@maudecode/talaria-web 1.15.0 → 1.17.2

package/dist/sessions/service.js

@@ -3,20 +3,24 @@ import { randomUUID } from 'node:crypto';
 import { rmSync } from 'node:fs';
 import { buildActiveTurnToken, copyJson, redactSessionData, redactValue, stripPublicInternalFields, withSceneToolDisplay } from '../redact.js';
 import { DraftVersionConflict, normalizeDraftVersion } from './drafts.js';
-import { allSessions, buildSessionListPayload, CLI_IDENTITY_FIELDS, isClaimableCliSource, isMessagingSessionRecord, withOwnerLocks, withSessionWireFlags, lineageRootId, mergeCliSidebarMetadata, sessionListResponse, sessionSearchMessageText, sessionSearchPreview } from './list.js';
-import { anchorSceneIntOrNull, hydrateAnchorActivityScenes, normalizeAnchorSceneMessageRef, readAnchorSceneRows, storeAnchorScene, withTurnIds } from './anchor.js';
-import { isSafeSessionId, lastMessageTimestamp, Session, titleFrom } from './session.js';
+import { allSessions, buildSessionListPayload, CLI_IDENTITY_FIELDS, isClaimableCliSource, isMessagingSessionRecord, withOwnerLocks, withSessionWireFlags, lineageRootId, mergeCliSidebarMetadata, sessionListResponse, sessionSearchMatches, sessionSearchMessageText, sessionSearchPreview, sessionSearchTerms } from './list.js';
+import { anchorSceneIntOrNull, fullToolResult, hydrateAnchorActivityScenes, normalizeAnchorSceneMessageRef, readAnchorSceneRows, storeAnchorScene, withTurnIds } from './anchor.js';
+import { isSafeSessionId, lastMessageTimestamp, Session, sharePath, stripAttachedFilesMarker, titleFrom } from './session.js';
 import { SessionBusy, SessionNotFound, statSignature } from './store.js';
-import { attachTodoState } from './todo.js';
-import { stateDbSessionMessages, stateDbSessionRow, stateDbSessionSources } from './state-db.js';
-import { anchorMessageKey, anchorSummary, CompressionJobs, visibleMessagesForAnchor } from './compress.js';
+import { UNSETTLED_TODO_KEY, attachTodoState } from './todo.js';
+import { isClaudeCodeSessionId } from './claude-code.js';
+import { stateDbCompressionLineage, stateDbSessionMessages, stateDbSessionRead, stateDbSessionRow, stateDbSessionSources } from './state-db.js';
+import { anchorMessageKey, anchorSummary, CompressionJobs, compressionReference, visibleMessagesForAnchor } from './compress.js';
 import { SidecarError } from '../sidecar/client.js';
-import { attachmentObjects, isContextCompressionMarker, mergeSessionMessagesAppendOnly, pendingUserRow, sanitizeMessagesForApi, withAttachmentObjects, withBodyExcerpts, withPendingUserTurn, withToolCallOutcomes, withoutRunningTurnOutput } from './merge.js';
+import { agentSteerText, attachedFilesPrompt, attachmentObjects, dedupeContext, isContextCompressionMarker, journalOutputRows, looksLikeCurrentUserTurn, stoppedTurnContext, workspaceContextPrefix, mergeSessionMessagesAppendOnly, messageIdentity, pendingUserRow, reasoningFieldsText, sanitizeMessagesForApi, stateDbSeenId, stripWorkspacePrefix, withAttachmentObjects, withBodyExcerpts, withDisplayMedia, withMarkerKinds, withSceneRowMedia, withPendingUserTurn, withToolCallOutcomes, withoutRunningTurnOutput } from './merge.js';
 import { withBackgroundUpdates } from './background-updates.js';
 import { withBackgroundLinks } from './background-tasks.js';
 import { messagesForLimitedPayload, messageWindowForDisplay, MAX_MSG_LIMIT, parseMsgLimit, toolCallsForMessageWindow } from './window.js';
 import { redactText } from '../redact.js';
+import { workspaceDisplayName } from '../workspace/workspaces.js';
 import { buildShareSnapshot } from './shares.js';
+import { mediaAnchorRoot, mediaRefPath, mediaTarget } from '../workspace/media.js';
+import { projectMediaRefs } from '../workspace/media-refs.js';
 import { loadGatewaySessionIdentityMap } from './list.js';
 import { join } from 'node:path';
 export class HttpFailure extends Error {
@@ -47,6 +51,9 @@ export async function ensureAgentRuntimeCurrent(sidecar) {
 function staleRuntimeFailure(error) {
     return new HttpFailure(409, error.message, { type: 'agent_runtime_stale', retryable: true, restart_scheduled: false, ...(error.data.agent_update_state !== undefined ? { agent_update_state: error.data.agent_update_state } : {}) });
 }
+/** TAL-536: the most of a dead run's journal stale-stream cleanup reads (Python's recovery window). */
+const RECOVERY_JOURNAL_MAX_BYTES = 8 * 1024 * 1024;
+const RECOVERY_JOURNAL_MAX_ROWS = 65536;
 const isDict = (v) => Boolean(v) && typeof v === 'object' && !Array.isArray(v);
 export class SessionService {
     deps;
@@ -57,6 +64,37 @@ export class SessionService {
         this.compressionJobs = new CompressionJobs();
     }
     get store() { return this.deps.store; }
+    /**
+     * TAL-186: rewrites a session's media references to their URLs. A local path is rewritten only when `/api/media`
+     * serves it for this session, under the same resolution, so every rewritten reference loads.
+     */
+    mediaProjector(s) {
+        const media = this.deps.media;
+        const served = new Map();
+        const localUrl = (path) => {
+            if (!media?.localIo(s.profile))
+                return null;
+            if (served.has(path))
+                return served.get(path) ?? null;
+            let url = null;
+            try {
+                const target = mediaTarget(mediaRefPath(path));
+                if (mediaAnchorRoot(target, s, media.access))
+                    url = `./api/media?${new URLSearchParams({ path: target, session_id: s.session_id }).toString()}`;
+            }
+            catch { /* an invalid path stays text */ }
+            served.set(path, url);
+            return url;
+        };
+        const workspace = s.workspace.trim() || null;
+        // A scene's final answer usually repeats its row's text: each distinct text is parsed once.
+        const projected = new Map();
+        return (text) => {
+            if (!projected.has(text))
+                projected.set(text, projectMediaRefs(text, { workspace, localUrl }));
+            return projected.get(text) ?? null;
+        };
+    }
     publish(reason, profile, sessionId) {
         this.deps.events.publish(reason, { profile: profile ?? null, sessionId: sessionId ?? null });
     }
@@ -151,9 +189,18 @@ export class SessionService {
     }
     /** The Agent's state.db rows for this session (empty for subagent views, which never merge). */
     stateDbRows(s) {
+        return this.stateDbRead(s).rows;
+    }
+    /** `stateDbRows` and whether the read succeeded on a state.db whose messages carry ids (TAL-493). */
+    stateDbRead(s) {
         if (str(s.source_tag || s.raw_source || s.session_source).trim().toLowerCase() === 'subagent')
-            return [];
-        return stateDbSessionMessages(join(this.deps.profileHome(s.profile ?? this.deps.activeProfile()), 'state.db'), s.session_id, { stitch: false });
+            return { rows: [], idCapable: false, ok: false };
+        // TAL-529: after a compression rotation the Agent writes to the continuation, so the read follows the recorded lineage.
+        const lineage = s.state_db_lineage?.[0] === s.session_id ? s.state_db_lineage : null;
+        return stateDbSessionRead(this.stateDbPath(s.profile), s.session_id, { stitch: false, lineage });
+    }
+    stateDbPath(profile) {
+        return join(this.deps.profileHome(profile ?? this.deps.activeProfile()), 'state.db');
     }
     /**
      * Python `_merged_session_messages_for_display`: the sidecar transcript merged append-only with the Agent's state.db
@@ -163,7 +210,91 @@ export class SessionService {
     mergedTranscript(s, local = s.messages, stateRows = this.stateDbRows(s)) {
         if (!stateRows.length)
             return local;
-        return mergeSessionMessagesAppendOnly(local, stateRows, { truncationWatermark: s.truncation_watermark });
+        return mergeSessionMessagesAppendOnly(local, stateRows, { truncationWatermark: s.truncation_watermark, compressedWatermark: s.truncation_watermark_compressed, stateDbSeenId: currentStateDbSeenId(s, stateRows) });
+    }
+    /**
+     * TAL-493: record the highest state.db id this boundary or settled turn read, under the session lock in the same save,
+     * so the merge never replays a covered row and appends every row committed after the read. Call it after the boundary
+     * fields are set: the marker holds only while they and the row it names stay as recorded.
+     */
+    markStateDbSeen(s, read = this.stateDbRead(s), opts = {}) {
+        // A failed read says nothing. A settlement keeps the marker; a boundary drops it (fail closed): it may cut rows the
+        // marker still admits without moving a field, and the timestamp rules honour its watermark.
+        if (!read.ok) {
+            if (opts.boundary) {
+                s.state_db_seen_id = null;
+                s.state_db_seen_boundary = null;
+                s.state_db_seen_stamp = null;
+            }
+            return;
+        }
+        // A successful read with no rows yet is a baseline: every row the session gets later is new.
+        s.state_db_seen_id = stateDbSeenId(read.rows) ?? (read.idCapable ? 0 : null);
+        s.state_db_seen_boundary = stateDbMarkKey(s, read.rows, s.state_db_seen_id);
+        s.state_db_seen_stamp = s.updated_at;
+    }
+    /**
+     * TAL-493: a turn's settlement. Each state.db row the merge shows now is matched to what the turn holds: a row already
+     * in the context it started from (by id), or one row the Agent added this turn (`agentRows` past that context, matched
+     * one to one by full text). An unmatched row is a CLI or gateway row committed while the turn ran: it joins the
+     * transcript and the model context before the marker passes it. Without the Agent's rows (`agentRows` empty), rows past
+     * `startId` (the highest id the turn read when it started) are its own unreported work: covered, never shown. Rows the
+     * turn started from but the transcript lacks (a CLI continuation read into its context) are kept before the turn.
+     */
+    settleStateDb(s, turn) {
+        const read = this.stateDbRead(s);
+        const startedWith = new Set(turn.previousContext.flatMap((m) => (typeof m._state_db_row_id === 'number' ? [m._state_db_row_id] : [])));
+        const earlier = mergeSessionMessagesAppendOnly(s.messages, read.rows.filter((m) => typeof m._state_db_row_id === 'number' && startedWith.has(m._state_db_row_id)), { stateDbSeenId: -1 }).slice(s.messages.length);
+        const added = new Map();
+        for (const m of withoutRows(turn.agentRows ?? [], turn.previousContext))
+            added.set(settledIdentity(m), (added.get(settledIdentity(m)) ?? 0) + 1);
+        const ownWorkAfter = turn.agentRows?.length ? null : turn.startId ?? null;
+        // Without a current marker, the turn's own starting read is the baseline: rows committed after it are judged here.
+        const seenId = currentStateDbSeenId(s, read.rows) ?? turn.startId ?? null;
+        const shown = read.rows.length ? mergeSessionMessagesAppendOnly(s.messages, read.rows, { truncationWatermark: s.truncation_watermark, compressedWatermark: s.truncation_watermark_compressed, stateDbSeenId: seenId }) : s.messages;
+        const fresh = new Set(shown.slice(s.messages.length));
+        // The turn's own rows the merge already matched to their local copies use up their share before any shown row can.
+        if (seenId !== null) {
+            for (const m of read.rows) {
+                const id = m._state_db_row_id;
+                if (typeof id !== 'number' || id <= seenId || startedWith.has(id) || fresh.has(m))
+                    continue;
+                const left = added.get(settledIdentity(m)) ?? 0;
+                if (left > 0)
+                    added.set(settledIdentity(m), left - 1);
+            }
+        }
+        const missed = [...fresh].filter((m) => {
+            const id = m._state_db_row_id;
+            if (typeof id === 'number' && startedWith.has(id))
+                return false;
+            const key = settledIdentity(m);
+            const left = added.get(key) ?? 0;
+            if (left > 0) {
+                added.set(key, left - 1);
+                return false;
+            }
+            return !(ownWorkAfter !== null && typeof id === 'number' && id > ownWorkAfter);
+        });
+        if (earlier.length) {
+            const at = s.messages.findIndex((m) => m._turn_id === turn.turnId);
+            s.messages.splice(at < 0 ? s.messages.length : at, 0, ...copyJson(earlier));
+        }
+        if (missed.length) {
+            s.messages.push(...copyJson(missed));
+            if (s.context_messages.length)
+                s.context_messages.push(...copyJson(missed));
+        }
+        this.markStateDbSeen(s, read);
+        // TAL-529: a compression rotation moved the Agent to a continuation, whose first rows restate the compressed context.
+        // The read follows the new lineage from here, and everything it holds now is covered.
+        // ponytail: a CLI row committed to the continuation before this settlement is covered with them; telling them apart
+        // needs the Agent to mark the rows it writes at rotation.
+        const lineage = stateDbCompressionLineage(this.stateDbPath(s.profile), s.session_id);
+        if (JSON.stringify(lineage) !== JSON.stringify(s.state_db_lineage ?? [s.session_id])) {
+            s.state_db_lineage = lineage.length > 1 ? lineage : null;
+            this.markStateDbSeen(s);
+        }
     }
     /**
      * Python `reconciled_state_db_messages_for_session(prefer_context=True)`: the model history is the owner context
@@ -174,15 +305,29 @@ export class SessionService {
         const local = s.context_messages.length ? s.context_messages : s.messages.filter((m) => !m._error && !m._partial);
         return local.some((m) => isContextCompressionMarker(m)) ? local : this.mergedTranscript(s, local, stateRows ?? this.stateDbRows(s));
     }
+    /**
+     * TAL-518: the model context a `/btw` clone inherits: the chat's history plus its running turn's prompt, which
+     * deferred save keeps out of `messages` and `context_messages` until settlement.
+     */
+    sideQuestionContext(s) {
+        const context = structuredClone(this.modelContext(s));
+        const pending = this.pendingTurn(s);
+        return pending ? withPendingUserTurn(context, pending) : context;
+    }
     /** Python `_lookup_cli_session_metadata`: the sidebar row for a state.db session in the active profile. */
     lookupCliMeta(sid) {
         try {
+            if (isClaudeCodeSessionId(sid))
+                return this.claudeCodeRows().find((r) => str(r.session_id) === sid) ?? null;
             return this.deps.cliSessions(this.deps.activeProfile(), { sourceFilter: null }).rows.find((r) => str(r.session_id) === sid) ?? null;
         }
         catch {
             return null;
         }
     }
+    claudeCodeRows() {
+        return this.deps.claudeCode?.rows(this.deps.workspaces.lastWorkspace(this.deps.activeProfile())) ?? [];
+    }
     /** Python `_session_index_marks_was_webui`: an index row that once owned a WebUI sidecar (self-heal 404). */
     indexMarksWasWebui(sid) {
         let entries;
@@ -219,7 +364,7 @@ export class SessionService {
         const subagentChild = stateDbSource === 'subagent';
         if ((this.indexMarksWasWebui(sid) || (this.store.wasDeleted(sid) && ['', 'webui', 'fork'].includes(stateDbSource))) && !subagentChild)
             return { session: null, reason: 'was_webui' };
-        const msgs = stateDbSessionMessages(dbPath, sid, { stitch: true });
+        const msgs = isClaudeCodeSessionId(sid) ? this.deps.claudeCode?.messages(sid) ?? [] : stateDbSessionMessages(dbPath, sid, { stitch: true });
         if (!msgs.length)
             return { session: null, reason: 'no_foreign_state' };
         const meta = { ...(metaIn ?? this.lookupCliMeta(sid) ?? {}) };
@@ -266,7 +411,16 @@ export class SessionService {
             throw error;
         }
     }
+    /**
+     * TAL-551: a Claude Code import is a live view of a transcript Claude Code keeps writing. Web never stores a copy,
+     * which would freeze its messages and pin it to one profile.
+     */
+    rejectClaudeCode(sid, verb) {
+        if (isClaudeCodeSessionId(sid))
+            throw new HttpFailure(400, `Claude Code sessions are view-only and cannot be ${verb} from WebUI`);
+    }
     rejectSubagent(sid, verb) {
+        this.rejectClaudeCode(sid, verb);
         if (this.isSubagentViewOnly(sid))
             throw new HttpFailure(400, `Subagent sessions are view-only and cannot be ${verb} from WebUI`);
     }
@@ -278,13 +432,36 @@ export class SessionService {
     publicSession(s, withMessages = true) {
         const payload = this.wireRow(s);
         // Mutation replies replace a client's transcript, so they carry the same server-built scenes as the detail.
-        if (withMessages)
-            payload.messages = this.backgroundLinked(s, hydrateAnchorActivityScenes(withToolCallOutcomes(withBackgroundUpdates(withTurnIds(s.messages), s), s.tool_calls, s.active_stream_id), s.anchor_activity_scenes, { activeTurnId: s.active_stream_id }));
+        if (withMessages) {
+            payload.messages = this.backgroundLinked(s, hydrateAnchorActivityScenes(withToolCallOutcomes(withBackgroundUpdates(withMarkerKinds(withTurnIds(s.messages)), s), s.tool_calls, s.active_stream_id), s.anchor_activity_scenes, { activeTurnId: s.active_stream_id, runningScene: !this.journaledActiveTurn(s) }));
+            payload.compression_reference = compressionReference(s, payload.messages);
+        }
         return redactSessionData(payload, this.deps.redactEnabled());
     }
     /** `compact()` with the wire streaming/read-only flags (TAL-312), for replies that return the session row. */
     wireRow(s) {
-        return withSessionWireFlags({ ...s.compact({ contextLengthFor: this.deps.contextLengthFor }), read_only: this.isReadOnly(s), assistant_name: this.assistantName(s) }, this.deps.runtime.activeStreamIds);
+        return withSessionWireFlags({ ...s.compact({ contextLengthFor: this.deps.contextLengthFor, modelOptionFor: this.deps.modelOptionFor }), read_only: this.isReadOnly(s), assistant_name: this.assistantName(s), workspace_name: this.workspaceNames()(s) }, this.deps.runtime.activeStreamIds);
+    }
+    /**
+     * TAL-303: the label for a session's workspace, from its own profile's registry (a profileless row is the root's).
+     * One resolver serves one response, so each profile's registry is read once however many rows it names.
+     */
+    workspaceNames() {
+        const registries = new Map();
+        return (row) => {
+            const profile = str(row.profile) || 'default';
+            let entries = registries.get(profile);
+            if (!entries) {
+                try {
+                    entries = this.deps.workspaces.entries(profile);
+                }
+                catch {
+                    entries = [];
+                }
+                registries.set(profile, entries);
+            }
+            return workspaceDisplayName(str(row.workspace), entries);
+        };
     }
     /** The agent's display name for a session's profile (`assistant_name`). */
     assistantName(s) {
@@ -328,7 +505,7 @@ export class SessionService {
         if (journaled)
             transcript = withoutRunningTurnOutput(transcript, { ...journaled, localCount: s.messages.length });
         // Turn ids, tool outcomes and scenes are computed over the full transcript, so every window reports the same values.
-        const all = loadMessages ? withBodyExcerpts(this.backgroundLinked(s, hydrateAnchorActivityScenes(withToolCallOutcomes(withBackgroundUpdates(withTurnIds(withAttachmentObjects(transcript)), s), s.tool_calls, s.active_stream_id), s.anchor_activity_scenes, { activeTurnId: s.active_stream_id, clipToolResults: msgLimit !== null })), s.active_stream_id) : [];
+        const all = loadMessages ? this.backgroundLinked(s, hydrateAnchorActivityScenes(withToolCallOutcomes(withBackgroundUpdates(withMarkerKinds(withTurnIds(withAttachmentObjects(transcript))), s), s.tool_calls, s.active_stream_id), s.anchor_activity_scenes, { activeTurnId: s.active_stream_id, runningScene: !journaled, clipToolResults: msgLimit !== null })) : [];
         let truncated = [];
         let offset = 0;
         let summaryCount = null;
@@ -344,6 +521,8 @@ export class SessionService {
                 truncated = all.slice(prompt, offset + truncated.length);
                 offset = prompt;
             }
+            // Per-row display fields (TAL-186 media, TAL-456 excerpts cut from that display text) only for the rows sent.
+            truncated = withBodyExcerpts(withDisplayMedia(truncated, this.mediaProjector(s)), s.active_stream_id);
             if (msgLimit !== null)
                 truncated = messagesForLimitedPayload(truncated);
         }
@@ -362,7 +541,7 @@ export class SessionService {
         }
         const activeStreamIds = this.deps.runtime.activeStreamIds;
         const raw = {
-            ...s.compact({ includeRuntime: true, activeStreamIds, contextLengthFor: this.deps.contextLengthFor }),
+            ...s.compact({ includeRuntime: true, activeStreamIds, contextLengthFor: this.deps.contextLengthFor, modelOptionFor: this.deps.modelOptionFor }),
             messages: truncated,
             message_count: mergedCount,
             tool_calls: toolCalls,
@@ -376,8 +555,10 @@ export class SessionService {
         };
         if (loadMessages)
             raw.transcript_seq = journaled ? { stream_id: journaled.turnId, seq: 0 } : null;
-        if (loadMessages && all.length)
-            attachTodoState(raw, all);
+        if (loadMessages)
+            attachTodoState(raw, all, s.extra[UNSETTLED_TODO_KEY]);
+        if (loadMessages)
+            raw.compression_reference = compressionReference(s, all);
         if (mergedLast) {
             raw.last_message_at = Math.max(Number(raw.last_message_at ?? 0) || 0, mergedLast);
             raw.updated_at = Math.max(Number(raw.updated_at ?? 0) || 0, mergedLast);
@@ -390,6 +571,7 @@ export class SessionService {
         raw._load_revision = revisionBefore !== null && revisionBefore === revisionAfter ? hashRevision(revisionBefore) : `unstable-${randomUUID().replace(/-/g, '')}`;
         raw.read_only = this.isReadOnly(s);
         raw.assistant_name = this.assistantName(s);
+        raw.workspace_name = this.workspaceNames()(s);
         withSessionWireFlags(raw, activeStreamIds);
         raw.pending_steers = raw.active_stream_id ? (this.deps.runtime.pendingSteers?.(str(raw.active_stream_id)) ?? []) : [];
         return redactSessionData(raw, this.deps.redactEnabled());
@@ -437,7 +619,7 @@ export class SessionService {
     foreignSessionDetail(sid) {
         const { synth, meta } = this.foreignSession(sid);
         // The same turn projection as a WebUI session: turn ids, tool outcomes, then each completed turn's scene.
-        const msgs = hydrateAnchorActivityScenes(withToolCallOutcomes(withTurnIds(synth.messages), [], null), {});
+        const msgs = hydrateAnchorActivityScenes(withToolCallOutcomes(withMarkerKinds(withTurnIds(synth.messages)), [], null), {});
         const lastTs = Number(msgs[msgs.length - 1]?.timestamp ?? 0) || 0;
         const sess = {
             session_id: synth.session_id, title: synth.title, workspace: synth.workspace, model: synth.model, message_count: msgs.length,
@@ -445,13 +627,13 @@ export class SessionService {
             pinned: synth.pinned, archived: synth.archived, project_id: synth.project_id ?? null, profile: synth.profile,
             is_cli_session: synth.is_cli_session, source_tag: synth.source_tag, raw_source: synth.raw_source, session_source: synth.session_source,
             source_label: synth.source_label, read_only: synth.read_only, can_duplicate: false, messages: msgs, tool_calls: [], transcript_seq: null,
-            assistant_name: this.assistantName(synth),
+            assistant_name: this.assistantName(synth), workspace_name: this.workspaceNames()(synth),
         };
         attachTodoState(sess, msgs);
         const merged = withSessionWireFlags(meta ? mergeCliSidebarMetadata(sess, meta) : sess, this.deps.runtime.activeStreamIds);
         return redactSessionData(merged, this.deps.redactEnabled());
     }
-    /** Clear persisted streaming flags when no live stream backs them (Python `_clear_stale_stream_state`, no journal recovery). */
+    /** Clear persisted streaming flags when no live stream backs them (Python `_clear_stale_stream_state`). */
     clearStaleStreamState(session) {
         const streamId = session.active_stream_id;
         if (!streamId)
@@ -478,15 +660,40 @@ export class SessionService {
                 return false;
             }
         }
-        // Python `_materialize_pending_user_turn_before_error` (#1361): the prompt that was in flight becomes a durable user
-        // turn and an interruption marker follows it, so a dead stream never silently drops what the user sent.
+        // Python `_materialize_pending_user_turn_before_error` (#1361) and `_recover_dead_run_journal`: the prompt that was in
+        // flight becomes a durable user turn, the output its journal holds follows it, and an interruption marker closes a
+        // run that never finished with an answer, so a dead stream never silently drops what the user sent or what streamed.
+        const turnId = str(target.active_stream_id);
+        // ponytail: one bounded tail read (Python's recovery window); a journal past it recovers its latest output only.
+        const events = this.deps.journal?.readRunEventTail(target.session_id, turnId, RECOVERY_JOURNAL_MAX_BYTES, RECOVERY_JOURNAL_MAX_ROWS).events ?? [];
+        const { rows: output, answered } = journalOutputRows(events, turnId);
         const pendingText = str(target.pending_user_message);
+        const attachments = [...target.pending_attachments];
+        // The run's starting read died with its worker: the state.db rows from before it started stand in for it. Its own
+        // rows open with its prompt and run to the next prompt; anything else another client wrote meanwhile stays.
+        const read = this.stateDbRead(target);
+        const runStart = target.pending_started_at || events[0]?.created_at || this.deps.now();
+        const before = read.rows.filter((m) => Number(m.timestamp) < runStart);
+        const ownRows = target.hasPendingPrompt ? runStateDbRows(read.rows.filter((m) => Number(m.timestamp) >= runStart), pendingText) : null;
+        // Without this turn's rows: an eager save already put its prompt in the transcript a fresh context falls back to.
+        const previousContext = this.modelContext(target, before).filter((m) => m._turn_id !== turnId);
         if (target.hasPendingPrompt) {
-            const turnId = str(target.active_stream_id);
             const startedAt = typeof target.pending_started_at === 'number' && target.pending_started_at > 0 ? target.pending_started_at : this.deps.now();
-            const attachments = [...target.pending_attachments];
-            target.messages.push({ role: 'user', content: pendingText, timestamp: Math.trunc(startedAt), ...(attachments.length ? { attachments } : {}), _recovered: true, _source: target.pending_user_source ?? 'webui', ...(turnId ? { _turn_id: turnId } : {}) });
-            target.messages.push({ role: 'assistant', content: '**Interrupted:** The reply was interrupted before it could be saved.', timestamp: Math.trunc(this.deps.now()), _error: true, ...(turnId ? { _turn_id: turnId } : {}) });
+            // An eager save already checkpointed this prompt as the turn's user row.
+            if (!target.messages.some((m) => m.role === 'user' && !m._steer && m._turn_id === turnId))
+                target.messages.push({ role: 'user', content: pendingText, timestamp: Math.trunc(startedAt), ...(attachments.length ? { attachments } : {}), _recovered: true, _source: target.pending_user_source ?? 'webui', _turn_id: turnId });
+            // The model context settles as a Stop's does: the Agent's own rows when it committed the prompt, else the prompt it
+            // was sent; then the prose that streamed past them.
+            const prompt = attachedFilesPrompt((str(target.workspace) ? workspaceContextPrefix(str(target.workspace)) : '') + pendingText, attachments);
+            const streamed = output.map((m) => str(m.content)).filter(Boolean).join('\n\n');
+            target.context_messages = dedupeContext(stoppedTurnContext(previousContext, ownRows ? [...previousContext, ...ownRows] : null, prompt, pendingText, streamed, previousContext.length) ?? [...structuredClone(previousContext), { role: 'user', content: prompt }]);
+        }
+        if (target.hasPendingPrompt || output.length) {
+            target.messages.push(...output);
+            if (!answered)
+                target.messages.push({ role: 'assistant', content: '**Interrupted:** The reply was interrupted before it could be saved.', timestamp: Math.trunc(this.deps.now()), _error: true, _turn_id: turnId });
+            // Settled like a turn: the Agent's own rows are covered by the recovered turn; without them, every row past the run's start is.
+            this.settleStateDb(target, { turnId, previousContext, agentRows: ownRows, startId: stateDbSeenId(before) ?? (read.idCapable ? 0 : null) });
         }
         target.active_stream_id = null;
         target.pending_user_message = null;
@@ -515,11 +722,12 @@ export class SessionService {
         const wantState = params.showCliSessions || params.showCronSessions || params.showWebhookSessions || params.showKanbanSessions;
         // Python reads every profile's state.db under all_profiles; this port projects the active profile only.
         const cliRead = wantState ? this.deps.cliSessions(activeProfile, { sourceFilter: params.sourceFilter ?? null }) : undefined;
-        const cliRows = cliRead?.rows;
+        const claudeCodeRows = params.showCliSessions && params.showClaudeCodeSessions ? this.claudeCodeRows() : [];
+        const cliRows = cliRead ? [...cliRead.rows, ...claudeCodeRows] : undefined;
         const gatewayIdentity = loadGatewaySessionIdentityMap(join(this.deps.profileHome(activeProfile), 'sessions', 'sessions.json'));
         const truncatedSources = cliRead?.truncated;
         const payload = buildSessionListPayload(this.store, { ...params, ...(cliRows ? { cliRows } : {}), ...(truncatedSources ? { truncatedSources } : {}), gatewayIdentity, stateDbSources: this.stateDbSources, activeProfile, isolatedProfileMode: this.deps.isolatedProfileMode(), profilesMatch: this.deps.profilesMatch });
-        return sessionListResponse(payload, this.deps.runtime, this.deps.redactEnabled(), this.deps.now());
+        return sessionListResponse(payload, this.deps.runtime, this.deps.redactEnabled(), this.deps.now(), this.workspaceNames());
     }
     search(q, opts) {
         const activeProfile = this.deps.activeProfile();
@@ -528,8 +736,10 @@ export class SessionService {
             sessions = sessions.filter((r) => this.deps.profilesMatch(str(r.profile) || null, activeProfile));
         sessions = withOwnerLocks(sessions, this.stateDbSources);
         const redact = this.deps.redactEnabled();
+        const workspaceName = this.workspaceNames();
         const redactRow = (item) => {
             withSessionWireFlags(item, this.deps.runtime.activeStreamIds);
+            item.workspace_name = workspaceName(item);
             if (typeof item.title === 'string')
                 item.title = redactText(item.title, redact);
             for (const f of ['display_title', '_state_db_title', 'parent_title'])
@@ -540,35 +750,71 @@ export class SessionService {
         const query = q.toLowerCase().trim();
         if (!query)
             return { sessions: sessions.map((s) => redactRow({ ...s })), all_profiles: opts.allProfiles, active_profile: activeProfile };
+        const terms = sessionSearchTerms(query);
         const results = [];
         for (const s of sessions) {
-            if (str(s.title).toLowerCase().includes(query)) {
+            if (sessionSearchMatches(str(s.title), terms)) {
                 results.push(redactRow({ ...s, match_type: 'title' }));
                 continue;
             }
             if (!opts.content)
                 continue;
-            let sess;
-            try {
-                sess = this.store.get(str(s.session_id), { promote: false, cacheOnMiss: false });
+            const hit = this.contentMatch(str(s.session_id), terms, opts.depth);
+            if (hit)
+                results.push(redactRow({ ...s, ...hit }));
+        }
+        return { sessions: results, query, count: results.length, all_profiles: opts.allProfiles, active_profile: activeProfile };
+    }
+    /**
+     * TAL-308: the sidebar search. The candidates are exactly the `/api/sessions` rows for `params` (visibility, source,
+     * archived, projection and order), narrowed to `projectId` (`none`: rows without a project), then matched on the
+     * title, then the metadata the row shows (workspace path and name, model, provider, profile, source label), then message content.
+     */
+    sidebarSearch(q, params, opts) {
+        let rows = this.list(params).body.sessions;
+        if (opts.projectId === 'none')
+            rows = rows.filter((r) => !r.project_id);
+        else if (opts.projectId)
+            rows = rows.filter((r) => str(r.project_id) === opts.projectId);
+        const query = q.toLowerCase().trim();
+        const base = { all_profiles: params.allProfiles, active_profile: this.deps.activeProfile(), include_archived: params.includeArchived, sidebar_filtered: true };
+        if (!query)
+            return { ...base, sessions: rows };
+        const terms = sessionSearchTerms(query);
+        const results = [];
+        for (const row of rows) {
+            if (sessionSearchMatches(str(row.title), terms))
+                results.push({ ...row, match_type: 'title' });
+            else if (['workspace', 'workspace_name', 'model', 'model_provider', 'profile', 'source_label'].some((k) => sessionSearchMatches(str(row[k]), terms)))
+                results.push({ ...row, match_type: 'metadata' });
+            else if (opts.content) {
+                const hit = this.contentMatch(str(row.session_id), terms, opts.depth);
+                if (hit)
+                    results.push({ ...row, ...hit });
             }
-            catch {
+        }
+        return { ...base, sessions: results, query, count: results.length };
+    }
+    /** The first of a stored session's first `depth` messages (0: all) containing every term, with its redacted excerpt. */
+    contentMatch(sid, terms, depth) {
+        let sess;
+        try {
+            sess = this.store.get(sid, { promote: false, cacheOnMiss: false });
+        }
+        catch {
+            return null;
+        }
+        for (const m of depth ? sess.messages.slice(0, depth) : sess.messages) {
+            const c = sessionSearchMessageText(m);
+            if (!sessionSearchMatches(c, terms))
                 continue;
-            }
-            const msgs = opts.depth ? sess.messages.slice(0, opts.depth) : sess.messages;
-            for (const m of msgs) {
-                const c = sessionSearchMessageText(m);
-                if (c.toLowerCase().includes(query)) {
-                    const item = { ...s, match_type: 'content' };
-                    const preview = sessionSearchPreview(c, query);
-                    if (preview)
-                        item.match_preview = redactText(preview, redact);
-                    results.push(redactRow(item));
-                    break;
-                }
-            }
+            const item = { match_type: 'content' };
+            const preview = sessionSearchPreview(c, terms);
+            if (preview)
+                item.match_preview = redactText(preview, this.deps.redactEnabled());
+            return item;
         }
-        return { sessions: results, query, count: results.length, all_profiles: opts.allProfiles, active_profile: activeProfile };
+        return null;
     }
     // ── status / usage ───────────────────────────────────────────────────────
     status(sid) {
@@ -618,17 +864,20 @@ export class SessionService {
         const [workspace] = this.deps.workspaces.resolveImplicitWithRecovery(value, (p) => this.deps.workspaces.profileDefaultWorkspaceForBoot(p), profile);
         return workspace;
     }
+    /** The server owns the names' normalization (TAL-631): trimmed, blanks dropped, and nothing left is the profile's defaults. */
     validateToolsetsShape(toolsets) {
         if (toolsets === null || toolsets === undefined)
             return null;
-        if (!Array.isArray(toolsets) || !toolsets.length)
-            throw new HttpFailure(400, 'toolsets must be a non-empty list or null');
-        if (!toolsets.every((t) => typeof t === 'string' && t))
-            throw new HttpFailure(400, 'each toolset must be a non-empty string');
-        return toolsets;
+        if (!Array.isArray(toolsets))
+            throw new HttpFailure(400, 'toolsets must be a list or null');
+        if (!toolsets.every((t) => typeof t === 'string'))
+            throw new HttpFailure(400, 'each toolset must be a string');
+        const names = toolsets.map((t) => t.trim()).filter(Boolean);
+        return names.length ? names : null;
     }
     create(body, opts = {}) {
-        const profile = (typeof body.profile === 'string' && body.profile) || null;
+        // Python `new_session`: a body without a profile takes the request's active profile (cookie first).
+        const profile = (typeof body.profile === 'string' && body.profile) || this.deps.activeProfile();
         let prevSessionId = typeof body.prev_session_id === 'string' && body.prev_session_id ? body.prev_session_id : null;
         if (prevSessionId && !this.sessionIdVisible(prevSessionId))
             prevSessionId = null;
@@ -819,6 +1068,7 @@ export class SessionService {
             throw new HttpFailure(400, 'keep_count must be non-negative');
         await this.store.withLock(sid, () => {
             truncateSessionAtKeep(s, keep);
+            this.markStateDbSeen(s, undefined, { boundary: true });
             this.store.save(s);
         });
         this.deps.runtime.evictAgent(sid);
@@ -930,7 +1180,8 @@ export class SessionService {
                 if (streamState(live) !== streamBefore)
                     throw new HttpFailure(409, 'Session stream state changed during compression; please retry.');
                 // One state.db read serves the check, the kept display rows, and the boundary.
-                const stateRows = this.stateDbRows(live);
+                const read = this.stateDbRead(live);
+                const stateRows = read.rows;
                 if (transcriptKey(live, sanitizeMessagesForApi(this.modelContext(live, stateRows))) !== historyKey)
                     throw new HttpFailure(409, 'Session was modified during compression; please retry.');
                 // Rows the sidecar returns without a timestamp take the newest one this compression saw, never the clock: the
@@ -960,6 +1211,8 @@ export class SessionService {
                 // #4836: an intentional-shrink boundary, so append-only state.db reconciliation does not replay compressed rows.
                 live.truncation_watermark = truncationWatermarkFor(compressed);
                 live.truncation_boundary = live.truncation_watermark;
+                live.truncation_watermark_compressed = true;
+                this.markStateDbSeen(live, read, { boundary: true });
                 live.last_prompt_tokens = result.after_tokens;
                 live.post_compression_context_tokens_estimate = result.after_tokens;
                 this.store.save(live);
@@ -1021,6 +1274,7 @@ export class SessionService {
             s.pending_user_source = null;
             s.clear_generation = hadMessages ? randomUUID().replace(/-/g, '') : null;
             applySessionTitleRename(s, 'Untitled');
+            this.markStateDbSeen(s, undefined, { boundary: true });
             this.store.save(s);
             if (hadMessages) {
                 try {
@@ -1029,7 +1283,7 @@ export class SessionService {
                 catch { /* ignore */ }
             }
         });
-        this.deps.runtime.evictAgent(sid);
+        this.deps.runtime.evictAgent(sid, true);
         return { ok: true, session: this.wireRow(s) };
     }
     async retry(sid) {
@@ -1040,11 +1294,20 @@ export class SessionService {
             const lastUser = findLastUserIndex(history);
             if (lastUser === null)
                 return { error: 'No previous message to retry.' };
-            const lastUserText = extractText(history[lastUser]?.content);
+            // What a client resends (TAL-515): the files that reached the model, which only ever got attachments with a path,
+            // and the prompt as typed. The attached-files line is the server's only when such files exist; otherwise the user
+            // typed it. Nothing to resend fails before the exchange is removed.
+            const prompt = history[lastUser];
+            const lastUserText = extractText(prompt.content);
+            const lastUserAttachments = attachmentObjects(Array.isArray(prompt.attachments) ? prompt.attachments : []).filter((a) => isDict(a) && Boolean(str(a.path).trim()));
+            const lastUserPrompt = stripWorkspacePrefix(lastUserAttachments.length ? stripAttachedFilesMarker(lastUserText) : lastUserText, true);
+            if (!lastUserPrompt && !lastUserAttachments.length)
+                return { error: 'The last message has nothing to resend.' };
             const removed = history.length - lastUser;
             shrinkTo(s, lastUser);
+            this.markStateDbSeen(s, undefined, { boundary: true });
             this.store.save(s);
-            return { ok: true, last_user_text: lastUserText, removed_count: removed };
+            return { ok: true, last_user_text: lastUserText, last_user_prompt: lastUserPrompt, last_user_attachments: lastUserAttachments, removed_count: removed };
         });
     }
     async undo(sid) {
@@ -1058,6 +1321,7 @@ export class SessionService {
             const removedText = extractText(history[lastUser]?.content);
             const removed = history.length - lastUser;
             shrinkTo(s, lastUser);
+            this.markStateDbSeen(s, undefined, { boundary: true });
             this.store.save(s);
             const preview = removedText.length > 40 ? `${removedText.slice(0, 40)}...` : removedText;
             return { ok: true, removed_count: removed, removed_preview: preview };
@@ -1069,12 +1333,14 @@ export class SessionService {
         if (!session)
             throw new HttpFailure(404, 'Session not found');
         const now = this.deps.now();
+        // A truncation cut names deleted state.db rows of the source; the copy's own state.db rows are all genuine (TAL-504).
+        const watermark = session.truncation_watermark_compressed ? { truncation_watermark: session.truncation_watermark, truncation_boundary: session.truncation_boundary, truncation_watermark_compressed: true } : {};
         const copied = new Session({
             title: `${session.title || 'Untitled'} (copy)`, workspace: session.workspace, model: session.model, model_provider: session.model_provider,
             messages: copyJson(session.messages), tool_calls: copyJson(session.tool_calls), pinned: false, archived: false, project_id: session.project_id, profile: session.profile,
             input_tokens: session.input_tokens, output_tokens: session.output_tokens, estimated_cost: session.estimated_cost, cache_read_tokens: session.cache_read_tokens, cache_write_tokens: session.cache_write_tokens,
             personality: session.personality, enabled_toolsets: session.enabled_toolsets, context_length: session.context_length, threshold_tokens: session.threshold_tokens,
-            truncation_watermark: session.truncation_watermark, truncation_boundary: session.truncation_boundary, context_messages: copyJson(session.context_messages),
+            ...watermark, context_messages: copyJson(session.context_messages),
             gateway_routing: copyJson(session.gateway_routing), gateway_routing_history: copyJson(session.gateway_routing_history), llm_title_generated: session.llm_title_generated,
             manual_title: session.manual_title, composer_draft: copyJson(session.composer_draft), context_engine: session.context_engine, context_engine_state: copyJson(session.context_engine_state),
             created_at: now, updated_at: now,
@@ -1131,6 +1397,19 @@ export class SessionService {
         }
         return { session_id: branch.session_id, title, parent_session_id: source.session_id };
     }
+    /** The run that keeps `delete` answering 409, if any; stream status reports it so a draining client can wait on it (TAL-622). */
+    activeRunBlocking(sid) {
+        const live = this.deps.runtime.activeRunStream(sid);
+        if (live)
+            return live;
+        try {
+            const candidate = str(this.store.get(sid, { metadataOnly: true, promote: false, cacheOnMiss: false }).active_stream_id).trim();
+            if (candidate && this.deps.runtime.activeStreamIds.has(candidate))
+                return candidate;
+        }
+        catch { /* absent */ }
+        return null;
+    }
     async delete(sid) {
         if (!sid)
             throw new HttpFailure(400, 'session_id is required');
@@ -1163,25 +1442,20 @@ export class SessionService {
                 return true;
         }
         catch { /* absent */ } const meta = this.lookupCliMeta(sid); return meta !== null && isMessagingSessionRecord(meta); })();
-        const blocking = () => {
-            const live = this.deps.runtime.activeRunStream(sid);
-            if (live)
-                return live;
-            try {
-                const snapshot = this.store.get(sid, { metadataOnly: true });
-                const candidate = str(snapshot.active_stream_id).trim();
-                if (candidate && this.deps.runtime.activeStreamIds.has(candidate))
-                    return candidate;
-            }
-            catch { /* absent */ }
-            return null;
-        };
-        if (blocking())
+        if (this.activeRunBlocking(sid))
             throw new HttpFailure(409, 'Session has an active run; stop it before deleting');
         try {
             await this.store.withLock(sid, () => {
-                if (blocking())
+                if (this.activeRunBlocking(sid))
                     throw new HttpFailure(409, 'Session has an active run; stop it before deleting');
+                // A public share outlives its session file, and revokeShare needs the session, so revoke it first.
+                try {
+                    this.deps.shares.revoke(this.store.get(sid, { metadataOnly: true }));
+                }
+                catch (error) {
+                    if (!(error instanceof SessionNotFound))
+                        throw error;
+                }
                 if (!this.store.deleteFiles(sid))
                     throw new HttpFailure(500, 'Failed to delete session data');
             }, { timeoutMs: 5000 });
@@ -1191,7 +1465,7 @@ export class SessionService {
                 throw new HttpFailure(503, 'Session busy, try again');
             throw error;
         }
-        this.deps.runtime.evictAgent(sid);
+        this.deps.runtime.evictAgent(sid, true);
         try {
             rmSync(this.deps.attachmentDir(sid), { recursive: true, force: true });
         }
@@ -1206,11 +1480,15 @@ export class SessionService {
         // messaging channel's memory is never erased from the WebUI; the actual outcome is reported.
         let stateDbCleanupFailed = false;
         if (!isMessaging) {
-            try {
-                stateDbCleanupFailed = !(await this.deps.runtime.deleteCliSession(eventProfile, sid));
-            }
-            catch {
-                stateDbCleanupFailed = true;
+            // TAL-529: the compression continuations go too, tip first; the Agent's delete keeps and detaches them otherwise.
+            for (const id of stateDbCompressionLineage(this.stateDbPath(eventProfile), sid).reverse()) {
+                try {
+                    if (!(await this.deps.runtime.deleteCliSession(eventProfile, id)))
+                        stateDbCleanupFailed = true;
+                }
+                catch {
+                    stateDbCleanupFailed = true;
+                }
             }
         }
         this.publish('session_delete', eventProfile);
@@ -1226,6 +1504,13 @@ export class SessionService {
             const shouldDelete = zeroOnly ? s.messages.length === 0 : s.title === 'Untitled' && s.messages.length === 0;
             if (!shouldDelete)
                 continue;
+            // A cleared session keeps its share; keep the session (and its revoke route) if the share cannot be revoked.
+            try {
+                this.deps.shares.revoke(s);
+            }
+            catch {
+                continue;
+            }
             this.store.sessions.delete(s.session_id);
             rmSync(this.store.pathFor(s.session_id), { force: true });
             cleaned += 1;
@@ -1426,39 +1711,54 @@ export class SessionService {
             return { ok: true, ...placement };
         });
     }
-    readAnchorScene(query) {
-        const sid = str(query.session_id).trim();
-        const messageRef = normalizeAnchorSceneMessageRef(query.message_ref);
-        const messageIndex = anchorSceneIntOrNull(query.message_index);
-        if (!sid || (!messageRef && messageIndex === null))
-            throw new HttpFailure(400, 'session_id and message_ref or message_index are required');
-        let session;
-        let transcript;
+    /** The session and the full transcript its detail is built from; a state.db-only session gives its synthesized one. */
+    fullTranscript(sid) {
         try {
-            session = this.store.get(sid);
+            let session = this.store.get(sid);
             if (session.loadedMetadataOnly)
                 session = this.store.load(sid) ?? session;
             if (!this.visibleToActiveProfile(session.profile))
                 throw new HttpFailure(404, 'Session not found');
-            transcript = this.mergedTranscript(session);
+            return { session, transcript: this.mergedTranscript(session), stored: true };
         }
         catch (error) {
             if (error instanceof HttpFailure)
                 throw error;
-            // A state.db-only session pages the same synthesized transcript its detail was built from.
-            session = this.foreignSession(sid).synth;
-            transcript = session.messages;
+            const session = this.foreignSession(sid).synth;
+            return { session, transcript: session.messages, stored: false };
         }
+    }
+    readAnchorScene(query) {
+        const sid = str(query.session_id).trim();
+        const messageRef = normalizeAnchorSceneMessageRef(query.message_ref);
+        const messageIndex = anchorSceneIntOrNull(query.message_index);
+        if (!sid || (!messageRef && messageIndex === null))
+            throw new HttpFailure(400, 'session_id and message_ref or message_index are required');
+        const { session, transcript, stored } = this.fullTranscript(sid);
         const result = readAnchorSceneRows(session, { messageRef, messageIndex, before: anchorSceneIntOrNull(query.before), limit: anchorSceneIntOrNull(query.limit) }, withToolCallOutcomes(withTurnIds(transcript), session.tool_calls, session.active_stream_id));
         if (!result)
             throw new HttpFailure(404, 'Anchor activity scene not found');
         // Paged rows come from the raw transcript, so they take the same credential redaction as the detail's preview.
         const enabled = this.deps.redactEnabled();
         const redacted = redactValue(result, enabled);
-        return { ...redacted, rows: withSceneToolDisplay(result.rows, redacted.rows, enabled) };
+        const rows = withSceneToolDisplay(result.rows, redacted.rows, enabled);
+        // `/api/media` serves stored sessions only, so a state.db-only session's rows stay as written, as its detail does.
+        return { ...redacted, rows: stored ? withSceneRowMedia(rows, this.mediaProjector(session)) : rows };
+    }
+    /** TAL-331: one tool call's whole result, which a limited response clipped (`result_truncated`), redacted like the detail. */
+    readToolResult(query) {
+        const sid = query.session_id.trim();
+        const id = query.tool_call_id.trim();
+        if (!sid || !id)
+            throw new HttpFailure(400, 'session_id and tool_call_id are required');
+        const full = fullToolResult(this.fullTranscript(sid).transcript, id);
+        if (full === null)
+            throw new HttpFailure(404, 'Tool result not found');
+        return { tool_call_id: id, ...redactValue(full, this.deps.redactEnabled()) };
     }
     // ── shares ───────────────────────────────────────────────────────────────
     createShare(sid) {
+        this.rejectClaudeCode(sid, 'shared');
         let s = this.get404(sid);
         if (!this.visibleToActiveProfile(s.profile))
             throw new HttpFailure(404, 'Session not found');
@@ -1477,7 +1777,7 @@ export class SessionService {
         this.publish('session_share_create', s.profile, sid);
         return {
             ok: true,
-            share: { token: meta.share_token, url: `/share/${meta.share_token}`, title: meta.share_title, message_count: meta.share_message_count, created_at: meta.share_created_at, updated_at: meta.share_updated_at },
+            share: { token: meta.share_token, url: sharePath(meta.share_token) ?? '', title: meta.share_title, message_count: meta.share_message_count, created_at: meta.share_created_at, updated_at: meta.share_updated_at },
             session: this.publicSession(s),
         };
     }
@@ -1544,6 +1844,44 @@ function findLastUserIndex(history) {
 export function sanitizePaths(error) {
     return str(error?.message ?? error).replace(/(?:(?:\/[a-zA-Z0-9_.-]+)+|(?:[A-Z]:\\[^\s]+))/g, '<path>');
 }
+/** TAL-536: a dead run's own state.db rows: from its prompt to the next prompt (tool results and applied steers stay in it). */
+function runStateDbRows(rows, prompt) {
+    const at = rows.findIndex((m) => looksLikeCurrentUserTurn(m, prompt));
+    if (at < 0)
+        return null;
+    const toolResult = (m) => Array.isArray(m.content) && m.content.some((part) => isDict(part) && part.type === 'tool_result');
+    const end = rows.findIndex((m, i) => i > at && m.role === 'user' && !toolResult(m) && agentSteerText(m) === null);
+    return rows.slice(at, end < 0 ? undefined : end);
+}
+/** TAL-493: a row's full-text identity; one with no text (reasoning or media only) by its raw role, content, and reasoning. */
+function settledIdentity(m) {
+    return messageIdentity(m, Infinity) ?? JSON.stringify([m.role ?? null, m.content ?? null, reasoningFieldsText(m)]);
+}
+/** `rows` minus one occurrence of each row of `base`, by `settledIdentity`. */
+function withoutRows(rows, base) {
+    const left = new Map();
+    for (const m of base)
+        left.set(settledIdentity(m), (left.get(settledIdentity(m)) ?? 0) + 1);
+    return rows.filter((m) => { const key = settledIdentity(m); const n = left.get(key) ?? 0; if (n > 0)
+        left.set(key, n - 1); return n === 0; });
+}
+/**
+ * TAL-493: what the state.db marker was recorded under: the boundary fields every boundary writer sets (an older release
+ * moves them without the marker) and the role, timestamp, and database file identity of the row the marker names (a
+ * recreated state.db, whose ids start over, has no such row).
+ */
+function stateDbMarkKey(s, stateRows, seenId) {
+    const anchor = seenId === null ? undefined : stateRows.find((m) => m._state_db_row_id === seenId);
+    return JSON.stringify([s.truncation_watermark ?? null, s.truncation_boundary ?? null, s.intentional_shrink_generation ?? null, s.clear_generation ?? null, anchor ? [anchor.role ?? null, anchor.timestamp ?? null, anchor._state_db_generation ?? null] : null]);
+}
+/**
+ * The recorded state.db marker while what it was recorded under still holds and this version wrote the session last (an
+ * older release can apply a boundary that changes no field), else null (the timestamp rules apply).
+ */
+function currentStateDbSeenId(s, stateRows) {
+    const seenId = s.state_db_seen_id;
+    return seenId !== null && s.state_db_seen_stamp === s.updated_at && s.state_db_seen_boundary === stateDbMarkKey(s, stateRows, seenId) ? seenId : null;
+}
 function truncationWatermarkFor(messages) {
     if (!messages.length)
         return 0.0;
@@ -1557,17 +1895,142 @@ function stampIntentionalShrink(session, oldCount, newCount) {
     session.intentional_shrink_generation = randomUUID().replace(/-/g, '');
     return true;
 }
-/** Align model context with the display prefix (Python `truncate_context_for_display_keep`, simplified to the row-count contract). */
+/** Python truthiness for the JSON values a transcript row carries. */
+function pyTruthy(v) {
+    if (Array.isArray(v))
+        return v.length > 0;
+    if (isDict(v))
+        return Object.keys(v).length > 0;
+    return Boolean(v);
+}
+/** JSON with sorted object keys (Python `json.dumps(..., sort_keys=True)`). */
+function sortedJson(v) {
+    return JSON.stringify(v, (_key, value) => (isDict(value) ? Object.fromEntries(Object.keys(value).sort().map((k) => [k, value[k]])) : value)) ?? '';
+}
+/** Equality key for a row `id`/`timestamp`; `null` when the value is absent. Numbers compare by value (`2 == 2.0`). */
+function identityKey(v) {
+    if (v === null || v === undefined)
+        return null;
+    return typeof v === 'string' ? `s${v}` : typeof v === 'number' ? `n${String(v)}` : `j${sortedJson(v)}`;
+}
+function rowSignature(row) {
+    if (!isDict(row))
+        return null;
+    const field = (v) => (!pyTruthy(v) ? '' : typeof v === 'string' ? v : sortedJson(v));
+    return JSON.stringify([field(row.role), field(row.content), field(row.tool_call_id), field(row.tool_use_id), field(row.tool_name || row.name), field(row.tool_calls)]);
+}
+/** First index in sorted `positions` whose value is `>= start`. */
+function lowerBound(positions, start) {
+    let lo = 0;
+    let hi = positions.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >> 1;
+        if (positions[mid] < start)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo;
+}
+/**
+ * Map each display row to the context row it represents, scanning forward. An `id` match wins; otherwise the role+content
+ * signature must match, and a shared `timestamp` makes it exact. A signature match where an identity is missing is weak:
+ * one weak candidate counts as a match, a second one before any exact match leaves the row ambiguous.
+ */
+function alignDisplayToContext(ctx, full) {
+    const index = () => new Map();
+    const push = (map, key, idx) => {
+        const list = map.get(key);
+        if (list)
+            list.push(idx);
+        else
+            map.set(key, [idx]);
+    };
+    const first = (list, start) => list?.[lowerBound(list, start)];
+    const byId = index(), bySigTs = index(), bySigTsNoId = index();
+    const weakAny = index(), weakNoId = index(), weakNoTs = index(), weakNoIdNoTs = index();
+    ctx.forEach((row, idx) => {
+        const sig = rowSignature(row);
+        if (sig === null)
+            return;
+        const id = identityKey(row.id);
+        const ts = identityKey(row.timestamp);
+        push(weakAny, sig, idx);
+        if (id === null)
+            push(weakNoId, sig, idx);
+        if (ts === null)
+            push(weakNoTs, sig, idx);
+        if (id === null && ts === null)
+            push(weakNoIdNoTs, sig, idx);
+        if (id !== null)
+            push(byId, id, idx);
+        if (ts !== null) {
+            push(bySigTs, `${sig}\0${ts}`, idx);
+            if (id === null)
+                push(bySigTsNoId, `${sig}\0${ts}`, idx);
+        }
+    });
+    const matches = [];
+    const ambiguous = [];
+    let next = 0;
+    for (const message of full) {
+        let match = null;
+        let ambiguousAt = null;
+        const sig = rowSignature(message);
+        if (sig !== null) {
+            const id = identityKey(message.id);
+            const ts = identityKey(message.timestamp);
+            const exact = [id !== null ? first(byId.get(id), next) : undefined, ts !== null ? first((id !== null ? bySigTsNoId : bySigTs).get(`${sig}\0${ts}`), next) : undefined]
+                .filter((idx) => idx !== undefined);
+            const exactIdx = exact.length ? Math.min(...exact) : null;
+            const weakList = (id !== null ? (ts !== null ? weakNoIdNoTs : weakNoId) : ts !== null ? weakNoTs : weakAny).get(sig) ?? [];
+            const w = lowerBound(weakList, next);
+            const [firstWeak, secondWeak] = [weakList[w], weakList[w + 1]];
+            if (secondWeak !== undefined && (exactIdx === null || secondWeak < exactIdx))
+                ambiguousAt = firstWeak;
+            else
+                match = exactIdx ?? firstWeak ?? null;
+        }
+        matches.push(match);
+        ambiguous.push(ambiguousAt);
+        if (match !== null)
+            next = match + 1;
+    }
+    return { matches, ambiguous };
+}
+/** Align model context with the display prefix `full[:keep]` (Python `truncate_context_for_display_keep`, #5096/#5563). */
 export function truncateContextForDisplayKeep(context, full, keep) {
     if (keep <= 0)
         return [];
-    const rows = context ?? [];
-    if (!rows.length)
+    const ctx = context ?? [];
+    if (!ctx.length || !full.length)
         return [];
-    if (keep >= full.length)
-        return [...rows];
-    // ponytail: context rows map 1:1 onto display rows for WebUI-authored transcripts; fuzzy alignment stays in Python until compression lands.
-    return rows.slice(0, Math.min(rows.length, keep));
+    if (keep < full.length) {
+        const { matches, ambiguous } = alignDisplayToContext(ctx, full);
+        const lastKept = matches[keep - 1];
+        const firstUnkept = matches[keep];
+        const boundary = full[keep - 1];
+        const keptUser = isDict(boundary) && boundary.role === 'user';
+        // Cut at the first unkept display row; a kept user turn ends at its own row so unkept tool rows after it drop.
+        if (firstUnkept !== null)
+            return lastKept !== null && keptUser ? ctx.slice(0, lastKept + 1) : ctx.slice(0, firstUnkept);
+        if (lastKept !== null) {
+            const ambiguousUnkept = ambiguous[keep];
+            return ambiguousUnkept !== null && isDict(boundary) && !keptUser ? ctx.slice(0, ambiguousUnkept) : ctx.slice(0, lastKept + 1);
+        }
+        // Both boundary rows unresolved in a shorter (compressed) context: cut past the last kept display row that resolved,
+        // accepting a weak match. Under-keeping beats slicing at the raw display index.
+        if (ctx.length < full.length) {
+            for (let i = keep - 1; i >= 0; i -= 1) {
+                const resolved = matches[i] ?? ambiguous[i];
+                if (resolved !== null && resolved !== undefined)
+                    return ctx.slice(0, resolved + 1);
+            }
+        }
+    }
+    // Unalignable (or nothing cut): keep the compaction prefix a longer context carries, then `keep` rows (#5096).
+    const prefixLen = Math.max(0, ctx.length - full.length);
+    return ctx.slice(0, prefixLen + keep);
 }
 export function truncateSessionAtKeep(session, keep) {
     const full = [...session.messages];
@@ -1578,6 +2041,7 @@ export function truncateSessionAtKeep(session, keep) {
     session.context_messages = truncateContextForDisplayKeep(session.context_messages, full, keep);
     session.truncation_watermark = truncationWatermarkFor(session.messages);
     session.truncation_boundary = session.truncation_watermark;
+    session.truncation_watermark_compressed = false;
     return [oldMsgCount, oldCtxCount];
 }
 function shrinkTo(session, lastUserIdx) {
@@ -1586,6 +2050,7 @@ function shrinkTo(session, lastUserIdx) {
     stampIntentionalShrink(session, history.length, session.messages.length);
     session.truncation_watermark = truncationWatermarkFor(session.messages);
     session.truncation_boundary = session.truncation_watermark;
+    session.truncation_watermark_compressed = false;
     if (session.context_messages.length) {
         const ctxLast = findLastUserIndex(session.context_messages);
         if (ctxLast !== null)