@maudecode/talaria-web 1.19.0 → 1.21.0

package/dist/sessions/state-db.js

@@ -2,13 +2,15 @@
  * Read-only projection of the Agent's `state.db` (Python `api/agent_sessions.py`):
  * importable agent session rows with compression-chain collapse, CLI visibility
  * rules, the O(1) change fingerprint used by the gateway watcher, and existence
- * probes. Uses `node:sqlite`; every read opens a short-lived read-only handle
- * with a bounded busy timeout, and no path here ever writes to the database.
+ * probes. Uses cached read-only `node:sqlite` handles with a bounded busy timeout
+ * and a fresh snapshot per read; no path here ever writes to the database.
  */
 import { existsSync, openSync, readSync, closeSync, statSync } from 'node:fs';
 import { DatabaseSync } from 'node:sqlite';
 import { createHash } from 'node:crypto';
 import { Worker } from 'node:worker_threads';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { startupTimingScope } from '../startup-timing.js';
 import { str } from '../util.js';
 import { stateDbMessageFingerprint, stateDbMessageKey } from './state-db-identity.js';
 import { MESSAGING_SOURCES } from './source-kind.js';
@@ -118,6 +120,8 @@ export function isCliSessionRowVisible(row) {
 // ── compression-chain projection ─────────────────────────────────────────
 /** The Agent's `_CHAIN_CAP`: the most hops a walk along a compression lineage takes. Its visited check stops a cycle sooner. */
 const COMPRESSION_CHAIN_CAP = 1000;
+/** The most ids the Agent's `_resume_lineage_ids` returns, a tighter defensive bound than `_CHAIN_CAP`. */
+const RESUME_LINEAGE_CAP = 100;
 function isContinuationSession(parent, child) {
     if (!parent || !child)
         return false;
@@ -138,6 +142,37 @@ function isContinuationSession(parent, child) {
     const ended = Number.parseFloat(str(endedAt));
     return Number.isFinite(started) && Number.isFinite(ended) && started + 1.0 >= ended;
 }
+/**
+ * `ids` plus every session a compression continuation (`isContinuationSession`) joins to one of them, up and down, at
+ * most `COMPRESSION_CHAIN_CAP` in all: the rows `projectAgentSessionRows` needs to collapse their chains as the sidebar
+ * listing does. Forks and other children are never followed, so they cannot crowd a continuation out of the cap.
+ */
+function compressionChainIds(db, cols, ids) {
+    if (!['parent_session_id', 'end_reason'].every((c) => cols.has(c)))
+        return ids;
+    const fields = ['id', 'source', 'session_source', 'model_config', 'started_at', 'parent_session_id', 'end_reason', 'ended_at'].map((c) => cols.has(c) ? c : `NULL AS ${c}`).join(', ');
+    const row = db.prepare(`SELECT ${fields} FROM sessions WHERE id = ?`);
+    const children = db.prepare(`SELECT ${fields} FROM sessions WHERE parent_session_id = ?`);
+    const seen = new Set(ids);
+    const pending = [...ids];
+    const visit = (next) => { if (next && !seen.has(next) && seen.size < COMPRESSION_CHAIN_CAP) {
+        seen.add(next);
+        pending.push(next);
+    } };
+    while (pending.length) {
+        const current = row.get(pending.pop());
+        if (!current)
+            continue;
+        const parentId = str(current.parent_session_id);
+        if (parentId && isContinuationSession(row.get(parentId), current))
+            visit(parentId);
+        if (['compression', 'cli_close'].includes(str(current.end_reason)))
+            for (const child of children.all(str(current.id)))
+                if (isContinuationSession(current, child))
+                    visit(str(child.id));
+    }
+    return [...seen];
+}
 function continuationRootId(rowsById, sessionId) {
     if (!sessionId)
         return null;
@@ -159,7 +194,7 @@ function continuationRootId(rowsById, sessionId) {
     return rootId;
 }
 /** Python `_project_agent_session_rows`: collapse compression chains into one sidebar row pointing at the freshest importable tip. */
-export function projectAgentSessionRows(rows) {
+export function projectAgentSessionRows(rows, keepEmpty = false) {
     const rowsById = new Map(rows.map((r) => [str(r.id), r]));
     const childrenByParent = new Map();
     const continuationChildIds = new Set();
@@ -225,8 +260,12 @@ export function projectAgentSessionRows(rows) {
         let tip = row;
         if (['compression', 'cli_close'].includes(str(row.end_reason)))
             [tip, segments] = compressionTip(row);
-        if (!tip || positiveInt(tip.actual_message_count) <= 0)
+        // `keepEmpty` (a direct lookup of receipt-proven Web diagnostic chats, TAL-1040) keeps a turnless plain row.
+        if (!tip || positiveInt(tip.actual_message_count) <= 0) {
+            if (keepEmpty && tip === row)
+                projected.push({ ...row });
             continue;
+        }
         if (tip === row) {
             projected.push({ ...row });
             continue;
@@ -255,17 +294,96 @@ export function projectAgentSessionRows(rows) {
     projected.sort((a, b) => score(b.last_activity, b.started_at) - score(a.last_activity, a.started_at));
     return projected;
 }
-// ── sqlite access ─────────────────────────────────────────────────────────
-/** Python `open_state_db_readonly`: read-only URI open with a bounded busy timeout; the caller closes it. */
-export function openStateDbReadonly(dbPath, busyTimeoutMs = STATE_DB_BUSY_TIMEOUT_MS) {
-    if (!existsSync(dbPath))
-        throw new Error(`agent state.db not found: ${dbPath}`);
-    const db = new DatabaseSync(dbPath, { readOnly: true, timeout: busyTimeoutMs });
-    return db;
+/** Bound descriptors and page caches even when deleted profiles are never read again. */
+const STATE_DB_HANDLE_CACHE_MAX = 16;
+const readonlyStateDbs = new Map();
+const schemaCaches = new WeakMap();
+/** Cache ownership ends at shutdown; worker termination also disposes its native SQLite resources. */
+function closeStateDbs(paths = readonlyStateDbs.keys()) {
+    for (const path of paths) {
+        const cached = readonlyStateDbs.get(path);
+        if (cached?.db.isOpen)
+            cached.db.close();
+        readonlyStateDbs.delete(path);
+    }
+}
+process.once('exit', () => { closeStateDbs(); });
+/** One handle per file identity. The caller ends the read snapshot in finally, leaving closure to the cache. */
+function openStateDbReadonly(dbPath, busyTimeoutMs = STATE_DB_BUSY_TIMEOUT_MS) {
+    const { ino, dev, mtimeNs } = statSync(dbPath, { bigint: true });
+    let cached = readonlyStateDbs.get(dbPath);
+    // Raw writes need not advance SQLite's change counter; revalidate the main file after any such change.
+    if (cached && (cached.ino !== ino || cached.dev !== dev || cached.mtimeNs !== mtimeNs || !cached.db.isOpen)) {
+        closeStateDbs([dbPath]);
+        cached = undefined;
+    }
+    if (!cached) {
+        if (readonlyStateDbs.size >= STATE_DB_HANDLE_CACHE_MAX)
+            closeStateDbs([readonlyStateDbs.keys().next().value]);
+        const db = new DatabaseSync(dbPath, { readOnly: true, timeout: busyTimeoutMs });
+        cached = { db, ino, dev, mtimeNs, schemaVersion: null, columns: new Map(), indexes: new Map() };
+        schemaCaches.set(db, cached);
+    }
+    readonlyStateDbs.delete(dbPath);
+    readonlyStateDbs.set(dbPath, cached);
+    const { db } = cached;
+    try {
+        db.exec(`PRAGMA busy_timeout = ${Math.max(0, Math.trunc(busyTimeoutMs))}`);
+        // The schema cookie and all probes/queries must describe the same committed snapshot.
+        db.exec('BEGIN');
+        const version = db.prepare('PRAGMA schema_version').get().schema_version;
+        if (cached.schemaVersion !== version) {
+            cached.columns.clear();
+            cached.indexes.clear();
+            cached.schemaVersion = version;
+        }
+        return db;
+    }
+    catch (error) {
+        closeStateDbs([dbPath]);
+        throw error;
+    }
 }
-/** The table's columns; a failed read throws, so an unreadable database is never mistaken for an older schema (TAL-785). */
+function finishStateDbRead(db) {
+    try {
+        db.exec('COMMIT');
+    }
+    catch {
+        // A failed read can poison COMMIT too; discard the handle without hiding the reader's failure result.
+        db.close();
+    }
+}
+/** A failed probe throws, so unreadable storage is never mistaken for an older schema (TAL-785). */
 function tableColumns(db, table) {
-    return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((r) => r.name));
+    const cache = schemaCaches.get(db).columns;
+    let columns = cache.get(table);
+    if (!columns) {
+        columns = new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((r) => r.name));
+        cache.set(table, columns);
+    }
+    return columns;
+}
+function tableIndexes(db, table) {
+    const cache = schemaCaches.get(db).indexes;
+    const indexes = cache.get(table);
+    if (indexes)
+        return indexes;
+    try {
+        const found = new Set(db.prepare(`PRAGMA index_list(${table})`).all().map((r) => r.name));
+        cache.set(table, found);
+        return found;
+    }
+    catch {
+        return new Set();
+    }
+}
+/** Agent `_sql_freshest_of`: the `last_activity_at` heartbeat can lag a newer message, so it never ranks alone. */
+function freshestActivity(lastActivityAt, lastMessage) {
+    return `MAX(COALESCE(${lastActivityAt}, 0), COALESCE(${lastMessage}, 0), COALESCE(s.started_at, 0))`;
+}
+/** Stale Agent statistics can favor a non-covering index and read every message row. */
+function lastMessageTimestamp(indexed, alias = 'm') {
+    return `(SELECT MAX(${alias}.timestamp) FROM messages ${alias}${indexed ? ' INDEXED BY idx_messages_session' : ''} WHERE ${alias}.session_id = s.id)`;
 }
 const LOCAL_POLICY_PREFIX = 'gateway.local_policy.v1:';
 /** Read-only equivalent of Agent validate_local_lineage. A receipt, never a reset edge alone, proves ownership. */
@@ -279,8 +397,8 @@ function localLineages(db, sid) {
     const meta = db.prepare('SELECT value FROM state_meta WHERE key = ?');
     const fetch = db.prepare('SELECT * FROM sessions WHERE id IN (SELECT value FROM json_each(?))');
     const messageCols = tableColumns(db, 'messages');
-    const lastMessage = ['session_id', 'timestamp'].every((c) => messageCols.has(c)) ? '(SELECT MAX(m.timestamp) FROM messages m WHERE m.session_id = s.id)' : 'NULL';
-    const activity = `MAX(COALESCE(${cols.has('last_activity_at') ? 's.last_activity_at' : 'NULL'}, 0), COALESCE(${lastMessage}, 0), COALESCE(s.started_at, 0))`;
+    const lastMessage = ['session_id', 'timestamp'].every((c) => messageCols.has(c)) ? lastMessageTimestamp(tableIndexes(db, 'messages').has('idx_messages_session')) : 'NULL';
+    const activity = freshestActivity(cols.has('last_activity_at') ? 's.last_activity_at' : 'NULL', lastMessage);
     // Agent _CHAIN_STEP_SQL prefers a compression child, then a live child, then recency and id.
     const children = db.prepare(`SELECT s.* FROM sessions s WHERE s.parent_session_id = ? ORDER BY CASE WHEN s.end_reason = 'compression' THEN 0 WHEN s.ended_at IS NULL THEN 1 ELSE 2 END, ${activity} DESC, s.started_at DESC, s.id DESC`);
     const explicitChild = (child, includeReset) => {
@@ -373,7 +491,6 @@ export function stateDbLocalTarget(dbPath, sid, opts = {}) {
         return sid;
     }
     try {
-        db.exec('BEGIN');
         const target = localLineages(db, sid).get(sid)?.ids.at(-1) ?? sid;
         opts.onRead?.(target);
         return target;
@@ -382,9 +499,15 @@ export function stateDbLocalTarget(dbPath, sid, opts = {}) {
         return sid;
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
+/** `stateDbLocalTarget` plus whether state.db answered (a missing one does), so only a real answer seeds a routing cache. */
+function stateDbLocalTargetRead(dbPath, sid) {
+    let read = false;
+    const target = stateDbLocalTarget(dbPath, sid, { onRead: () => { read = true; } });
+    return { target, read };
+}
 export const AGENT_STORAGE_OK = Object.freeze({ state: 'ok', reason: null });
 /**
  * The corrupt-storage reason when `error` is SQLite's `SQLITE_CORRUPT` or `SQLITE_NOTADB` (the Agent's
@@ -404,6 +527,9 @@ export function stateDbReadFailure(error) {
         return { state: 'corrupt', reason: corrupt };
     return { state: 'unavailable', reason: `Agent session storage (state.db) could not be read: ${error instanceof Error ? error.message : String(error)}.` };
 }
+function outdatedStateDbStorage() {
+    return { state: 'outdated', reason: "state.db has no 'source' column (older hermes-agent?). Agent sessions unavailable. Upgrade hermes-agent to fix this." };
+}
 /**
  * TAL-785: whether `state.db` can serve the session list: `corrupt` when SQLite reports the file damaged, `unavailable`
  * when it cannot be read for another reason (permissions, a lock, an I/O error), `outdated` when a readable database
@@ -417,10 +543,10 @@ export function stateDbStorage(dbPath) {
         const db = openStateDbReadonly(dbPath);
         try {
             if (!tableColumns(db, 'sessions').has('source'))
-                return { state: 'outdated', reason: `state.db has no 'source' column (older hermes-agent?). Agent sessions unavailable. Upgrade hermes-agent to fix this.` };
+                return outdatedStateDbStorage();
         }
         finally {
-            db.close();
+            finishStateDbRead(db);
         }
     }
     catch (error) {
@@ -441,45 +567,42 @@ export function setStateDbReadDelayForTests(ms) { readDelayMs = ms; }
  * `idx_messages_session` exactly as Python does when its heal fails.
  */
 export function readImportableAgentSessionRows(dbPath, opts = {}) {
+    const result = readImportableAgentSessionRowBatches(dbPath, [opts]).rows[0];
+    if (result instanceof Error)
+        throw result;
+    return result;
+}
+/** All listing windows share one read snapshot, schema, validated local lineages and ownership lookup. */
+export function readImportableAgentSessionRowBatches(dbPath, queries) {
     if (!existsSync(dbPath))
-        return [];
-    const limit = opts.limit === undefined ? 200 : opts.limit;
-    const exclude = opts.excludeSources === undefined ? ['cron', 'webui'] : opts.excludeSources;
-    const include = opts.includeSources ?? null;
+        return { rows: queries.map(() => []), storage: AGENT_STORAGE_OK };
     if (readDelayMs > 0)
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, readDelayMs);
     const db = openStateDbReadonly(dbPath);
     try {
-        db.exec('BEGIN'); // Receipt and physical rows must belong to the same committed generation.
-        const local = localLineages(db, opts.sessionIds?.length === 1 ? opts.sessionIds[0] : undefined);
         const sessionCols = tableColumns(db, 'sessions');
         const messageCols = tableColumns(db, 'messages');
         if (!sessionCols.has('source')) {
             if (!warnedNoSourceColumn.has(dbPath)) {
                 warnedNoSourceColumn.add(dbPath);
-                opts.log?.(`[webui] agent session listing skipped: state.db at ${dbPath} has no 'source' column (older hermes-agent?). Agent sessions unavailable. Upgrade hermes-agent to fix this.`);
+                queries[0]?.log?.(`[webui] agent session listing skipped: state.db at ${dbPath} has no 'source' column (older hermes-agent?). Agent sessions unavailable. Upgrade hermes-agent to fix this.`);
             }
-            return [];
+            return { rows: queries.map(() => []), storage: outdatedStateDbStorage() };
         }
+        const only = queries.length === 1 ? queries[0]?.sessionIds : undefined;
+        const local = localLineages(db, only?.length === 1 ? only[0] : undefined);
         const col = (name) => (sessionCols.has(name) ? `s.${name}` : `NULL AS ${name}`);
         const messagesHasSessionId = messageCols.has('session_id');
         const messagesHasTimestamp = messageCols.has('timestamp');
         const countCol = messageCols.has('id') ? 'id' : 'session_id';
-        let messagesIndexPresent = false;
-        let userMessagesIndexPresent = false;
-        if (messagesHasSessionId && messagesHasTimestamp) {
-            try {
-                const indexes = new Set(db.prepare('PRAGMA index_list(messages)').all().map((r) => r.name));
-                messagesIndexPresent = indexes.has('idx_messages_session');
-                userMessagesIndexPresent = indexes.has('idx_messages_session_user');
-            }
-            catch {
-                messagesIndexPresent = false;
-            }
-        }
+        const messageIndexes = messagesHasSessionId && messagesHasTimestamp ? tableIndexes(db, 'messages') : new Set();
+        const sessionIndexes = tableIndexes(db, 'sessions');
+        const hasPolicies = Boolean(db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'state_meta'").get());
+        const messagesIndexPresent = messageIndexes.has('idx_messages_session');
+        const userMessagesIndexPresent = messageIndexes.has('idx_messages_session_user');
         let actualCountExpr;
         let userCountExpr;
-        let lastActivityExpr;
+        let baseLastActivityExpr;
         let joinClause = '';
         let groupByClause = '';
         if (messagesHasSessionId) {
@@ -492,12 +615,12 @@ export function readImportableAgentSessionRows(dbPath, opts = {}) {
                 }
                 else
                     userCountExpr = actualCountExpr;
-                lastActivityExpr = messagesHasTimestamp ? '(SELECT MAX(lm.timestamp) FROM messages lm WHERE lm.session_id = s.id)' : 'NULL';
+                baseLastActivityExpr = messagesHasTimestamp ? lastMessageTimestamp(messagesIndexPresent, 'lm') : 'NULL';
             }
             else {
                 actualCountExpr = `COUNT(m.${countCol})`;
                 userCountExpr = messageCols.has('role') ? "EXISTS(SELECT 1 FROM messages um WHERE um.session_id = s.id AND LOWER(um.role) = 'user')" : `COUNT(m.${countCol})`;
-                lastActivityExpr = messagesHasTimestamp ? 'MAX(m.timestamp)' : 'NULL';
+                baseLastActivityExpr = messagesHasTimestamp ? 'MAX(m.timestamp)' : 'NULL';
                 joinClause = 'LEFT JOIN messages m ON m.session_id = s.id';
                 groupByClause = 'GROUP BY s.id';
             }
@@ -505,100 +628,151 @@ export function readImportableAgentSessionRows(dbPath, opts = {}) {
         else {
             actualCountExpr = 's.message_count';
             userCountExpr = 's.message_count';
-            lastActivityExpr = 'NULL';
-        }
-        let orderBy = 'ORDER BY s.started_at DESC';
-        let latestMessagesCte = null;
-        let candidateOrder = 'ORDER BY s.started_at DESC';
-        const where = ['s.source IS NOT NULL'];
-        const params = [];
-        if (opts.sessionIds !== undefined) {
-            where.push('s.id IN (SELECT value FROM json_each(?))');
-            params.push(JSON.stringify(opts.sessionIds.map((id) => local.get(id)?.ids.at(-1) ?? id)));
-        }
-        const superseded = [...local].filter(([id, lineage]) => id !== lineage.ids.at(-1)).map(([id]) => id);
-        if (superseded.length) {
-            where.push('s.id NOT IN (SELECT value FROM json_each(?))');
-            params.push(JSON.stringify(superseded));
+            baseLastActivityExpr = 'NULL';
         }
-        const hasPolicies = Boolean(db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'state_meta'").get());
-        const policySource = (id) => `(SELECT CASE WHEN json_valid(value) THEN json_extract(value, '$.policy.source') END FROM state_meta WHERE key = '${LOCAL_POLICY_PREFIX}' || ${id})`;
-        const sourceSql = hasPolicies ? `COALESCE(${policySource('s.id')}, ${sessionCols.has('chat_id') ? policySource('s.chat_id') : 'NULL'}, s.source)` : 's.source';
-        const included = (include ?? []).map(String).filter(Boolean);
-        if (included.length) {
-            where.push(`${sourceSql} IN (${included.map(() => '?').join(', ')})`);
-            params.push(...included);
-        }
-        const excluded = (exclude ?? []).map(String).filter(Boolean);
-        if (excluded.length) {
-            where.push(`${sourceSql} NOT IN (${excluded.map(() => '?').join(', ')})`);
-            params.push(...excluded);
-        }
-        const preaggregated = messagesHasSessionId && messagesHasTimestamp && included.length === 1 && included[0] === 'cron' && !messagesIndexPresent;
-        if (preaggregated) {
-            orderBy = 'ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC';
-            latestMessagesCte = 'latest_messages AS (SELECT mx.session_id AS session_id, MAX(mx.timestamp) AS last_message_at FROM messages mx GROUP BY mx.session_id)';
-            candidateOrder = 'ORDER BY COALESCE(lm.last_message_at, s.started_at) DESC, s.started_at DESC';
-        }
-        else if (messagesHasSessionId && messagesHasTimestamp) {
-            orderBy = messagesIndexPresent ? 'ORDER BY COALESCE(last_activity, s.started_at) DESC' : 'ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC';
-            candidateOrder = 'ORDER BY COALESCE((SELECT MAX(mx.timestamp) FROM messages mx WHERE mx.session_id = s.id), s.started_at) DESC, s.started_at DESC';
-        }
-        const selectSql = `SELECT s.id, s.title, s.model, s.message_count, s.started_at, s.source, ${['model_config', 'session_source', 'user_id', 'chat_id', 'chat_type', 'thread_id', 'session_key', 'origin_chat_id', 'origin_user_id', 'platform', 'parent_session_id', 'ended_at', 'end_reason'].map(col).join(', ')}, ${actualCountExpr} AS actual_message_count, ${userCountExpr} AS actual_user_message_count, ${lastActivityExpr} AS last_activity`;
-        let raw;
-        if (limit !== null) {
-            const resultLimit = Math.max(0, Math.trunc(limit));
-            if (resultLimit === 0)
-                return [];
-            const candidateLimit = Math.max(resultLimit * 8, resultLimit);
-            const candidateCte = latestMessagesCte
-                ? `WITH ${latestMessagesCte}, candidates AS (SELECT s.id FROM sessions s LEFT JOIN latest_messages lm ON lm.session_id = s.id WHERE ${where.join(' AND ')} ${candidateOrder} LIMIT ?)`
-                : `WITH candidates AS (SELECT s.id FROM sessions s WHERE ${where.join(' AND ')} ${candidateOrder} LIMIT ?)`;
-            raw = db.prepare(`${candidateCte} ${selectSql} FROM sessions s JOIN candidates c ON c.id = s.id ${joinClause} ${groupByClause} ${orderBy}`).all(...params, candidateLimit);
+        const candidates = (opts) => {
+            const limit = opts.limit === undefined ? 200 : opts.limit;
+            const exclude = opts.excludeSources === undefined ? ['cron', 'webui'] : opts.excludeSources;
+            const include = opts.includeSources ?? null;
+            let lastActivityExpr = baseLastActivityExpr;
+            let orderBy = 'ORDER BY s.started_at DESC';
+            let latestMessagesCte = null;
+            let candidateOrder = 'ORDER BY s.started_at DESC';
+            const where = ['s.source IS NOT NULL'];
+            const params = [];
+            if (opts.sessionIds !== undefined) {
+                where.push('s.id IN (SELECT value FROM json_each(?))');
+                const ids = opts.sessionIds.map((id) => local.get(id)?.ids.at(-1) ?? id);
+                params.push(JSON.stringify(opts.compressionChains ? compressionChainIds(db, sessionCols, ids) : ids));
+            }
+            const superseded = [...local].filter(([id, lineage]) => id !== lineage.ids.at(-1)).map(([id]) => id);
+            if (superseded.length) {
+                where.push('s.id NOT IN (SELECT value FROM json_each(?))');
+                params.push(JSON.stringify(superseded));
+            }
+            const policySource = (id) => `(SELECT CASE WHEN json_valid(value) THEN json_extract(value, '$.policy.source') END FROM state_meta WHERE key = '${LOCAL_POLICY_PREFIX}' || ${id})`;
+            const sourceSql = hasPolicies ? `COALESCE(${policySource('s.id')}, ${sessionCols.has('chat_id') ? policySource('s.chat_id') : 'NULL'}, s.source)` : 's.source';
+            const included = (include ?? []).map(String).filter(Boolean);
+            if (included.length) {
+                where.push(`${sourceSql} IN (${included.map(() => '?').join(', ')})`);
+                params.push(...included);
+            }
+            const excluded = (exclude ?? []).map(String).filter(Boolean);
+            if (excluded.length) {
+                where.push(`${sourceSql} NOT IN (${excluded.map(() => '?').join(', ')})`);
+                params.push(...excluded);
+            }
+            const preaggregated = messagesHasSessionId && messagesHasTimestamp && included.length === 1 && included[0] === 'cron' && !messagesIndexPresent;
+            // TAL-1163: the Agent's activity index preselects the window; exact recency is computed for those candidates only.
+            const activityIndexed = limit !== null && messagesHasSessionId && messagesHasTimestamp && sessionCols.has('last_activity_at')
+                && sessionIndexes.has('idx_sessions_effective_activity');
+            if (activityIndexed) {
+                lastActivityExpr = freshestActivity('s.last_activity_at', lastActivityExpr);
+                orderBy = 'ORDER BY last_activity DESC';
+                candidateOrder = 'ORDER BY COALESCE(s.last_activity_at, s.started_at) DESC, s.started_at DESC, s.id DESC';
+            }
+            else if (preaggregated) {
+                orderBy = 'ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC';
+                latestMessagesCte = 'latest_messages AS (SELECT mx.session_id AS session_id, MAX(mx.timestamp) AS last_message_at FROM messages mx GROUP BY mx.session_id)';
+                candidateOrder = 'ORDER BY COALESCE(lm.last_message_at, s.started_at) DESC, s.started_at DESC';
+            }
+            else if (messagesHasSessionId && messagesHasTimestamp) {
+                orderBy = messagesIndexPresent ? 'ORDER BY COALESCE(last_activity, s.started_at) DESC' : 'ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC';
+                candidateOrder = `ORDER BY COALESCE(${lastMessageTimestamp(messagesIndexPresent, 'mx')}, s.started_at) DESC, s.started_at DESC`;
+            }
+            const selectSql = `SELECT s.id, s.title, s.model, s.message_count, s.started_at, s.source, ${['model_config', 'session_source', 'user_id', 'chat_id', 'chat_type', 'thread_id', 'session_key', 'origin_chat_id', 'origin_user_id', 'platform', 'parent_session_id', 'ended_at', 'end_reason'].map(col).join(', ')}, ${actualCountExpr} AS actual_message_count, ${userCountExpr} AS actual_user_message_count, ${lastActivityExpr} AS last_activity`;
+            let raw;
+            if (limit !== null) {
+                const resultLimit = Math.max(0, Math.trunc(limit));
+                if (resultLimit === 0)
+                    return [];
+                const candidateLimit = Math.max(resultLimit * 8, resultLimit);
+                const candidateCte = latestMessagesCte
+                    ? `WITH ${latestMessagesCte}, candidates AS (SELECT s.id FROM sessions s LEFT JOIN latest_messages lm ON lm.session_id = s.id WHERE ${where.join(' AND ')} ${candidateOrder} LIMIT ?)`
+                    : `WITH candidates AS (SELECT s.id FROM sessions s WHERE ${where.join(' AND ')} ${candidateOrder} LIMIT ?)`;
+                raw = db.prepare(`${candidateCte} ${selectSql} FROM sessions s JOIN candidates c ON c.id = s.id ${joinClause} ${groupByClause} ${orderBy}`).all(...params, candidateLimit);
+            }
+            else {
+                raw = db.prepare(`${selectSql} FROM sessions s ${joinClause} WHERE ${where.join(' AND ')} ${groupByClause} ${orderBy}`).all(...params);
+            }
+            return raw;
+        };
+        const batches = queries.map((opts) => {
+            try {
+                return candidates(opts);
+            }
+            catch (error) {
+                return error;
+            }
+        });
+        const ids = [...new Set(batches.flatMap((rows) => rows instanceof Error ? [] : rows.map((r) => str(r.id))))];
+        let owners;
+        try {
+            owners = sessionSources(db, sessionCols, ids);
         }
-        else {
-            raw = db.prepare(`${selectSql} FROM sessions s ${joinClause} WHERE ${where.join(' AND ')} ${groupByClause} ${orderBy}`).all(...params);
+        catch (error) {
+            if (queries.length === 1)
+                throw error;
+            // Retry ownership per window only on damage, so a background failure cannot hide healthy interactive rows.
         }
-        const owners = sessionSources(db, sessionCols, raw.map((r) => str(r.id)));
-        raw = raw.map((r) => { const owner = owners.get(str(r.id)); return { ...r, source: typeof owner === 'object' ? owner.source : owner || r.source }; });
-        let projected = projectAgentSessionRows(raw.map((r) => {
-            const lineage = local.get(str(r.id));
-            if (!lineage)
-                return { ...r };
-            const root = lineage.rows[0];
-            const title = lineage.title || r.title;
-            return { ...r, title, started_at: root.started_at, last_activity: r.last_activity ?? r.started_at, parent_session_id: root.parent_session_id,
-                _lineage_root_id: lineage.owner, _lineage_tip_id: r.id, _lineage_ids: [...lineage.ids], _compression_segment_count: lineage.ids.length };
-        }));
-        projected = projected.map((r) => {
-            const parent = local.get(str(r.parent_session_id));
-            return { ...r, ...normalizeAgentSessionSource(r.source), ...(parent ? { _parent_lineage_root_id: parent.owner, parent_title: parent.title, parent_source: parent.rows.at(-1)?.source ?? null } : {}) };
+        const rows = batches.map((batch, i) => {
+            if (batch instanceof Error)
+                return batch;
+            let batchOwners = owners;
+            if (batchOwners === undefined) {
+                try {
+                    batchOwners = sessionSources(db, sessionCols, batch.map((row) => str(row.id)));
+                }
+                catch (error) {
+                    return error;
+                }
+            }
+            let raw = batch;
+            const opts = queries[i];
+            const limit = opts.limit === undefined ? 200 : opts.limit;
+            raw = raw.map((r) => { const owner = batchOwners.get(str(r.id)); return { ...r, source: typeof owner === 'object' ? owner.source : owner || r.source }; });
+            const keepEmpty = opts.keepEmpty === true && opts.sessionIds !== undefined;
+            let projected = projectAgentSessionRows(raw.map((r) => {
+                const lineage = local.get(str(r.id));
+                if (!lineage)
+                    return { ...r };
+                const root = lineage.rows[0];
+                const title = lineage.title || r.title;
+                return { ...r, title, started_at: root.started_at, last_activity: r.last_activity ?? r.started_at, parent_session_id: root.parent_session_id,
+                    _lineage_root_id: lineage.owner, _lineage_tip_id: r.id, _lineage_ids: [...lineage.ids], _compression_segment_count: lineage.ids.length };
+            }), keepEmpty);
+            projected = projected.map((r) => {
+                const parent = local.get(str(r.parent_session_id));
+                return { ...r, ...normalizeAgentSessionSource(r.source), ...(parent ? { _parent_lineage_root_id: parent.owner, parent_title: parent.title, parent_source: parent.rows.at(-1)?.source ?? null } : {}) };
+            });
+            if (!keepEmpty)
+                projected = projected.filter(isCliSessionRowVisible);
+            if (limit === null)
+                return projected;
+            const selected = projected.slice(0, Math.max(0, Math.trunc(limit)));
+            const have = new Set(selected.map((r) => str(r.id)));
+            const byId = new Map(projected.filter((r) => r.id).map((r) => [str(r.id), r]));
+            const pending = [...selected];
+            while (pending.length) {
+                const row = pending.pop();
+                if (lower(row.raw_source || row.source) !== 'subagent')
+                    continue;
+                const parentId = str(row.parent_session_id);
+                if (!parentId || have.has(parentId))
+                    continue;
+                const parent = byId.get(parentId);
+                if (!parent || lower(parent.raw_source || parent.source) !== 'subagent')
+                    continue;
+                selected.push(parent);
+                have.add(parentId);
+                pending.push(parent);
+            }
+            return selected;
         });
-        projected = projected.filter(isCliSessionRowVisible);
-        if (limit === null)
-            return projected;
-        const selected = projected.slice(0, Math.max(0, Math.trunc(limit)));
-        const have = new Set(selected.map((r) => str(r.id)));
-        const byId = new Map(projected.filter((r) => r.id).map((r) => [str(r.id), r]));
-        const pending = [...selected];
-        while (pending.length) {
-            const row = pending.pop();
-            if (lower(row.raw_source || row.source) !== 'subagent')
-                continue;
-            const parentId = str(row.parent_session_id);
-            if (!parentId || have.has(parentId))
-                continue;
-            const parent = byId.get(parentId);
-            if (!parent || lower(parent.raw_source || parent.source) !== 'subagent')
-                continue;
-            selected.push(parent);
-            have.add(parentId);
-            pending.push(parent);
-        }
-        return selected;
+        return { rows, storage: AGENT_STORAGE_OK };
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /** Python `agent_session_rows_existing`: batch existence probe; assumes present on any failure so nothing is pruned by mistake. */
@@ -629,12 +803,61 @@ export function agentSessionRowsExisting(dbPath, sessionIds) {
         return wanted;
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
+    }
+}
+/** Scheduler admissions are the identity of gateway-fired cron runs, whose session ids stay local-*. */
+function cronAdmissionJobIds(db, terminalOnly = false) {
+    const found = new Map();
+    const cols = tableColumns(db, 'session_admissions');
+    if (!['request_id', 'target_session_id', 'principal_id'].every((col) => cols.has(col)) || (terminalOnly && !cols.has('status')))
+        return found;
+    // The principal predicate selects the Agent's partial covering index, excluding interactive admissions.
+    const rows = db.prepare(`SELECT target_session_id, request_id FROM session_admissions WHERE principal_id = 'cron-owner' AND request_id LIKE 'cron:%'${terminalOnly ? " AND status = 'terminal'" : ''}`).all();
+    for (const row of rows) {
+        const match = /^cron:([^:]+):([^:]+)$/.exec(row.request_id);
+        if (match)
+            found.set(row.target_session_id, match[1]);
+    }
+    return found;
+}
+/** Read-only admission lookup, built once per session listing; older Agent stores have none. */
+export function stateDbCronJobIds(dbPath) {
+    if (!existsSync(dbPath))
+        return new Map();
+    let db;
+    try {
+        db = openStateDbReadonly(dbPath);
+    }
+    catch {
+        return new Map();
+    }
+    try {
+        return cronAdmissionJobIds(db);
+    }
+    catch {
+        return new Map();
+    }
+    finally {
+        finishStateDbRead(db);
     }
 }
+/** Shared job identity rule for completion links and sidebar titles, including legacy job ids with underscores. */
+export function cronSessionJobId(sid, jobIds, admissions) {
+    const admitted = admissions.get(sid);
+    if (admitted)
+        return admitted;
+    const legacy = /^cron_(.+)_\d{8}_\d{6}$/.exec(sid);
+    if (legacy)
+        return legacy[1];
+    // Preserve prefix matching for older non-timestamp session ids.
+    return [...jobIds].filter((id) => sid.startsWith(`cron_${id}_`)).reduce((best, id) => best === null || id.length > best.length ? id : best, null);
+}
 /**
- * Python `_latest_cron_session_info_for_jobs`: the newest-started cron session for each completed job. A session id
- * belongs to the job with the longest matching `cron_{job_id}_` prefix, so `a` never claims `a_b`'s sessions. A
+ * Python `_latest_cron_session_info_for_jobs`: the newest-started cron session for each completed job, excluding
+ * non-terminal gateway admissions so the next run cannot steal the completion link. A session id
+ * belongs to its scheduler admission's job or its legacy timestamp identity. Non-timestamp ids retain the longest
+ * matching job prefix, so `a` never claims a known `a_b`'s sessions. A
  * missing, locked, or unrecognized state.db answers an empty map; callers send no enrichment.
  */
 export function latestCronSessionInfo(dbPath, jobIds, completedIds) {
@@ -654,17 +877,23 @@ export function latestCronSessionInfo(dbPath, jobIds, completedIds) {
         const cols = tableColumns(db, 'sessions');
         if (!cols.has('id') || !cols.has('source'))
             return found;
+        const admissions = cronAdmissionJobIds(db, true);
         const count = cols.has('message_count') ? 's.message_count' : 'NULL';
         const order = cols.has('started_at') ? 'COALESCE(s.started_at, 0) DESC, s.id DESC' : 's.id DESC';
-        const rows = db.prepare(`SELECT s.id AS id, ${count} AS message_count FROM sessions s WHERE LOWER(COALESCE(s.source, '')) = 'cron' ORDER BY ${order}`).all();
-        for (const row of rows) {
-            const sid = typeof row.id === 'string' ? row.id : '';
-            const owner = ids.filter((id) => sid.startsWith(`cron_${id}_`)).reduce((best, id) => (best === null || id.length > best.length ? id : best), null);
-            if (owner === null || !wanted.has(owner) || found.has(owner))
-                continue;
-            found.set(owner, { session_id: sid, message_count: Number.isFinite(Number(row.message_count)) && row.message_count !== null ? Math.trunc(Number(row.message_count)) : null });
-            if (found.size === wanted.size)
-                break;
+        const indexed = tableIndexes(db, 'sessions').has('idx_sessions_source_id') ? ' INDEXED BY idx_sessions_source_id' : '';
+        const query = db.prepare(`SELECT s.id AS id, ${count} AS message_count FROM sessions s${indexed} WHERE s.source = 'cron' ORDER BY ${order} LIMIT ? OFFSET ?`);
+        const batchSize = wanted.size * 8;
+        // Stream older rows only if needed: a busy job must not hide another job's completion link.
+        for (const [limit, offset] of [[batchSize, 0], [-1, batchSize]]) {
+            for (const row of query.iterate(limit, offset)) {
+                const sid = typeof row.id === 'string' ? row.id : '';
+                const owner = cronSessionJobId(sid, ids, admissions);
+                if (owner === null || !wanted.has(owner) || found.has(owner))
+                    continue;
+                found.set(owner, { session_id: sid, message_count: Number.isFinite(Number(row.message_count)) && row.message_count !== null ? Math.trunc(Number(row.message_count)) : null });
+                if (found.size === wanted.size)
+                    return found;
+            }
         }
         return found;
     }
@@ -672,7 +901,7 @@ export function latestCronSessionInfo(dbPath, jobIds, completedIds) {
         return new Map();
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /** A source label remains display metadata; canonical receipts and ledgers independently retain write ownership. */
@@ -722,36 +951,49 @@ function sessionSources(db, cols, ids) {
                 receiptOwners.set(id, owner);
     };
     if (tables.has('state_meta')) {
-        const read = db.prepare('SELECT value FROM state_meta WHERE key = ?');
+        const prefixes = [LOCAL_POLICY_PREFIX, 'gateway.retired_session.v1.', 'gateway.api.binding.v1.'];
+        const keys = candidates.flatMap((owner) => prefixes.map((prefix) => `${prefix}${owner}`));
+        const metadata = new Map();
+        const read = db.prepare('SELECT key, value FROM state_meta WHERE key IN (SELECT value FROM json_each(?))');
+        for (let i = 0; i < keys.length; i += 400) {
+            for (const row of read.all(JSON.stringify(keys.slice(i, i + 400))))
+                metadata.set(row.key, row.value);
+        }
+        // Keep receipt precedence in candidate order, independent of SQLite's key ordering.
         for (const owner of candidates) {
-            const raw = read.get(`${LOCAL_POLICY_PREFIX}${owner}`);
-            if (raw)
-                rememberPolicy(owner, policyValue(raw.value));
-            if (read.get(`gateway.retired_session.v1.${owner}`))
+            const key = `${LOCAL_POLICY_PREFIX}${owner}`;
+            if (metadata.has(key))
+                rememberPolicy(owner, policyValue(metadata.get(key)));
+            if (metadata.has(`gateway.retired_session.v1.${owner}`))
                 retired.add(owner);
-            if (read.get(`gateway.api.binding.v1.${owner}`))
+            if (metadata.has(`gateway.api.binding.v1.${owner}`))
                 bindings.add(owner);
         }
     }
     const ledgerIds = new Set();
+    const ledgerCandidates = JSON.stringify(candidates);
     for (const [table, column] of [['session_admissions', 'target_session_id'], ['worker_executions', 'session_id']]) {
-        if (!tables.has(table))
+        if (!tables.has(table) || !candidates.length)
             continue;
         const hasLineage = tableColumns(db, table).has('lineage_json');
         for (let i = 0; i < candidates.length; i += 400) {
             const chunk = candidates.slice(i, i + 400);
             const marks = chunk.map(() => '?').join(',');
-            const linked = hasLineage ? ` OR EXISTS (SELECT 1 FROM json_each(lineage_json) WHERE value IN (${marks}))` : '';
-            const found = db.prepare(`SELECT ${column} AS id, ${hasLineage ? 'lineage_json' : 'NULL AS lineage_json'} FROM ${table} WHERE ${column} IN (${marks})${linked}`).all(...chunk, ...(hasLineage ? chunk : []));
-            for (const row of found) {
+            for (const row of db.prepare(`SELECT ${column} AS id FROM ${table} WHERE ${column} IN (${marks})`).all(...chunk))
                 ledgerIds.add(row.id);
-                if (row.lineage_json !== null) {
-                    const lineage = JSON.parse(row.lineage_json);
-                    if (!Array.isArray(lineage) || !lineage.every((v) => typeof v === 'string'))
-                        throw new Error('Unreadable Agent admission lineage');
-                    for (const sid of lineage)
-                        ledgerIds.add(sid);
-                }
+        }
+        if (hasLineage) {
+            // Bind the complete set once so unrelated history never crosses into JavaScript, even across candidate chunks.
+            const scan = db.prepare(`SELECT ${column} AS id, lineage_json FROM ${table} WHERE lineage_json IS NOT NULL AND
+        (${column} IN (SELECT value FROM json_each(?)) OR EXISTS
+          (SELECT 1 FROM json_each(lineage_json) WHERE value IN (SELECT value FROM json_each(?))))`);
+            for (const row of scan.iterate(ledgerCandidates, ledgerCandidates)) {
+                const lineage = JSON.parse(row.lineage_json);
+                if (!Array.isArray(lineage) || !lineage.every((v) => typeof v === 'string'))
+                    throw new Error('Unreadable Agent admission lineage');
+                ledgerIds.add(row.id);
+                for (const sid of lineage)
+                    ledgerIds.add(sid);
             }
         }
     }
@@ -769,12 +1011,13 @@ function sessionSources(db, cols, ids) {
             rememberPolicy(owner, policy);
         }
     }
-    const kanban = new Set(kanbanOwnedIds(db, cols, ids.filter((id) => rows.has(id))));
+    const kanban = new Set(kanbanOwnedIds(db, cols, new Map([...lineages].filter(([id]) => rows.has(id)))));
     for (const id of ids) {
         const row = rows.get(id);
         let source = kanban.has(id) ? 'kanban' : str(row?.source);
         let canonical = false;
         let retiredId = false;
+        let mode;
         for (const segment of lineages.get(id) ?? [id]) {
             const chatId = str(rows.get(segment)?.chat_id);
             for (const owner of new Set([segment, chatId, receiptOwners.get(segment)].filter((v) => Boolean(v)))) {
@@ -788,8 +1031,12 @@ function sessionSources(db, cols, ids) {
                 // A broken receipt never releases its owner or a physical row naming that owner.
                 canonical = true;
                 const origin = policy?.policy;
-                if (origin && typeof origin === 'object' && !Array.isArray(origin) && str(origin.source))
-                    source = str(origin.source);
+                if (origin && typeof origin === 'object' && !Array.isArray(origin)) {
+                    const frozen = origin;
+                    if (str(frozen.source))
+                        source = str(frozen.source);
+                    mode ??= frozen.safe_mode === true ? 'safe' : frozen.ignore_user_config === true ? 'ignore_config' : 'normal';
+                }
             }
         }
         const authority = canonical;
@@ -798,10 +1045,38 @@ function sessionSources(db, cols, ids) {
             canonical = true;
         if (!row && !canonical && !retiredId)
             continue;
-        sources.set(id, retiredId && !authority ? { source, canonical: true, reason: RETIRED_READ_ONLY_REASON } : canonical ? { source, canonical: true } : source);
+        const owned = { source, canonical: true, ...(mode ? { execution_mode: mode } : {}) };
+        sources.set(id, retiredId && !authority ? { ...owned, reason: RETIRED_READ_ONLY_REASON } : canonical ? owned : source);
     }
     return sources;
 }
+/** TAL-1040: the request-id prefix Talaria mints for the diagnostic chats it asks an owner to create; its receipt keeps it. */
+export const WEB_DIAGNOSTIC_REQUEST_PREFIX = 'talaria-web:';
+/** Owner ids whose creation receipt carries Talaria's request prefix: chats Web started, shown whatever the external-session setting. */
+export function stateDbWebDiagnosticIds(dbPath) {
+    if (!existsSync(dbPath))
+        return [];
+    let db;
+    try {
+        db = openStateDbReadonly(dbPath);
+    }
+    catch {
+        return [];
+    }
+    try {
+        if (!tableColumns(db, 'state_meta').has('value'))
+            return [];
+        const rows = db.prepare("SELECT key FROM state_meta WHERE key GLOB ? AND json_valid(value) AND json_extract(value, '$.request_id') GLOB ?")
+            .all(`${LOCAL_POLICY_PREFIX}*`, `${WEB_DIAGNOSTIC_REQUEST_PREFIX}*`);
+        return rows.map((row) => row.key.slice(LOCAL_POLICY_PREFIX.length));
+    }
+    catch {
+        return [];
+    }
+    finally {
+        finishStateDbRead(db);
+    }
+}
 /** Batched source/ownership probe. An unreadable authority answers null so callers fail closed. */
 export function stateDbSessionSources(dbPath, sessionIds) {
     const ids = [...new Set([...sessionIds].map((s) => s.trim()).filter(Boolean))];
@@ -815,14 +1090,13 @@ export function stateDbSessionSources(dbPath, sessionIds) {
         return null;
     }
     try {
-        db.exec('BEGIN');
         return sessionSources(db, tableColumns(db, 'sessions'), ids);
     }
     catch {
         return null;
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /** The same marker parser serves conservative history boundaries and exact-parent ownership walks. */
@@ -851,8 +1125,8 @@ function isExplicitForkChild(row, includeReset) {
 }
 /**
  * Python `_resume_lineage_ids`: `sid` and the compression ancestors a resume loads, root first. Each hop's parent ended
- * `compression` and the child is no branch, reset, delegate or tool fork. The walk stops at a cycle or the Agent's
- * 1000-hop `_CHAIN_CAP`; without the lineage columns it is `[sid]`.
+ * `compression` and the child is no branch, reset, delegate or tool fork. The walk stops at a cycle or
+ * `RESUME_LINEAGE_CAP` ids; without the lineage columns it is `[sid]`.
  */
 function resumeLineageWalker(db, cols) {
     if (!['parent_session_id', 'end_reason'].every((c) => cols.has(c)))
@@ -863,7 +1137,7 @@ function resumeLineageWalker(db, cols) {
         let current = select.get(sid);
         if (!current || isExplicitForkChild(current, false))
             return chain;
-        while (chain.length < 1000) {
+        while (chain.length < RESUME_LINEAGE_CAP) {
             const parentId = str(current.parent_session_id);
             if (!parentId || chain.includes(parentId) || isExplicitForkChild(current, true))
                 break;
@@ -880,12 +1154,10 @@ function resumeLineageWalker(db, cols) {
  * TAL-793 (Agent `is_kanban_owned_session`): the `ids` whose compression lineage has a `kanban` `source` or
  * `created_source` (schema v31; `source` alone decides before it), a Kanban worker's transcript only its dispatcher continues.
  */
-function kanbanOwnedIds(db, cols, ids) {
-    if (!ids.length)
+function kanbanOwnedIds(db, cols, lineages) {
+    if (!lineages.size)
         return [];
-    const walk = resumeLineageWalker(db, cols);
-    const lineages = ids.map(walk);
-    const segments = [...new Set(lineages.flat())];
+    const segments = [...new Set([...lineages.values()].flat())];
     const match = cols.has('created_source') ? "(source = 'kanban' OR created_source = 'kanban')" : "source = 'kanban'";
     const kanban = new Set();
     for (let i = 0; i < segments.length; i += 500) {
@@ -893,7 +1165,7 @@ function kanbanOwnedIds(db, cols, ids) {
         for (const row of db.prepare(`SELECT id FROM sessions WHERE id IN (${chunk.map(() => '?').join(',')}) AND ${match}`).all(...chunk))
             kanban.add(row.id);
     }
-    return ids.filter((_, i) => lineages[i].some((sid) => kanban.has(sid)));
+    return [...lineages].filter(([, lineage]) => lineage.some((sid) => kanban.has(sid))).map(([id]) => id);
 }
 /** Python `state_db_has_session`: true only when `sid` is a row of the sessions table; a missing or unreadable db is false. */
 export function stateDbHasSession(dbPath, sid) {
@@ -916,7 +1188,33 @@ export function stateDbHasSession(dbPath, sid) {
         return false;
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
+    }
+}
+/** True when a session has a live message; never materializes its transcript or compaction archive. */
+export function stateDbSessionHasMessages(dbPath, sid) {
+    const id = sid.trim();
+    if (!id || !existsSync(dbPath))
+        return false;
+    let db;
+    try {
+        db = openStateDbReadonly(dbPath);
+    }
+    catch {
+        return false;
+    }
+    try {
+        const cols = tableColumns(db, 'messages');
+        if (!cols.has('session_id'))
+            return false;
+        const active = cols.has('active') ? ' AND (active IS NULL OR active != 0)' : '';
+        return db.prepare(`SELECT 1 FROM messages WHERE session_id = ?${active} LIMIT 1`).get(id) !== undefined;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        finishStateDbRead(db);
     }
 }
 /**
@@ -939,7 +1237,7 @@ export function cheapChangeFingerprint(dbPath, onError) {
             }
         }
         finally {
-            db.close();
+            finishStateDbRead(db);
         }
         for (const path of [dbPath, `${dbPath}-wal`]) {
             try {
@@ -971,22 +1269,28 @@ export function cheapChangeFingerprint(dbPath, onError) {
         return null;
     }
 }
-let listingWorker = null;
+const STATE_DB_WORKER_LANES = ['listing', 'authority', 'session'];
+const listingWorkers = new Map();
+const listingReadScope = new AsyncLocalStorage();
+/** Keep a sidebar phase's nested reads on its lane without changing interactive callers' defaults. */
+export function withStateDbListingReads(read) { return listingReadScope.run('listing', read); }
 let nextCallId = 0;
-/** Set while `stopStateDbWorker` waits for the worker to exit; calls then reject instead of starting another worker. */
+/** Set until every worker exits during shutdown; calls then reject instead of starting another worker. */
 let stoppingWorker = false;
 /** Reject every call still waiting on `current` and forget it, so the next call starts a fresh worker. */
 function retireListingWorker(current, error) {
-    if (listingWorker === current)
-        listingWorker = null;
+    for (const [lane, worker] of listingWorkers)
+        if (worker === current)
+            listingWorkers.delete(lane);
     for (const call of current.pending.values())
         call.reject(error);
     current.pending.clear();
 }
-/** The lazily started, long-lived listing worker; requests run one at a time in arrival order. */
-function startedListingWorker() {
-    if (listingWorker)
-        return listingWorker;
+/** Each lane lazily starts one long-lived worker and keeps its own FIFO and read-only handle cache. */
+function startedListingWorker(lane) {
+    const existing = listingWorkers.get(lane);
+    if (existing)
+        return existing;
     // Source runs (vitest) load the TypeScript worker; the build runs the compiled one beside this module.
     const ext = import.meta.url.endsWith('.ts') ? 'ts' : 'js';
     const current = { worker: new Worker(new URL(`./state-db-worker.${ext}`, import.meta.url)), pending: new Map() };
@@ -1002,20 +1306,26 @@ function startedListingWorker() {
     });
     current.worker.on('error', (error) => { retireListingWorker(current, error); });
     current.worker.on('exit', (code) => { retireListingWorker(current, new Error(`state.db worker exited with code ${String(code)}`)); });
-    listingWorker = current;
+    listingWorkers.set(lane, current);
     return current;
 }
-function callListingWorker(call) {
+function callListingWorker(call, lane) {
     // A multi-read caller the stop interrupted goes on to its next read; that read must not restart the worker.
     if (stoppingWorker)
         return Promise.reject(new Error('state.db worker stopped'));
-    const current = startedListingWorker();
+    const target = lane ?? listingReadScope.getStore() ?? (call.op === 'session' ? SESSION_READ_LANES[call.read] : call.op === 'sources' || call.op === 'existing' ? 'authority' : 'listing');
+    const current = startedListingWorker(target);
     const id = ++nextCallId;
+    const timing = startupTimingScope.getStore();
     return new Promise((resolve, reject) => {
-        current.pending.set(id, { resolve, reject });
+        current.pending.set(id, { resolve: (reply) => {
+                if (reply.timing)
+                    timing?.workerRead(target, call.op === 'session' ? call.read : call.op, reply.timing);
+                resolve(reply);
+            }, reject });
         // A call in flight keeps the process alive until it settles; an idle worker never does.
         current.worker.ref();
-        current.worker.postMessage({ ...call, id, delayMs: readDelayMs });
+        current.worker.postMessage({ ...call, id, delayMs: readDelayMs, queuedAtNs: process.hrtime.bigint() });
     });
 }
 /** `readImportableAgentSessionRows` on the listing worker, so a slow `state.db` never blocks the event loop. Rejects when the worker fails. */
@@ -1028,6 +1338,15 @@ export async function readImportableAgentSessionRowsAsync(dbPath, opts = {}) {
         throw new Error(reply.error);
     return reply.value;
 }
+/** One worker crossing for all sidebar windows and their storage health. */
+export async function readImportableAgentSessionRowBatchesAsync(dbPath, queries) {
+    const reply = await callListingWorker({ op: 'rowBatches', dbPath, queries: queries.map((opts) => ({ ...opts, log: undefined })) });
+    for (const line of reply.logs)
+        queries[0]?.log?.(line);
+    if (reply.error !== undefined)
+        throw new Error(reply.error);
+    return reply.value;
+}
 /** `cheapChangeFingerprint` on the listing worker; a worker failure reports as a failed change check. */
 export async function cheapChangeFingerprintAsync(dbPath, onError) {
     let reply;
@@ -1051,8 +1370,10 @@ export async function stateDbStorageAsync(dbPath) {
         return stateDbReadFailure(error);
     }
 }
-/** `stateDbSessionSources` on the listing worker; a worker failure is an unreadable state.db (null), so owners stay locked. */
+/** `stateDbSessionSources` on the authority worker; a worker failure is an unreadable state.db (null), so owners stay locked. Without a state.db it answers here, opening nothing. */
 export async function stateDbSessionSourcesAsync(dbPath, sessionIds) {
+    if (!existsSync(dbPath))
+        return stateDbSessionSources(dbPath, sessionIds);
     try {
         return (await callListingWorker({ op: 'sources', dbPath, ids: [...sessionIds] })).value;
     }
@@ -1060,7 +1381,16 @@ export async function stateDbSessionSourcesAsync(dbPath, sessionIds) {
         return null;
     }
 }
-/** `agentSessionRowsExisting` on the listing worker; a worker failure assumes every row present, so nothing is pruned. */
+/** `stateDbWebDiagnosticIds` on the listing worker; a failed read lists none, so the setting still governs every other row. */
+export async function stateDbWebDiagnosticIdsAsync(dbPath) {
+    try {
+        return (await callListingWorker({ op: 'webDiagnostic', dbPath })).value;
+    }
+    catch {
+        return [];
+    }
+}
+/** `agentSessionRowsExisting` on the authority worker; a worker failure assumes every row present, so nothing is pruned. */
 export async function agentSessionRowsExistingAsync(dbPath, sessionIds) {
     const ids = [...sessionIds];
     try {
@@ -1070,19 +1400,60 @@ export async function agentSessionRowsExistingAsync(dbPath, sessionIds) {
         return new Set(ids.map((s) => s.trim()).filter(Boolean));
     }
 }
-/** Test hook: the listing worker exits abruptly while this call is in flight. */
-export function crashStateDbWorkerForTests() {
-    return callListingWorker({ op: 'crash' });
+/**
+ * TAL-923: the single-session readers behind chat start, session detail, and the mutation gates, run on the worker.
+ * TAL-1162: and the transcript reads behind turn history, settlement, and the detail's page tail.
+ * TAL-1256: shared cron admission identities and completion links use this same dispatcher.
+ */
+export const SESSION_READS = { stateDbHasSession, stateDbSessionHasMessages, insightsSessionRows, countConversationRounds, stateDbTailToolContent, stateDbLineageReport, stateDbCronJobIds, latestCronSessionInfo, stateDbLocalTargetRead, stateDbSessionRow, stateDbSessionMessages, stateDbCompressionLineage, stateDbSessionRead, stateDbSessionTailRead, stateDbSettlementRead };
+/** Exhaustive policy: authority never waits for transcript materialization; sidebar-scoped probes stay on listing. */
+const SESSION_READ_LANES = {
+    stateDbHasSession: 'authority', stateDbSessionHasMessages: 'authority', stateDbLocalTargetRead: 'authority', stateDbSessionRow: 'authority',
+    insightsSessionRows: 'session', countConversationRounds: 'session', stateDbTailToolContent: 'session', stateDbLineageReport: 'session',
+    stateDbCronJobIds: 'session', latestCronSessionInfo: 'session', stateDbSessionMessages: 'session', stateDbCompressionLineage: 'session',
+    stateDbSessionRead: 'session', stateDbSessionTailRead: 'session', stateDbSettlementRead: 'session',
+};
+/**
+ * A `SESSION_READS` reader on its authority or transcript lane, so expensive reads cannot hold up authority. Each reader
+ * already answers a failed read with `fallback`'s value; a worker failure answers it too. Without a state.db the reader
+ * answers here, as it opens nothing then.
+ */
+export async function stateDbSessionReadAsync(fallback, read, ...args) {
+    if (!existsSync(args[0]))
+        return SESSION_READS[read](...args);
+    try {
+        const reply = await callListingWorker({ op: 'session', read, args });
+        return reply.error === undefined ? reply.value : fallback;
+    }
+    catch {
+        return fallback;
+    }
 }
-/** Stop the listing worker (server shutdown). Calls in flight reject; a later call starts a new worker. */
+/** Test hook: crash one lane, or all when omitted, while its calls are in flight. */
+export function crashStateDbWorkerForTests(lane) {
+    return Promise.all((lane ? [lane] : STATE_DB_WORKER_LANES).map((target) => callListingWorker({ op: 'crash' }, target)));
+}
+/** Stop every worker (server shutdown). Calls in flight reject; later calls start fresh workers. */
 export async function stopStateDbWorker() {
-    const current = listingWorker;
-    if (!current)
+    closeStateDbs();
+    const workers = [...listingWorkers.values()];
+    if (!workers.length)
         return;
     stoppingWorker = true;
     try {
-        retireListingWorker(current, new Error('state.db worker stopped'));
-        await current.worker.terminate();
+        await Promise.all(workers.map(async (current) => {
+            retireListingWorker(current, new Error('state.db worker stopped'));
+            const exited = new Promise((resolve) => { current.worker.once('exit', () => { resolve(); }); });
+            // Idle workers close their cache through process.exit; a blocked read still cannot delay shutdown.
+            const force = setTimeout(() => { void current.worker.terminate(); }, 100);
+            try {
+                current.worker.postMessage({ op: 'stop', id: 0, delayMs: 0 });
+                await exited;
+            }
+            finally {
+                clearTimeout(force);
+            }
+        }));
     }
     finally {
         stoppingWorker = false;
@@ -1091,7 +1462,7 @@ export async function stopStateDbWorker() {
 // ── message reader ────────────────────────────────────────────────────────
 const STATE_DB_CONTENT_JSON_PREFIX = '\0json:';
 // `display_kind` / `display_metadata`: the Agent's own tag for rows it writes itself (steers, delivered notifications; TAL-371).
-const OPTIONAL_MESSAGE_COLUMNS = ['tool_call_id', 'tool_calls', 'tool_name', 'reasoning', 'reasoning_details', 'codex_reasoning_items', 'reasoning_content', 'codex_message_items', 'api_content', 'display_kind', 'display_metadata', 'absorbed_message_uids'];
+const OPTIONAL_MESSAGE_COLUMNS = ['tool_call_id', 'tool_calls', 'tool_name', 'reasoning', 'reasoning_details', 'codex_reasoning_items', 'reasoning_content', 'codex_message_items', 'api_content', 'display_kind', 'display_metadata', 'absorbed_message_uids', '_compressed_summary'];
 const JSON_MESSAGE_COLUMNS = new Set(['tool_calls', 'reasoning_details', 'codex_reasoning_items', 'codex_message_items', 'display_metadata', 'absorbed_message_uids']);
 /** Python `_decode_state_db_content`: the Agent's sentinel-prefixed structured content, left untouched otherwise. */
 function decodeStateDbContent(value) {
@@ -1123,11 +1494,28 @@ function jsonLoadsIfString(value) {
         return value;
     }
 }
+// Agent v0.22.3's ordinary kept-tail handoff. Only its explicit flag and exact wrapper prove a carrier.
+const PRIOR_CONTEXT_HEADER = '[PRIOR CONTEXT — for reference only; not a new message]';
+const COMPACTION_SUMMARY_DELIMITER = '\n\n[END OF PRIOR CONTEXT — COMPACTION SUMMARY BELOW]\n\n';
+function compactionCarrier(row) {
+    if (row._compressed_summary !== 1 && row._compressed_summary !== true)
+        return null;
+    const content = decodeStateDbContent(row.content);
+    if ((row.role !== 'user' && row.role !== 'assistant') || typeof content !== 'string' || !content.startsWith(`${PRIOR_CONTEXT_HEADER}\n`))
+        return null;
+    const boundary = content.indexOf(COMPACTION_SUMMARY_DELIMITER, PRIOR_CONTEXT_HEADER.length);
+    if (boundary < 0)
+        return null;
+    // Remove only the separators the Agent added; preserve the kept reply's own whitespace.
+    const prior = content.slice(PRIOR_CONTEXT_HEADER.length + 1, boundary);
+    const summary = content.slice(boundary + COMPACTION_SUMMARY_DELIMITER.length).trim();
+    return prior && summary ? { prior, summary } : null;
+}
 /** Python `_project_state_db_message`: one row → WebUI message (`tool_name → name`, empty optionals omitted). */
 function projectStateDbMessage(row, hasId) {
-    const msg = { role: row.role, content: decodeStateDbContent(row.content), timestamp: row.timestamp };
+    const msg = { role: row.role, content: compactionCarrier(row)?.prior ?? decodeStateDbContent(row.content), timestamp: row.timestamp };
     for (const col of OPTIONAL_MESSAGE_COLUMNS) {
-        if (!(col in row))
+        if (col === '_compressed_summary' || !(col in row))
             continue;
         const value = row[col];
         if (value === null || value === undefined || value === '')
@@ -1159,7 +1547,7 @@ function stateDbGeneration(dbPath) {
 }
 // Agent v0.21.6's exact in-flight request wrapper. Unknown rewrites are not copy evidence.
 const INFLIGHT_REPLAY_HEADER = '[STILL IN PROGRESS — this is the active request, restated after the compaction boundary because it was not finished yet. Continue it; do not start over.]';
-/** The payload comparison ignores only the Agent's documented replay wrapper and dropped api_content. */
+/** Compare the kept payload after the Agent's exact request/carrier wrappers and stale api_content are removed. */
 function replayPayload(row) {
     const message = projectStateDbMessage(row, false);
     delete message.timestamp;
@@ -1190,7 +1578,7 @@ function replayPayload(row) {
     }
     message.content = content;
     delete message.api_content; // _reappend_inflight_user_task drops this stale model-facing sidecar.
-    return { copyKey, replayKey: JSON.stringify(message), replay };
+    return { copyKey, replayKey: JSON.stringify(message), replay, carrier: compactionCarrier(row)?.summary ?? null };
 }
 /**
  * Compare adjacent generations, never all rows of one UID with its oldest archive. The archive retains
@@ -1215,13 +1603,15 @@ function replayIdentities(db, chain, rows, available) {
         const payload = replayPayload(row);
         const prior = previous.get(uid);
         const copy = payload.copyKey === prior?.copyKey && row.timestamp === prior.timestamp;
-        const restatement = prior && payload.replay && payload.replayKey === prior.replayKey && (prior.active !== 0 || prior.compacted === 1);
+        const restatement = payload.replayKey === prior?.replayKey && ((payload.replay && (prior.active !== 0 || prior.compacted === 1)) ||
+            (payload.carrier && row.timestamp === prior.timestamp));
         const identity = prior && (copy || restatement) ? prior.identity : Number(row.id);
         const changed = prior ? (copy || restatement ? prior.changed : true) : false;
         const sourceKey = prior && (copy || restatement) ? prior.sourceKey : stateDbMessageFingerprint(projectStateDbMessage(row, false));
+        const summaryId = payload.carrier && payload.carrier === prior?.carrier && row.timestamp === prior.timestamp ? prior.summaryId : Number(row.id);
         if (prior && row.role !== 'tool' && liveIds.has(row.id))
-            identities.set(Number(row.id), { id: identity, changed, sourceKey });
-        previous.set(uid, { ...payload, identity, changed, sourceKey, timestamp: row.timestamp, active: row.active, compacted: row.compacted });
+            identities.set(Number(row.id), { id: identity, changed, sourceKey, summaryId });
+        previous.set(uid, { ...payload, identity, changed, sourceKey, summaryId, timestamp: row.timestamp, active: row.active, compacted: row.compacted });
     }
     return identities;
 }
@@ -1235,6 +1625,16 @@ export function stateDbSessionMessages(dbPath, sid, opts = {}) {
 export function stateDbSessionRead(dbPath, sid, opts = {}) {
     return readStateDbSession(dbPath, sid, opts);
 }
+/**
+ * A settlement's reads in one request: the transcript under `recorded` (the session's `state_db_lineage`), the lineage
+ * the Agent's compression rotations give it now, and, when that differs from `recorded`, the transcript under it.
+ */
+export function stateDbSettlementRead(dbPath, sid, recorded) {
+    const read = stateDbSessionRead(dbPath, sid, { stitch: false, lineage: recorded?.[0] === sid ? recorded : null });
+    const lineage = stateDbCompressionLineage(dbPath, sid);
+    const moved = JSON.stringify(lineage) !== JSON.stringify(recorded ?? [sid]);
+    return { ...read, lineage, rotated: moved ? stateDbSessionRead(dbPath, sid, { stitch: false, lineage: lineage.length > 1 && lineage[0] === sid ? lineage : null }) : null };
+}
 /** The same snapshot and provenance projection, restricted to physical rows past the seen marker. */
 export function stateDbSessionTailRead(dbPath, sid, afterId, opts = {}) {
     return readStateDbSession(dbPath, sid, { ...opts, stitch: false, afterId });
@@ -1248,11 +1648,10 @@ function readStateDbSession(dbPath, sid, opts) {
     try {
         db = openStateDbReadonly(dbPath);
     }
-    catch {
-        return none;
+    catch (error) {
+        return { ...none, reason: stateDbReadFailure(error).reason };
     }
     try {
-        db.exec('BEGIN'); // The live rows and their archived predecessors must describe one snapshot.
         const available = tableColumns(db, 'messages');
         if (!['role', 'content', 'timestamp'].every((c) => available.has(c)))
             return { ...none, ok: available.size > 0 };
@@ -1288,7 +1687,7 @@ function readStateDbSession(dbPath, sid, opts) {
         const rangeArgs = opts.afterId === undefined ? [] : [opts.afterId];
         const order = hasId ? 'id' : 'timestamp';
         const rows = db.prepare(`SELECT ${selected.join(', ')}, session_id FROM messages WHERE session_id IN (${chain.map(() => '?').join(', ')})${activeClause}${range} ORDER BY ${order} ASC`).all(...chain, ...rangeArgs);
-        const projected = rows.map((row) => projectStateDbMessage(row, hasId));
+        let projected = rows.map((row) => projectStateDbMessage(row, hasId));
         // TAL-709: an in-place compaction archives the live rows and re-inserts each as a copy that keeps its role and timestamp
         // (content may be pruned). A copy takes the id of the oldest archived row it copies, so the merge sees a row it has
         // already read instead of a new one. Only a compaction archive (`compacted = 1`) vouches for a changed copy: a rewound
@@ -1307,8 +1706,9 @@ function readStateDbSession(dbPath, sid, opts) {
                     projected[i]._state_db_row_id = twin;
             }
         }
+        let identities;
         if (hasId && ['message_uid', 'active', 'compacted'].every((c) => available.has(c))) {
-            const identities = replayIdentities(db, local?.context ?? chain, rows, available);
+            identities = replayIdentities(db, local?.context ?? chain, rows, available);
             for (const [i, row] of rows.entries()) {
                 const identity = identities.get(Number(row.id));
                 // A known changed generation overrides even a coincidental legacy timestamp twin.
@@ -1321,6 +1721,13 @@ function readStateDbSession(dbPath, sid, opts) {
                 }
             }
         }
+        // The kept reply and summary have independent archive identities; neither can consume the other's copy.
+        const withCarrierSummary = (row, message) => {
+            const carrier = compactionCarrier(row);
+            return carrier ? [message, { role: 'assistant', content: carrier.summary, timestamp: row.timestamp,
+                    _context_compression_marker: true, ...(hasId ? { _state_db_row_id: identities?.get(Number(row.id))?.summaryId ?? row.id } : {}) }] : [message];
+        };
+        projected = rows.flatMap((row, i) => withCarrierSummary(row, projected[i]));
         // TAL-493: the database file's identity, so a marker taken in a replaced state.db is never applied to its successor.
         const generation = stateDbGeneration(dbPath);
         if (hasId) {
@@ -1333,7 +1740,7 @@ function readStateDbSession(dbPath, sid, opts) {
             if (!anchor) {
                 const row = db.prepare(`SELECT ${selected.join(', ')}, session_id FROM messages WHERE session_id IN (${chain.map(() => '?').join(', ')}) AND id = ?${activeClause} LIMIT 1`).get(...chain, opts.afterId);
                 if (row)
-                    anchor = { ...projectStateDbMessage(row, true), _state_db_generation: generation };
+                    anchor = { ...withCarrierSummary(row, projectStateDbMessage(row, true)).at(-1), _state_db_generation: generation };
             }
         }
         let requiresFullRead = false;
@@ -1352,7 +1759,7 @@ function readStateDbSession(dbPath, sid, opts) {
         return { ...none, reason: stateDbReadFailure(error).reason };
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /**
@@ -1372,7 +1779,6 @@ export function stateDbCompressionLineage(dbPath, sid) {
         return lineage;
     }
     try {
-        db.exec('BEGIN');
         const local = localLineages(db, lineage[0]).get(lineage[0]);
         if (local)
             return [...local.ids];
@@ -1398,7 +1804,7 @@ export function stateDbCompressionLineage(dbPath, sid) {
         return lineage.slice(0, 1);
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 function lineageReportRow(row, role) {
@@ -1408,7 +1814,7 @@ function lineageReportRow(row, role) {
         end_reason: row.end_reason ?? null, active: ended === null, archived: false,
     };
 }
-const emptyLineageReport = (sid) => ({
+export const emptyLineageReport = (sid) => ({
     mutation: false, found: false, session_id: sid, lineage_key: sid, tip_session_id: sid, total_segments: 0, materialized_segments: 0, segments: [], children: [], manual_review: false,
 });
 /**
@@ -1429,7 +1835,6 @@ export function stateDbLineageReport(dbPath, rawSid, maxHops = COMPRESSION_CHAIN
         return emptyLineageReport(sid);
     }
     try {
-        db.exec('BEGIN');
         const local = localLineages(db, sid).get(sid);
         const cols = tableColumns(db, 'sessions');
         if (!['id', 'parent_session_id', 'end_reason'].every((c) => cols.has(c)))
@@ -1485,7 +1890,7 @@ export function stateDbLineageReport(dbPath, rawSid, maxHops = COMPRESSION_CHAIN
         return emptyLineageReport(sid);
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /** The `sessions` row for `sid` (source and lifecycle columns), or null. */
@@ -1511,7 +1916,7 @@ export function stateDbSessionRow(dbPath, sid) {
         return null;
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /**
@@ -1537,21 +1942,31 @@ export function insightsSessionRows(dbPath, cutoff) {
         const col = (name) => (cols.has(name) ? `s.${name}` : 'NULL');
         const messageCols = tableColumns(db, 'messages');
         const hasMessages = messageCols.has('session_id') && messageCols.has('timestamp');
-        let indexed = false;
-        try {
-            indexed = hasMessages && db.prepare('PRAGMA index_list(messages)').all().some((r) => r.name === 'idx_messages_session');
-        }
-        catch {
-            indexed = false;
-        }
+        const indexed = hasMessages && tableIndexes(db, 'messages').has('idx_messages_session');
         // Without the index a per-session lookup scans messages once per session; one grouped scan replaces it.
-        const lastMessage = !hasMessages ? 'NULL' : indexed ? '(SELECT MAX(m.timestamp) FROM messages m WHERE m.session_id = s.id)' : 'lm.last_message_at';
-        const join = hasMessages && !indexed ? 'LEFT JOIN (SELECT session_id, MAX(timestamp) AS last_message_at FROM messages GROUP BY session_id) lm ON lm.session_id = s.id' : '';
+        const lastMessage = !hasMessages ? 'NULL' : indexed ? lastMessageTimestamp(indexed) : 'lm.last_message_at';
+        const messageCte = hasMessages && !indexed ? 'latest_messages AS MATERIALIZED (SELECT session_id, MAX(timestamp) AS last_message_at FROM messages GROUP BY session_id)' : '';
+        const join = messageCte ? 'LEFT JOIN latest_messages lm ON lm.session_id = s.id' : '';
         const source = cols.has('source') ? "LOWER(COALESCE(s.source, '')) != 'webui'" : '1';
-        const rows = db.prepare(`SELECT * FROM (SELECT s.id AS id, ${col('model')} AS model, ${col('message_count')} AS message_count, ${col('input_tokens')} AS input_tokens,
+        const activityIndexed = cols.has('last_activity_at') && tableIndexes(db, 'sessions').has('idx_sessions_effective_activity');
+        const activity = activityIndexed ? freshestActivity('s.last_activity_at', `MAX(COALESCE(${col('ended_at')}, 0), COALESCE(${lastMessage}, 0))`)
+            : `MAX(COALESCE(s.started_at, 0), COALESCE(${col('ended_at')}, 0), COALESCE(${lastMessage}, 0))`;
+        // The heartbeat can lag a message or end time; union their candidates before the exact activity check.
+        const candidates = activityIndexed ? [
+            'SELECT s.id FROM sessions s INDEXED BY idx_sessions_effective_activity WHERE COALESCE(s.last_activity_at, s.started_at) >= ?',
+            'SELECT id FROM sessions WHERE started_at >= ?',
+            ...(cols.has('ended_at') ? ['SELECT id FROM sessions WHERE ended_at >= ?'] : []),
+            ...(hasMessages ? [indexed ? 'SELECT DISTINCT session_id AS id FROM messages WHERE timestamp >= ?' : 'SELECT session_id AS id FROM latest_messages WHERE last_message_at >= ?'] : []),
+        ] : [];
+        const ctes = [messageCte, ...(activityIndexed ? [`candidates AS MATERIALIZED (SELECT DISTINCT id FROM (${candidates.join(' UNION ALL ')}))`] : [])].filter(Boolean);
+        const withClause = ctes.length ? `WITH ${ctes.join(', ')} ` : '';
+        // CROSS JOIN keeps the candidate IDs ahead of the expensive per-session freshness projection.
+        const from = activityIndexed ? 'candidates c CROSS JOIN sessions s ON s.id = c.id' : 'sessions s';
+        const ordering = activityIndexed ? ' ORDER BY COALESCE(s.last_activity_at, s.started_at) DESC' : '';
+        const rows = db.prepare(`${withClause}SELECT * FROM (SELECT s.id AS id, ${col('model')} AS model, ${col('message_count')} AS message_count, ${col('input_tokens')} AS input_tokens,
       ${col('output_tokens')} AS output_tokens, ${col('cache_read_tokens')} AS cache_read_tokens, ${col('estimated_cost_usd')} AS estimated_cost_usd, s.started_at AS started_at,
-      MAX(COALESCE(s.started_at, 0), COALESCE(${col('ended_at')}, 0), COALESCE(${lastMessage}, 0)) AS last_activity
-      FROM sessions s ${join} WHERE ${source}) WHERE last_activity >= ?`).all(cutoff);
+      ${activity} AS last_activity
+      FROM ${from} ${join} WHERE ${source}${ordering}) WHERE last_activity >= ?`).all(...Array(candidates.length + 1).fill(cutoff));
         return rows.map((r) => ({
             session_id: str(r.id), model: r.model, message_count: r.message_count, input_tokens: r.input_tokens, output_tokens: r.output_tokens,
             cache_read_tokens: r.cache_read_tokens, estimated_cost: r.estimated_cost_usd, created_at: r.started_at, updated_at: r.last_activity,
@@ -1561,7 +1976,7 @@ export function insightsSessionRows(dbPath, cutoff) {
         return [];
     }
     finally {
-        db.close();
+        finishStateDbRead(db);
     }
 }
 /** A state.db `timestamp` in unix seconds: a number, or an ISO-8601 string (Python `fromisoformat`); null when unreadable. */
@@ -1590,7 +2005,7 @@ export function countConversationRounds(dbPath, sid, since = null) {
             rows = db.prepare('SELECT role, timestamp FROM messages WHERE session_id = ? ORDER BY timestamp ASC').all(sid);
         }
         finally {
-            db.close();
+            finishStateDbRead(db);
         }
     }
     catch {
@@ -1631,7 +2046,7 @@ export function stateDbTailToolContent(dbPath, sid) {
             return typeof content === 'string' ? content : null;
         }
         finally {
-            db.close();
+            finishStateDbRead(db);
         }
     }
     catch {