@linxin666/dsh-client-ui-task-board 0.4.6 → 0.4.7

package/src/host/launch-admission.ts

@@ -0,0 +1,140 @@
+/**
+ * Admission control for the session-creating half of a run.
+ *
+ * One board action can open a whole subtree, and a team run hands every member
+ * of it to the Lead at once. Both paths used to fire every launch in the same
+ * tick, so the Host asked DSH for N sessions at once — the burst the repository's
+ * measured guidance caps at three heavy implementation subagents
+ * (docs/multi-agent-resources.md), with no mechanism enforcing it.
+ *
+ * The queue is SERVICE-wide, not per run group: the pressure it bounds is the
+ * machine's (the Host process's memory and the swap it drives), and two run
+ * groups opened from two tabs share one Host. Admission is round-robin across
+ * run groups — FIFO inside a group, so a group's first run (the Lead, which
+ * carries the run shape and the teammate namespace) always starts before its
+ * members — so a large subtree cannot starve a run opened after it, and no
+ * entry can be starved.
+ *
+ * The width is read through a live callback, so a settings edit takes effect on
+ * the next admission without remounting anything.
+ *
+ * @module dsh-task-board/host/launch-admission
+ */
+
+/** One launch the queue has not started yet. */
+export interface QueuedLaunch {
+  /** Run group this launch belongs to; the unit of round-robin fairness. */
+  readonly groupId: string
+  /**
+   * Perform the launch. The slot is held until this promise settles, which
+   * makes "in flight" mean "still creating and prompting its session".
+   * A rejection is swallowed here so one broken launch can never wedge the
+   * slot; the caller owns reporting.
+   */
+  start(): Promise<void>
+  /**
+   * Called by {@link LaunchAdmissionQueue.drain} for a launch that never
+   * started, so the caller can take its execution out of the running column.
+   */
+  abandon(): void
+}
+
+export class LaunchAdmissionQueue {
+  /** Waiting launches per run group, in arrival order. */
+  private readonly waiting = new Map<string, QueuedLaunch[]>()
+  /** Run groups in round-robin order. */
+  private rotation: string[] = []
+  /** Slot holders of the launches in flight, one per admitted launch. */
+  private readonly inFlight = new Set<() => void>()
+  /** Highest number of launches in flight at once; observability and tests. */
+  peakInFlight = 0
+
+  /**
+   * @param width - live admission width (already normalized by the caller).
+   */
+  constructor(private readonly width: () => number) {}
+
+  /** Launches the queue has not admitted yet. */
+  get pendingCount(): number {
+    let total = 0
+    for (const queue of this.waiting.values()) total += queue.length
+    return total
+  }
+
+  /** Launches currently holding a slot. */
+  get inFlightCount(): number {
+    return this.inFlight.size
+  }
+
+  /** Admit one launch, immediately if a slot is free. */
+  enqueue(launch: QueuedLaunch): void {
+    const queue = this.waiting.get(launch.groupId)
+    if (queue === undefined) {
+      this.waiting.set(launch.groupId, [launch])
+      this.rotation.push(launch.groupId)
+    } else {
+      queue.push(launch)
+    }
+    this.pump()
+  }
+
+  /**
+   * Abandon every waiting launch: the queue is being torn down, so an entry
+   * that never started can never start. Launches already in flight are left
+   * alone — their session may already exist, and the callers that own them
+   * settle them through the normal path.
+   * @returns the abandoned launches, in abandonment order.
+   */
+  drain(): QueuedLaunch[] {
+    const abandoned: QueuedLaunch[] = []
+    for (const groupId of this.rotation) {
+      for (const launch of this.waiting.get(groupId) ?? []) abandoned.push(launch)
+    }
+    this.rotation = []
+    this.waiting.clear()
+    for (const launch of abandoned) launch.abandon()
+    return abandoned
+  }
+
+  private pump(): void {
+    while (this.inFlight.size < this.width()) {
+      const launch = this.takeNext()
+      if (launch === undefined) return
+      this.admit(launch)
+    }
+  }
+
+  /** The next launch by round-robin across groups and FIFO inside one. */
+  private takeNext(): QueuedLaunch | undefined {
+    while (this.rotation.length > 0) {
+      const groupId = this.rotation.shift()
+      if (groupId === undefined) return undefined
+      const queue = this.waiting.get(groupId)
+      if (queue === undefined || queue.length === 0) {
+        this.waiting.delete(groupId)
+        continue
+      }
+      const launch = queue.shift()
+      if (launch === undefined) continue
+      if (queue.length === 0) this.waiting.delete(groupId)
+      // A group that still has work goes to the back of the rotation, so every
+      // other run group gets its turn before this one's next member.
+      else this.rotation.push(groupId)
+      return launch
+    }
+    return undefined
+  }
+
+  private admit(launch: QueuedLaunch): void {
+    const release = (): void => {
+      this.inFlight.delete(release)
+      this.pump()
+    }
+    this.inFlight.add(release)
+    if (this.inFlight.size > this.peakInFlight) this.peakInFlight = this.inFlight.size
+    void Promise.resolve()
+      .then(() => launch.start())
+      .catch(() => { /* a rejected launch still releases its slot; the caller reports it */ })
+      .then(release)
+  }
+}

package/src/host-ledger.ts

@@ -10,6 +10,7 @@ import {
   DEFAULT_SUBTASK_DEPTH,
   cascadeTargets,
   combineCascadeOutcome,
+  joinsCascadeRun,
   normalizeSubtaskDepth,
   openGroupExecution,
   pendingCascadeChildren,
@@ -17,6 +18,7 @@ import {
 } from './core/subtask.ts'
 import { applyArchiveTask, applyRestoreTask } from './core/use-cases/task-archive.ts'
 import { applyCreateTask } from './core/use-cases/task-create.ts'
+import type { CardDefaults } from './core/card-defaults.ts'
 import { applyDeleteTask } from './core/use-cases/task-delete.ts'
 import { applySetSchedule, applyScheduleProgress, applyScheduleRefund, type ScheduleProgress } from './core/use-cases/task-schedule.ts'
 import { applySetParent } from './core/use-cases/task-parent.ts'
@@ -488,11 +490,15 @@ export class HostTaskLedger {
    */
   private depthLimit: number
 
-  constructor(dir: string = join(dshHome(), 'task-board'), private readonly now: () => number = Date.now, options: { sessionDefaultPermission?: TaskPermission | (() => TaskPermission); maxSubtaskDepth?: number } = {}) {
+  /** Live reader of the deployment's new-card defaults (a volatile config read). */
+  private readonly cardDefaults: () => CardDefaults
+
+  constructor(dir: string = join(dshHome(), 'task-board'), private readonly now: () => number = Date.now, options: { sessionDefaultPermission?: TaskPermission | (() => TaskPermission); maxSubtaskDepth?: number; cardDefaults?: () => CardDefaults } = {}) {
     // Resolved before the load/repair passes below: they can evaluate the gate.
     const baseline = options.sessionDefaultPermission
     this.sessionDefault = typeof baseline === 'function' ? baseline : () => baseline ?? DEFAULT_SESSION_PERMISSION
     this.depthLimit = normalizeSubtaskDepth(options.maxSubtaskDepth ?? DEFAULT_SUBTASK_DEPTH)
+    this.cardDefaults = options.cardDefaults ?? (() => ({}))
     mkdirSync(dir, { recursive: true })
     this.file = join(dir, 'ledger-v2.json')
     this.lockFile = join(dir, 'ledger-v2.lock')
@@ -974,7 +980,7 @@ export class HostTaskLedger {
         const input = action.input.freeze === undefined || initiator === undefined || initiator === ''
           ? action.input
           : { ...action.input, freeze: { ...action.input.freeze, frozenBy: initiator } }
-        const result = applyCreateTask(this.document.tasks, input, now, action.id, this.maxSubtaskDepth, timeZone())
+        const result = applyCreateTask(this.document.tasks, input, now, action.id, this.maxSubtaskDepth, timeZone(), this.cardDefaults())
         if (result.task === undefined) throw new Error(result.error ?? 'invalid task')
         this.document.tasks = [...result.tasks]
         break
@@ -1262,10 +1268,11 @@ export class HostTaskLedger {
   }
 
   /**
-   * Open one execution per cascade participant (the requested task and its
-   * on-board descendants, within the depth limit) under a single run group, and
-   * commit the ledger once. The returned runs are ordered root-first, so the
-   * Host launches the parent before its subtasks.
+   * Open one execution per cascade participant that still has work (the
+   * requested task and its on-board descendants, within the depth limit) under
+   * a single run group, and commit the ledger once. A descendant in 'done' is
+   * not a participant ({@link joinsCascadeRun}). The returned runs are ordered
+   * root-first, so the Host launches the parent before its subtasks.
    * @param root - the task the user ran.
    * @param now - clock instant (ms epoch).
    * @param initiator - the DSH session that asked for the run (audit only).
@@ -1285,6 +1292,11 @@ export class HostTaskLedger {
     const runs: OpenedRun[] = []
     for (const task of cascadeTargets(before, root.id, this.maxSubtaskDepth)) {
       if (task.archivedAt !== undefined) continue
+      // A subtask that already sits in 'done' is left alone: running the parent
+      // repeats the parent, never the work a subtask has already finished. The
+      // rule is the card's column, so it holds for a manual run, a re-run and a
+      // due occurrence alike.
+      if (!joinsCascadeRun(task, root.id)) continue
       if (hasOpenExecution(task)) continue
       const base = rerun && task.id === root.id ? withStatus(task, 'todo', now) : task
       const opened = startExecution(base, now, crypto.randomUUID(), initiator, groupId)

package/src/host-runner.ts

@@ -1,9 +1,12 @@
-import type { TypertGateway } from '@deepseek-ai/dsh-api-gateway'
+import { Context } from '@deepseek-ai/cordis'
+import type { InvokeRemoteRequest, TypertGateway } from '@deepseek-ai/dsh-api-gateway'
 import type { SessionAddress, SessionHistoryRecord, SessionListValue, SessionPage, SessionSummary } from '@deepseek-ai/dsh-api-session-controller/types'
 import type { CommandResult } from '@deepseek-ai/dsh-commands/types'
 import type { Workspace } from '@deepseek-ai/dsh-workspace/types'
 import { teammateName } from './core/subtask.ts'
 import { mostRecentWorkspaceId } from './core/workspace-target.ts'
+import { declaredRoute, normalizeReasoningEffort, resolveReasoningEffort, type ReasoningRoute } from './core/reasoning-effort.ts'
+import type { ModelCatalogView } from './core/verification.ts'
 import type { TaskPermission, TaskRecord } from './core/tasks.ts'
 
 /**
@@ -14,13 +17,69 @@ export interface TaskBoardWorkspaceRegistry {
   list(): readonly Workspace[]
 }
 
+/**
+ * The peer every gateway request names: derived from the public
+ * `InvokeRemoteRequest` type so this package needs no direct dependency on
+ * `@deepseek-ai/dsh-typert-protocol` for the shape.
+ */
+export type GatewayPeer = InvokeRemoteRequest['peer']
+
 interface GatewayRequest {
   namespace: string
   method: string
   args: Record<string, unknown>
+  peer: GatewayPeer
   signal?: AbortSignal
 }
 
+/**
+ * Mint the in-process owner peer this plugin's Host calls speak for.
+ *
+ * The 0.2.1 gateway made `peer` mandatory on every request, and the
+ * authorization layer reads only `peer.principal`: a principal of
+ * `{ kind: 'owner' }` is how host-local code states that the call IS the local
+ * user driving their own Host, so the gateway answers it directly instead of
+ * running a remote-access decision (only non-owner principals are judged).
+ * That is exactly the task board's position — it creates, renames, prompts,
+ * and reads sessions as the Host itself, which before 0.2.1 was the implicit
+ * privilege of every in-process caller. The board claims owner explicitly, and
+ * only ever inside its own Host process: no wire field can set a principal,
+ * and this plugin never forwards a browser-supplied one.
+ *
+ * `interactions` stays `'none'`: the board only invokes methods and opens the
+ * short `session/follow` stream. The gateway's interactions check gates
+ * exactly the forwarded-event endpoints (opening an event stream, answering a
+ * waterfall), which this caller never touches; an `'answer'` peer would
+ * additionally receive forwarded Host events, a capability the board neither
+ * needs nor wants.
+ *
+ * The peer's signal aborts once `ctx` disposes, so streams opened for it end
+ * with the plugin fiber, and `dispose()` is idempotent with racing calls
+ * sharing one completion. The id carries no credential — the protocol fixes
+ * `principal` as the only identity persisted in a session log — so a fresh
+ * unique id per mount is sufficient.
+ */
+export function createOwnerPeer(ctx: Context): GatewayPeer {
+  const controller = new AbortController()
+  let completion: Promise<void> | undefined
+  const peer: GatewayPeer = {
+    id: `task-board-owner:${crypto.randomUUID()}` as GatewayPeer['id'],
+    ctx,
+    principal: { kind: 'owner' },
+    signal: controller.signal,
+    interactions: 'none',
+    dispose() {
+      if (completion === undefined) {
+        controller.abort()
+        completion = Promise.resolve()
+      }
+      return completion
+    },
+  }
+  ctx.effect(() => () => { void peer.dispose() }, 'task-board owner peer')
+  return peer
+}
+
 interface SessionGateway {
   invoke(request: GatewayRequest): Promise<unknown>
   stream?(request: GatewayRequest): Promise<AsyncIterable<unknown>>
@@ -313,10 +372,20 @@ function invokeWireArgs(namespace: string, method: string, request: Record<strin
 }
 
 export class HostExecutionRunner {
-  /** Newest scanned event sequence per session with no matching execution end. */
+  /**
+   * Newest event sequence per session whose COMPLETE history walk (reaching
+   * the execution boundary) found no matching execution end. A later walk may
+   * trust everything at or below it and examine only newer records.
+   */
   private readonly scanMemos = new Map<string, number>()
   private readonly unavailableAttempts: number
   private readonly unavailableBackoffMs: number
+  /**
+   * The peer every request speaks for. Production passes the peer bound to the
+   * plugin fiber; a bare runner (unit tests around fake gateways) gets one
+   * bound to a fresh root context instead.
+   */
+  private readonly ownerPeer: GatewayPeer
   private unsupportedSessionListWarned = false
 
   constructor(
@@ -324,18 +393,20 @@ export class HostExecutionRunner {
     private readonly commands?: SessionCommandDispatcher,
     private readonly workspaceRegistry?: TaskBoardWorkspaceRegistry,
     unavailableRetry?: { attempts?: number; backoffMs?: number },
+    ownerPeer?: GatewayPeer,
   ) {
     this.unavailableAttempts = unavailableRetry?.attempts ?? SERVICE_UNAVAILABLE_ATTEMPTS
     this.unavailableBackoffMs = unavailableRetry?.backoffMs ?? SERVICE_UNAVAILABLE_BACKOFF_MS
+    this.ownerPeer = ownerPeer ?? createOwnerPeer(new Context())
   }
 
   private invoke(namespace: string, method: string, request: Record<string, unknown>, signal?: AbortSignal): Promise<unknown> {
-    return this.gateway.invoke({ namespace, method, args: invokeWireArgs(namespace, method, request), ...(signal === undefined ? {} : { signal }) })
+    return this.gateway.invoke({ namespace, method, args: invokeWireArgs(namespace, method, request), peer: this.ownerPeer, ...(signal === undefined ? {} : { signal }) })
   }
 
   private stream(namespace: string, method: string, request: Record<string, unknown>, signal?: AbortSignal): Promise<AsyncIterable<unknown>> {
     if (!('stream' in this.gateway) || this.gateway.stream === undefined) throw new Error('gateway stream is unavailable')
-    return this.gateway.stream({ namespace, method, args: { request }, ...(signal === undefined ? {} : { signal }) })
+    return this.gateway.stream({ namespace, method, args: { request }, peer: this.ownerPeer, ...(signal === undefined ? {} : { signal }) })
   }
 
   /**
@@ -377,6 +448,14 @@ export class HostExecutionRunner {
      * `goalRun` still applies on top of it (both must ASK for a goal).
      */
     goalEnabled?: boolean
+    /**
+     * The host model catalog, read ONCE per execution by the caller. The card's
+     * pinned reasoning effort is sent only when this catalog declares it for the
+     * route the execution runs at, so one snapshot decides both the acceptance
+     * contract and the effort this run freezes. Absent means "no capability
+     * evidence": an effort is then not sent at all.
+     */
+    catalog?: ModelCatalogView
   } = {}): Promise<string> {
     // A handover bundle overrides the legacy pin fields: the bundle is the
     // authoritative execution triplet for a continuation card (issue #5). A
@@ -417,7 +496,7 @@ export class HostExecutionRunner {
         // at the gate without its binding.
         options.onSession?.(reused)
         await this.assertReusedPreset(reused, mode)
-        await this.pinAndPrompt(reused, task, permission, options.promptContext, options.onGoalArmed, options.goalEnabled === true)
+        await this.pinAndPrompt(reused, task, permission, options.promptContext, options.onGoalArmed, options.goalEnabled === true, options.catalog)
       } catch (error) {
         throw new SessionLaunchError(reused, error)
       }
@@ -431,7 +510,7 @@ export class HostExecutionRunner {
     options.onSession?.(sessionId)
     try {
       await this.invoke('session', 'rename', { sessionId, title: task.title })
-      await this.pinAndPrompt(sessionId, task, permission, options.promptContext, options.onGoalArmed, options.goalEnabled === true)
+      await this.pinAndPrompt(sessionId, task, permission, options.promptContext, options.onGoalArmed, options.goalEnabled === true, options.catalog)
     } catch (error) {
       throw new SessionLaunchError(sessionId, error)
     }
@@ -466,10 +545,59 @@ export class HostExecutionRunner {
     )
   }
 
+  /**
+   * Split a `provider/model` pin. A pin without a provider keeps only the model
+   * id: the provider is the one the host catalog declares for it, resolved at
+   * launch because the session wire contract requires a provider.
+   */
+  private static pinnedRoute(model: string | undefined): ReasoningRoute | undefined {
+    const raw = model?.trim()
+    if (raw === undefined || raw === '') return undefined
+    const slash = raw.indexOf('/')
+    if (slash < 0) return { model: raw }
+    const provider = raw.slice(0, slash).trim()
+    const modelId = raw.slice(slash + 1).trim()
+    if (provider === '' || modelId === '') return undefined
+    return { provider, model: modelId }
+  }
+
+  /**
+   * The route a card that pins no model actually runs at: the session's own
+   * recorded selection (the durable fold the GUI reads; `next` is the pending
+   * user choice, `lastUsed` what the last request consumed), or — for a session
+   * that has selected none yet, which is exactly a session that would start at
+   * the deployment default — the host default from the catalog.
+   *
+   * A route that cannot be READ is undefined and the effort is not sent:
+   * falling back to the host default there would silently switch the model of a
+   * session this run only meant to continue.
+   */
+  private async sessionRoute(sessionId: ExecutionSessionId, catalog?: ModelCatalogView): Promise<ReasoningRoute | undefined> {
+    let selection: { provider?: unknown; model?: unknown } | null | undefined
+    try {
+      const projections = await this.invoke('session', 'projections', { sessionId }) as
+        | { values?: { modelSelection?: { lastUsed?: { provider?: unknown; model?: unknown } | null; next?: { provider?: unknown; model?: unknown } | null } } }
+        | null
+      selection = projections?.values?.modelSelection?.next ?? projections?.values?.modelSelection?.lastUsed
+    } catch (error) {
+      console.warn('[dsh-task-board] session/projections failed while resolving the execution model route', error)
+      return undefined
+    }
+    if (typeof selection?.provider === 'string' && selection.provider !== ''
+      && typeof selection.model === 'string' && selection.model !== '') {
+      return { provider: selection.provider, model: selection.model }
+    }
+    return catalog?.default === undefined
+      ? undefined
+      : { provider: catalog.default.provider, model: catalog.default.model }
+  }
+
   /**
    * Re-assert the pinned execution contract on a session and queue the task
    * prompt. Shared by the fresh-session and reuse paths so both apply exactly
-   * the same permission/model pins before the prompt.
+   * the same permission/model/effort pins before the prompt. A session that
+   * refuses a selection carrying a catalog-confirmed effort throws here, so the
+   * prompt is never queued behind a run at the wrong level.
    */
   private async pinAndPrompt(
     sessionId: ExecutionSessionId,
@@ -478,6 +606,7 @@ export class HostExecutionRunner {
     context: PromptContext = {},
     onGoalArmed?: (armed: boolean) => void,
     goalEnabled = false,
+    catalog?: ModelCatalogView,
   ): Promise<void> {
     if (permission !== undefined) {
       if (this.commands === undefined) throw new Error('permission command dispatcher is unavailable')
@@ -485,19 +614,43 @@ export class HostExecutionRunner {
       if (command === undefined) throw new Error('permission command was not acknowledged')
       if (command.kind !== 'success') throw new Error(command.text ?? 'permission command failed')
     }
-    if (task.model !== undefined && task.model.trim() !== '') {
-      const rawModel = task.model.trim()
-      const slashIdx = rawModel.indexOf('/')
-      const provider = slashIdx >= 0 ? rawModel.slice(0, slashIdx).trim() : undefined
-      const modelId = slashIdx >= 0 ? rawModel.slice(slashIdx + 1).trim() : rawModel
+    // The effort is bound to the model route the execution runs at. A card that
+    // pins no model of its own runs at the session's route, so that route is
+    // resolved first — and only when there is an effort to place: a card that
+    // never chose one must not gain a model-selection call it did not have.
+    const requestedEffort = normalizeReasoningEffort(task.reasoningEffort)
+    const pinned = HostExecutionRunner.pinnedRoute(task.model)
+    const route = pinned ?? (requestedEffort === undefined ? undefined : await this.sessionRoute(sessionId, catalog))
+    if (route !== undefined) {
+      const routeLabel = `${route.provider === undefined ? '' : route.provider + '/'}${route.model}`
+      const decision = resolveReasoningEffort(requestedEffort, catalog, route)
+      if (decision.dropped !== undefined) {
+        console.warn(`[dsh-task-board] model route ${routeLabel} does not declare reasoning effort "${decision.dropped}"; session ${sessionId} runs at the model default`)
+      }
+      // The catalog completes a bare model pin into the provider the session
+      // request must name; an undeclared pin keeps its own spelling exactly as
+      // before, minus an effort that could not be verified.
+      const declared = declaredRoute(catalog, route)
+      const provider = declared?.provider ?? route.provider
+      const modelId = declared?.model ?? route.model
       try {
         await this.invoke('session', 'selectModel', {
           sessionId,
-          ...(provider ? { provider } : {}),
+          ...(provider === undefined ? {} : { provider }),
           model: modelId,
+          ...(decision.effort === undefined ? {} : { reasoningEffort: decision.effort }),
         })
       } catch (modelError) {
-        console.warn(`[dsh-task-board] failed to select model "${task.model}" for session ${sessionId}, falling back to default:`, modelError)
+        // An effort the catalog CONFIRMED for this route is a contract, not a
+        // preference: if the session refuses the selection, the run fails here,
+        // before the prompt, rather than silently executing at the model default
+        // the user did not pick. A selection that carries no confirmed effort
+        // keeps the best-effort behavior: the card was asked to run, and losing
+        // the work over a model switch this run never promised is worse.
+        if (decision.effort !== undefined) {
+          throw new Error(`session ${sessionId} refused the model selection "${provider === undefined ? modelId : provider + '/' + modelId}" with reasoning effort "${decision.effort}": ` + (modelError instanceof Error ? modelError.message : String(modelError)))
+        }
+        console.warn(`[dsh-task-board] failed to select model "${provider === undefined ? modelId : provider + '/' + modelId}" for session ${sessionId}, falling back to default:`, modelError)
       }
     }
     await this.invoke('session', 'prompt', {
@@ -704,10 +857,21 @@ export class HostExecutionRunner {
     }
     const openingEvents = opening.records.map(record => ({ event: recordEvent(record) }))
     const newestSeq = openingEvents.reduce<number | undefined>((newest, entry) => newest === undefined ? entry.event.seq : Math.max(newest, entry.event.seq), undefined)
-    if (newestSeq !== undefined && this.scanMemos.get(sessionId) === newestSeq) return { outcome: 'pending' }
+    const scannedThrough = this.scanMemos.get(sessionId)
+    if (newestSeq !== undefined && scannedThrough === newestSeq) return { outcome: 'pending' }
+    // The memo is not only "nothing changed": it is the seq up to which a
+    // COMPLETE walk already proved this execution has no completed turn. A
+    // session log is append-only, so records at or below it can never acquire
+    // one — this pass only has to examine what arrived after it. Without that,
+    // a working teammate (whose roster entry never stops reporting `running`,
+    // so every poll re-inspects it) re-read its whole history since the run
+    // started once per poll: a 1200-record history cost 12 page RPCs and 1223
+    // materialized records per session per poll, against 0 and 21 here.
+    const oldestOpeningSeq = openingEvents.reduce<number | undefined>((oldest, entry) => oldest === undefined ? entry.event.seq : Math.min(oldest, entry.event.seq), undefined)
+    const coveredThrough = scannedThrough !== undefined && oldestOpeningSeq !== undefined && oldestOpeningSeq <= scannedThrough
     const events: Array<{ event: { type: string; seq: number; time: number; data: unknown } }> = [...openingEvents]
     let beforeSeq: number | undefined
-    let reachedExecutionBoundary = !opening.hasMore
+    let reachedExecutionBoundary = !opening.hasMore || coveredThrough
     for (let page = 0; page < HISTORY_PAGE_LIMIT && !reachedExecutionBoundary; page += 1) {
       let history: SessionPage
       try {
@@ -724,11 +888,13 @@ export class HostExecutionRunner {
       const pageEntries = pageEvents(history)
       events.push(...pageEntries)
       const oldestTime = pageEntries.reduce<number | undefined>((oldest, entry) => oldest === undefined ? entry.event.time : Math.min(oldest, entry.event.time), undefined)
-      if (!history.hasMore || (oldestTime !== undefined && oldestTime <= startedAt)) {
+      const oldestSeq = pageEntries.reduce<number | undefined>((oldest, entry) => oldest === undefined ? entry.event.seq : Math.min(oldest, entry.event.seq), undefined)
+      if (!history.hasMore
+        || (oldestTime !== undefined && oldestTime <= startedAt)
+        || (scannedThrough !== undefined && oldestSeq !== undefined && oldestSeq <= scannedThrough)) {
         reachedExecutionBoundary = true
         break
       }
-      const oldestSeq = pageEntries.reduce<number | undefined>((oldest, entry) => oldest === undefined ? entry.event.seq : Math.min(oldest, entry.event.seq), undefined)
       if (oldestSeq === undefined || oldestSeq === beforeSeq) return { outcome: 'pending' }
       beforeSeq = oldestSeq
     }