@inflexa-ai/harness 0.24.0 → 0.26.0

package/dist/loop/run-agent.js

@@ -10,7 +10,7 @@ import { classifyProviderError } from "../providers/errors.js";
 import { DEFAULT_PROMPT_CACHE, promptCacheProviderOptions } from "../providers/prompt-cache.js";
 import { resultStep } from "./run-step.js";
 import { AskRejectedError, UnavailableAsk } from "../tools/approval/contract.js";
-import { isToolError, readToolResultImage } from "../tools/define-tool.js";
+import { isToolError, readToolResultImages } from "../tools/define-tool.js";
 import { addChatUsage, hasReportedUsage, recordAgentRun } from "./metrics.js";
 import { computeDetail, computeResultDetail } from "./tool-detail.js";
 import { toolOutcomeForOutputType } from "./tool-outcome.js";
@@ -457,6 +457,16 @@ function imagePlacementFor(capabilities) {
         return "user-message";
     return "drop";
 }
+/**
+ * The text part that names one deferred picture. The wire holds no structural
+ * link between a user message and a tool call, thus the line names the call. A
+ * result with several pictures numbers each one, thus the model reads which
+ * slice it looks at.
+ */
+function deferredImageLabel(deferred, index) {
+    const call = `the tool result ${deferred.toolCallId} of ${deferred.toolName}`;
+    return deferred.images.length === 1 ? `The picture of ${call}.` : `The picture ${index + 1} of ${deferred.images.length} of ${call}.`;
+}
 /**
  * Append one user message that carries each deferred picture of the round, then
  * empty the collector.
@@ -464,10 +474,11 @@ function imagePlacementFor(capabilities) {
  * The tool message must come directly after the assistant message with the
  * tool calls. Thus a picture rides a separate message after the whole tool
  * message, and one message batches the round. The parts obey the order of
- * `results`, which is the order of the tool calls. Each deferred picture has a
- * result of this round, because the collector fills during the dispatch and it
- * empties here. A text part names the tool call of each picture, because the wire
- * holds no structural link between a user message and a tool call.
+ * `results`, which is the order of the tool calls, and the pictures of one
+ * result keep the order that the tool gave. Each deferred picture has a result
+ * of this round, because the collector fills during the dispatch and it empties
+ * here. A text part names the tool call of each picture, because the wire holds
+ * no structural link between a user message and a tool call.
  *
  * The message carries the synthetic marker, because a `user` message opens a
  * conversation turn. An unmarked one is loop machinery that reads as a turn
@@ -482,8 +493,10 @@ function appendDeferredImages(messages, results, deferredImages) {
         const deferred = byToolCallId.get(result.toolCallId);
         if (deferred === undefined)
             continue;
-        content.push({ type: "text", text: `The picture of the tool result ${deferred.toolCallId} of ${deferred.toolName}.` });
-        content.push({ type: "file", mediaType: deferred.image.mediaType, data: { type: "data", data: deferred.image.base64 } });
+        for (const [index, image] of deferred.images.entries()) {
+            content.push({ type: "text", text: deferredImageLabel(deferred, index) });
+            content.push({ type: "file", mediaType: image.mediaType, data: { type: "data", data: image.base64 } });
+        }
     }
     messages.push(syntheticUserMessage(content));
     deferredImages.length = 0;
@@ -615,15 +628,16 @@ function jsonValue(value) {
  * Encode a tool ok value onto a tool-result message. A value with no picture
  * stays a plain JSON result, byte-identical to a value that never carried one.
  *
- * A value that carries a picture splits: the JSON data goes to a text part, and
- * the bytes ride as an image content block. Thus the model sees the picture, and
- * the JSON text holds no bytes. When the wire carries no picture, the block drops
- * and the text stays, because base64 text floods the context and the model cannot
- * see it. The drop rides the log, thus an operator sees that the picture did not
- * reach the model.
+ * A value that carries pictures splits: the JSON data goes to a text part, and
+ * the bytes ride as image content blocks after it, in the order that the tool
+ * gave. Thus the model sees each picture, and the JSON text holds no bytes. When
+ * the wire carries no picture, the blocks drop and the text stays, because
+ * base64 text floods the context and the model cannot see it. One warn with the
+ * count rides the log, thus an operator sees how many pictures did not reach the
+ * model.
  *
  * A wire that renders a picture on a user message only gets the fallback: the
- * result keeps its JSON text, and the picture goes to the collector of the round.
+ * result keeps its JSON text, and the pictures go to the collector of the round.
  * The round then sends the bytes after the tool message.
  */
 function successResult(toolCall, value, encoding) {
@@ -634,15 +648,18 @@ function successResult(toolCall, value, encoding) {
         toolName: toolCall.toolName,
         output: { type: "json", value: jsonData },
     };
-    const image = readToolResultImage(value);
-    if (image === undefined)
+    const images = readToolResultImages(value);
+    if (images.length === 0)
         return jsonOnly;
     if (encoding.placement === "drop") {
-        encoding.log.warn("the wired provider carries no picture in a tool result, thus the picture is dropped", { toolName: toolCall.toolName });
+        encoding.log.warn("the wired provider carries no picture in a tool result, thus the pictures are dropped", {
+            toolName: toolCall.toolName,
+            imageCount: images.length,
+        });
         return jsonOnly;
     }
     if (encoding.placement === "user-message") {
-        encoding.deferredImages.push({ toolCallId: toolCall.toolCallId, toolName: toolCall.toolName, image });
+        encoding.deferredImages.push({ toolCallId: toolCall.toolCallId, toolName: toolCall.toolName, images });
         return jsonOnly;
     }
     return {
@@ -653,7 +670,7 @@ function successResult(toolCall, value, encoding) {
             type: "content",
             value: [
                 { type: "text", text: JSON.stringify(jsonData) },
-                { type: "file", mediaType: image.mediaType, data: { type: "data", data: image.base64 } },
+                ...images.map((image) => ({ type: "file", mediaType: image.mediaType, data: { type: "data", data: image.base64 } })),
             ],
         },
     };

package/dist/memory/card-builders.d.ts

@@ -3,12 +3,10 @@
  * `data-presentation`, `data-run-card`, `data-file-reference`).
  *
  * Display tools (`show_plan`, `show_user`, `show_file`) emit these cards live
- * over the chat SSE stream, but the persisted turn keeps only the Anthropic
- * transcript (text / tool_use / tool_result) — the cards are not stored. To
- * re-render a card on reload, `content-to-cortex` reconstructs it from the
- * tool_use block via these same builders, so the live and replayed cards are
- * byte-identical (the deterministic `id` matches, enabling downstream
- * reconciliation).
+ * over the chat SSE stream, and the turn persists what it emitted, so a reload
+ * replays the built card rather than rebuilding it. These builders therefore run
+ * once per card, on the live path only. The `id` stays deterministic all the
+ * same: it is what a re-emission of the same card reconciles on.
  *
  * The builders return the FLAT wire `data` payload (no `type` wrapper, no
  * `source`): the tool emits `{ type, source, data }` (the emit pipeline

package/dist/memory/card-builders.js

@@ -3,12 +3,10 @@
  * `data-presentation`, `data-run-card`, `data-file-reference`).
  *
  * Display tools (`show_plan`, `show_user`, `show_file`) emit these cards live
- * over the chat SSE stream, but the persisted turn keeps only the Anthropic
- * transcript (text / tool_use / tool_result) — the cards are not stored. To
- * re-render a card on reload, `content-to-cortex` reconstructs it from the
- * tool_use block via these same builders, so the live and replayed cards are
- * byte-identical (the deterministic `id` matches, enabling downstream
- * reconciliation).
+ * over the chat SSE stream, and the turn persists what it emitted, so a reload
+ * replays the built card rather than rebuilding it. These builders therefore run
+ * once per card, on the live path only. The `id` stays deterministic all the
+ * same: it is what a re-emission of the same card reconciles on.
  *
  * The builders return the FLAT wire `data` payload (no `type` wrapper, no
  * `source`): the tool emits `{ type, source, data }` (the emit pipeline

package/dist/memory/conversation-display-replay.d.ts

@@ -1,18 +1,19 @@
 /**
  * The runtime transcript read: stored display projections → `CortexMessage[]`.
  *
- * `ThreadHistory.loadPage` returns a thread's rows in `seq` order, and every
+ * `ThreadHistory.loadAll` returns a thread's rows in `seq` order, and every
  * append's first row carries the display projection for that append. Replay is
  * therefore a concatenation: walk the rows, emit each envelope's messages in
  * order, done. No turn grouping, no tool-name recognition, no card rebuilding,
  * no filesystem or database lookup — nothing that could render a reloaded
  * conversation differently from the one the user was shown.
  *
- * A row with no envelope predates the display projection and is skipped. The
- * startup backfill (`conversation-display-backfill.ts`) writes one for every such
- * row before the runtime serves traffic, so in a booted harness there are none;
- * skipping rather than falling back to the migration renderer is what keeps the
- * reconstruction path out of the runtime entirely.
+ * A row with no envelope predates the display projection and is skipped — the
+ * only handling there is or will be. Reconstructing one from the model
+ * transcript instead is what the deleted migration renderer did, and rebuilding
+ * a display from a transcript that never carried one makes every later change to
+ * a tool or a card silently rewrite history. Skipping keeps the gap observable
+ * and the read total in what it consults: the stored projection, nothing else.
  */
 import type { CortexMessage } from "../contracts/message.js";
 import type { StoredMessage } from "./thread-history.js";

package/dist/memory/conversation-display-replay.js

@@ -1,18 +1,19 @@
 /**
  * The runtime transcript read: stored display projections → `CortexMessage[]`.
  *
- * `ThreadHistory.loadPage` returns a thread's rows in `seq` order, and every
+ * `ThreadHistory.loadAll` returns a thread's rows in `seq` order, and every
  * append's first row carries the display projection for that append. Replay is
  * therefore a concatenation: walk the rows, emit each envelope's messages in
  * order, done. No turn grouping, no tool-name recognition, no card rebuilding,
  * no filesystem or database lookup — nothing that could render a reloaded
  * conversation differently from the one the user was shown.
  *
- * A row with no envelope predates the display projection and is skipped. The
- * startup backfill (`conversation-display-backfill.ts`) writes one for every such
- * row before the runtime serves traffic, so in a booted harness there are none;
- * skipping rather than falling back to the migration renderer is what keeps the
- * reconstruction path out of the runtime entirely.
+ * A row with no envelope predates the display projection and is skipped — the
+ * only handling there is or will be. Reconstructing one from the model
+ * transcript instead is what the deleted migration renderer did, and rebuilding
+ * a display from a transcript that never carried one makes every later change to
+ * a tool or a card silently rewrite history. Skipping keeps the gap observable
+ * and the read total in what it consults: the stored projection, nothing else.
  */
 import { conversationUIToCortexMessages } from "./conversation-display-storage.js";
 export function storedMessagesToCortex(messages) {

package/dist/memory/conversation-display-storage.d.ts

@@ -18,6 +18,7 @@ import { type DataUIPart, type UIMessage } from "ai";
 import type { AskPart, ChildSessionStartedPart, FileReferencePart, PlanPart, PresentationPart, ReportRenderedPart, RunCardPart } from "../contracts/chat-parts.js";
 import type { ToolCallOutcome } from "../contracts/chat-events.js";
 import type { CortexMessage, CortexPart, ToolCallPart } from "../contracts/message.js";
+import type { Logger } from "../lib/logger.js";
 export declare const SUPPORTED_DISPLAY_SCHEMA_VERSION = 1;
 type Payload<T extends {
     type: string;
@@ -52,7 +53,7 @@ export interface StoredDisplayEnvelope {
     readonly messages: ConversationUIMessage[];
 }
 export declare function envelopeDisplayMessages(messages: readonly ConversationUIMessage[]): StoredDisplayEnvelope;
-export declare function parseStoredDisplayEnvelope(value: unknown, identity: string): Promise<StoredDisplayEnvelope>;
+export declare function parseStoredDisplayEnvelope(value: unknown, identity: string, logger?: Logger): Promise<StoredDisplayEnvelope>;
 /**
  * Build the stored form of one non-text Cortex part.
  *
@@ -66,15 +67,6 @@ export declare function parseStoredDisplayEnvelope(value: unknown, identity: str
 export declare function conversationDisplayPart(part: Exclude<CortexPart, {
     type: "text";
 }>): DataUIPart<ConversationUIData>;
-/**
- * Project Cortex display messages into the durable representation.
- *
- * The startup backfill's only path into storage: it renders a legacy turn from
- * the model transcript and freezes the result. The live recorder builds the same
- * shape directly from the event stream instead of round-tripping through
- * `CortexMessage`.
- */
-export declare function cortexMessagesToConversationUI(messages: readonly CortexMessage[]): ConversationUIMessage[];
 /**
  * Read the durable representation back as Cortex display messages.
  *

package/dist/memory/conversation-display-storage.js

@@ -39,23 +39,35 @@ const DisplayEnvelopeHeaderSchema = z.object({
  * lifecycle field beside an optional outcome instead would put the meaning of the
  * combination in each reader's head, and readers would disagree.
  */
-const ToolCallDisplaySchema = z
-    .object({
+const ToolCallDisplaySchema = z.object({
     toolCallId: z.string(),
     toolName: z.string(),
     outcome: ToolCallOutcomeSchema,
     detail: z.string().optional(),
-})
-    .strict();
+});
+/**
+ * The schema behind each stored part key.
+ *
+ * Deliberately NOT `.strict()`. These validate rows this package wrote itself,
+ * months earlier, in another process — so the only thing an unknown key can mean
+ * is that the part shed a field since. Rejecting the row for it would make
+ * dropping an optional field, otherwise the safest change available, a
+ * read-breaking one. Zod strips the stale key instead, which is what a reader
+ * would do with it anyway.
+ *
+ * A key stays here as long as rows written under it must still render: the
+ * vocabulary is append-mostly, and retiring an entry is what
+ * {@link parseStoredDisplayEnvelope}'s filter then has to paper over.
+ */
 const dataSchemas = {
     "tool-call": ToolCallDisplaySchema,
-    presentation: PresentationPartSchema.omit({ type: true }).strict(),
-    plan: PlanPartSchema.omit({ type: true }).strict(),
-    "run-card": RunCardPartSchema.omit({ type: true }).strict(),
-    "file-reference": FileReferencePartSchema.omit({ type: true }).strict(),
-    ask: AskPartSchema.omit({ type: true }).strict(),
-    "child-session-started": ChildSessionStartedPartSchema.omit({ type: true }).strict(),
-    "report-rendered": ReportRenderedPartSchema.omit({ type: true }).strict(),
+    presentation: PresentationPartSchema.omit({ type: true }),
+    plan: PlanPartSchema.omit({ type: true }),
+    "run-card": RunCardPartSchema.omit({ type: true }),
+    "file-reference": FileReferencePartSchema.omit({ type: true }),
+    ask: AskPartSchema.omit({ type: true }),
+    "child-session-started": ChildSessionStartedPartSchema.omit({ type: true }),
+    "report-rendered": ReportRenderedPartSchema.omit({ type: true }),
 };
 export function envelopeDisplayMessages(messages) {
     if (messages.length === 0)
@@ -67,14 +79,68 @@ export function envelopeDisplayMessages(messages) {
         messages: structuredClone(messages),
     };
 }
-export async function parseStoredDisplayEnvelope(value, identity) {
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Strip every `data-*` part the current vocabulary cannot render.
+ *
+ * `validateUIMessages` rejects a whole envelope when one part's key is absent
+ * from `dataSchemas`, and exposes no lenient mode, so the filter has to run
+ * ahead of it. Two things go: a part whose key was retired, and a part whose
+ * payload no longer satisfies the schema still standing behind its key — the
+ * second reachable only by making a field required after rows were written,
+ * since the schemas strip rather than reject what they don't know.
+ *
+ * Both are schema evolution, and a transcript missing one card reads better than
+ * a thread that will not load at all. That is the whole line: a part this
+ * package can identify but no longer understands is dropped; anything it cannot
+ * identify AS a part — a non-array `messages`, a part with no `type` — is
+ * corruption, passes through untouched, and still fails the validator. There is
+ * no partial recovery available for a shape you cannot walk.
+ */
+function dropUnrenderableDataParts(messages, identity, logger) {
+    const unknownKey = [];
+    const schemaMismatch = [];
+    const filtered = messages.map((message) => {
+        if (!isRecord(message) || !Array.isArray(message.parts))
+            return message;
+        const parts = message.parts.filter((part) => {
+            if (!isRecord(part) || typeof part.type !== "string" || !part.type.startsWith("data-"))
+                return true;
+            const key = part.type.slice("data-".length);
+            // `Object.hasOwn` before the index: a part typed `data-constructor`
+            // would otherwise resolve up the prototype chain to something that is
+            // not a schema at all, and throw where it should have been dropped.
+            if (!Object.hasOwn(dataSchemas, key)) {
+                unknownKey.push(part.type);
+                return false;
+            }
+            if (!dataSchemas[key].safeParse(part.data).success) {
+                schemaMismatch.push(part.type);
+                return false;
+            }
+            return true;
+        });
+        return parts.length === message.parts.length ? message : { ...message, parts };
+    });
+    if (unknownKey.length > 0 || schemaMismatch.length > 0) {
+        logger?.warn("dropped unrenderable stored display parts", {
+            identity,
+            ...(unknownKey.length > 0 ? { unknownKey: [...new Set(unknownKey)] } : {}),
+            ...(schemaMismatch.length > 0 ? { schemaMismatch: [...new Set(schemaMismatch)] } : {}),
+        });
+    }
+    return filtered;
+}
+export async function parseStoredDisplayEnvelope(value, identity, logger) {
     const header = DisplayEnvelopeHeaderSchema.safeParse(value);
     if (!header.success) {
         throw new Error(`Invalid stored conversation display envelope at ${identity}: ${header.error.message}`);
     }
     try {
         const messages = await validateUIMessages({
-            messages: header.data.messages,
+            messages: dropUnrenderableDataParts(header.data.messages, identity, logger),
             dataSchemas,
             metadataSchema: z.object({ interrupted: z.boolean().optional() }).optional(),
         });
@@ -110,25 +176,6 @@ export function conversationDisplayPart(part) {
     const data = part.type === "tool-call" ? { ...rest, outcome: part.outcome ?? "incomplete" } : rest;
     return { type: displayPartType(part), id: displayPartId(part), data };
 }
-/**
- * Project Cortex display messages into the durable representation.
- *
- * The startup backfill's only path into storage: it renders a legacy turn from
- * the model transcript and freezes the result. The live recorder builds the same
- * shape directly from the event stream instead of round-tripping through
- * `CortexMessage`.
- */
-export function cortexMessagesToConversationUI(messages) {
-    return messages.map((message) => {
-        const parts = message.parts.map((part) => part.type === "text" ? { type: "text", text: part.text, state: "done" } : conversationDisplayPart(part));
-        return {
-            id: message.id,
-            role: message.role,
-            ...(message.interrupted ? { metadata: { interrupted: true } } : {}),
-            parts,
-        };
-    });
-}
 /**
  * Read the durable representation back as Cortex display messages.
  *

package/dist/memory/thread-history.d.ts

@@ -25,9 +25,10 @@ import { ResultAsync } from "neverthrow";
 import type { Pool } from "pg";
 import type { TokenUsageRollup } from "../contracts/usage.js";
 import { type DbError } from "../lib/db-result.js";
+import type { Logger } from "../lib/logger.js";
 import { type StoredMessageEnvelope } from "./ai-sdk-message-storage.js";
 import { type ConversationUIMessage, type StoredDisplayEnvelope } from "./conversation-display-storage.js";
-/** One stored message, as returned by the display read (`loadPage`). */
+/** One stored message, as returned by the display read (`loadAll`). */
 export interface StoredMessage {
     readonly seq: number;
     readonly envelope: StoredMessageEnvelope;
@@ -98,18 +99,6 @@ export interface ConversationTurn {
  * message the turn-boundary predicates fail to recognise.
  */
 export declare function conversationRecordTurn(text: string): ConversationTurn;
-/**
- * A page of stored messages plus pagination metadata. Pagination is
- * turn-based: `total` is the thread's turn count and `page`/`perPage` index
- * turns, while `messages` is the flattened rows of the page's turns.
- */
-export interface MessagePage {
-    readonly messages: StoredMessage[];
-    readonly total: number;
-    readonly page: number;
-    readonly perPage: number;
-    readonly hasMore: boolean;
-}
 /**
  * The result of `retractLastTurn`. `retracted` carries `messages` — the number
  * of rows removed — so a caller can assert exactly what came off the tail. The
@@ -170,13 +159,23 @@ export interface ThreadHistory {
      */
     loadRecent(threadId: string, tokenBudget: number, options?: LoadRecentOptions): ResultAsync<ModelMessage[], DbError>;
     /**
-     * Return one page of a thread's messages oldest-first for UI display —
-     * NOT token-windowed (that is `loadRecent`'s job for the agent loop). No
-     * eviction. Paginated by whole turns: `page`, `perPage`, and `total` count
-     * turns, not rows, so a multi-row turn always reloads intact. `messages`
-     * holds the flattened rows of the selected turns.
+     * Return a thread's messages oldest-first for UI display, grouped into turns.
+     * NOT token-windowed — that is `loadRecent`'s job for the agent loop — and no
+     * eviction.
+     *
+     * There is no paginated form, because a page could never cost less: the read
+     * selects and parses every row of the thread and would slice only afterwards,
+     * so a page saves no query and no parse. It would only truncate the answer,
+     * which is a way to lose turns and not a way to save work. A reader wanting a
+     * window takes one here, where it knows what it is bounding.
+     *
+     * Grouped rather than flat because the grouping is what the read computes and
+     * what a turn count means, and `.flat()` recovers the rows in `seq` order for
+     * a display replay. The reverse does not hold: a flat return would make a
+     * caller that wants the tail turn, or the newest N turns, re-find boundaries
+     * this read already found.
      */
-    loadPage(threadId: string, page: number, perPage: number): ResultAsync<MessagePage, DbError>;
+    loadAll(threadId: string): ResultAsync<StoredMessage[][], DbError>;
     /**
      * Remove the thread's most recent turn — every row from the last
      * genuine-user-start `seq` onward — in a single transaction.
@@ -209,6 +208,13 @@ export interface ThreadHistory {
      * no guarantee, because the tail can move one append later without it.
      */
     latestSeq(threadId: string): ResultAsync<number | null, DbError>;
+    /**
+     * When the thread last moved — `MAX(messages.created_at)`, or `null` for a
+     * thread with no rows. The thread's ACTIVITY clock, and deliberately not
+     * `cortex_analysis_threads.updated_at`: a title rename bumps that column
+     * too, so it cannot answer "has a turn settled since <time>".
+     */
+    latestTurnAt(threadId: string): ResultAsync<Date | null, DbError>;
     /**
      * The count of the thread turns that a person opened past `seq`. A caller
      * reads it as the new work of the thread past an anchor.
@@ -260,5 +266,10 @@ export declare const EVICTION_BLOCK_TURNS = 4;
  * Create a `ThreadHistory` bound to a Postgres pool — a factory closure
  * capturing `pool` (dependency injection per the harness-durable-runtime spec). The `messages` table is
  * provisioned by the project's state-init DDL.
+ *
+ * `logger` serves exactly one purpose: reporting a stored display part the
+ * current vocabulary had to drop. It is optional because the read returns the
+ * same messages either way — the drop reports a deploy, not a failed read — and
+ * requiring it would break every call site over a diagnostic.
  */
-export declare function createThreadHistory(pool: Pool): ThreadHistory;
+export declare function createThreadHistory(pool: Pool, logger?: Logger): ThreadHistory;

package/dist/memory/thread-history.js

@@ -108,7 +108,7 @@ function serializeEnvelope(message) {
 /**
  * Group rows (oldest-first) into turns at genuine-user-start boundaries.
  * Generic over the row shape so the token-windowed read (`loadRecent`) and
- * the display read (`loadPage`) share it, each supplying its own start
+ * the display read (`loadAll`) share it, each supplying its own start
  * predicate.
  */
 function groupTurns(rows, isStart) {
@@ -173,8 +173,13 @@ export const EVICTION_BLOCK_TURNS = 4;
  * Create a `ThreadHistory` bound to a Postgres pool — a factory closure
  * capturing `pool` (dependency injection per the harness-durable-runtime spec). The `messages` table is
  * provisioned by the project's state-init DDL.
+ *
+ * `logger` serves exactly one purpose: reporting a stored display part the
+ * current vocabulary had to drop. It is optional because the read returns the
+ * same messages either way — the drop reports a deploy, not a failed read — and
+ * requiring it would break every call site over a diagnostic.
  */
-export function createThreadHistory(pool) {
+export function createThreadHistory(pool, logger) {
     function appendTurn(threadId, turn) {
         const { modelMessages: messages, displayMessages, turnUsage, turnDurationMs } = turn;
         if (messages.length === 0)
@@ -351,52 +356,40 @@ export function createThreadHistory(pool) {
             return (keepsFirstTurn ? [turns[0], ...retained] : retained).flat().map((row) => row.message);
         });
     }
-    function loadPage(threadId, page, perPage) {
-        const safePerPage = Math.min(Math.max(perPage, 1), 200);
-        const safePage = Math.max(page, 0);
-        return tryQuery("thread-history.loadPage", async () => {
-            // Display pages are turn-bounded, not row-bounded. A serial-tool assistant
-            // turn is persisted as one row per step (plus its tool_result `user` rows),
-            // so a row-windowed page could split a turn — truncating the trailing
-            // report card/text out of the page the UI fetches. Read the thread, group
-            // into turns, and slice whole turns so a turn always reloads intact.
-            // Threads are conversation-scoped and bounded, so reading every row here
-            // matches `loadRecent`'s existing whole-thread read.
-            const { rows } = await pool.query(
-            // ORDER BY must qualify `messages.seq` — a bare `seq` would bind to the
-            // `seq::text AS seq` output alias (Postgres resolves an unqualified
-            // ORDER BY name to the output column), sorting the bigint as text:
-            // "10" before "2". The qualified name forces the bigint column.
-            `SELECT seq::text AS seq, message_envelope, display_envelope, reported_usage, turn_duration_ms::text AS turn_duration_ms
+    // Display reads are turn-bounded, not row-bounded. A serial-tool assistant
+    // turn is persisted as one row per step (plus its tool_result `user` rows),
+    // so a row-windowed page could split a turn — truncating the trailing
+    // report card/text out of the page the UI fetches. Read the thread and group
+    // into turns, so a turn always reloads intact. Threads are conversation-scoped
+    // and bounded, so reading every row here matches `loadRecent`'s existing
+    async function readTurns(threadId) {
+        const { rows } = await pool.query(
+        // ORDER BY must qualify `messages.seq` — a bare `seq` would bind to the
+        // `seq::text AS seq` output alias (Postgres resolves an unqualified
+        // ORDER BY name to the output column), sorting the bigint as text:
+        // "10" before "2". The qualified name forces the bigint column.
+        `SELECT seq::text AS seq, message_envelope, display_envelope, reported_usage, turn_duration_ms::text AS turn_duration_ms
          FROM messages WHERE thread_id = $1
          ORDER BY messages.seq ASC`, [threadId]);
-            // Spread rather than `usage: r.reported_usage ?? undefined`, so a row with
-            // no rollup carries no `usage` KEY at all — absent, not present-and-undefined.
-            // The duration obeys the same rule, and it reads from its own column.
-            const stored = await Promise.all(rows.map(async (r) => {
-                const envelope = parseStoredMessageEnvelope(r.message_envelope, `${threadId}/${r.seq}`);
-                const displayEnvelope = r.display_envelope == null ? undefined : await parseStoredDisplayEnvelope(r.display_envelope, `${threadId}/${r.seq}/display`);
-                return {
-                    seq: Number(r.seq),
-                    envelope,
-                    message: envelope.message,
-                    ...(displayEnvelope ? { displayEnvelope } : {}),
-                    ...(r.reported_usage === null ? {} : { usage: r.reported_usage }),
-                    ...(r.turn_duration_ms === null ? {} : { durationMs: Number(r.turn_duration_ms) }),
-                };
-            }));
-            const turns = groupTurns(stored, (row) => isGenuineUserStart(row.message));
-            const total = turns.length;
-            const offset = safePage * safePerPage;
-            const pageTurns = turns.slice(offset, offset + safePerPage);
+        // Spread rather than `usage: r.reported_usage ?? undefined`, so a row with
+        // no rollup carries no `usage` KEY at all — absent, not present-and-undefined.
+        // The duration obeys the same rule, and it reads from its own column.
+        const stored = await Promise.all(rows.map(async (r) => {
+            const envelope = parseStoredMessageEnvelope(r.message_envelope, `${threadId}/${r.seq}`);
+            const displayEnvelope = r.display_envelope == null ? undefined : await parseStoredDisplayEnvelope(r.display_envelope, `${threadId}/${r.seq}/display`, logger);
             return {
-                messages: pageTurns.flat(),
-                total,
-                page: safePage,
-                perPage: safePerPage,
-                hasMore: offset + pageTurns.length < total,
+                seq: Number(r.seq),
+                envelope,
+                message: envelope.message,
+                ...(displayEnvelope ? { displayEnvelope } : {}),
+                ...(r.reported_usage === null ? {} : { usage: r.reported_usage }),
+                ...(r.turn_duration_ms === null ? {} : { durationMs: Number(r.turn_duration_ms) }),
             };
-        });
+        }));
+        return groupTurns(stored, (row) => isGenuineUserStart(row.message));
+    }
+    function loadAll(threadId) {
+        return tryQuery("thread-history.loadAll", () => readTurns(threadId));
     }
     function retractLastTurn(threadId) {
         return withTransaction(pool, "thread-history.retractLastTurn", (client) => 
@@ -452,6 +445,13 @@ export function createThreadHistory(pool) {
             return maxSeq === null ? null : Number(maxSeq);
         });
     }
+    function latestTurnAt(threadId) {
+        // `MAX(created_at)` over no rows is SQL NULL, so a thread with no messages
+        // reads as `null` rather than as a time. This is the thread's ACTIVITY
+        // clock — distinct from `cortex_analysis_threads.updated_at`, which a
+        // rename also bumps, and so cannot answer "did a turn settle after X".
+        return tryQuery("thread-history.latestTurnAt", () => pool.query("SELECT MAX(created_at) AS latest_at FROM messages WHERE thread_id = $1", [threadId])).map(({ rows }) => rows[0]?.latest_at ?? null);
+    }
     function countUserTurnsAfter(threadId, seq) {
         // `GENUINE_USER_START_SQL` is the stored-envelope twin of
         // `isGenuineUserStart`, and the tail retraction cuts on the same text.
@@ -468,5 +468,5 @@ export function createThreadHistory(pool) {
                 AND seq > $2::bigint
                 AND ${GENUINE_USER_START_SQL}`, [threadId, seq])).map(({ rows }) => Number(rows[0].turns));
     }
-    return { appendTurn, loadRecent, loadPage, retractLastTurn, latestSeq, countUserTurnsAfter };
+    return { appendTurn, loadRecent, loadAll, retractLastTurn, latestSeq, latestTurnAt, countUserTurnsAfter };
 }