservations.js'
 
 const TOOL_STATUS_MESSAGES: Record<string, string> = {
@@ -243,6 +244,13 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
       ...(request.activityToolMode === 'preview' ? {
         onActivityLine: (line: { kind: 'input' | 'output'; text: string }) => callbacks.onActivityLine(line),
       } : {}),
+      // 6.52.0, the Messages trail. Journaled only (the coordinator applies the user's
+      // tool-activity mode and the store redacts); it NEVER goes on the display bus, which
+      // any paired display may read. Absent entirely with COS_MESSAGES_TRAIL=0, so the
+      // bridges attach no second stdout reader at all.
+      ...(messagesTrailEnabled() ? {
+        onTrail: (draft: JobTrailDraft) => callbacks.onTrail(draft),
+      } : {}),
       onAnswerReady: text => callbacks.onAnswerReady(text, {
         ...(activeModel ? { provider: providerFor(activeModel), resolvedModel: activeModel } : {}),
       }),

package/server/lib/query-job-store.ts

@@ -28,7 +28,36 @@ import {
   type QueryJobSnapshot,
   type QueryJobStatus,
   type QueryJobStoreHealth,
+  type QueryJobTrailEntry,
 } from './query-job-types.js'
+import {
+  jobTrailTextChars,
+  parseJobTrailEventData,
+  sanitizeJobTrailDraft,
+  type JobTrailDraft,
+} from './job-trail.js'
+
+const QUERY_JOB_STATUSES: readonly QueryJobStatus[] = [
+  'accepted', 'starting', 'running', 'answer_ready', 'completed', 'failed', 'canceled', 'interrupted',
+]
+
+/**
+ * Every event type hydration accepts. A row of any other type counts as malformed and is
+ * skipped, which is exactly what a 6.51.0 server does with the `trail` rows this build
+ * writes: those jobs still load and only `malformedRows` rises (the rollback contract, so
+ * QUERY_JOB_SCHEMA_VERSION stays 1; a bump would drop every row on rollback). THIS build
+ * must list `trail`, or it would count its own rows as malformed on every restart and the
+ * trail would vanish after a reboot.
+ *
+ * A `trail` row is NOT a job event (QA round 1). It carries the job's CURRENT eventSeq and
+ * never advances it, takes no replay-ring slot, never moves `updatedAt`, and is applied
+ * idempotently by its own dense `trailSeq`. So an old client's stream is exactly the
+ * 6.51.0 one, and a rolled-back 6.51.0 server, which skips these rows, numbers its next
+ * event after the last event it CAN read without colliding with anything written here.
+ */
+export const QUERY_JOB_JOURNAL_EVENT_TYPES: readonly QueryJobEventType[] = [
+  ...QUERY_JOB_STATUSES, 'chunk', 'tool_status', 'activity_line', 'acknowledged', 'trail',
+]
 
 const PARTITION_RE = /^\d{4}-\d{2}-\d{2}\.jsonl$/
 const MAX_JOURNAL_RECORD_BYTES = 512 * 1024
@@ -59,6 +88,9 @@ interface HydratedQueryJob {
   snapshot: QueryJobSnapshot
   events: QueryJobEvent[]
   lastBootId: string
+  /** The last `trailSeq` this job journaled. The next trail row is this plus one,
+   * assigned inside the serialized append, so the persisted order is dense 1..n. */
+  trailSeq: number
 }
 
 interface QueryJobIdentity {
@@ -95,9 +127,41 @@ export interface QueryJobExecutionRecord {
 
 export interface QueryJobSubscription {
   replay: QueryJobReplay
+  /** Present only when the subscriber asked for the trail. */
+  trailReplay?: QueryJobTrailReplay
   unsubscribe: () => void
 }
 
+/** One trail entry as a subscriber receives it: its own cursor, never the job eventSeq. */
+export interface QueryJobTrailFrame {
+  type: 'trail'
+  trailSeq: number
+  jobId: string
+  clientJobId: string
+  generation: number
+  at: string
+  data: JobTrailDraft
+}
+
+/**
+ * What a trail subscriber missed. `gap` means entries after its cursor are no longer held
+ * (`snapshot.trail` is bounded) or the cursor is ahead: the client resets its trail to
+ * `entries` and continues from `latestTrailSeq`. Otherwise `entries` are exactly those
+ * after the cursor, in order.
+ */
+export interface QueryJobTrailReplay {
+  entries: QueryJobTrailEntry[]
+  gap: boolean
+  reason?: 'trail_gap' | 'cursor_ahead'
+  oldestTrailSeq: number
+  latestTrailSeq: number
+}
+
+export interface QueryJobTrailSubscribe {
+  after: number
+  listener: (frame: QueryJobTrailFrame) => void
+}
+
 export interface QueryJobJournalStorage {
   prepare(root: string): Promise<void>
   listPartitions(root: string): Promise<string[]>
@@ -162,6 +226,14 @@ export interface QueryJobStoreOptions {
   maxHydratedJobs?: number
   maxReplayEvents?: number
   maxActivityEntries?: number
+  maxTrailEntries?: number
+  maxTrailChars?: number
+  /**
+   * Replaces the hydration allowlist. Production never passes it. It exists so a test
+   * can hydrate a journal through the exact 6.51.0 list (no `trail`) and prove the
+   * rollback contract on real bytes without shipping a second copy of this class.
+   */
+  journalEventTypes?: readonly QueryJobEventType[]
 }
 
 export class QueryJobStoreError extends Error {
@@ -290,10 +362,15 @@ export class QueryJobStore {
   private readonly maxHydratedJobs: number
   private readonly maxReplayEvents: number
   private readonly maxActivityEntries: number
+  private readonly maxTrailEntries: number
+  private readonly maxTrailChars: number
+  private readonly journalEventTypes: readonly QueryJobEventType[]
   private readonly jobs = new Map<string, HydratedQueryJob>()
   private readonly identitiesByJobId = new Map<string, QueryJobIdentity>()
   private readonly identitiesByKey = new Map<string, QueryJobIdentity>()
   private readonly emitter = new EventEmitter()
+  /** Trail frames, apart from job events: only a subscriber that asked for them listens. */
+  private readonly trailEmitter = new EventEmitter()
   private appendTail: Promise<void> = Promise.resolve()
   private initPromise: Promise<QueryJobStoreHealth> | null = null
   private partitions: string[] = []
@@ -307,7 +384,11 @@ export class QueryJobStore {
     this.maxHydratedJobs = Math.max(1, options.maxHydratedJobs ?? QUERY_JOB_LIMITS.hydratedJobs)
     this.maxReplayEvents = Math.max(1, options.maxReplayEvents ?? QUERY_JOB_LIMITS.replayEvents)
     this.maxActivityEntries = Math.max(1, options.maxActivityEntries ?? QUERY_JOB_LIMITS.activityEntries)
+    this.maxTrailEntries = Math.max(1, options.maxTrailEntries ?? QUERY_JOB_LIMITS.trailEntries)
+    this.maxTrailChars = Math.max(1, options.maxTrailChars ?? QUERY_JOB_LIMITS.trailChars)
+    this.journalEventTypes = options.journalEventTypes ?? QUERY_JOB_JOURNAL_EVENT_TYPES
     this.emitter.setMaxListeners(1_000)
+    this.trailEmitter.setMaxListeners(1_000)
     this.health = {
       state: 'new',
       bootId: options.bootId,
@@ -429,9 +510,10 @@ export class QueryJobStore {
       || typeof r.status !== 'string'
       || !r.patch || typeof r.patch !== 'object'
       || !r.eventData || typeof r.eventData !== 'object') return null
-    const statuses: QueryJobStatus[] = ['accepted', 'starting', 'running', 'answer_ready', 'completed', 'failed', 'canceled', 'interrupted']
-    const eventTypes: QueryJobEventType[] = [...statuses, 'chunk', 'tool_status', 'activity_line', 'acknowledged']
-    if (!statuses.includes(r.status as QueryJobStatus) || !eventTypes.includes(r.type as QueryJobEventType)) return null
+    if (!QUERY_JOB_STATUSES.includes(r.status as QueryJobStatus)
+      || !this.journalEventTypes.includes(r.type as QueryJobEventType)) return null
+    // A trail row whose data is not a trail entry is malformed, not a hole in the trail.
+    if (r.type === 'trail' && !parseJobTrailEventData(r.eventData)) return null
     return r as unknown as QueryJobJournalRecord
   }
 
@@ -466,6 +548,7 @@ export class QueryJobStore {
         request,
         events: [],
         lastBootId: record.bootId,
+        trailSeq: 0,
         snapshot: {
           schemaVersion: QUERY_JOB_SCHEMA_VERSION,
           jobId: record.jobId,
@@ -494,6 +577,11 @@ export class QueryJobStore {
       }
       this.jobs.set(record.jobId, hydrated)
     }
+    // A trail row is not a job event: its own cursor, nothing else of the job moves.
+    if (record.type === 'trail') {
+      this.applyTrail(hydrated, record, publish)
+      return undefined
+    }
     if (record.eventSeq <= hydrated.snapshot.eventSeq) return undefined
     if (record.type !== 'accepted'
       && record.type !== 'acknowledged'
@@ -604,6 +692,45 @@ export class QueryJobStore {
     if (snapshot.activity.length > this.maxActivityEntries) snapshot.activity.shift()
   }
 
+  /**
+   * One trail row into `snapshot.trail`, the page a client rebuilds from. Idempotent by
+   * `trailSeq` (a row at or below the job's last one is history, whichever boot wrote it),
+   * never on a terminal job, and it touches NOTHING else of the job: not eventSeq, not the
+   * replay ring, not `updatedAt`, not the identity. Bounded twice: the newest
+   * `maxTrailEntries` entries, and no more than `maxTrailChars` characters of text across
+   * them (the oldest go first; the newest entry always stays). The array exists only once a
+   * row does. A live append is published on the trail channel, which only a subscriber that
+   * asked for the trail listens to.
+   */
+  private applyTrail(hydrated: HydratedQueryJob, record: QueryJobJournalRecord, publish: boolean): void {
+    const parsed = parseJobTrailEventData(record.eventData)
+    if (!parsed) return
+    if (record.generation !== hydrated.snapshot.generation) return
+    if (isTerminalQueryJobStatus(hydrated.snapshot.status)) return
+    if (parsed.trailSeq <= hydrated.trailSeq) return
+    hydrated.trailSeq = parsed.trailSeq
+    const trail = hydrated.snapshot.trail ?? (hydrated.snapshot.trail = [])
+    const entry: QueryJobTrailEntry = { ...parsed.draft, trailSeq: parsed.trailSeq, at: record.persistedAt }
+    trail.push(entry)
+    let chars = trail.reduce((sum, e) => sum + jobTrailTextChars(e), 0)
+    while (trail.length > 1 && (trail.length > this.maxTrailEntries || chars > this.maxTrailChars)) {
+      chars -= jobTrailTextChars(trail.shift()!)
+    }
+    if (publish) {
+      const { trailSeq: _seq, at: _at, ...draft } = entry
+      const frame: QueryJobTrailFrame = {
+        type: 'trail',
+        trailSeq: entry.trailSeq,
+        jobId: hydrated.snapshot.jobId,
+        clientJobId: hydrated.snapshot.clientJobId,
+        generation: hydrated.snapshot.generation,
+        at: entry.at,
+        data: draft as JobTrailDraft,
+      }
+      this.trailEmitter.emit(hydrated.snapshot.jobId, frame)
+    }
+  }
+
   private async appendRecord(record: QueryJobJournalRecord): Promise<void> {
     const serialized = JSON.stringify(record)
     if (Buffer.byteLength(serialized, 'utf8') > MAX_JOURNAL_RECORD_BYTES) {
@@ -771,6 +898,55 @@ export class QueryJobStore {
     return this.mutateSameStatus(jobId, type, {}, { kind, text: safe.text, truncated: safe.truncated })
   }
 
+  /**
+   * One trail draft into the journal (6.52.0).
+   *
+   * Redacted and bounded here, at the journal boundary, whatever the caller already did
+   * (`sanitizeJobTrailDraft`). `trailSeq` is assigned INSIDE the serialized append from the
+   * job's own last one, so the persisted trail is dense 1..n no matter how trail, chunk and
+   * activity writes interleave. A draft with nothing to say, or a job already terminal,
+   * writes nothing and is never an error: a trail row must not be able to fail a run.
+   *
+   * NOT A JOB EVENT (QA round 1). The row carries the job's current eventSeq without
+   * advancing it and goes to the trail channel only: job subscribers, the replay ring and
+   * every snapshot field but `trail` are exactly what they would be without it.
+   */
+  async appendTrail(jobId: string, raw: unknown): Promise<QueryJobMutationResult> {
+    const draft = sanitizeJobTrailDraft(raw)
+    await this.ensureInitialized()
+    await this.ensureHydrated(jobId)
+    return this.enqueue(async () => {
+      this.assertWritable()
+      const hydrated = this.jobs.get(jobId)
+      if (!hydrated) throw new QueryJobNotFoundError(jobId)
+      if (!draft || isTerminalQueryJobStatus(hydrated.snapshot.status)) {
+        return { applied: false, job: clone(hydrated.snapshot) }
+      }
+      const snapshot = hydrated.snapshot
+      const record: QueryJobJournalRecord = {
+        schemaVersion: QUERY_JOB_SCHEMA_VERSION,
+        recordId: randomUUID(),
+        partitionDay: localPartitionDay(this.now()),
+        persistedAt: this.now().toISOString(),
+        bootId: this.options.bootId,
+        jobId: snapshot.jobId,
+        clientJobId: snapshot.clientJobId,
+        generation: snapshot.generation,
+        turnId: snapshot.turnId,
+        requestFingerprint: snapshot.requestFingerprint,
+        // The event this row follows. Never `+ 1`: the job cursor is not the trail's.
+        eventSeq: snapshot.eventSeq,
+        type: 'trail',
+        status: snapshot.status,
+        patch: {},
+        eventData: { ...draft, trailSeq: hydrated.trailSeq + 1 },
+      }
+      await this.appendRecord(record)
+      this.applyTrail(hydrated, record, true)
+      return { applied: true, job: clone(hydrated.snapshot) }
+    })
+  }
+
   async markAnswerReady(
     jobId: string,
     fullText: string,
@@ -1109,31 +1285,64 @@ export class QueryJobStore {
     generation: number,
     after: number,
     listener: (event: QueryJobEvent) => void,
+    trail?: QueryJobTrailSubscribe,
   ): Promise<QueryJobSubscription> {
     await this.getSnapshot(jobId, generation)
     let closed = false
     const wrapped = (event: QueryJobEvent) => {
       if (!closed && event.generation === generation && event.eventSeq > after) listener(clone(event))
     }
+    // The live trail cursor. It starts at the client's, and a rebuild moves it (below).
+    let trailCursor = trail ? trail.after : 0
+    const trailWrapped = trail
+      ? (frame: QueryJobTrailFrame) => {
+        if (!closed && frame.generation === generation && frame.trailSeq > trailCursor) trail.listener(clone(frame))
+      }
+      : null
     this.emitter.on(jobId, wrapped)
+    if (trailWrapped) this.trailEmitter.on(jobId, trailWrapped)
     this.subscriberCount++
     this.refreshHealth()
     // Register first, then take the synchronous replay snapshot. An append can
-    // therefore be in replay OR arrive live (and clients dedupe by eventSeq),
-    // but can never fall into an await-sized gap between the two.
+    // therefore be in replay OR arrive live (and clients dedupe by eventSeq, or by
+    // trailSeq), but can never fall into an await-sized gap between the two.
     const replay = this.buildReplay(jobId, after)
+    const trailReplay = trail ? this.buildTrailReplay(jobId, trail.after) : undefined
+    // A rebuild (`cursor_ahead` or `trail_gap`) resets the client's trail to the held entries
+    // and continues from `latestTrailSeq`, so the live filter does too (6.52.0 app QA). A
+    // retried Messages run keeps its queue row but starts a new job whose trail restarts at 1;
+    // subscribed with the failed attempt's `trailAfter=5` to a trail at 2, the stale cursor
+    // dropped entries 3, 4 and 5 as already seen. Still synchronous with the registration.
+    if (trailReplay?.gap) trailCursor = trailReplay.latestTrailSeq
     return {
       replay,
+      ...(trailReplay ? { trailReplay } : {}),
       unsubscribe: () => {
         if (closed) return
         closed = true
         this.emitter.off(jobId, wrapped)
+        if (trailWrapped) this.trailEmitter.off(jobId, trailWrapped)
         this.subscriberCount = Math.max(0, this.subscriberCount - 1)
         this.refreshHealth()
       },
     }
   }
 
+  /** The trail entries after `after`, or the whole held trail when some are gone. */
+  private buildTrailReplay(jobId: string, after: number): QueryJobTrailReplay {
+    const hydrated = this.jobs.get(jobId)!
+    const trail = hydrated.snapshot.trail ?? []
+    const latestTrailSeq = hydrated.trailSeq
+    const oldestTrailSeq = trail[0]?.trailSeq ?? latestTrailSeq + 1
+    if (after > latestTrailSeq) {
+      return { entries: clone(trail), gap: true, reason: 'cursor_ahead', oldestTrailSeq, latestTrailSeq }
+    }
+    if (after < oldestTrailSeq - 1) {
+      return { entries: clone(trail), gap: true, reason: 'trail_gap', oldestTrailSeq, latestTrailSeq }
+    }
+    return { entries: clone(trail.filter(entry => entry.trailSeq > after)), gap: false, oldestTrailSeq, latestTrailSeq }
+  }
+
   private trimHydratedJobs(protectedJobId?: string): void {
     if (this.jobs.size <= this.maxHydratedJobs) return
     const candidates = [...this.jobs.values()]

package/server/lib/query-job-types.ts

@@ -4,6 +4,7 @@ import {
   parseMediaIdList,
   type MediaAttachmentRef,
 } from '../../shared/media-attachment.js'
+import type { JobTrailDraft } from './job-trail.js'
 
 export const QUERY_JOB_SCHEMA_VERSION = 1 as const
 export const QUERY_JOB_PROTOCOL_VERSION = 1 as const
@@ -17,6 +18,12 @@ export const QUERY_JOB_LIMITS = Object.freeze({
   errorChars: 2_000,
   activityChars: 2_000,
   activityEntries: 64,
+  /** `snapshot.trail` keeps the newest 200 entries (6.52.0)... */
+  trailEntries: 200,
+  /** ...and at most this many characters of text across them, whichever bound
+   * bites first, so a replay-gap snapshot stays small on a phone. Each field is
+   * capped on its own too (see `sanitizeJobTrailDraft`). */
+  trailChars: 32_000,
   replayEvents: 256,
   retainedDays: 7,
   hydratedJobs: 500,
@@ -43,6 +50,11 @@ export type QueryJobEventType =
   | 'tool_status'
   | 'activity_line'
   | 'acknowledged'
+  // 6.52.0: one readable step of a Messages run (see lib/job-trail.ts), a JOURNAL row
+  // type only: it is never a job event, never takes an eventSeq or a replay-ring slot,
+  // and reaches only a subscriber that asked for the trail. Its data is one draft plus
+  // `trailSeq`, a dense 1..n per job.
+  | 'trail'
 
 export type QueryJobActivityMode = 'off' | 'status' | 'preview'
 export type QueryJobActivityKind = 'status' | 'input' | 'output' | 'gap'
@@ -147,6 +159,13 @@ export interface QueryJobActivity {
   repeatCount?: number
 }
 
+/** One entry of `snapshot.trail`: the journaled draft, its dense `trailSeq` (the trail's
+ * own cursor, never the job eventSeq) and when it was written. */
+export type QueryJobTrailEntry = JobTrailDraft & {
+  trailSeq: number
+  at: string
+}
+
 export interface QueryJobSnapshot extends QueryJobProviderLinkage {
   schemaVersion: typeof QUERY_JOB_SCHEMA_VERSION
   jobId: string
@@ -172,6 +191,11 @@ export interface QueryJobSnapshot extends QueryJobProviderLinkage {
   outputImageStats?: QueryJobOutputImageStats
   error?: QueryJobError
   activity: QueryJobActivity[]
+  /** The readable trail (6.52.0), bounded by `QUERY_JOB_LIMITS.trailEntries` and
+   * `trailChars`, rebuilt from the journal on restart. ABSENT, never `[]`, on a job
+   * with no trail rows, and stripped from every snapshot sent to a client that did not
+   * ask for the trail (`?trail=1`), so such a client sees exactly the 6.51.0 shape. */
+  trail?: QueryJobTrailEntry[]
   acceptedAt: string
   startedAt?: string
   answerReadyAt?: string
@@ -477,6 +501,18 @@ export function parseQueryJobOutputImageStats(raw: unknown): QueryJobOutputImage
   return { published, attached, rejected }
 }
 
+/** The store's own credential and local-path patterns, applied to free text with
+ * nothing else changed: no whitespace collapsing, no bound, newlines kept. The trail
+ * sanitizer (lib/job-trail.ts) runs this after `redactSecretText`, so a trail field
+ * passes BOTH redaction layers before it reaches the journal. */
+export function redactQueryJobText(value: string): string {
+  if (typeof value !== 'string' || value.length === 0) return ''
+  let text = value
+  for (const pattern of SECRET_PATTERNS) text = text.replace(pattern, '[redacted]')
+  for (const pattern of PATH_PATTERNS) text = text.replace(pattern, '[path]')
+  return text
+}
+
 /** Second-line redaction even for bridge-produced "safe" activity. This is
  * intentionally conservative: replay never needs a credential or local path. */
 export function sanitizeQueryJobActivity(value: unknown): { text: string; truncated: boolean } {

package/server/lib/session-signal-store.ts

@@ -149,6 +149,18 @@ function turnOpenedByTool(prev: SessionSignal, p: Record<string, unknown>, at: n
 /** Waiting kinds a PostToolUse of the same tool resolves without a fingerprint match. */
 const TOOL_WAITING: Record<string, WaitingKind> = { AskUserQuestion: 'question', ExitPlanMode: 'plan' }
 
+/** The tool whose PermissionRequest is a question card, not an approval (6.52.0). */
+export const ASK_USER_QUESTION_TOOL = 'AskUserQuestion'
+
+/**
+ * 6.52.0: the permission broker's id survives a re-announcement of the SAME request. The
+ * async PreToolUse can land after the PermissionRequest (and the spool after the broker
+ * parked it), and either rewrite of `waiting` would otherwise drop the id the rows carry.
+ */
+function keptRequestId(prev: WaitingSignal | null, fingerprint: string): string | null {
+  return prev?.requestId && fingerprint && prev.fingerprint === fingerprint ? prev.requestId : null
+}
+
 function resolvesWaiting(waiting: WaitingSignal, event: HookEventName, toolName: string, fingerprint: string): boolean {
   if (waiting.fingerprint && waiting.fingerprint === fingerprint) return true
   // Question/plan tools carry no meaningful input to fingerprint; the tool name is the key.
@@ -210,7 +222,7 @@ export function applyHookEvent(prev: SessionSignal | undefined, env: HookEnvelop
         return {
           ...next,
           turnOpen: true,
-          waiting: { kind, detail: tool.target, toolName: tool.name, fingerprint: tool.fingerprint, since: env.ts, requestId: null },
+          waiting: { kind, detail: tool.target, toolName: tool.name, fingerprint: tool.fingerprint, since: env.ts, requestId: keptRequestId(next.waiting, tool.fingerprint) },
         }
       }
       return { ...next, ...turnOpenedByTool(next, p, env.ts), lastTool: tool.name || next.lastTool, lastToolAt: env.ts }
@@ -221,12 +233,15 @@ export function applyHookEvent(prev: SessionSignal | undefined, env: HookEnvelop
         ...next,
         turnOpen: true,
         waiting: {
-          kind: 'permission',
+          // 6.52.0: an AskUserQuestion stays a QUESTION through its PermissionRequest. As
+          // `permission` it cleared only on a fingerprint match, and the answered tool's
+          // PostToolUse carries `answers` in its input, so the row could stay waiting.
+          kind: tool.name === ASK_USER_QUESTION_TOOL ? 'question' : 'permission',
           detail: tool.target ? `${tool.name} ${tool.target}` : tool.name,
           toolName: tool.name,
           fingerprint: tool.fingerprint,
           since: env.ts,
-          requestId: null,
+          requestId: keptRequestId(next.waiting, tool.fingerprint),
         },
       }
     }
@@ -314,19 +329,36 @@ export class SessionSignalStore {
     this.signals.set(sessionId, { ...current, entrypoint })
   }
 
-  /** RESERVED FOR 6.48.2 (the permission broker); no caller in 6.48.0. Attach the broker's
-   *  minted id so rows can carry `pending_permission_id`. */
-  attachPermissionRequestId(sessionId: string, requestId: string | null): void {
+  /**
+   * The permission broker (6.52.0) attaches its item id so rows can carry
+   * `pending_permission_id` (an approval) or `pending_question_id` (an AskUserQuestion).
+   * Widened to `question` in 6.52.0. With a fingerprint, only the wait for THAT request
+   * takes the id: a different dialog now standing must never advertise it. True when set.
+   */
+  attachPermissionRequestId(sessionId: string, requestId: string | null, fingerprint?: string): boolean {
     const current = this.signals.get(sessionId)
-    if (!current?.waiting || current.waiting.kind !== 'permission') return
+    if (!current?.waiting || (current.waiting.kind !== 'permission' && current.waiting.kind !== 'question')) return false
+    if (fingerprint !== undefined && current.waiting.fingerprint !== fingerprint) return false
     this.signals.set(sessionId, { ...current, waiting: { ...current.waiting, requestId } })
+    return true
+  }
+
+  /** The broker let go of a request without deciding it: drop its id, keep the wait. */
+  detachPermissionRequestId(sessionId: string, requestId: string): void {
+    const current = this.signals.get(sessionId)
+    if (!current?.waiting || current.waiting.requestId !== requestId) return
+    this.signals.set(sessionId, { ...current, waiting: { ...current.waiting, requestId: null } })
   }
 
-  /** RESERVED FOR 6.48.2 (the permission broker); no caller in 6.48.0. The broker decided
-   *  (allow or deny): that is resolution evidence. */
-  resolveWaiting(sessionId: string): void {
+  /**
+   * The broker decided (allow or deny): that is resolution evidence. With `match` (6.52.0),
+   * only the wait that carries the broker's id, or that is the same request by fingerprint,
+   * is cleared; a different dialog standing now is left alone.
+   */
+  resolveWaiting(sessionId: string, match?: { requestId: string; fingerprint: string }): void {
     const current = this.signals.get(sessionId)
     if (!current?.waiting) return
+    if (match && current.waiting.requestId !== match.requestId && current.waiting.fingerprint !== match.fingerprint) return
     this.signals.set(sessionId, { ...current, waiting: null })
   }
 

package/server/lib/session-state-derive.ts

@@ -36,7 +36,10 @@ export interface DerivedSessionState {
   waiting_detail?: string
   failure?: string
   last_reply?: string
+  /** 6.52.0: the permission broker holds this approval; `GET /api/session-questions` has it. */
   pending_permission_id?: string
+  /** 6.52.0: the permission broker holds this AskUserQuestion; `GET /api/session-questions` has it. */
+  pending_question_id?: string
   /** Consecutive derives that saw a dead registry pid; carried by the caller between polls. */
   deadScans: number
   /** When the pid was first seen dead, so two observations must also be DEAD_GRACE_MS apart. */
@@ -160,14 +163,20 @@ function deriveFromSignal(signal: SessionSignal, registry: RegistryFacts | undef
   if (signal.ended && !(registry?.alive)) {
     return { agent_state: 'ended', state_source: 'hook', state_since: iso(signal.ended.at), ...reply }
   }
-  if (signal.waiting && waitStillStands(signal.waiting.since, registry, transcript, now)) {
+  // 6.52.0: a wait the permission broker still holds stands whatever the registry or the
+  // transcript say. The broker is positive evidence the hook is blocked on it right now,
+  // and it drops the id on every way the request ends (answer, desk, deadline, hook gone),
+  // all bounded by its deadline.
+  if (signal.waiting && (signal.waiting.requestId || waitStillStands(signal.waiting.since, registry, transcript, now))) {
+    const requestId = signal.waiting.requestId
     return {
       agent_state: 'waiting',
       state_source: 'hook',
       state_since: iso(signal.waiting.since),
       waiting_kind: signal.waiting.kind,
       waiting_detail: signal.waiting.detail,
-      ...(signal.waiting.requestId ? { pending_permission_id: signal.waiting.requestId } : {}),
+      ...(requestId && signal.waiting.kind === 'question' ? { pending_question_id: requestId } : {}),
+      ...(requestId && signal.waiting.kind !== 'question' ? { pending_permission_id: requestId } : {}),
       ...reply,
     }
   }
@@ -208,8 +217,8 @@ function waitStillStands(since: number, registry: RegistryFacts | undefined, tra
 }
 
 /**
- * The fields a `status` draft carries (6.48.1): the row fields minus the permission id
- * (slice 4's, never on the stream) and with `last_reply` only on an idle state, where a
+ * The fields a `status` draft carries (6.48.1): the row fields minus the broker ids
+ * (`pending_permission_id`, `pending_question_id`: never on the stream) and with `last_reply` only on an idle state, where a
  * feed renders "Idle, last reply: …". A typed projection, so a new row field cannot reach
  * the wire by accident.
  */
@@ -245,5 +254,6 @@ export function derivedRowFields(derived: DerivedSessionState | undefined): Reco
     ...(derived.failure ? { failure: derived.failure } : {}),
     ...(derived.last_reply ? { last_reply: derived.last_reply } : {}),
     ...(derived.pending_permission_id ? { pending_permission_id: derived.pending_permission_id } : {}),
+    ...(derived.pending_question_id ? { pending_question_id: derived.pending_question_id } : {}),
   }
 }