@maudecode/talaria-web 1.18.0 → 1.20.0

package/dist/sessions/state-db.js

@@ -2,18 +2,26 @@
  * Read-only projection of the Agent's `state.db` (Python `api/agent_sessions.py`):
  * importable agent session rows with compression-chain collapse, CLI visibility
  * rules, the O(1) change fingerprint used by the gateway watcher, and existence
- * probes. Uses `node:sqlite`; every read opens a short-lived read-only handle
- * with a bounded busy timeout, and no path here ever writes to the database.
+ * probes. Uses cached read-only `node:sqlite` handles with a bounded busy timeout
+ * and a fresh snapshot per read; no path here ever writes to the database.
  */
 import { existsSync, openSync, readSync, closeSync, statSync } from 'node:fs';
 import { DatabaseSync } from 'node:sqlite';
+import { createHash } from 'node:crypto';
 import { Worker } from 'node:worker_threads';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { startupTimingScope } from '../startup-timing.js';
 import { str } from '../util.js';
+import { stateDbMessageFingerprint, stateDbMessageKey } from './state-db-identity.js';
 import { MESSAGING_SOURCES } from './source-kind.js';
 import { looksLikeDefaultCliTitle, normalizeSourceName } from './titles.js';
 export const CLI_MIN_UNTITLED_USER_MESSAGE_COUNT = 2;
-const STATE_DB_BUSY_TIMEOUT_MS = 500;
+/** The Agent's `_READ_BUSY_TIMEOUT_S` (TAL-890): a DELETE-journal commit by another process blocks readers across its fsyncs. */
+const STATE_DB_BUSY_TIMEOUT_MS = 5000;
+/** The gateway watcher's change check stays cheap; a lock there fails over to a full projection. */
+const STATE_DB_FINGERPRINT_BUSY_TIMEOUT_MS = 500;
 const SOURCE_LABELS = {
+    bluebubbles: 'BlueBubbles', dingtalk: 'DingTalk', feishu: 'Feishu', qqbot: 'QQBot', yuanbao: 'Yuanbao', whatsapp_cloud: 'WhatsApp Cloud',
     acp: 'ACP', api_server: 'API', cli: 'CLI', cron: 'Cron', discord: 'Discord', email: 'Email', kanban: 'Kanban', wecom: 'WeCom', wecom_callback: 'WeCom Callback',
     slack: 'Slack', telegram: 'Telegram', tool: 'Tool', tui: 'TUI', webhook: 'Webhook', webui: 'WebUI', weixin: 'Weixin', matrix: 'Matrix', signal: 'Signal',
 };
@@ -90,6 +98,8 @@ export function isCliSessionRow(row) {
 export function isCliSessionRowVisible(row) {
     if (!isCliSessionRow(row))
         return true;
+    if (row._lineage_root_id && row._lineage_tip_id)
+        return true;
     const actual = positiveInt(row.actual_message_count);
     const messageCount = actual || positiveInt(row.message_count);
     if (messageCount <= 0)
@@ -108,9 +118,15 @@ export function isCliSessionRowVisible(row) {
     return countUserTurns(row) >= CLI_MIN_UNTITLED_USER_MESSAGE_COUNT;
 }
 // ── compression-chain projection ─────────────────────────────────────────
+/** The Agent's `_CHAIN_CAP`: the most hops a walk along a compression lineage takes. Its visited check stops a cycle sooner. */
+const COMPRESSION_CHAIN_CAP = 1000;
+/** The most ids the Agent's `_resume_lineage_ids` returns, a tighter defensive bound than `_CHAIN_CAP`. */
+const RESUME_LINEAGE_CAP = 100;
 function isContinuationSession(parent, child) {
     if (!parent || !child)
         return false;
+    if (lower(child.source) === 'tool' || explicitForkMarkers(child, true).length > 0)
+        return false;
     if (lower(child.session_source) === 'fork')
         return false;
     const parentSource = lower(parent.source);
@@ -126,6 +142,37 @@ function isContinuationSession(parent, child) {
     const ended = Number.parseFloat(str(endedAt));
     return Number.isFinite(started) && Number.isFinite(ended) && started + 1.0 >= ended;
 }
+/**
+ * `ids` plus every session a compression continuation (`isContinuationSession`) joins to one of them, up and down, at
+ * most `COMPRESSION_CHAIN_CAP` in all: the rows `projectAgentSessionRows` needs to collapse their chains as the sidebar
+ * listing does. Forks and other children are never followed, so they cannot crowd a continuation out of the cap.
+ */
+function compressionChainIds(db, cols, ids) {
+    if (!['parent_session_id', 'end_reason'].every((c) => cols.has(c)))
+        return ids;
+    const fields = ['id', 'source', 'session_source', 'model_config', 'started_at', 'parent_session_id', 'end_reason', 'ended_at'].map((c) => cols.has(c) ? c : `NULL AS ${c}`).join(', ');
+    const row = db.prepare(`SELECT ${fields} FROM sessions WHERE id = ?`);
+    const children = db.prepare(`SELECT ${fields} FROM sessions WHERE parent_session_id = ?`);
+    const seen = new Set(ids);
+    const pending = [...ids];
+    const visit = (next) => { if (next && !seen.has(next) && seen.size < COMPRESSION_CHAIN_CAP) {
+        seen.add(next);
+        pending.push(next);
+    } };
+    while (pending.length) {
+        const current = row.get(pending.pop());
+        if (!current)
+            continue;
+        const parentId = str(current.parent_session_id);
+        if (parentId && isContinuationSession(row.get(parentId), current))
+            visit(parentId);
+        if (['compression', 'cli_close'].includes(str(current.end_reason)))
+            for (const child of children.all(str(current.id)))
+                if (isContinuationSession(current, child))
+                    visit(str(child.id));
+    }
+    return [...seen];
+}
 function continuationRootId(rowsById, sessionId) {
     if (!sessionId)
         return null;
@@ -147,7 +194,7 @@ function continuationRootId(rowsById, sessionId) {
     return rootId;
 }
 /** Python `_project_agent_session_rows`: collapse compression chains into one sidebar row pointing at the freshest importable tip. */
-export function projectAgentSessionRows(rows) {
+export function projectAgentSessionRows(rows, keepEmpty = false) {
     const rowsById = new Map(rows.map((r) => [str(r.id), r]));
     const childrenByParent = new Map();
     const continuationChildIds = new Set();
@@ -203,14 +250,22 @@ export function projectAgentSessionRows(rows) {
     };
     const projected = [];
     for (const row of rows) {
+        if (row._lineage_root_id && row._lineage_tip_id) {
+            projected.push({ ...row });
+            continue;
+        }
         if (continuationChildIds.has(str(row.id)))
             continue;
         let segments = 1;
         let tip = row;
         if (['compression', 'cli_close'].includes(str(row.end_reason)))
             [tip, segments] = compressionTip(row);
-        if (!tip || positiveInt(tip.actual_message_count) <= 0)
+        // `keepEmpty` (a direct lookup of receipt-proven Web diagnostic chats, TAL-1040) keeps a turnless plain row.
+        if (!tip || positiveInt(tip.actual_message_count) <= 0) {
+            if (keepEmpty && tip === row)
+                projected.push({ ...row });
             continue;
+        }
         if (tip === row) {
             projected.push({ ...row });
             continue;
@@ -239,22 +294,266 @@ export function projectAgentSessionRows(rows) {
     projected.sort((a, b) => score(b.last_activity, b.started_at) - score(a.last_activity, a.started_at));
     return projected;
 }
-// ── sqlite access ─────────────────────────────────────────────────────────
-/** Python `open_state_db_readonly`: read-only URI open with a bounded busy timeout; the caller closes it. */
-export function openStateDbReadonly(dbPath, busyTimeoutMs = STATE_DB_BUSY_TIMEOUT_MS) {
-    if (!existsSync(dbPath))
-        throw new Error(`agent state.db not found: ${dbPath}`);
-    const db = new DatabaseSync(dbPath, { readOnly: true, timeout: busyTimeoutMs });
-    return db;
+/** Bound descriptors and page caches even when deleted profiles are never read again. */
+const STATE_DB_HANDLE_CACHE_MAX = 16;
+const readonlyStateDbs = new Map();
+const schemaCaches = new WeakMap();
+/** Cache ownership ends at shutdown; worker termination also disposes its native SQLite resources. */
+function closeStateDbs(paths = readonlyStateDbs.keys()) {
+    for (const path of paths) {
+        const cached = readonlyStateDbs.get(path);
+        if (cached?.db.isOpen)
+            cached.db.close();
+        readonlyStateDbs.delete(path);
+    }
+}
+process.once('exit', () => { closeStateDbs(); });
+/** One handle per file identity. The caller ends the read snapshot in finally, leaving closure to the cache. */
+function openStateDbReadonly(dbPath, busyTimeoutMs = STATE_DB_BUSY_TIMEOUT_MS) {
+    const { ino, dev, mtimeNs } = statSync(dbPath, { bigint: true });
+    let cached = readonlyStateDbs.get(dbPath);
+    // Raw writes need not advance SQLite's change counter; revalidate the main file after any such change.
+    if (cached && (cached.ino !== ino || cached.dev !== dev || cached.mtimeNs !== mtimeNs || !cached.db.isOpen)) {
+        closeStateDbs([dbPath]);
+        cached = undefined;
+    }
+    if (!cached) {
+        if (readonlyStateDbs.size >= STATE_DB_HANDLE_CACHE_MAX)
+            closeStateDbs([readonlyStateDbs.keys().next().value]);
+        const db = new DatabaseSync(dbPath, { readOnly: true, timeout: busyTimeoutMs });
+        cached = { db, ino, dev, mtimeNs, schemaVersion: null, columns: new Map(), indexes: new Map() };
+        schemaCaches.set(db, cached);
+    }
+    readonlyStateDbs.delete(dbPath);
+    readonlyStateDbs.set(dbPath, cached);
+    const { db } = cached;
+    try {
+        db.exec(`PRAGMA busy_timeout = ${Math.max(0, Math.trunc(busyTimeoutMs))}`);
+        // The schema cookie and all probes/queries must describe the same committed snapshot.
+        db.exec('BEGIN');
+        const version = db.prepare('PRAGMA schema_version').get().schema_version;
+        if (cached.schemaVersion !== version) {
+            cached.columns.clear();
+            cached.indexes.clear();
+            cached.schemaVersion = version;
+        }
+        return db;
+    }
+    catch (error) {
+        closeStateDbs([dbPath]);
+        throw error;
+    }
 }
+function finishStateDbRead(db) {
+    try {
+        db.exec('COMMIT');
+    }
+    catch {
+        // A failed read can poison COMMIT too; discard the handle without hiding the reader's failure result.
+        db.close();
+    }
+}
+/** A failed probe throws, so unreadable storage is never mistaken for an older schema (TAL-785). */
 function tableColumns(db, table) {
+    const cache = schemaCaches.get(db).columns;
+    let columns = cache.get(table);
+    if (!columns) {
+        columns = new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((r) => r.name));
+        cache.set(table, columns);
+    }
+    return columns;
+}
+function tableIndexes(db, table) {
+    const cache = schemaCaches.get(db).indexes;
+    const indexes = cache.get(table);
+    if (indexes)
+        return indexes;
     try {
-        return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((r) => r.name));
+        const found = new Set(db.prepare(`PRAGMA index_list(${table})`).all().map((r) => r.name));
+        cache.set(table, found);
+        return found;
     }
     catch {
         return new Set();
     }
 }
+/** Agent `_sql_freshest_of`: the `last_activity_at` heartbeat can lag a newer message, so it never ranks alone. */
+function freshestActivity(lastActivityAt, lastMessage) {
+    return `MAX(COALESCE(${lastActivityAt}, 0), COALESCE(${lastMessage}, 0), COALESCE(s.started_at, 0))`;
+}
+/** Stale Agent statistics can favor a non-covering index and read every message row. */
+function lastMessageTimestamp(indexed, alias = 'm') {
+    return `(SELECT MAX(${alias}.timestamp) FROM messages ${alias}${indexed ? ' INDEXED BY idx_messages_session' : ''} WHERE ${alias}.session_id = s.id)`;
+}
+const LOCAL_POLICY_PREFIX = 'gateway.local_policy.v1:';
+/** Read-only equivalent of Agent validate_local_lineage. A receipt, never a reset edge alone, proves ownership. */
+function localLineages(db, sid) {
+    const result = new Map();
+    if (!tableColumns(db, 'state_meta').has('value'))
+        return result;
+    const cols = tableColumns(db, 'sessions');
+    if (!['chat_id', 'user_id', 'session_key', 'model_config', 'parent_session_id', 'end_reason'].every((c) => cols.has(c)))
+        return result;
+    const meta = db.prepare('SELECT value FROM state_meta WHERE key = ?');
+    const fetch = db.prepare('SELECT * FROM sessions WHERE id IN (SELECT value FROM json_each(?))');
+    const messageCols = tableColumns(db, 'messages');
+    const lastMessage = ['session_id', 'timestamp'].every((c) => messageCols.has(c)) ? lastMessageTimestamp(tableIndexes(db, 'messages').has('idx_messages_session')) : 'NULL';
+    const activity = freshestActivity(cols.has('last_activity_at') ? 's.last_activity_at' : 'NULL', lastMessage);
+    // Agent _CHAIN_STEP_SQL prefers a compression child, then a live child, then recency and id.
+    const children = db.prepare(`SELECT s.* FROM sessions s WHERE s.parent_session_id = ? ORDER BY CASE WHEN s.end_reason = 'compression' THEN 0 WHEN s.ended_at IS NULL THEN 1 ELSE 2 END, ${activity} DESC, s.started_at DESC, s.id DESC`);
+    const explicitChild = (child, includeReset) => {
+        return lower(child.source) === 'tool' || lower(child.session_source) === 'fork'
+            || explicitForkMarkers(child, includeReset).length > 0;
+    };
+    const compressionChildren = (parent) => str(parent.end_reason) === 'compression'
+        ? children.all(str(parent.id)).filter((child) => !explicitChild(child, true)) : [];
+    const owner = sid ? db.prepare('SELECT chat_id FROM sessions WHERE id = ?').get(sid)?.chat_id || sid : null;
+    const receipts = owner
+        ? db.prepare('SELECT key, value FROM state_meta WHERE key = ?').all(`${LOCAL_POLICY_PREFIX}${str(owner)}`)
+        : db.prepare('SELECT key, value FROM state_meta WHERE key GLOB ?').iterate(`${LOCAL_POLICY_PREFIX}*`);
+    for (const saved of receipts) {
+        try {
+            if (saved.value.length > 1_000_000)
+                continue;
+            const receipt = JSON.parse(saved.value);
+            const owner = saved.key.slice(LOCAL_POLICY_PREFIX.length);
+            const ids = receipt.lineage;
+            const entry = receipt.entry;
+            if (receipt.session_id !== owner || !Array.isArray(ids) || ids.length < 2 || ids.length > COMPRESSION_CHAIN_CAP
+                || !ids.every((id) => typeof id === 'string' && Boolean(id)) || new Set(ids).size !== ids.length
+                || ids[0] !== owner || ids.at(-1) !== entry?.session_id)
+                continue;
+            if (!['profile_id', 'principal_id', 'request_id', 'route'].every((key) => typeof receipt[key] === 'string' && receipt[key]))
+                continue;
+            if ('legacy_session_id' in receipt) {
+                const legacy = meta.get(`gateway.local_legacy.v1:${owner}`);
+                if (receipt.legacy_session_id !== owner || !legacy)
+                    continue;
+                const binding = JSON.parse(legacy.value);
+                if (!['session_id', 'profile_id', 'principal_id', 'legacy_session_id'].every((key) => binding[key] === receipt[key]))
+                    continue;
+            }
+            else {
+                // Python json.dumps uses ensure_ascii=True, including UTF-16 surrogate pairs.
+                const identity = JSON.stringify([receipt.profile_id, receipt.principal_id, receipt.request_id]).replace(/[\u007f-\uffff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+                if (owner !== `local-${createHash('sha256').update(identity).digest('hex')}`)
+                    continue;
+            }
+            const byId = new Map(fetch.all(JSON.stringify(ids)).map((row) => [str(row.id), row]));
+            const rows = ids.map((id) => byId.get(id));
+            if (!rows.every((row) => Boolean(row) && row.chat_id === owner && row.user_id === receipt.principal_id && row.session_key === receipt.route))
+                continue;
+            let contextStart = 0;
+            let valid = true;
+            for (let i = 1; i < rows.length; i += 1) {
+                const parent = rows[i - 1], child = rows[i];
+                if (child.parent_session_id !== parent.id || explicitChild(child, false)) {
+                    valid = false;
+                    break;
+                }
+                if (parent.end_reason === 'session_reset') {
+                    const config = jsonLoadsIfString(child.model_config);
+                    if (!config || config._reset_from !== parent.id) {
+                        valid = false;
+                        break;
+                    }
+                    contextStart = i;
+                }
+                else {
+                    const next = compressionChildren(parent);
+                    if (next[0]?.id !== child.id) {
+                        valid = false;
+                        break;
+                    }
+                }
+            }
+            if (!valid || compressionChildren(rows.at(-1)).length)
+                continue;
+            const lineage = { owner, ids, context: ids.slice(contextStart), rows, title: [...rows].reverse().find((row) => row.title)?.title ?? null };
+            for (const id of ids)
+                result.set(id, lineage);
+        }
+        catch { /* Malformed receipts cannot attach history to another conversation. */ }
+    }
+    return result;
+}
+/** The validated receipt's current physical target, or the original id on old Agents / unproven metadata. */
+export function stateDbLocalTarget(dbPath, sid, opts = {}) {
+    if (!existsSync(dbPath)) {
+        opts.onRead?.(sid);
+        return sid;
+    }
+    let db;
+    try {
+        db = openStateDbReadonly(dbPath);
+    }
+    catch {
+        return sid;
+    }
+    try {
+        const target = localLineages(db, sid).get(sid)?.ids.at(-1) ?? sid;
+        opts.onRead?.(target);
+        return target;
+    }
+    catch {
+        return sid;
+    }
+    finally {
+        finishStateDbRead(db);
+    }
+}
+/** `stateDbLocalTarget` plus whether state.db answered (a missing one does), so only a real answer seeds a routing cache. */
+function stateDbLocalTargetRead(dbPath, sid) {
+    let read = false;
+    const target = stateDbLocalTarget(dbPath, sid, { onRead: () => { read = true; } });
+    return { target, read };
+}
+export const AGENT_STORAGE_OK = Object.freeze({ state: 'ok', reason: null });
+/**
+ * The corrupt-storage reason when `error` is SQLite's `SQLITE_CORRUPT` or `SQLITE_NOTADB` (the Agent's
+ * `hermes_state_health`), else null. The message is matched too, since a listing worker failure crosses the thread
+ * boundary as its message alone.
+ */
+export function stateDbCorruptReason(error) {
+    const code = error?.errcode;
+    const message = error instanceof Error ? error.message : String(error);
+    const corrupt = (typeof code === 'number' && [11, 26].includes(code & 0xff)) || /malformed|not a database/i.test(message);
+    return corrupt ? `Agent session storage (state.db) is damaged: ${message}. Agent sessions are unavailable until it is repaired or restored from a backup.` : null;
+}
+/** The storage state a failed `state.db` read reports: `corrupt` when SQLite says the file is damaged, else `unavailable`. */
+export function stateDbReadFailure(error) {
+    const corrupt = stateDbCorruptReason(error);
+    if (corrupt)
+        return { state: 'corrupt', reason: corrupt };
+    return { state: 'unavailable', reason: `Agent session storage (state.db) could not be read: ${error instanceof Error ? error.message : String(error)}.` };
+}
+function outdatedStateDbStorage() {
+    return { state: 'outdated', reason: "state.db has no 'source' column (older hermes-agent?). Agent sessions unavailable. Upgrade hermes-agent to fix this." };
+}
+/**
+ * TAL-785: whether `state.db` can serve the session list: `corrupt` when SQLite reports the file damaged, `unavailable`
+ * when it cannot be read for another reason (permissions, a lock, an I/O error), `outdated` when a readable database
+ * has no `sessions.source` column. A missing file is `ok`. Full-text index damage is never probed, so it stays `ok`, as
+ * the Agent treats it.
+ */
+export function stateDbStorage(dbPath) {
+    if (!existsSync(dbPath))
+        return AGENT_STORAGE_OK;
+    try {
+        const db = openStateDbReadonly(dbPath);
+        try {
+            if (!tableColumns(db, 'sessions').has('source'))
+                return outdatedStateDbStorage();
+        }
+        finally {
+            finishStateDbRead(db);
+        }
+    }
+    catch (error) {
+        return stateDbReadFailure(error);
+    }
+    return AGENT_STORAGE_OK;
+}
 const warnedNoSourceColumn = new Set();
 let readDelayMs = 0;
 /** Test hook: each listing read (and each listing worker request) blocks its thread this long first, standing in for a slow `state.db` (TAL-920). */
@@ -268,11 +567,15 @@ export function setStateDbReadDelayForTests(ms) { readDelayMs = ms; }
  * `idx_messages_session` exactly as Python does when its heal fails.
  */
 export function readImportableAgentSessionRows(dbPath, opts = {}) {
+    const result = readImportableAgentSessionRowBatches(dbPath, [opts]).rows[0];
+    if (result instanceof Error)
+        throw result;
+    return result;
+}
+/** All listing windows share one read snapshot, schema, validated local lineages and ownership lookup. */
+export function readImportableAgentSessionRowBatches(dbPath, queries) {
     if (!existsSync(dbPath))
-        return [];
-    const limit = opts.limit === undefined ? 200 : opts.limit;
-    const exclude = opts.excludeSources === undefined ? ['cron', 'webui'] : opts.excludeSources;
-    const include = opts.includeSources ?? null;
+        return { rows: queries.map(() => []), storage: AGENT_STORAGE_OK };
     if (readDelayMs > 0)
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, readDelayMs);
     const db = openStateDbReadonly(dbPath);
@@ -282,29 +585,24 @@ export function readImportableAgentSessionRows(dbPath, opts = {}) {
         if (!sessionCols.has('source')) {
             if (!warnedNoSourceColumn.has(dbPath)) {
                 warnedNoSourceColumn.add(dbPath);
-                opts.log?.(`[webui] agent session listing skipped: state.db at ${dbPath} has no 'source' column (older hermes-agent?). Agent sessions unavailable. Upgrade hermes-agent to fix this.`);
+                queries[0]?.log?.(`[webui] agent session listing skipped: state.db at ${dbPath} has no 'source' column (older hermes-agent?). Agent sessions unavailable. Upgrade hermes-agent to fix this.`);
             }
-            return [];
+            return { rows: queries.map(() => []), storage: outdatedStateDbStorage() };
         }
+        const only = queries.length === 1 ? queries[0]?.sessionIds : undefined;
+        const local = localLineages(db, only?.length === 1 ? only[0] : undefined);
         const col = (name) => (sessionCols.has(name) ? `s.${name}` : `NULL AS ${name}`);
         const messagesHasSessionId = messageCols.has('session_id');
         const messagesHasTimestamp = messageCols.has('timestamp');
         const countCol = messageCols.has('id') ? 'id' : 'session_id';
-        let messagesIndexPresent = false;
-        let userMessagesIndexPresent = false;
-        if (messagesHasSessionId && messagesHasTimestamp) {
-            try {
-                const indexes = new Set(db.prepare('PRAGMA index_list(messages)').all().map((r) => r.name));
-                messagesIndexPresent = indexes.has('idx_messages_session');
-                userMessagesIndexPresent = indexes.has('idx_messages_session_user');
-            }
-            catch {
-                messagesIndexPresent = false;
-            }
-        }
+        const messageIndexes = messagesHasSessionId && messagesHasTimestamp ? tableIndexes(db, 'messages') : new Set();
+        const sessionIndexes = tableIndexes(db, 'sessions');
+        const hasPolicies = Boolean(db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'state_meta'").get());
+        const messagesIndexPresent = messageIndexes.has('idx_messages_session');
+        const userMessagesIndexPresent = messageIndexes.has('idx_messages_session_user');
         let actualCountExpr;
         let userCountExpr;
-        let lastActivityExpr;
+        let baseLastActivityExpr;
         let joinClause = '';
         let groupByClause = '';
         if (messagesHasSessionId) {
@@ -317,12 +615,12 @@ export function readImportableAgentSessionRows(dbPath, opts = {}) {
                 }
                 else
                     userCountExpr = actualCountExpr;
-                lastActivityExpr = messagesHasTimestamp ? '(SELECT MAX(lm.timestamp) FROM messages lm WHERE lm.session_id = s.id)' : 'NULL';
+                baseLastActivityExpr = messagesHasTimestamp ? lastMessageTimestamp(messagesIndexPresent, 'lm') : 'NULL';
             }
             else {
                 actualCountExpr = `COUNT(m.${countCol})`;
                 userCountExpr = messageCols.has('role') ? "EXISTS(SELECT 1 FROM messages um WHERE um.session_id = s.id AND LOWER(um.role) = 'user')" : `COUNT(m.${countCol})`;
-                lastActivityExpr = messagesHasTimestamp ? 'MAX(m.timestamp)' : 'NULL';
+                baseLastActivityExpr = messagesHasTimestamp ? 'MAX(m.timestamp)' : 'NULL';
                 joinClause = 'LEFT JOIN messages m ON m.session_id = s.id';
                 groupByClause = 'GROUP BY s.id';
             }
@@ -330,75 +628,151 @@ export function readImportableAgentSessionRows(dbPath, opts = {}) {
         else {
             actualCountExpr = 's.message_count';
             userCountExpr = 's.message_count';
-            lastActivityExpr = 'NULL';
-        }
-        let orderBy = 'ORDER BY s.started_at DESC';
-        let latestMessagesCte = null;
-        let candidateOrder = 'ORDER BY s.started_at DESC';
-        const where = ['s.source IS NOT NULL'];
-        const params = [];
-        const included = (include ?? []).map(String).filter(Boolean);
-        if (included.length) {
-            where.push(`s.source IN (${included.map(() => '?').join(', ')})`);
-            params.push(...included);
+            baseLastActivityExpr = 'NULL';
         }
-        const excluded = (exclude ?? []).map(String).filter(Boolean);
-        if (excluded.length) {
-            where.push(`s.source NOT IN (${excluded.map(() => '?').join(', ')})`);
-            params.push(...excluded);
-        }
-        const preaggregated = messagesHasSessionId && messagesHasTimestamp && included.length === 1 && included[0] === 'cron' && !messagesIndexPresent;
-        if (preaggregated) {
-            orderBy = 'ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC';
-            latestMessagesCte = 'latest_messages AS (SELECT mx.session_id AS session_id, MAX(mx.timestamp) AS last_message_at FROM messages mx GROUP BY mx.session_id)';
-            candidateOrder = 'ORDER BY COALESCE(lm.last_message_at, s.started_at) DESC, s.started_at DESC';
-        }
-        else if (messagesHasSessionId && messagesHasTimestamp) {
-            orderBy = messagesIndexPresent ? 'ORDER BY COALESCE(last_activity, s.started_at) DESC' : 'ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC';
-            candidateOrder = 'ORDER BY COALESCE((SELECT MAX(mx.timestamp) FROM messages mx WHERE mx.session_id = s.id), s.started_at) DESC, s.started_at DESC';
-        }
-        const selectSql = `SELECT s.id, s.title, s.model, s.message_count, s.started_at, s.source, ${['session_source', 'user_id', 'chat_id', 'chat_type', 'thread_id', 'session_key', 'origin_chat_id', 'origin_user_id', 'platform', 'parent_session_id', 'ended_at', 'end_reason'].map(col).join(', ')}, ${actualCountExpr} AS actual_message_count, ${userCountExpr} AS actual_user_message_count, ${lastActivityExpr} AS last_activity`;
-        let raw;
-        if (limit !== null) {
-            const resultLimit = Math.max(0, Math.trunc(limit));
-            if (resultLimit === 0)
-                return [];
-            const candidateLimit = Math.max(resultLimit * 8, resultLimit);
-            const candidateCte = latestMessagesCte
-                ? `WITH ${latestMessagesCte}, candidates AS (SELECT s.id FROM sessions s LEFT JOIN latest_messages lm ON lm.session_id = s.id WHERE ${where.join(' AND ')} ${candidateOrder} LIMIT ?)`
-                : `WITH candidates AS (SELECT s.id FROM sessions s WHERE ${where.join(' AND ')} ${candidateOrder} LIMIT ?)`;
-            raw = db.prepare(`${candidateCte} ${selectSql} FROM sessions s JOIN candidates c ON c.id = s.id ${joinClause} ${groupByClause} ${orderBy}`).all(...params, candidateLimit);
-        }
-        else {
-            raw = db.prepare(`${selectSql} FROM sessions s ${joinClause} WHERE ${where.join(' AND ')} ${groupByClause} ${orderBy}`).all(...params);
+        const candidates = (opts) => {
+            const limit = opts.limit === undefined ? 200 : opts.limit;
+            const exclude = opts.excludeSources === undefined ? ['cron', 'webui'] : opts.excludeSources;
+            const include = opts.includeSources ?? null;
+            let lastActivityExpr = baseLastActivityExpr;
+            let orderBy = 'ORDER BY s.started_at DESC';
+            let latestMessagesCte = null;
+            let candidateOrder = 'ORDER BY s.started_at DESC';
+            const where = ['s.source IS NOT NULL'];
+            const params = [];
+            if (opts.sessionIds !== undefined) {
+                where.push('s.id IN (SELECT value FROM json_each(?))');
+                const ids = opts.sessionIds.map((id) => local.get(id)?.ids.at(-1) ?? id);
+                params.push(JSON.stringify(opts.compressionChains ? compressionChainIds(db, sessionCols, ids) : ids));
+            }
+            const superseded = [...local].filter(([id, lineage]) => id !== lineage.ids.at(-1)).map(([id]) => id);
+            if (superseded.length) {
+                where.push('s.id NOT IN (SELECT value FROM json_each(?))');
+                params.push(JSON.stringify(superseded));
+            }
+            const policySource = (id) => `(SELECT CASE WHEN json_valid(value) THEN json_extract(value, '$.policy.source') END FROM state_meta WHERE key = '${LOCAL_POLICY_PREFIX}' || ${id})`;
+            const sourceSql = hasPolicies ? `COALESCE(${policySource('s.id')}, ${sessionCols.has('chat_id') ? policySource('s.chat_id') : 'NULL'}, s.source)` : 's.source';
+            const included = (include ?? []).map(String).filter(Boolean);
+            if (included.length) {
+                where.push(`${sourceSql} IN (${included.map(() => '?').join(', ')})`);
+                params.push(...included);
+            }
+            const excluded = (exclude ?? []).map(String).filter(Boolean);
+            if (excluded.length) {
+                where.push(`${sourceSql} NOT IN (${excluded.map(() => '?').join(', ')})`);
+                params.push(...excluded);
+            }
+            const preaggregated = messagesHasSessionId && messagesHasTimestamp && included.length === 1 && included[0] === 'cron' && !messagesIndexPresent;
+            // TAL-1163: the Agent's activity index preselects the window; exact recency is computed for those candidates only.
+            const activityIndexed = limit !== null && messagesHasSessionId && messagesHasTimestamp && sessionCols.has('last_activity_at')
+                && sessionIndexes.has('idx_sessions_effective_activity');
+            if (activityIndexed) {
+                lastActivityExpr = freshestActivity('s.last_activity_at', lastActivityExpr);
+                orderBy = 'ORDER BY last_activity DESC';
+                candidateOrder = 'ORDER BY COALESCE(s.last_activity_at, s.started_at) DESC, s.started_at DESC, s.id DESC';
+            }
+            else if (preaggregated) {
+                orderBy = 'ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC';
+                latestMessagesCte = 'latest_messages AS (SELECT mx.session_id AS session_id, MAX(mx.timestamp) AS last_message_at FROM messages mx GROUP BY mx.session_id)';
+                candidateOrder = 'ORDER BY COALESCE(lm.last_message_at, s.started_at) DESC, s.started_at DESC';
+            }
+            else if (messagesHasSessionId && messagesHasTimestamp) {
+                orderBy = messagesIndexPresent ? 'ORDER BY COALESCE(last_activity, s.started_at) DESC' : 'ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC';
+                candidateOrder = `ORDER BY COALESCE(${lastMessageTimestamp(messagesIndexPresent, 'mx')}, s.started_at) DESC, s.started_at DESC`;
+            }
+            const selectSql = `SELECT s.id, s.title, s.model, s.message_count, s.started_at, s.source, ${['model_config', 'session_source', 'user_id', 'chat_id', 'chat_type', 'thread_id', 'session_key', 'origin_chat_id', 'origin_user_id', 'platform', 'parent_session_id', 'ended_at', 'end_reason'].map(col).join(', ')}, ${actualCountExpr} AS actual_message_count, ${userCountExpr} AS actual_user_message_count, ${lastActivityExpr} AS last_activity`;
+            let raw;
+            if (limit !== null) {
+                const resultLimit = Math.max(0, Math.trunc(limit));
+                if (resultLimit === 0)
+                    return [];
+                const candidateLimit = Math.max(resultLimit * 8, resultLimit);
+                const candidateCte = latestMessagesCte
+                    ? `WITH ${latestMessagesCte}, candidates AS (SELECT s.id FROM sessions s LEFT JOIN latest_messages lm ON lm.session_id = s.id WHERE ${where.join(' AND ')} ${candidateOrder} LIMIT ?)`
+                    : `WITH candidates AS (SELECT s.id FROM sessions s WHERE ${where.join(' AND ')} ${candidateOrder} LIMIT ?)`;
+                raw = db.prepare(`${candidateCte} ${selectSql} FROM sessions s JOIN candidates c ON c.id = s.id ${joinClause} ${groupByClause} ${orderBy}`).all(...params, candidateLimit);
+            }
+            else {
+                raw = db.prepare(`${selectSql} FROM sessions s ${joinClause} WHERE ${where.join(' AND ')} ${groupByClause} ${orderBy}`).all(...params);
+            }
+            return raw;
+        };
+        const batches = queries.map((opts) => {
+            try {
+                return candidates(opts);
+            }
+            catch (error) {
+                return error;
+            }
+        });
+        const ids = [...new Set(batches.flatMap((rows) => rows instanceof Error ? [] : rows.map((r) => str(r.id))))];
+        let owners;
+        try {
+            owners = sessionSources(db, sessionCols, ids);
         }
-        let projected = projectAgentSessionRows(raw.map((r) => ({ ...r })));
-        projected = projected.map((r) => ({ ...r, ...normalizeAgentSessionSource(r.source) }));
-        projected = projected.filter(isCliSessionRowVisible);
-        if (limit === null)
-            return projected;
-        const selected = projected.slice(0, Math.max(0, Math.trunc(limit)));
-        const have = new Set(selected.map((r) => str(r.id)));
-        const byId = new Map(projected.filter((r) => r.id).map((r) => [str(r.id), r]));
-        const pending = [...selected];
-        while (pending.length) {
-            const row = pending.pop();
-            if (lower(row.raw_source || row.source) !== 'subagent')
-                continue;
-            const parentId = str(row.parent_session_id);
-            if (!parentId || have.has(parentId))
-                continue;
-            const parent = byId.get(parentId);
-            if (!parent || lower(parent.raw_source || parent.source) !== 'subagent')
-                continue;
-            selected.push(parent);
-            have.add(parentId);
-            pending.push(parent);
+        catch (error) {
+            if (queries.length === 1)
+                throw error;
+            // Retry ownership per window only on damage, so a background failure cannot hide healthy interactive rows.
         }
-        return selected;
+        const rows = batches.map((batch, i) => {
+            if (batch instanceof Error)
+                return batch;
+            let batchOwners = owners;
+            if (batchOwners === undefined) {
+                try {
+                    batchOwners = sessionSources(db, sessionCols, batch.map((row) => str(row.id)));
+                }
+                catch (error) {
+                    return error;
+                }
+            }
+            let raw = batch;
+            const opts = queries[i];
+            const limit = opts.limit === undefined ? 200 : opts.limit;
+            raw = raw.map((r) => { const owner = batchOwners.get(str(r.id)); return { ...r, source: typeof owner === 'object' ? owner.source : owner || r.source }; });
+            const keepEmpty = opts.keepEmpty === true && opts.sessionIds !== undefined;
+            let projected = projectAgentSessionRows(raw.map((r) => {
+                const lineage = local.get(str(r.id));
+                if (!lineage)
+                    return { ...r };
+                const root = lineage.rows[0];
+                const title = lineage.title || r.title;
+                return { ...r, title, started_at: root.started_at, last_activity: r.last_activity ?? r.started_at, parent_session_id: root.parent_session_id,
+                    _lineage_root_id: lineage.owner, _lineage_tip_id: r.id, _lineage_ids: [...lineage.ids], _compression_segment_count: lineage.ids.length };
+            }), keepEmpty);
+            projected = projected.map((r) => {
+                const parent = local.get(str(r.parent_session_id));
+                return { ...r, ...normalizeAgentSessionSource(r.source), ...(parent ? { _parent_lineage_root_id: parent.owner, parent_title: parent.title, parent_source: parent.rows.at(-1)?.source ?? null } : {}) };
+            });
+            if (!keepEmpty)
+                projected = projected.filter(isCliSessionRowVisible);
+            if (limit === null)
+                return projected;
+            const selected = projected.slice(0, Math.max(0, Math.trunc(limit)));
+            const have = new Set(selected.map((r) => str(r.id)));
+            const byId = new Map(projected.filter((r) => r.id).map((r) => [str(r.id), r]));
+            const pending = [...selected];
+            while (pending.length) {
+                const row = pending.pop();
+                if (lower(row.raw_source || row.source) !== 'subagent')
+                    continue;
+                const parentId = str(row.parent_session_id);
+                if (!parentId || have.has(parentId))
+                    continue;
+                const parent = byId.get(parentId);
+                if (!parent || lower(parent.raw_source || parent.source) !== 'subagent')
+                    continue;
+                selected.push(parent);
+                have.add(parentId);
+                pending.push(parent);
+            }
+            return selected;
+        });
+        return { rows, storage: AGENT_STORAGE_OK };
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /** Python `agent_session_rows_existing`: batch existence probe; assumes present on any failure so nothing is pruned by mistake. */
@@ -429,12 +803,61 @@ export function agentSessionRowsExisting(dbPath, sessionIds) {
         return wanted;
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
+    }
+}
+/** Scheduler admissions are the identity of gateway-fired cron runs, whose session ids stay local-*. */
+function cronAdmissionJobIds(db, terminalOnly = false) {
+    const found = new Map();
+    const cols = tableColumns(db, 'session_admissions');
+    if (!['request_id', 'target_session_id', 'principal_id'].every((col) => cols.has(col)) || (terminalOnly && !cols.has('status')))
+        return found;
+    // The principal predicate selects the Agent's partial covering index, excluding interactive admissions.
+    const rows = db.prepare(`SELECT target_session_id, request_id FROM session_admissions WHERE principal_id = 'cron-owner' AND request_id LIKE 'cron:%'${terminalOnly ? " AND status = 'terminal'" : ''}`).all();
+    for (const row of rows) {
+        const match = /^cron:([^:]+):([^:]+)$/.exec(row.request_id);
+        if (match)
+            found.set(row.target_session_id, match[1]);
+    }
+    return found;
+}
+/** Read-only admission lookup, built once per session listing; older Agent stores have none. */
+export function stateDbCronJobIds(dbPath) {
+    if (!existsSync(dbPath))
+        return new Map();
+    let db;
+    try {
+        db = openStateDbReadonly(dbPath);
+    }
+    catch {
+        return new Map();
+    }
+    try {
+        return cronAdmissionJobIds(db);
+    }
+    catch {
+        return new Map();
+    }
+    finally {
+        finishStateDbRead(db);
     }
 }
+/** Shared job identity rule for completion links and sidebar titles, including legacy job ids with underscores. */
+export function cronSessionJobId(sid, jobIds, admissions) {
+    const admitted = admissions.get(sid);
+    if (admitted)
+        return admitted;
+    const legacy = /^cron_(.+)_\d{8}_\d{6}$/.exec(sid);
+    if (legacy)
+        return legacy[1];
+    // Preserve prefix matching for older non-timestamp session ids.
+    return [...jobIds].filter((id) => sid.startsWith(`cron_${id}_`)).reduce((best, id) => best === null || id.length > best.length ? id : best, null);
+}
 /**
- * Python `_latest_cron_session_info_for_jobs`: the newest-started cron session for each completed job. A session id
- * belongs to the job with the longest matching `cron_{job_id}_` prefix, so `a` never claims `a_b`'s sessions. A
+ * Python `_latest_cron_session_info_for_jobs`: the newest-started cron session for each completed job, excluding
+ * non-terminal gateway admissions so the next run cannot steal the completion link. A session id
+ * belongs to its scheduler admission's job or its legacy timestamp identity. Non-timestamp ids retain the longest
+ * matching job prefix, so `a` never claims a known `a_b`'s sessions. A
  * missing, locked, or unrecognized state.db answers an empty map; callers send no enrichment.
  */
 export function latestCronSessionInfo(dbPath, jobIds, completedIds) {
@@ -454,17 +877,23 @@ export function latestCronSessionInfo(dbPath, jobIds, completedIds) {
         const cols = tableColumns(db, 'sessions');
         if (!cols.has('id') || !cols.has('source'))
             return found;
+        const admissions = cronAdmissionJobIds(db, true);
         const count = cols.has('message_count') ? 's.message_count' : 'NULL';
         const order = cols.has('started_at') ? 'COALESCE(s.started_at, 0) DESC, s.id DESC' : 's.id DESC';
-        const rows = db.prepare(`SELECT s.id AS id, ${count} AS message_count FROM sessions s WHERE LOWER(COALESCE(s.source, '')) = 'cron' ORDER BY ${order}`).all();
-        for (const row of rows) {
-            const sid = typeof row.id === 'string' ? row.id : '';
-            const owner = ids.filter((id) => sid.startsWith(`cron_${id}_`)).reduce((best, id) => (best === null || id.length > best.length ? id : best), null);
-            if (owner === null || !wanted.has(owner) || found.has(owner))
-                continue;
-            found.set(owner, { session_id: sid, message_count: Number.isFinite(Number(row.message_count)) && row.message_count !== null ? Math.trunc(Number(row.message_count)) : null });
-            if (found.size === wanted.size)
-                break;
+        const indexed = tableIndexes(db, 'sessions').has('idx_sessions_source_id') ? ' INDEXED BY idx_sessions_source_id' : '';
+        const query = db.prepare(`SELECT s.id AS id, ${count} AS message_count FROM sessions s${indexed} WHERE s.source = 'cron' ORDER BY ${order} LIMIT ? OFFSET ?`);
+        const batchSize = wanted.size * 8;
+        // Stream older rows only if needed: a busy job must not hide another job's completion link.
+        for (const [limit, offset] of [[batchSize, 0], [-1, batchSize]]) {
+            for (const row of query.iterate(limit, offset)) {
+                const sid = typeof row.id === 'string' ? row.id : '';
+                const owner = cronSessionJobId(sid, ids, admissions);
+                if (owner === null || !wanted.has(owner) || found.has(owner))
+                    continue;
+                found.set(owner, { session_id: sid, message_count: Number.isFinite(Number(row.message_count)) && row.message_count !== null ? Math.trunc(Number(row.message_count)) : null });
+                if (found.size === wanted.size)
+                    return found;
+            }
         }
         return found;
     }
@@ -472,18 +901,187 @@ export function latestCronSessionInfo(dbPath, jobIds, completedIds) {
         return new Map();
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
-/**
- * TAL-358: the `sessions.source` owner of each present id, in one chunked read. A missing state.db (or one without a
- * `source` column) owns nothing; an unreadable one answers null, so callers fail closed on an unknown owner.
- */
-export function stateDbSessionSources(dbPath, sessionIds) {
+/** A source label remains display metadata; canonical receipts and ledgers independently retain write ownership. */
+export const CANONICAL_READ_ONLY_REASON = 'This session is owned by the Agent gateway and is display-only in Talaria.';
+export const OWNERSHIP_UNAVAILABLE_REASON = 'Agent session ownership could not be verified. The session is read-only until storage is readable.';
+export const RETIRED_READ_ONLY_REASON = 'The Agent has retired this session identity. Open or import a new conversation to continue.';
+/** Ownership fences outlive the fully validated localLineages history: even a pruned or broken receipt cannot release a writer. */
+function sessionSources(db, cols, ids) {
     const sources = new Map();
+    const canReadRows = cols.has('id') && cols.has('source');
+    const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name));
+    const walk = canReadRows ? resumeLineageWalker(db, cols) : (sid) => [sid];
+    const lineages = new Map(ids.map((id) => [id, walk(id)]));
+    const segments = [...new Set([...lineages.values()].flat())];
+    const rows = new Map();
+    for (let i = 0; canReadRows && i < segments.length; i += 400) {
+        const chunk = segments.slice(i, i + 400);
+        for (const row of db.prepare(`SELECT id, source, ${cols.has('chat_id') ? 'chat_id' : 'NULL AS chat_id'} FROM sessions WHERE id IN (${chunk.map(() => '?').join(',')})`).all(...chunk))
+            rows.set(str(row.id), row);
+    }
+    const candidates = [...new Set([...segments, ...[...rows.values()].map((r) => str(r.chat_id)).filter(Boolean)])];
+    const candidateSet = new Set(candidates);
+    const policies = new Map();
+    const receiptOwners = new Map();
+    const retired = new Set();
+    const bindings = new Set();
+    const wanted = new Set(segments);
+    const policyValue = (value) => {
+        try {
+            const parsed = JSON.parse(str(value));
+            return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const rememberPolicy = (owner, policy) => {
+        const entry = policy?.entry;
+        const target = entry && typeof entry === 'object' && !Array.isArray(entry) ? entry.session_id : null;
+        const lineage = Array.isArray(policy?.lineage) ? policy.lineage : [];
+        const aliases = [owner, policy?.session_id, policy?.legacy_session_id, target, ...lineage];
+        if (!candidateSet.has(owner) && !aliases.some((id) => typeof id === 'string' && wanted.has(id)))
+            return;
+        policies.set(owner, policy);
+        for (const id of aliases)
+            if (typeof id === 'string' && wanted.has(id) && !receiptOwners.has(id))
+                receiptOwners.set(id, owner);
+    };
+    if (tables.has('state_meta')) {
+        const prefixes = [LOCAL_POLICY_PREFIX, 'gateway.retired_session.v1.', 'gateway.api.binding.v1.'];
+        const keys = candidates.flatMap((owner) => prefixes.map((prefix) => `${prefix}${owner}`));
+        const metadata = new Map();
+        const read = db.prepare('SELECT key, value FROM state_meta WHERE key IN (SELECT value FROM json_each(?))');
+        for (let i = 0; i < keys.length; i += 400) {
+            for (const row of read.all(JSON.stringify(keys.slice(i, i + 400))))
+                metadata.set(row.key, row.value);
+        }
+        // Keep receipt precedence in candidate order, independent of SQLite's key ordering.
+        for (const owner of candidates) {
+            const key = `${LOCAL_POLICY_PREFIX}${owner}`;
+            if (metadata.has(key))
+                rememberPolicy(owner, policyValue(metadata.get(key)));
+            if (metadata.has(`gateway.retired_session.v1.${owner}`))
+                retired.add(owner);
+            if (metadata.has(`gateway.api.binding.v1.${owner}`))
+                bindings.add(owner);
+        }
+    }
+    const ledgerIds = new Set();
+    const ledgerCandidates = JSON.stringify(candidates);
+    for (const [table, column] of [['session_admissions', 'target_session_id'], ['worker_executions', 'session_id']]) {
+        if (!tables.has(table) || !candidates.length)
+            continue;
+        const hasLineage = tableColumns(db, table).has('lineage_json');
+        for (let i = 0; i < candidates.length; i += 400) {
+            const chunk = candidates.slice(i, i + 400);
+            const marks = chunk.map(() => '?').join(',');
+            for (const row of db.prepare(`SELECT ${column} AS id FROM ${table} WHERE ${column} IN (${marks})`).all(...chunk))
+                ledgerIds.add(row.id);
+        }
+        if (hasLineage) {
+            // Bind the complete set once so unrelated history never crosses into JavaScript, even across candidate chunks.
+            const scan = db.prepare(`SELECT ${column} AS id, lineage_json FROM ${table} WHERE lineage_json IS NOT NULL AND
+        (${column} IN (SELECT value FROM json_each(?)) OR EXISTS
+          (SELECT 1 FROM json_each(lineage_json) WHERE value IN (SELECT value FROM json_each(?))))`);
+            for (const row of scan.iterate(ledgerCandidates, ledgerCandidates)) {
+                const lineage = JSON.parse(row.lineage_json);
+                if (!Array.isArray(lineage) || !lineage.every((v) => typeof v === 'string'))
+                    throw new Error('Unreadable Agent admission lineage');
+                ledgerIds.add(row.id);
+                for (const sid of lineage)
+                    ledgerIds.add(sid);
+            }
+        }
+    }
+    // Pruned/reset segments can survive only in a receipt, without a row or chat_id to follow.
+    if (tables.has('state_meta') && segments.some((id) => !receiptOwners.has(id) && !ledgerIds.has(id) && !retired.has(id) && !bindings.has(id))) {
+        for (const raw of db.prepare('SELECT key, value FROM state_meta WHERE key GLOB ?').iterate(`${LOCAL_POLICY_PREFIX}*`)) {
+            const policy = policyValue(raw.value);
+            const entry = policy?.entry;
+            const target = entry && typeof entry === 'object' && !Array.isArray(entry) ? entry.session_id : null;
+            if (!policy || typeof policy.session_id !== 'string' || typeof target !== 'string' || (policy.lineage !== undefined && (!Array.isArray(policy.lineage) || !policy.lineage.length || !policy.lineage.every((id) => typeof id === 'string'))))
+                throw new Error('Unreadable Agent ownership receipt');
+            const owner = raw.key.slice(LOCAL_POLICY_PREFIX.length);
+            if (!owner)
+                throw new Error('Unreadable Agent ownership receipt');
+            rememberPolicy(owner, policy);
+        }
+    }
+    const kanban = new Set(kanbanOwnedIds(db, cols, new Map([...lineages].filter(([id]) => rows.has(id)))));
+    for (const id of ids) {
+        const row = rows.get(id);
+        let source = kanban.has(id) ? 'kanban' : str(row?.source);
+        let canonical = false;
+        let retiredId = false;
+        let mode;
+        for (const segment of lineages.get(id) ?? [id]) {
+            const chatId = str(rows.get(segment)?.chat_id);
+            for (const owner of new Set([segment, chatId, receiptOwners.get(segment)].filter((v) => Boolean(v)))) {
+                if (retired.has(owner))
+                    retiredId = true;
+                if (ledgerIds.has(owner) || bindings.has(owner))
+                    canonical = true;
+                if (!policies.has(owner))
+                    continue;
+                const policy = policies.get(owner);
+                // A broken receipt never releases its owner or a physical row naming that owner.
+                canonical = true;
+                const origin = policy?.policy;
+                if (origin && typeof origin === 'object' && !Array.isArray(origin)) {
+                    const frozen = origin;
+                    if (str(frozen.source))
+                        source = str(frozen.source);
+                    mode ??= frozen.safe_mode === true ? 'safe' : frozen.ignore_user_config === true ? 'ignore_config' : 'normal';
+                }
+            }
+        }
+        const authority = canonical;
+        // LOCAL is the canonical transport. Missing receipts cannot prove it safe to claim.
+        if (lower(source) === 'local')
+            canonical = true;
+        if (!row && !canonical && !retiredId)
+            continue;
+        const owned = { source, canonical: true, ...(mode ? { execution_mode: mode } : {}) };
+        sources.set(id, retiredId && !authority ? { ...owned, reason: RETIRED_READ_ONLY_REASON } : canonical ? owned : source);
+    }
+    return sources;
+}
+/** TAL-1040: the request-id prefix Talaria mints for the diagnostic chats it asks an owner to create; its receipt keeps it. */
+export const WEB_DIAGNOSTIC_REQUEST_PREFIX = 'talaria-web:';
+/** Owner ids whose creation receipt carries Talaria's request prefix: chats Web started, shown whatever the external-session setting. */
+export function stateDbWebDiagnosticIds(dbPath) {
+    if (!existsSync(dbPath))
+        return [];
+    let db;
+    try {
+        db = openStateDbReadonly(dbPath);
+    }
+    catch {
+        return [];
+    }
+    try {
+        if (!tableColumns(db, 'state_meta').has('value'))
+            return [];
+        const rows = db.prepare("SELECT key FROM state_meta WHERE key GLOB ? AND json_valid(value) AND json_extract(value, '$.request_id') GLOB ?")
+            .all(`${LOCAL_POLICY_PREFIX}*`, `${WEB_DIAGNOSTIC_REQUEST_PREFIX}*`);
+        return rows.map((row) => row.key.slice(LOCAL_POLICY_PREFIX.length));
+    }
+    catch {
+        return [];
+    }
+    finally {
+        finishStateDbRead(db);
+    }
+}
+/** Batched source/ownership probe. An unreadable authority answers null so callers fail closed. */
+export function stateDbSessionSources(dbPath, sessionIds) {
     const ids = [...new Set([...sessionIds].map((s) => s.trim()).filter(Boolean))];
     if (!ids.length || !existsSync(dbPath))
-        return sources;
+        return new Map();
     let db;
     try {
         db = openStateDbReadonly(dbPath);
@@ -492,22 +1090,82 @@ export function stateDbSessionSources(dbPath, sessionIds) {
         return null;
     }
     try {
-        const cols = tableColumns(db, 'sessions');
-        if (!cols.has('id') || !cols.has('source'))
-            return sources;
-        for (let i = 0; i < ids.length; i += 500) {
-            const chunk = ids.slice(i, i + 500);
-            for (const row of db.prepare(`SELECT id, source FROM sessions WHERE id IN (${chunk.map(() => '?').join(',')})`).all(...chunk))
-                sources.set(row.id, str(row.source));
-        }
-        return sources;
+        return sessionSources(db, tableColumns(db, 'sessions'), ids);
     }
     catch {
         return null;
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
+    }
+}
+/** The same marker parser serves conservative history boundaries and exact-parent ownership walks. */
+function explicitForkMarkers(row, includeReset) {
+    let cfg = row.model_config;
+    if (typeof cfg === 'string') {
+        try {
+            cfg = JSON.parse(cfg);
+        }
+        catch {
+            return [];
+        }
     }
+    if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg))
+        return [];
+    const c = cfg;
+    return [c._branched_from, c._delegate_from, ...(includeReset ? [c._reset_from] : [])].filter((m) => m !== undefined && m !== null);
+}
+/** Python `_is_explicit_fork_child_row`: a tool child, or a branch/delegate (`includeReset`: also reset) fork of its parent. */
+function isExplicitForkChild(row, includeReset) {
+    if (str(row.source) === 'tool')
+        return true;
+    const markers = explicitForkMarkers(row, includeReset);
+    const parentId = row.parent_session_id;
+    return parentId ? markers.includes(parentId) : markers.length > 0;
+}
+/**
+ * Python `_resume_lineage_ids`: `sid` and the compression ancestors a resume loads, root first. Each hop's parent ended
+ * `compression` and the child is no branch, reset, delegate or tool fork. The walk stops at a cycle or
+ * `RESUME_LINEAGE_CAP` ids; without the lineage columns it is `[sid]`.
+ */
+function resumeLineageWalker(db, cols) {
+    if (!['parent_session_id', 'end_reason'].every((c) => cols.has(c)))
+        return (sid) => [sid];
+    const select = db.prepare(`SELECT id, source, parent_session_id, end_reason, ${cols.has('model_config') ? 'model_config' : 'NULL AS model_config'} FROM sessions WHERE id = ?`);
+    return (sid) => {
+        const chain = [sid];
+        let current = select.get(sid);
+        if (!current || isExplicitForkChild(current, false))
+            return chain;
+        while (chain.length < RESUME_LINEAGE_CAP) {
+            const parentId = str(current.parent_session_id);
+            if (!parentId || chain.includes(parentId) || isExplicitForkChild(current, true))
+                break;
+            const parent = select.get(parentId);
+            if (str(parent?.end_reason) !== 'compression')
+                break;
+            chain.push(parentId);
+            current = parent;
+        }
+        return chain.reverse();
+    };
+}
+/**
+ * TAL-793 (Agent `is_kanban_owned_session`): the `ids` whose compression lineage has a `kanban` `source` or
+ * `created_source` (schema v31; `source` alone decides before it), a Kanban worker's transcript only its dispatcher continues.
+ */
+function kanbanOwnedIds(db, cols, lineages) {
+    if (!lineages.size)
+        return [];
+    const segments = [...new Set([...lineages.values()].flat())];
+    const match = cols.has('created_source') ? "(source = 'kanban' OR created_source = 'kanban')" : "source = 'kanban'";
+    const kanban = new Set();
+    for (let i = 0; i < segments.length; i += 500) {
+        const chunk = segments.slice(i, i + 500);
+        for (const row of db.prepare(`SELECT id FROM sessions WHERE id IN (${chunk.map(() => '?').join(',')}) AND ${match}`).all(...chunk))
+            kanban.add(row.id);
+    }
+    return [...lineages].filter(([, lineage]) => lineage.some((sid) => kanban.has(sid))).map(([id]) => id);
 }
 /** Python `state_db_has_session`: true only when `sid` is a row of the sessions table; a missing or unreadable db is false. */
 export function stateDbHasSession(dbPath, sid) {
@@ -530,7 +1188,33 @@ export function stateDbHasSession(dbPath, sid) {
         return false;
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
+    }
+}
+/** True when a session has a live message; never materializes its transcript or compaction archive. */
+export function stateDbSessionHasMessages(dbPath, sid) {
+    const id = sid.trim();
+    if (!id || !existsSync(dbPath))
+        return false;
+    let db;
+    try {
+        db = openStateDbReadonly(dbPath);
+    }
+    catch {
+        return false;
+    }
+    try {
+        const cols = tableColumns(db, 'messages');
+        if (!cols.has('session_id'))
+            return false;
+        const active = cols.has('active') ? ' AND (active IS NULL OR active != 0)' : '';
+        return db.prepare(`SELECT 1 FROM messages WHERE session_id = ?${active} LIMIT 1`).get(id) !== undefined;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        finishStateDbRead(db);
     }
 }
 /**
@@ -541,7 +1225,7 @@ export function stateDbHasSession(dbPath, sid) {
 export function cheapChangeFingerprint(dbPath, onError) {
     try {
         const parts = [];
-        const db = openStateDbReadonly(dbPath);
+        const db = openStateDbReadonly(dbPath, STATE_DB_FINGERPRINT_BUSY_TIMEOUT_MS);
         try {
             for (const table of ['sessions', 'messages']) {
                 try {
@@ -553,7 +1237,7 @@ export function cheapChangeFingerprint(dbPath, onError) {
             }
         }
         finally {
-            db.close();
+            finishStateDbRead(db);
         }
         for (const path of [dbPath, `${dbPath}-wal`]) {
             try {
@@ -585,22 +1269,28 @@ export function cheapChangeFingerprint(dbPath, onError) {
         return null;
     }
 }
-let listingWorker = null;
+const STATE_DB_WORKER_LANES = ['listing', 'authority', 'session'];
+const listingWorkers = new Map();
+const listingReadScope = new AsyncLocalStorage();
+/** Keep a sidebar phase's nested reads on its lane without changing interactive callers' defaults. */
+export function withStateDbListingReads(read) { return listingReadScope.run('listing', read); }
 let nextCallId = 0;
-/** Set while `stopStateDbWorker` waits for the worker to exit; calls then reject instead of starting another worker. */
+/** Set until every worker exits during shutdown; calls then reject instead of starting another worker. */
 let stoppingWorker = false;
 /** Reject every call still waiting on `current` and forget it, so the next call starts a fresh worker. */
 function retireListingWorker(current, error) {
-    if (listingWorker === current)
-        listingWorker = null;
+    for (const [lane, worker] of listingWorkers)
+        if (worker === current)
+            listingWorkers.delete(lane);
     for (const call of current.pending.values())
         call.reject(error);
     current.pending.clear();
 }
-/** The lazily started, long-lived listing worker; requests run one at a time in arrival order. */
-function startedListingWorker() {
-    if (listingWorker)
-        return listingWorker;
+/** Each lane lazily starts one long-lived worker and keeps its own FIFO and read-only handle cache. */
+function startedListingWorker(lane) {
+    const existing = listingWorkers.get(lane);
+    if (existing)
+        return existing;
     // Source runs (vitest) load the TypeScript worker; the build runs the compiled one beside this module.
     const ext = import.meta.url.endsWith('.ts') ? 'ts' : 'js';
     const current = { worker: new Worker(new URL(`./state-db-worker.${ext}`, import.meta.url)), pending: new Map() };
@@ -616,20 +1306,26 @@ function startedListingWorker() {
     });
     current.worker.on('error', (error) => { retireListingWorker(current, error); });
     current.worker.on('exit', (code) => { retireListingWorker(current, new Error(`state.db worker exited with code ${String(code)}`)); });
-    listingWorker = current;
+    listingWorkers.set(lane, current);
     return current;
 }
-function callListingWorker(call) {
+function callListingWorker(call, lane) {
     // A multi-read caller the stop interrupted goes on to its next read; that read must not restart the worker.
     if (stoppingWorker)
         return Promise.reject(new Error('state.db worker stopped'));
-    const current = startedListingWorker();
+    const target = lane ?? listingReadScope.getStore() ?? (call.op === 'session' ? SESSION_READ_LANES[call.read] : call.op === 'sources' || call.op === 'existing' ? 'authority' : 'listing');
+    const current = startedListingWorker(target);
     const id = ++nextCallId;
+    const timing = startupTimingScope.getStore();
     return new Promise((resolve, reject) => {
-        current.pending.set(id, { resolve, reject });
+        current.pending.set(id, { resolve: (reply) => {
+                if (reply.timing)
+                    timing?.workerRead(target, call.op === 'session' ? call.read : call.op, reply.timing);
+                resolve(reply);
+            }, reject });
         // A call in flight keeps the process alive until it settles; an idle worker never does.
         current.worker.ref();
-        current.worker.postMessage({ ...call, id, delayMs: readDelayMs });
+        current.worker.postMessage({ ...call, id, delayMs: readDelayMs, queuedAtNs: process.hrtime.bigint() });
     });
 }
 /** `readImportableAgentSessionRows` on the listing worker, so a slow `state.db` never blocks the event loop. Rejects when the worker fails. */
@@ -642,6 +1338,15 @@ export async function readImportableAgentSessionRowsAsync(dbPath, opts = {}) {
         throw new Error(reply.error);
     return reply.value;
 }
+/** One worker crossing for all sidebar windows and their storage health. */
+export async function readImportableAgentSessionRowBatchesAsync(dbPath, queries) {
+    const reply = await callListingWorker({ op: 'rowBatches', dbPath, queries: queries.map((opts) => ({ ...opts, log: undefined })) });
+    for (const line of reply.logs)
+        queries[0]?.log?.(line);
+    if (reply.error !== undefined)
+        throw new Error(reply.error);
+    return reply.value;
+}
 /** `cheapChangeFingerprint` on the listing worker; a worker failure reports as a failed change check. */
 export async function cheapChangeFingerprintAsync(dbPath, onError) {
     let reply;
@@ -656,8 +1361,19 @@ export async function cheapChangeFingerprintAsync(dbPath, onError) {
         onError?.(reason, new Error(message));
     return reply.value;
 }
-/** `stateDbSessionSources` on the listing worker; a worker failure is an unreadable state.db (null), so owners stay locked. */
+/** `stateDbStorage` on the listing worker; a worker failure is `unavailable`. */
+export async function stateDbStorageAsync(dbPath) {
+    try {
+        return (await callListingWorker({ op: 'storage', dbPath })).value;
+    }
+    catch (error) {
+        return stateDbReadFailure(error);
+    }
+}
+/** `stateDbSessionSources` on the authority worker; a worker failure is an unreadable state.db (null), so owners stay locked. Without a state.db it answers here, opening nothing. */
 export async function stateDbSessionSourcesAsync(dbPath, sessionIds) {
+    if (!existsSync(dbPath))
+        return stateDbSessionSources(dbPath, sessionIds);
     try {
         return (await callListingWorker({ op: 'sources', dbPath, ids: [...sessionIds] })).value;
     }
@@ -665,7 +1381,16 @@ export async function stateDbSessionSourcesAsync(dbPath, sessionIds) {
         return null;
     }
 }
-/** `agentSessionRowsExisting` on the listing worker; a worker failure assumes every row present, so nothing is pruned. */
+/** `stateDbWebDiagnosticIds` on the listing worker; a failed read lists none, so the setting still governs every other row. */
+export async function stateDbWebDiagnosticIdsAsync(dbPath) {
+    try {
+        return (await callListingWorker({ op: 'webDiagnostic', dbPath })).value;
+    }
+    catch {
+        return [];
+    }
+}
+/** `agentSessionRowsExisting` on the authority worker; a worker failure assumes every row present, so nothing is pruned. */
 export async function agentSessionRowsExistingAsync(dbPath, sessionIds) {
     const ids = [...sessionIds];
     try {
@@ -675,19 +1400,60 @@ export async function agentSessionRowsExistingAsync(dbPath, sessionIds) {
         return new Set(ids.map((s) => s.trim()).filter(Boolean));
     }
 }
-/** Test hook: the listing worker exits abruptly while this call is in flight. */
-export function crashStateDbWorkerForTests() {
-    return callListingWorker({ op: 'crash' });
+/**
+ * TAL-923: the single-session readers behind chat start, session detail, and the mutation gates, run on the worker.
+ * TAL-1162: and the transcript reads behind turn history, settlement, and the detail's page tail.
+ * TAL-1256: shared cron admission identities and completion links use this same dispatcher.
+ */
+export const SESSION_READS = { stateDbHasSession, stateDbSessionHasMessages, insightsSessionRows, countConversationRounds, stateDbTailToolContent, stateDbLineageReport, stateDbCronJobIds, latestCronSessionInfo, stateDbLocalTargetRead, stateDbSessionRow, stateDbSessionMessages, stateDbCompressionLineage, stateDbSessionRead, stateDbSessionTailRead, stateDbSettlementRead };
+/** Exhaustive policy: authority never waits for transcript materialization; sidebar-scoped probes stay on listing. */
+const SESSION_READ_LANES = {
+    stateDbHasSession: 'authority', stateDbSessionHasMessages: 'authority', stateDbLocalTargetRead: 'authority', stateDbSessionRow: 'authority',
+    insightsSessionRows: 'session', countConversationRounds: 'session', stateDbTailToolContent: 'session', stateDbLineageReport: 'session',
+    stateDbCronJobIds: 'session', latestCronSessionInfo: 'session', stateDbSessionMessages: 'session', stateDbCompressionLineage: 'session',
+    stateDbSessionRead: 'session', stateDbSessionTailRead: 'session', stateDbSettlementRead: 'session',
+};
+/**
+ * A `SESSION_READS` reader on its authority or transcript lane, so expensive reads cannot hold up authority. Each reader
+ * already answers a failed read with `fallback`'s value; a worker failure answers it too. Without a state.db the reader
+ * answers here, as it opens nothing then.
+ */
+export async function stateDbSessionReadAsync(fallback, read, ...args) {
+    if (!existsSync(args[0]))
+        return SESSION_READS[read](...args);
+    try {
+        const reply = await callListingWorker({ op: 'session', read, args });
+        return reply.error === undefined ? reply.value : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Test hook: crash one lane, or all when omitted, while its calls are in flight. */
+export function crashStateDbWorkerForTests(lane) {
+    return Promise.all((lane ? [lane] : STATE_DB_WORKER_LANES).map((target) => callListingWorker({ op: 'crash' }, target)));
 }
-/** Stop the listing worker (server shutdown). Calls in flight reject; a later call starts a new worker. */
+/** Stop every worker (server shutdown). Calls in flight reject; later calls start fresh workers. */
 export async function stopStateDbWorker() {
-    const current = listingWorker;
-    if (!current)
+    closeStateDbs();
+    const workers = [...listingWorkers.values()];
+    if (!workers.length)
         return;
     stoppingWorker = true;
     try {
-        retireListingWorker(current, new Error('state.db worker stopped'));
-        await current.worker.terminate();
+        await Promise.all(workers.map(async (current) => {
+            retireListingWorker(current, new Error('state.db worker stopped'));
+            const exited = new Promise((resolve) => { current.worker.once('exit', () => { resolve(); }); });
+            // Idle workers close their cache through process.exit; a blocked read still cannot delay shutdown.
+            const force = setTimeout(() => { void current.worker.terminate(); }, 100);
+            try {
+                current.worker.postMessage({ op: 'stop', id: 0, delayMs: 0 });
+                await exited;
+            }
+            finally {
+                clearTimeout(force);
+            }
+        }));
     }
     finally {
         stoppingWorker = false;
@@ -696,16 +1462,23 @@ export async function stopStateDbWorker() {
 // ── message reader ────────────────────────────────────────────────────────
 const STATE_DB_CONTENT_JSON_PREFIX = '\0json:';
 // `display_kind` / `display_metadata`: the Agent's own tag for rows it writes itself (steers, delivered notifications; TAL-371).
-const OPTIONAL_MESSAGE_COLUMNS = ['tool_call_id', 'tool_calls', 'tool_name', 'reasoning', 'reasoning_details', 'codex_reasoning_items', 'reasoning_content', 'codex_message_items', 'api_content', 'display_kind', 'display_metadata'];
-const JSON_MESSAGE_COLUMNS = new Set(['tool_calls', 'reasoning_details', 'codex_reasoning_items', 'codex_message_items', 'display_metadata']);
+const OPTIONAL_MESSAGE_COLUMNS = ['tool_call_id', 'tool_calls', 'tool_name', 'reasoning', 'reasoning_details', 'codex_reasoning_items', 'reasoning_content', 'codex_message_items', 'api_content', 'display_kind', 'display_metadata', 'absorbed_message_uids', '_compressed_summary'];
+const JSON_MESSAGE_COLUMNS = new Set(['tool_calls', 'reasoning_details', 'codex_reasoning_items', 'codex_message_items', 'display_metadata', 'absorbed_message_uids']);
 /** Python `_decode_state_db_content`: the Agent's sentinel-prefixed structured content, left untouched otherwise. */
 function decodeStateDbContent(value) {
     const text = Buffer.isBuffer(value) ? value.toString('utf8') : value;
     if (typeof text !== 'string' || !text.startsWith(STATE_DB_CONTENT_JSON_PREFIX))
         return text;
     try {
-        const decoded = JSON.parse(text.slice(STATE_DB_CONTENT_JSON_PREFIX.length));
-        return Array.isArray(decoded) ? decoded : text;
+        const payload = text.slice(STATE_DB_CONTENT_JSON_PREFIX.length);
+        let unsafeInteger = false;
+        const decoded = JSON.parse(payload, (_key, value, context) => {
+            if (typeof value === 'number' && !Number.isSafeInteger(value) && /^-?\d+$/.test(context?.source ?? ''))
+                unsafeInteger = true;
+            return value;
+        });
+        // Python keeps arbitrary-precision integers. Retain the JSON text rather than silently rounding any of them.
+        return unsafeInteger ? payload : decoded;
     }
     catch {
         return text;
@@ -721,20 +1494,39 @@ function jsonLoadsIfString(value) {
         return value;
     }
 }
+// Agent v0.22.3's ordinary kept-tail handoff. Only its explicit flag and exact wrapper prove a carrier.
+const PRIOR_CONTEXT_HEADER = '[PRIOR CONTEXT — for reference only; not a new message]';
+const COMPACTION_SUMMARY_DELIMITER = '\n\n[END OF PRIOR CONTEXT — COMPACTION SUMMARY BELOW]\n\n';
+function compactionCarrier(row) {
+    if (row._compressed_summary !== 1 && row._compressed_summary !== true)
+        return null;
+    const content = decodeStateDbContent(row.content);
+    if ((row.role !== 'user' && row.role !== 'assistant') || typeof content !== 'string' || !content.startsWith(`${PRIOR_CONTEXT_HEADER}\n`))
+        return null;
+    const boundary = content.indexOf(COMPACTION_SUMMARY_DELIMITER, PRIOR_CONTEXT_HEADER.length);
+    if (boundary < 0)
+        return null;
+    // Remove only the separators the Agent added; preserve the kept reply's own whitespace.
+    const prior = content.slice(PRIOR_CONTEXT_HEADER.length + 1, boundary);
+    const summary = content.slice(boundary + COMPACTION_SUMMARY_DELIMITER.length).trim();
+    return prior && summary ? { prior, summary } : null;
+}
 /** Python `_project_state_db_message`: one row → WebUI message (`tool_name → name`, empty optionals omitted). */
 function projectStateDbMessage(row, hasId) {
-    const msg = { role: row.role, content: decodeStateDbContent(row.content), timestamp: row.timestamp };
+    const msg = { role: row.role, content: compactionCarrier(row)?.prior ?? decodeStateDbContent(row.content), timestamp: row.timestamp };
     for (const col of OPTIONAL_MESSAGE_COLUMNS) {
-        if (!(col in row))
+        if (col === '_compressed_summary' || !(col in row))
             continue;
         const value = row[col];
         if (value === null || value === undefined || value === '')
             continue;
-        msg[col] = JSON_MESSAGE_COLUMNS.has(col) ? jsonLoadsIfString(value) : value;
+        msg[col === 'absorbed_message_uids' ? '_absorbed_message_uids' : col] = JSON_MESSAGE_COLUMNS.has(col) ? jsonLoadsIfString(value) : value;
     }
     // TAL-493: the merge tells rows committed after the session's last read by this id.
     if (hasId && row.id !== null && row.id !== undefined)
         msg._state_db_row_id = row.id;
+    if (typeof row.message_uid === 'string' && row.message_uid.length)
+        msg._state_db_message_uid = row.message_uid;
     if (msg.role === 'tool' && msg.tool_name && !msg.name)
         msg.name = msg.tool_name;
     return msg;
@@ -753,6 +1545,76 @@ function stateDbGeneration(dbPath) {
         return null;
     }
 }
+// Agent v0.21.6's exact in-flight request wrapper. Unknown rewrites are not copy evidence.
+const INFLIGHT_REPLAY_HEADER = '[STILL IN PROGRESS — this is the active request, restated after the compaction boundary because it was not finished yet. Continue it; do not start over.]';
+/** Compare the kept payload after the Agent's exact request/carrier wrappers and stale api_content are removed. */
+function replayPayload(row) {
+    const message = projectStateDbMessage(row, false);
+    delete message.timestamp;
+    const copyKey = JSON.stringify(message);
+    let content = message.content;
+    let replay = false;
+    if (row.role === 'user') {
+        if (typeof content === 'string') {
+            replay = content.startsWith(`${INFLIGHT_REPLAY_HEADER}\n`);
+            content = (replay ? content.slice(INFLIGHT_REPLAY_HEADER.length + 1) : content).trim();
+        }
+        else if (Array.isArray(content)) {
+            // Multimodal replays prepend a text block and retain all original parts, including media.
+            const parts = content;
+            let start = 0;
+            while (start < parts.length) {
+                const first = parts[start];
+                if (!first || typeof first !== 'object' || Array.isArray(first))
+                    break;
+                const part = first;
+                if (part.type !== 'text' || part.text !== `${INFLIGHT_REPLAY_HEADER}\n` || Object.keys(part).some((k) => k !== 'type' && k !== 'text'))
+                    break;
+                start += 1;
+            }
+            replay = start > 0;
+            content = parts.slice(start);
+        }
+    }
+    message.content = content;
+    delete message.api_content; // _reappend_inflight_user_task drops this stale model-facing sidecar.
+    return { copyKey, replayKey: JSON.stringify(message), replay, carrier: compactionCarrier(row)?.summary ?? null };
+}
+/**
+ * Compare adjacent generations, never all rows of one UID with its oldest archive. The archive retains
+ * authored payload changes even after active/compacted flags change. Only unchanged timestamp copies or
+ * exact request restatements inherit identity; edits (including A -> B -> A) start at their own row ID.
+ */
+function replayIdentities(db, chain, rows, available) {
+    const identities = new Map();
+    // Tool-result text can be pruned without changing its tool-call identity; retain the existing rule.
+    const uids = [...new Set(rows.filter((row) => row.role !== 'tool').map((row) => row.message_uid).filter((uid) => typeof uid === 'string' && uid.length > 0))];
+    if (!uids.length)
+        return identities;
+    const liveIds = new Set(rows.map((row) => row.id));
+    const previous = new Map();
+    const columns = ['id', 'message_uid', 'active', 'compacted', 'role', 'content', 'timestamp', ...OPTIONAL_MESSAGE_COLUMNS.filter((c) => available.has(c))];
+    // One ordered scan of the selected sessions, filtering against a materialized UID set. Stream the rows;
+    // memory holds only the preceding payload per live UID, not the accumulated archive. NULL/nonstandard
+    // active flags take exactly the same path and do not depend on the Agent's partial active=1 UID index.
+    const history = db.prepare(`SELECT ${columns.join(', ')} FROM messages WHERE session_id IN (${chain.map(() => '?').join(', ')}) AND message_uid IN (SELECT value FROM json_each(?)) ORDER BY id`);
+    for (const row of history.iterate(...chain, JSON.stringify(uids))) {
+        const uid = row.message_uid;
+        const payload = replayPayload(row);
+        const prior = previous.get(uid);
+        const copy = payload.copyKey === prior?.copyKey && row.timestamp === prior.timestamp;
+        const restatement = payload.replayKey === prior?.replayKey && ((payload.replay && (prior.active !== 0 || prior.compacted === 1)) ||
+            (payload.carrier && row.timestamp === prior.timestamp));
+        const identity = prior && (copy || restatement) ? prior.identity : Number(row.id);
+        const changed = prior ? (copy || restatement ? prior.changed : true) : false;
+        const sourceKey = prior && (copy || restatement) ? prior.sourceKey : stateDbMessageFingerprint(projectStateDbMessage(row, false));
+        const summaryId = payload.carrier && payload.carrier === prior?.carrier && row.timestamp === prior.timestamp ? prior.summaryId : Number(row.id);
+        if (prior && row.role !== 'tool' && liveIds.has(row.id))
+            identities.set(Number(row.id), { id: identity, changed, sourceKey, summaryId });
+        previous.set(uid, { ...payload, identity, changed, sourceKey, summaryId, timestamp: row.timestamp, active: row.active, compacted: row.compacted });
+    }
+    return identities;
+}
 export function stateDbSessionMessages(dbPath, sid, opts = {}) {
     return stateDbSessionRead(dbPath, sid, opts).rows;
 }
@@ -761,7 +1623,24 @@ export function stateDbSessionMessages(dbPath, sid, opts = {}) {
  * (TAL-493: an empty id-capable read is a baseline of 0; a missing database or a failed read says nothing).
  */
 export function stateDbSessionRead(dbPath, sid, opts = {}) {
-    const none = { rows: [], idCapable: false, ok: false };
+    return readStateDbSession(dbPath, sid, opts);
+}
+/**
+ * A settlement's reads in one request: the transcript under `recorded` (the session's `state_db_lineage`), the lineage
+ * the Agent's compression rotations give it now, and, when that differs from `recorded`, the transcript under it.
+ */
+export function stateDbSettlementRead(dbPath, sid, recorded) {
+    const read = stateDbSessionRead(dbPath, sid, { stitch: false, lineage: recorded?.[0] === sid ? recorded : null });
+    const lineage = stateDbCompressionLineage(dbPath, sid);
+    const moved = JSON.stringify(lineage) !== JSON.stringify(recorded ?? [sid]);
+    return { ...read, lineage, rotated: moved ? stateDbSessionRead(dbPath, sid, { stitch: false, lineage: lineage.length > 1 && lineage[0] === sid ? lineage : null }) : null };
+}
+/** The same snapshot and provenance projection, restricted to physical rows past the seen marker. */
+export function stateDbSessionTailRead(dbPath, sid, afterId, opts = {}) {
+    return readStateDbSession(dbPath, sid, { ...opts, stitch: false, afterId });
+}
+function readStateDbSession(dbPath, sid, opts) {
+    const none = { rows: [], idCapable: false, ok: false, reason: null, generation: null };
     const id = sid.trim();
     if (!id || !existsSync(dbPath))
         return none;
@@ -769,24 +1648,26 @@ export function stateDbSessionRead(dbPath, sid, opts = {}) {
     try {
         db = openStateDbReadonly(dbPath);
     }
-    catch {
-        return none;
+    catch (error) {
+        return { ...none, reason: stateDbReadFailure(error).reason };
     }
     try {
         const available = tableColumns(db, 'messages');
         if (!['role', 'content', 'timestamp'].every((c) => available.has(c)))
             return { ...none, ok: available.size > 0 };
         const hasId = available.has('id');
-        const selected = [...(hasId ? ['id'] : []), 'role', 'content', 'timestamp', ...OPTIONAL_MESSAGE_COLUMNS.filter((c) => available.has(c))];
+        const selected = [...(hasId ? ['id'] : []), ...(available.has('message_uid') ? ['message_uid'] : []), 'role', 'content', 'timestamp', ...OPTIONAL_MESSAGE_COLUMNS.filter((c) => available.has(c))];
         // TAL-529: an explicit lineage (the session and its compression continuations) replaces the parent walk.
-        const chain = opts.lineage?.length ? [...opts.lineage] : [id];
-        if (!opts.lineage?.length && (opts.stitch ?? true)) {
+        const local = localLineages(db, id).get(id);
+        const chain = local ? (opts.stitch === false ? [local.ids.at(-1) ?? id] : [...local.context]) : opts.lineage?.length ? [...opts.lineage] : [id];
+        if (!local && !opts.lineage?.length && (opts.stitch ?? true)) {
             const sessionCols = tableColumns(db, 'sessions');
             if (['parent_session_id', 'end_reason', 'started_at', 'source'].every((c) => sessionCols.has(c))) {
-                const select = db.prepare('SELECT id, source, started_at, parent_session_id, ended_at, end_reason FROM sessions WHERE id = ?');
+                const extra = ['model_config', 'session_source'].map((c) => sessionCols.has(c) ? c : `NULL AS ${c}`).join(', ');
+                const select = db.prepare(`SELECT id, source, started_at, parent_session_id, ended_at, end_reason, ${extra} FROM sessions WHERE id = ?`);
                 let current = select.get(id);
                 const seen = new Set([id]);
-                for (let hop = 0; hop < 20 && current; hop += 1) {
+                for (let hop = 0; hop < COMPRESSION_CHAIN_CAP && current; hop += 1) {
                     const parentId = str(current.parent_session_id);
                     if (!parentId || seen.has(parentId))
                         break;
@@ -800,9 +1681,13 @@ export function stateDbSessionRead(dbPath, sid, opts = {}) {
             }
         }
         const activeClause = available.has('active') ? ' AND (active IS NULL OR active != 0)' : '';
+        if (opts.afterId !== undefined && !hasId)
+            return { ...none, ok: true };
+        const range = opts.afterId === undefined ? '' : ' AND id > ?';
+        const rangeArgs = opts.afterId === undefined ? [] : [opts.afterId];
         const order = hasId ? 'id' : 'timestamp';
-        const rows = db.prepare(`SELECT ${selected.join(', ')}, session_id FROM messages WHERE session_id IN (${chain.map(() => '?').join(', ')})${activeClause} ORDER BY ${order} ASC`).all(...chain);
-        const projected = rows.map((row) => projectStateDbMessage(row, hasId));
+        const rows = db.prepare(`SELECT ${selected.join(', ')}, session_id FROM messages WHERE session_id IN (${chain.map(() => '?').join(', ')})${activeClause}${range} ORDER BY ${order} ASC`).all(...chain, ...rangeArgs);
+        let projected = rows.map((row) => projectStateDbMessage(row, hasId));
         // TAL-709: an in-place compaction archives the live rows and re-inserts each as a copy that keeps its role and timestamp
         // (content may be pruned). A copy takes the id of the oldest archived row it copies, so the merge sees a row it has
         // already read instead of a new one. Only a compaction archive (`compacted = 1`) vouches for a changed copy: a rewound
@@ -813,7 +1698,7 @@ export function stateDbSessionRead(dbPath, sid, opts = {}) {
             // compactions it holds.
             const sameCall = available.has('tool_call_id') ? " AND COALESCE(a.tool_call_id, '') = COALESCE(m.tool_call_id, '')" : '';
             const vouched = [available.has('compacted') ? 'a.compacted = 1' : '', available.has('tool_call_id') ? 'm.tool_call_id IS NOT NULL' : '', 'a.content = m.content'].filter(Boolean).join(' OR ');
-            const twins = db.prepare(`SELECT m.id AS id, MIN(a.id) AS twin FROM messages m JOIN messages a ON a.session_id = m.session_id AND a.active = 0 AND a.role = m.role AND a.timestamp = m.timestamp AND a.id < m.id${sameCall} WHERE m.session_id IN (${chain.map(() => '?').join(', ')}) AND (m.active IS NULL OR m.active != 0) AND (${vouched}) GROUP BY m.id`).all(...chain);
+            const twins = db.prepare(`SELECT m.id AS id, MIN(a.id) AS twin FROM messages m JOIN messages a ON a.session_id = m.session_id AND a.active = 0 AND a.role = m.role AND a.timestamp = m.timestamp AND a.id < m.id${sameCall} WHERE m.session_id IN (${chain.map(() => '?').join(', ')}) AND (m.active IS NULL OR m.active != 0) AND (${vouched})${opts.afterId === undefined ? '' : ' AND m.id > ?'} GROUP BY m.id`).all(...chain, ...rangeArgs);
             const twinOf = new Map(twins.map((row) => [row.id, row.twin]));
             for (const [i, row] of rows.entries()) {
                 const twin = twinOf.get(row.id);
@@ -821,25 +1706,66 @@ export function stateDbSessionRead(dbPath, sid, opts = {}) {
                     projected[i]._state_db_row_id = twin;
             }
         }
+        let identities;
+        if (hasId && ['message_uid', 'active', 'compacted'].every((c) => available.has(c))) {
+            identities = replayIdentities(db, local?.context ?? chain, rows, available);
+            for (const [i, row] of rows.entries()) {
+                const identity = identities.get(Number(row.id));
+                // A known changed generation overrides even a coincidental legacy timestamp twin.
+                if (identity !== undefined) {
+                    projected[i]._state_db_row_id = identity.id;
+                    if (identity.id !== row.id)
+                        projected[i]._state_db_source_key = identity.sourceKey;
+                    if (identity.changed)
+                        projected[i]._state_db_authored_change = true;
+                }
+            }
+        }
+        // The kept reply and summary have independent archive identities; neither can consume the other's copy.
+        const withCarrierSummary = (row, message) => {
+            const carrier = compactionCarrier(row);
+            return carrier ? [message, { role: 'assistant', content: carrier.summary, timestamp: row.timestamp,
+                    _context_compression_marker: true, ...(hasId ? { _state_db_row_id: identities?.get(Number(row.id))?.summaryId ?? row.id } : {}) }] : [message];
+        };
+        projected = rows.flatMap((row, i) => withCarrierSummary(row, projected[i]));
         // TAL-493: the database file's identity, so a marker taken in a replaced state.db is never applied to its successor.
+        const generation = stateDbGeneration(dbPath);
         if (hasId) {
-            const generation = stateDbGeneration(dbPath);
             for (const m of projected)
                 m._state_db_generation = generation;
         }
-        return { rows: projected, idCapable: hasId, ok: true };
+        let anchor;
+        if (opts.afterId !== undefined) {
+            anchor = projected.find((m) => m._state_db_row_id === opts.afterId);
+            if (!anchor) {
+                const row = db.prepare(`SELECT ${selected.join(', ')}, session_id FROM messages WHERE session_id IN (${chain.map(() => '?').join(', ')}) AND id = ?${activeClause} LIMIT 1`).get(...chain, opts.afterId);
+                if (row)
+                    anchor = { ...withCarrierSummary(row, projectStateDbMessage(row, true)).at(-1), _state_db_generation: generation };
+            }
+        }
+        let requiresFullRead = false;
+        if (opts.afterId !== undefined && opts.unidentified) {
+            const matches = projected.filter((m) => opts.unidentified.some((keys) => keys.has(stateDbMessageKey(m))));
+            if (matches.length) {
+                // Projection can normalize content/timestamps. A bounded role-key superset is conservative copy detection.
+                const roles = [...new Set(matches.map((m) => m.role))];
+                const covered = db.prepare(`SELECT 1 FROM messages WHERE session_id IN (${chain.map(() => '?').join(', ')}) AND id <= ? AND role IN (SELECT value FROM json_each(?))${activeClause} LIMIT 1`).get(...chain, opts.afterId, JSON.stringify(roles));
+                requiresFullRead = Boolean(covered) || available.has('message_uid');
+            }
+        }
+        return { rows: projected, idCapable: hasId, ok: true, reason: null, generation, requiresFullRead, ...(anchor ? { anchor } : {}) };
     }
-    catch {
-        return none;
+    catch (error) {
+        return { ...none, reason: stateDbReadFailure(error).reason };
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /**
  * TAL-529: `sid` and each compression continuation the Agent rotated it to, down to the live tip (Python
- * `resolve_live_compression_tip`). The walk stops at the last unambiguous row: no continuation, several, a cycle, or 20
- * hops. A missing or unreadable database is `[sid]`.
+ * `resolve_live_compression_tip`). The walk stops at the last unambiguous row: no continuation, several, a cycle, or
+ * `COMPRESSION_CHAIN_CAP` hops. A missing or unreadable database is `[sid]`.
  */
 export function stateDbCompressionLineage(dbPath, sid) {
     const lineage = [sid.trim()];
@@ -853,14 +1779,18 @@ export function stateDbCompressionLineage(dbPath, sid) {
         return lineage;
     }
     try {
+        const local = localLineages(db, lineage[0]).get(lineage[0]);
+        if (local)
+            return [...local.ids];
         const sessionCols = tableColumns(db, 'sessions');
         if (!['id', 'parent_session_id', 'end_reason', 'ended_at', 'started_at', 'source'].every((c) => sessionCols.has(c)))
             return lineage;
         const sessionSource = sessionCols.has('session_source') ? 'session_source' : 'NULL AS session_source';
-        const cols = `id, source, ${sessionSource}, started_at, parent_session_id, ended_at, end_reason`;
+        const modelConfig = sessionCols.has('model_config') ? 'model_config' : 'NULL AS model_config';
+        const cols = `id, source, ${sessionSource}, started_at, parent_session_id, ended_at, end_reason, ${modelConfig}`;
         let current = db.prepare(`SELECT ${cols} FROM sessions WHERE id = ?`).get(lineage[0]);
         const children = db.prepare(`SELECT ${cols} FROM sessions WHERE parent_session_id = ?`);
-        for (let hop = 0; hop < 20 && current; hop += 1) {
+        for (let hop = 0; hop < COMPRESSION_CHAIN_CAP && current; hop += 1) {
             const parent = current;
             const next = children.all(str(parent.id)).filter((child) => isContinuationSession(parent, child));
             if (next.length !== 1 || lineage.includes(str(next[0].id)))
@@ -874,7 +1804,7 @@ export function stateDbCompressionLineage(dbPath, sid) {
         return lineage.slice(0, 1);
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 function lineageReportRow(row, role) {
@@ -884,7 +1814,7 @@ function lineageReportRow(row, role) {
         end_reason: row.end_reason ?? null, active: ended === null, archived: false,
     };
 }
-const emptyLineageReport = (sid) => ({
+export const emptyLineageReport = (sid) => ({
     mutation: false, found: false, session_id: sid, lineage_key: sid, tip_session_id: sid, total_segments: 0, materialized_segments: 0, segments: [], children: [], manual_review: false,
 });
 /**
@@ -893,7 +1823,7 @@ const emptyLineageReport = (sid) => ({
  * newest first. A cycle, a hop limit hit, or a continuation off the walked path marks `manual_review`. A missing,
  * unreadable, or too-old database, or an unknown id, answers `found: false`.
  */
-export function stateDbLineageReport(dbPath, rawSid, maxHops = 20) {
+export function stateDbLineageReport(dbPath, rawSid, maxHops = COMPRESSION_CHAIN_CAP) {
     const sid = rawSid.trim();
     if (!sid || !existsSync(dbPath))
         return emptyLineageReport(sid);
@@ -905,6 +1835,7 @@ export function stateDbLineageReport(dbPath, rawSid, maxHops = 20) {
         return emptyLineageReport(sid);
     }
     try {
+        const local = localLineages(db, sid).get(sid);
         const cols = tableColumns(db, 'sessions');
         if (!['id', 'parent_session_id', 'end_reason'].every((c) => cols.has(c)))
             return emptyLineageReport(sid);
@@ -915,10 +1846,10 @@ export function stateDbLineageReport(dbPath, rawSid, maxHops = 20) {
         const target = fetch(sid);
         if (!target)
             return emptyLineageReport(sid);
-        const segments = [target];
-        const seen = new Set([sid]);
-        let manualReview = true;
-        for (let hop = 0; hop < maxHops; hop += 1) {
+        const segments = local ? [...local.rows].reverse().slice(0, Math.max(1, maxHops)) : [target];
+        const seen = new Set(segments.map((row) => str(row.id)));
+        let manualReview = local ? local.ids.length > maxHops : true;
+        for (let hop = 0; !local && hop < maxHops; hop += 1) {
             const current = segments[segments.length - 1];
             const parentId = str(current.parent_session_id);
             const parent = fetch(parentId);
@@ -959,7 +1890,7 @@ export function stateDbLineageReport(dbPath, rawSid, maxHops = 20) {
         return emptyLineageReport(sid);
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /** The `sessions` row for `sid` (source and lifecycle columns), or null. */
@@ -985,7 +1916,7 @@ export function stateDbSessionRow(dbPath, sid) {
         return null;
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /**
@@ -1011,21 +1942,31 @@ export function insightsSessionRows(dbPath, cutoff) {
         const col = (name) => (cols.has(name) ? `s.${name}` : 'NULL');
         const messageCols = tableColumns(db, 'messages');
         const hasMessages = messageCols.has('session_id') && messageCols.has('timestamp');
-        let indexed = false;
-        try {
-            indexed = hasMessages && db.prepare('PRAGMA index_list(messages)').all().some((r) => r.name === 'idx_messages_session');
-        }
-        catch {
-            indexed = false;
-        }
+        const indexed = hasMessages && tableIndexes(db, 'messages').has('idx_messages_session');
         // Without the index a per-session lookup scans messages once per session; one grouped scan replaces it.
-        const lastMessage = !hasMessages ? 'NULL' : indexed ? '(SELECT MAX(m.timestamp) FROM messages m WHERE m.session_id = s.id)' : 'lm.last_message_at';
-        const join = hasMessages && !indexed ? 'LEFT JOIN (SELECT session_id, MAX(timestamp) AS last_message_at FROM messages GROUP BY session_id) lm ON lm.session_id = s.id' : '';
+        const lastMessage = !hasMessages ? 'NULL' : indexed ? lastMessageTimestamp(indexed) : 'lm.last_message_at';
+        const messageCte = hasMessages && !indexed ? 'latest_messages AS MATERIALIZED (SELECT session_id, MAX(timestamp) AS last_message_at FROM messages GROUP BY session_id)' : '';
+        const join = messageCte ? 'LEFT JOIN latest_messages lm ON lm.session_id = s.id' : '';
         const source = cols.has('source') ? "LOWER(COALESCE(s.source, '')) != 'webui'" : '1';
-        const rows = db.prepare(`SELECT * FROM (SELECT s.id AS id, ${col('model')} AS model, ${col('message_count')} AS message_count, ${col('input_tokens')} AS input_tokens,
+        const activityIndexed = cols.has('last_activity_at') && tableIndexes(db, 'sessions').has('idx_sessions_effective_activity');
+        const activity = activityIndexed ? freshestActivity('s.last_activity_at', `MAX(COALESCE(${col('ended_at')}, 0), COALESCE(${lastMessage}, 0))`)
+            : `MAX(COALESCE(s.started_at, 0), COALESCE(${col('ended_at')}, 0), COALESCE(${lastMessage}, 0))`;
+        // The heartbeat can lag a message or end time; union their candidates before the exact activity check.
+        const candidates = activityIndexed ? [
+            'SELECT s.id FROM sessions s INDEXED BY idx_sessions_effective_activity WHERE COALESCE(s.last_activity_at, s.started_at) >= ?',
+            'SELECT id FROM sessions WHERE started_at >= ?',
+            ...(cols.has('ended_at') ? ['SELECT id FROM sessions WHERE ended_at >= ?'] : []),
+            ...(hasMessages ? [indexed ? 'SELECT DISTINCT session_id AS id FROM messages WHERE timestamp >= ?' : 'SELECT session_id AS id FROM latest_messages WHERE last_message_at >= ?'] : []),
+        ] : [];
+        const ctes = [messageCte, ...(activityIndexed ? [`candidates AS MATERIALIZED (SELECT DISTINCT id FROM (${candidates.join(' UNION ALL ')}))`] : [])].filter(Boolean);
+        const withClause = ctes.length ? `WITH ${ctes.join(', ')} ` : '';
+        // CROSS JOIN keeps the candidate IDs ahead of the expensive per-session freshness projection.
+        const from = activityIndexed ? 'candidates c CROSS JOIN sessions s ON s.id = c.id' : 'sessions s';
+        const ordering = activityIndexed ? ' ORDER BY COALESCE(s.last_activity_at, s.started_at) DESC' : '';
+        const rows = db.prepare(`${withClause}SELECT * FROM (SELECT s.id AS id, ${col('model')} AS model, ${col('message_count')} AS message_count, ${col('input_tokens')} AS input_tokens,
       ${col('output_tokens')} AS output_tokens, ${col('cache_read_tokens')} AS cache_read_tokens, ${col('estimated_cost_usd')} AS estimated_cost_usd, s.started_at AS started_at,
-      MAX(COALESCE(s.started_at, 0), COALESCE(${col('ended_at')}, 0), COALESCE(${lastMessage}, 0)) AS last_activity
-      FROM sessions s ${join} WHERE ${source}) WHERE last_activity >= ?`).all(cutoff);
+      ${activity} AS last_activity
+      FROM ${from} ${join} WHERE ${source}${ordering}) WHERE last_activity >= ?`).all(...Array(candidates.length + 1).fill(cutoff));
         return rows.map((r) => ({
             session_id: str(r.id), model: r.model, message_count: r.message_count, input_tokens: r.input_tokens, output_tokens: r.output_tokens,
             cache_read_tokens: r.cache_read_tokens, estimated_cost: r.estimated_cost_usd, created_at: r.started_at, updated_at: r.last_activity,
@@ -1035,7 +1976,7 @@ export function insightsSessionRows(dbPath, cutoff) {
         return [];
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /** A state.db `timestamp` in unix seconds: a number, or an ISO-8601 string (Python `fromisoformat`); null when unreadable. */
@@ -1064,7 +2005,7 @@ export function countConversationRounds(dbPath, sid, since = null) {
             rows = db.prepare('SELECT role, timestamp FROM messages WHERE session_id = ? ORDER BY timestamp ASC').all(sid);
         }
         finally {
-            db.close();
+            finishStateDbRead(db);
         }
     }
     catch {
@@ -1105,7 +2046,7 @@ export function stateDbTailToolContent(dbPath, sid) {
             return typeof content === 'string' ? content : null;
         }
         finally {
-            db.close();
+            finishStateDbRead(db);
         }
     }
     catch {