@mono-agent/web 0.19.0 → 0.20.0

package/dist/store.js

@@ -2,15 +2,22 @@ import { createECDH, createHash, randomUUID, timingSafeEqual } from "node:crypto
 import { chmod, lstat, readdir, unlink } from "node:fs/promises";
 import { resolve } from "node:path";
 import { DatabaseSync } from "node:sqlite";
-import { AGENT_LIVE_INPUT_MAX_CHARACTERS, } from "@mono-agent/agent-contracts";
+import { isDeepStrictEqual } from "node:util";
+import { AGENT_LIVE_INPUT_MAX_CHARACTERS, MAX_AGENT_REPLY_PARTS, classifyNotifySuppression, parseProcessJobProjection, } from "@mono-agent/agent-contracts";
 import { WEB_MAX_FILES_PER_TURN, WEB_MAX_LIVE_INPUTS_PER_THREAD, WEB_MAX_TURN_ATTACHMENT_BYTES, WEB_MAX_TURN_TEXT_CHARACTERS, } from "./contracts.js";
 import { WebConsoleError } from "./errors.js";
 import { webPushPreview } from "./push-preview.js";
 import { prepareWebStatePaths } from "./state-paths.js";
-const WEB_STORAGE_SCHEMA_VERSION = 4;
+const WEB_STORAGE_SCHEMA_VERSION = 7;
+const MAX_REVISIONS_PER_THREAD = 1_000;
+export const WEB_THREAD_PAGE_MAX = 200;
+export const WEB_MESSAGE_PAGE_MAX = 100;
 const MAX_ACTIVE_PUSH_SUBSCRIPTIONS = 32;
 const MAX_PENDING_PUSH_DELIVERIES_PER_SUBSCRIPTION = 200;
 const PUSH_RETENTION_MS = 30 * 24 * 60 * 60 * 1_000;
+export function cronChannelReadOnlyError() {
+    return new WebConsoleError("cron_channel_read_only", "Cron channels are read-only. Scheduled runs and history are managed by the agent.", 409);
+}
 export class WebStore {
     paths;
     database;
@@ -60,13 +67,23 @@ export class WebStore {
         this.database.close();
     }
     replaceAgents(agents) {
+        const current = this.listAgents();
+        const currentById = new Map(current.map((agent) => [agent.sourceId, agent]));
+        const incomingIds = new Set(agents.map((agent) => agent.sourceId));
+        const changed = agents.some((agent) => {
+            const prior = currentById.get(agent.sourceId);
+            return prior === undefined || !isDeepStrictEqual(prior, { ...agent, pinned: prior.pinned });
+        }) || current.some((agent) => !incomingIds.has(agent.sourceId) && agent.status !== "offline");
+        if (!changed)
+            return false;
         this.transaction(() => {
             this.database.prepare("UPDATE agents SET status = 'offline'").run();
             const statement = this.database.prepare(`
         INSERT INTO agents (
           source_id, label, status, health, supports_attachments, models_json,
-          default_model, default_effort, efforts_json, model_options_json, updated_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          default_model, default_effort, efforts_json, model_options_json,
+          cron_read, cron_actions, ask_by_id, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         ON CONFLICT(source_id) DO UPDATE SET
           label = excluded.label,
           status = excluded.status,
@@ -77,12 +94,16 @@ export class WebStore {
           default_effort = excluded.default_effort,
           efforts_json = excluded.efforts_json,
           model_options_json = excluded.model_options_json,
+          cron_read = excluded.cron_read,
+          cron_actions = excluded.cron_actions,
+          ask_by_id = excluded.ask_by_id,
           updated_at = excluded.updated_at
       `);
             for (const agent of agents) {
-                statement.run(agent.sourceId, agent.label, agent.status, agent.health ?? null, agent.supportsAttachments ? 1 : 0, stringifyOptional(agent.models), agent.defaultModel ?? null, agent.defaultEffort ?? null, stringifyOptional(agent.efforts), stringifyOptional(agent.modelOptions), agent.updatedAt);
+                statement.run(agent.sourceId, agent.label, agent.status, agent.health ?? null, agent.supportsAttachments ? 1 : 0, stringifyOptional(agent.models), agent.defaultModel ?? null, agent.defaultEffort ?? null, stringifyOptional(agent.efforts), stringifyOptional(agent.modelOptions), agent.cron?.read === true ? 1 : 0, agent.cron?.actions === true ? 1 : 0, agent.supportsAskById === true ? 1 : 0, agent.updatedAt);
             }
         });
+        return true;
     }
     listAgents() {
         const rows = this.database.prepare(agentSelectSql("ORDER BY pinned DESC, a.label COLLATE NOCASE, a.source_id")).all();
@@ -116,81 +137,192 @@ export class WebStore {
         if (input.text.trim().length === 0) {
             throw new WebConsoleError("invalid_notification", "Notification text cannot be empty.", 400);
         }
-        const threadId = notificationThreadId(input.sourceId, input.deliveryKey);
+        if ((input.jobId === undefined) !== (input.runId === undefined)
+            || (input.jobId !== undefined && input.triggerKind !== "cron")) {
+            throw new WebConsoleError("invalid_notification", "jobId and runId must be supplied together for cron notifications only.", 400);
+        }
+        const channel = input.jobId === undefined
+            ? undefined
+            : this.cronChannel(input.sourceId, input.jobId);
+        const threadId = input.jobId === undefined
+            ? notificationThreadId(input.sourceId, input.deliveryKey)
+            : channel?.thread_id ?? cronChannelThreadId(input.sourceId, input.jobId);
+        // Identity is compared through the structured columns below. Keep the
+        // content digest compatible with pre-v5 receipts so a newly-structured
+        // replay of an adopted historical delivery remains idempotent.
         const payloadSha256 = notificationPayloadSha256(input.triggerKind, input.text);
         const existing = this.database.prepare(`
       SELECT * FROM notification_deliveries WHERE source_id = ? AND delivery_key = ?
     `).get(input.sourceId, input.deliveryKey);
         if (existing !== undefined) {
-            if (existing.thread_id !== threadId
-                || existing.trigger_kind !== input.triggerKind
-                || existing.payload_sha256 !== payloadSha256) {
+            const historicalIdentity = input.jobId === undefined
+                && existing.trigger_kind === "cron"
+                && existing.job_id !== null
+                && existing.run_id !== null
+                ? legacyCronDeliveryIdentity(input.deliveryKey)
+                : undefined;
+            const expectedJobId = input.jobId ?? historicalIdentity?.jobId ?? null;
+            const expectedRunId = input.runId ?? historicalIdentity?.runId ?? null;
+            if (existing.trigger_kind !== input.triggerKind
+                || existing.payload_sha256 !== payloadSha256
+                || existing.job_id !== expectedJobId
+                || existing.run_id !== expectedRunId) {
                 throw new WebConsoleError("notification_idempotency_conflict", "The notification delivery key was already used with different content.", 409);
             }
+            if (existing.completed_at !== null && existing.thread_id === null) {
+                return {
+                    ...input,
+                    ...(historicalIdentity === undefined ? {} : historicalIdentity),
+                    payloadSha256,
+                    duplicate: true,
+                    tombstoned: true,
+                };
+            }
             if (existing.completed_at !== null && this.getThread(existing.thread_id) === undefined) {
                 throw new WebConsoleError("storage_corrupt", "A completed notification is missing its conversation.", 500);
             }
-            return { ...input, threadId, payloadSha256, duplicate: existing.completed_at !== null };
+            return {
+                ...input,
+                ...(historicalIdentity === undefined ? {} : historicalIdentity),
+                ...(existing.thread_id === null ? {} : { threadId: existing.thread_id }),
+                payloadSha256,
+                duplicate: existing.completed_at !== null,
+            };
         }
         const now = this.now();
+        if (input.jobId !== undefined
+            && input.runId !== undefined
+            && this.database.prepare(`
+        SELECT 1 FROM cron_channel_deletions WHERE source_id = ? AND job_id = ?
+      `).get(input.sourceId, input.jobId) !== undefined) {
+            this.database.prepare(`
+        INSERT INTO notification_deliveries (
+          source_id, delivery_key, thread_id, trigger_kind, job_id, run_id,
+          message_id, payload_sha256, created_at, completed_at
+        ) VALUES (?, ?, NULL, ?, ?, ?, NULL, ?, ?, ?)
+      `).run(input.sourceId, input.deliveryKey, input.triggerKind, input.jobId, input.runId, payloadSha256, now, now);
+            return { ...input, payloadSha256, duplicate: true, tombstoned: true };
+        }
         this.database.prepare(`
       INSERT INTO notification_deliveries (
-        source_id, delivery_key, thread_id, trigger_kind, payload_sha256, created_at, completed_at
-      ) VALUES (?, ?, ?, ?, ?, ?, NULL)
-    `).run(input.sourceId, input.deliveryKey, threadId, input.triggerKind, payloadSha256, now);
+        source_id, delivery_key, thread_id, trigger_kind, job_id, run_id,
+        message_id, payload_sha256, created_at, completed_at
+      ) VALUES (?, ?, ?, ?, ?, ?, NULL, ?, ?, NULL)
+    `).run(input.sourceId, input.deliveryKey, threadId, input.triggerKind, input.jobId ?? null, input.runId ?? null, payloadSha256, now);
         return { ...input, threadId, payloadSha256, duplicate: false };
     }
+    /** Agent-history namespace for a reserved console delivery. */
+    notificationConversationId(reservation) {
+        if (reservation.threadId === undefined) {
+            throw new WebConsoleError("notification_reservation_lost", "The notification reservation has no target.", 409);
+        }
+        return reservation.jobId === undefined
+            ? `web:${reservation.threadId}`
+            : cronConsoleConversationId(reservation.sourceId, reservation.jobId);
+    }
     completeNotification(reservation) {
         const existing = this.database.prepare(`
       SELECT * FROM notification_deliveries WHERE source_id = ? AND delivery_key = ?
     `).get(reservation.sourceId, reservation.deliveryKey);
         if (existing === undefined
-            || existing.thread_id !== reservation.threadId
             || existing.trigger_kind !== reservation.triggerKind
-            || existing.payload_sha256 !== reservation.payloadSha256) {
+            || existing.payload_sha256 !== reservation.payloadSha256
+            || existing.job_id !== (reservation.jobId ?? null)
+            || existing.run_id !== (reservation.runId ?? null)) {
             throw new WebConsoleError("notification_reservation_lost", "The notification reservation is no longer valid.", 409);
         }
         if (existing.completed_at !== null) {
+            if (existing.thread_id === null)
+                return { duplicate: true, tombstoned: true };
             return { thread: this.requireThread(existing.thread_id), duplicate: true };
         }
+        if (existing.thread_id === null || reservation.threadId === undefined) {
+            throw new WebConsoleError("notification_reservation_lost", "The notification reservation lost its target.", 409);
+        }
         const now = this.now();
-        const turnId = randomUUID();
-        const assistantMessageId = randomUUID();
-        const title = reservation.triggerKind === "cron" ? "Cron notification" : "Webhook notification";
+        let turnId = randomUUID();
+        let assistantMessageId = randomUUID();
+        let completedThreadId = existing.thread_id;
         this.transaction(() => {
-            if (this.getThread(reservation.threadId) !== undefined) {
+            const cronChannel = reservation.jobId === undefined
+                ? undefined
+                : this.cronChannel(reservation.sourceId, reservation.jobId);
+            completedThreadId = cronChannel?.thread_id ?? existing.thread_id;
+            const existingThread = this.getThread(completedThreadId);
+            if (existingThread === undefined) {
+                const title = reservation.jobId === undefined
+                    ? reservation.triggerKind === "cron" ? "Cron notification" : "Webhook notification"
+                    : `Cron · ${reservation.jobId}`;
+                this.database.prepare(`
+          INSERT INTO threads (
+            id, source_id, conversation_id, title, title_manual, trigger_kind, archived_at,
+            created_at, updated_at, revision
+          ) VALUES (?, ?, ?, ?, 0, ?, NULL, ?, ?, 1)
+        `).run(completedThreadId, reservation.sourceId, reservation.jobId === undefined
+                    ? `web:${completedThreadId}`
+                    : cronConsoleConversationId(reservation.sourceId, reservation.jobId), title, reservation.triggerKind, now, now);
+            }
+            else if (reservation.jobId === undefined) {
                 throw new WebConsoleError("notification_idempotency_conflict", "The notification conversation already exists.", 409);
             }
+            if (reservation.jobId !== undefined) {
+                this.database.prepare(`
+          INSERT INTO cron_channels (
+            source_id, job_id, thread_id, configured, created_at, updated_at
+          ) VALUES (?, ?, ?, 0, ?, ?)
+          ON CONFLICT(source_id, job_id) DO UPDATE SET
+            thread_id = excluded.thread_id,
+            updated_at = excluded.updated_at
+        `).run(reservation.sourceId, reservation.jobId, completedThreadId, now, now);
+            }
+            const mappedRun = reservation.jobId === undefined || reservation.runId === undefined
+                ? undefined
+                : this.database.prepare(`
+            SELECT turn_id, message_id FROM cron_run_messages
+            WHERE source_id = ? AND job_id = ? AND run_id = ? AND thread_id = ?
+          `).get(reservation.sourceId, reservation.jobId, reservation.runId, completedThreadId);
+            if (mappedRun === undefined) {
+                this.database.prepare(`
+          INSERT INTO turns (
+            id, thread_id, status, text, model, effort, assistant_message_id,
+            started_at, finished_at, error_code, error_message
+          ) VALUES (?, ?, 'complete', '', NULL, NULL, ?, ?, ?, NULL, NULL)
+        `).run(turnId, completedThreadId, assistantMessageId, now, now);
+                this.database.prepare(`
+          INSERT INTO messages (
+            id, thread_id, turn_id, role, parts_json, created_at, updated_at, status
+          ) VALUES (?, ?, ?, 'assistant', ?, ?, ?, 'complete')
+        `).run(assistantMessageId, completedThreadId, turnId, serializeParts([{ type: "text", text: reservation.text }]), now, now);
+            }
+            else {
+                turnId = mappedRun.turn_id;
+                assistantMessageId = mappedRun.message_id;
+                const message = this.database.prepare(`
+          SELECT parts_json FROM messages WHERE id = ? AND thread_id = ? AND turn_id = ?
+        `).get(assistantMessageId, completedThreadId, turnId);
+                if (message === undefined) {
+                    throw new WebConsoleError("storage_corrupt", "A cron run mapping is missing its message.", 500);
+                }
+                const parts = parseParts(message.parts_json);
+                if (!parts.some((part) => part.type === "text" && part.text === reservation.text)) {
+                    parts.push({ type: "text", text: reservation.text });
+                    this.database.prepare("UPDATE messages SET parts_json = ?, updated_at = ? WHERE id = ?")
+                        .run(serializeParts(parts), now, assistantMessageId);
+                }
+            }
             this.database.prepare(`
-        INSERT INTO threads (
-          id, source_id, conversation_id, title, title_manual, trigger_kind, archived_at,
-          created_at, updated_at, revision
-        ) VALUES (?, ?, ?, ?, 0, ?, NULL, ?, ?, 1)
-      `).run(reservation.threadId, reservation.sourceId, `web:${reservation.threadId}`, title, reservation.triggerKind, now, now);
-            this.database.prepare(`
-        INSERT INTO turns (
-          id, thread_id, status, text, model, effort, assistant_message_id,
-          started_at, finished_at, error_code, error_message
-        ) VALUES (?, ?, 'complete', '', NULL, NULL, ?, ?, ?, NULL, NULL)
-      `).run(turnId, reservation.threadId, assistantMessageId, now, now);
-            this.database.prepare(`
-        INSERT INTO messages (
-          id, thread_id, turn_id, role, parts_json, created_at, updated_at, status
-        ) VALUES (?, ?, ?, 'assistant', ?, ?, ?, 'complete')
-      `).run(assistantMessageId, reservation.threadId, turnId, JSON.stringify([{ type: "text", text: reservation.text }]), now, now);
-            this.database.prepare(`
-        INSERT INTO revisions (entity_kind, entity_id, revision, event, created_at)
-        VALUES ('thread', ?, 1, 'notification_created', ?)
-      `).run(reservation.threadId, now);
+        UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?
+      `).run(now, completedThreadId);
+            this.recordThreadRevision(completedThreadId, "notification_created", now);
             this.database.prepare(`
-        UPDATE notification_deliveries SET completed_at = ?
+        UPDATE notification_deliveries SET thread_id = ?, message_id = ?, completed_at = ?
         WHERE source_id = ? AND delivery_key = ? AND completed_at IS NULL
-      `).run(now, reservation.sourceId, reservation.deliveryKey);
+      `).run(completedThreadId, assistantMessageId, now, reservation.sourceId, reservation.deliveryKey);
             const agent = this.getAgent(reservation.sourceId);
             this.enqueueWebPushEventInTransaction({
-                logicalKey: `web-new:${reservation.threadId}`,
+                logicalKey: notificationPushLogicalKey(reservation.sourceId, reservation.deliveryKey),
                 kind: "response.ready",
-                threadId: reservation.threadId,
+                threadId: completedThreadId,
                 sourceId: reservation.sourceId,
                 title: `${agent?.label ?? "mono-agent"} · ${reservation.triggerKind.toUpperCase()}`,
                 body: reservation.text,
@@ -198,7 +330,483 @@ export class WebStore {
                 notBefore: new Date(new Date(now).getTime() + 3_000).toISOString(),
             });
         });
-        return { thread: this.requireThread(reservation.threadId), duplicate: false };
+        return { thread: this.requireThread(completedThreadId), duplicate: false };
+    }
+    /** Persist an agent-authoritative overview without deriving scheduler facts in the console. */
+    syncCronOverviewResult(overview) {
+        const effectiveJobs = this.effectiveIncomingCronJobs(overview.sourceId, overview.jobs);
+        if (this.cronOverviewMatches(overview, effectiveJobs)) {
+            const stored = this.storedCronOverview(overview.sourceId);
+            if (stored === undefined) {
+                throw new WebConsoleError("storage_corrupt", "Matched cron overview disappeared.", 500);
+            }
+            const threadByJobId = new Map(stored.jobs.map((job) => [job.jobId, job.threadId]));
+            return {
+                overview: {
+                    generatedAt: overview.generatedAt,
+                    actionsEnabled: overview.actionsEnabled,
+                    jobs: effectiveJobs.map((job) => {
+                        const threadId = threadByJobId.get(job.jobId);
+                        if (threadId === undefined) {
+                            throw new WebConsoleError("storage_corrupt", "Matched cron channel is missing.", 500);
+                        }
+                        return { ...job, threadId };
+                    }),
+                    ...(overview.degradedReason === undefined ? {} : { degradedReason: overview.degradedReason }),
+                    ...(overview.jobsTruncated === true ? { jobsTruncated: true } : {}),
+                },
+                changed: false,
+            };
+        }
+        return { overview: this.syncCronOverview(overview), changed: true };
+    }
+    syncCronOverview(overview) {
+        if (this.getAgent(overview.sourceId) === undefined) {
+            throw new WebConsoleError("agent_not_found", "Agent not found.", 404);
+        }
+        const effectiveJobs = this.effectiveIncomingCronJobs(overview.sourceId, overview.jobs);
+        const now = this.now();
+        const jobs = [];
+        this.transaction(() => {
+            this.database.prepare("UPDATE cron_channels SET configured = 0, updated_at = ? WHERE source_id = ?")
+                .run(now, overview.sourceId);
+            // Jobs omitted by the new authoritative overview remain historical
+            // channels. Reconcile their cached payload too so an offline read cannot
+            // resurrect the prior configured:true value after the relational column
+            // has already been cleared.
+            const removedSnapshots = this.database.prepare(`
+        SELECT s.job_id, s.payload_json
+        FROM cron_job_snapshots s
+        JOIN cron_channels c ON c.source_id = s.source_id AND c.job_id = s.job_id
+        WHERE s.source_id = ? AND c.configured = 0
+      `).all(overview.sourceId);
+            const markSnapshotRemoved = this.database.prepare(`
+        UPDATE cron_job_snapshots SET payload_json = ?, updated_at = ?
+        WHERE source_id = ? AND job_id = ?
+      `);
+            for (const snapshot of removedSnapshots) {
+                const job = parseStoredCronJob(snapshot.payload_json);
+                markSnapshotRemoved.run(JSON.stringify({ ...job, configured: false }), now, overview.sourceId, snapshot.job_id);
+            }
+            for (const job of effectiveJobs) {
+                if (job.configured) {
+                    this.database.prepare("DELETE FROM cron_channel_deletions WHERE source_id = ? AND job_id = ?")
+                        .run(overview.sourceId, job.jobId);
+                }
+                const current = this.cronChannel(overview.sourceId, job.jobId);
+                const threadId = current?.thread_id ?? cronChannelThreadId(overview.sourceId, job.jobId);
+                const existingThread = this.database.prepare("SELECT source_id, trigger_kind FROM threads WHERE id = ?")
+                    .get(threadId);
+                if (existingThread !== undefined
+                    && (existingThread.source_id !== overview.sourceId || existingThread.trigger_kind !== "cron")) {
+                    throw new WebConsoleError("storage_corrupt", "Cron channel identity collides with another conversation.", 500);
+                }
+                if (existingThread === undefined) {
+                    this.database.prepare(`
+            INSERT INTO threads (
+              id, source_id, conversation_id, title, title_manual, trigger_kind,
+              archived_at, created_at, updated_at, revision
+            ) VALUES (?, ?, ?, ?, 0, 'cron', NULL, ?, ?, 1)
+          `).run(threadId, overview.sourceId, cronConsoleConversationId(overview.sourceId, job.jobId), `Cron · ${job.jobId}`, now, now);
+                    this.database.prepare(`
+            INSERT INTO revisions (entity_kind, entity_id, revision, event, created_at)
+            VALUES ('thread', ?, 1, 'cron_channel_created', ?)
+          `).run(threadId, now);
+                }
+                else {
+                    this.database.prepare(`
+            UPDATE threads SET trigger_kind = 'cron',
+              title = CASE WHEN title_manual = 0 THEN ? ELSE title END
+            WHERE id = ?
+          `).run(`Cron · ${job.jobId}`, threadId);
+                }
+                this.database.prepare(`
+          INSERT INTO cron_channels (source_id, job_id, thread_id, configured, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?)
+          ON CONFLICT(source_id, job_id) DO UPDATE SET
+            thread_id = excluded.thread_id,
+            configured = excluded.configured,
+            updated_at = excluded.updated_at
+        `).run(overview.sourceId, job.jobId, threadId, job.configured ? 1 : 0, now, now);
+                this.database.prepare(`
+          INSERT INTO cron_job_snapshots (source_id, job_id, payload_json, updated_at)
+          VALUES (?, ?, ?, ?)
+          ON CONFLICT(source_id, job_id) DO UPDATE SET
+            payload_json = excluded.payload_json,
+            updated_at = excluded.updated_at
+        `).run(overview.sourceId, job.jobId, JSON.stringify(job), now);
+                jobs.push({ ...job, threadId });
+            }
+            this.database.prepare(`
+        INSERT INTO cron_overviews (
+          source_id, generated_at, actions_enabled, degraded_reason, jobs_truncated, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(source_id) DO UPDATE SET
+          generated_at = excluded.generated_at,
+          actions_enabled = excluded.actions_enabled,
+          degraded_reason = excluded.degraded_reason,
+          jobs_truncated = excluded.jobs_truncated,
+          updated_at = excluded.updated_at
+      `).run(overview.sourceId, overview.generatedAt, overview.actionsEnabled ? 1 : 0, overview.degradedReason ?? null, overview.jobsTruncated === true ? 1 : 0, now);
+        });
+        return {
+            generatedAt: overview.generatedAt,
+            actionsEnabled: overview.actionsEnabled,
+            jobs,
+            ...(overview.degradedReason === undefined ? {} : { degradedReason: overview.degradedReason }),
+            ...(overview.jobsTruncated === true ? { jobsTruncated: true } : {}),
+        };
+    }
+    effectiveIncomingCronJobs(sourceId, jobs) {
+        const tombstoned = this.database.prepare(`
+      SELECT 1 FROM cron_channel_deletions WHERE source_id = ? AND job_id = ?
+    `);
+        return jobs.filter((job) => job.configured || tombstoned.get(sourceId, job.jobId) === undefined);
+    }
+    cronOverviewMatches(overview, effectiveJobs) {
+        const stored = this.storedCronOverview(overview.sourceId);
+        if (stored === undefined
+            || stored.actionsEnabled !== overview.actionsEnabled
+            || stored.degradedReason !== overview.degradedReason
+            || (stored.jobsTruncated === true) !== (overview.jobsTruncated === true))
+            return false;
+        const storedById = new Map(stored.jobs.map((job) => [job.jobId, job]));
+        for (const incoming of effectiveJobs) {
+            const current = storedById.get(incoming.jobId);
+            if (current === undefined)
+                return false;
+            const { threadId: _threadId, ...currentPayload } = current;
+            if (!isDeepStrictEqual(currentPayload, incoming))
+                return false;
+        }
+        if (overview.jobsTruncated === true)
+            return true;
+        const incomingIds = new Set(effectiveJobs.map((job) => job.jobId));
+        return stored.jobs.every((job) => incomingIds.has(job.jobId) || job.configured === false);
+    }
+    storedCronOverview(sourceId) {
+        const overview = this.database.prepare("SELECT * FROM cron_overviews WHERE source_id = ?")
+            .get(sourceId);
+        if (overview === undefined)
+            return undefined;
+        const rows = this.database.prepare(`
+      SELECT s.payload_json, c.thread_id, c.configured
+      FROM cron_job_snapshots s
+      JOIN cron_channels c ON c.source_id = s.source_id AND c.job_id = s.job_id
+      WHERE s.source_id = ? ORDER BY s.job_id
+    `).all(sourceId);
+        const jobs = rows.map((row) => ({
+            ...parseStoredCronJob(row.payload_json),
+            configured: row.configured === 1,
+            threadId: row.thread_id,
+        }));
+        return {
+            generatedAt: overview.generated_at,
+            actionsEnabled: overview.actions_enabled === 1,
+            jobs,
+            ...(overview.degraded_reason === null ? {} : { degradedReason: overview.degraded_reason }),
+            ...(overview.jobs_truncated === 1 ? { jobsTruncated: true } : {}),
+        };
+    }
+    cronThread(sourceId, jobId) {
+        const channel = this.cronChannel(sourceId, jobId);
+        return channel === undefined ? undefined : this.getThread(channel.thread_id);
+    }
+    cronConversationIdForThread(threadId) {
+        const resolved = this.resolveThreadId(threadId);
+        const row = this.database.prepare(`
+      SELECT s.payload_json FROM cron_channels c
+      JOIN cron_job_snapshots s ON s.source_id = c.source_id AND s.job_id = c.job_id
+      WHERE c.thread_id = ?
+    `).get(resolved);
+        return row === undefined ? undefined : parseStoredCronJob(row.payload_json).conversationId;
+    }
+    storedCronRuns(sourceId, jobId, limit = 100) {
+        const bounded = boundedPageLimit(limit, 100);
+        const rows = this.database.prepare(`
+      SELECT payload_json FROM cron_run_messages
+      WHERE source_id = ? AND job_id = ?
+      ORDER BY ordered_at DESC, sequence DESC, run_id DESC LIMIT ?
+    `).all(sourceId, jobId, bounded);
+        return { runs: rows.map((row) => parseStoredCronRun(row.payload_json)) };
+    }
+    reconcileCronRuns(sourceId, jobId, runs) {
+        return [...this.reconcileCronRunsResult(sourceId, jobId, runs).messages];
+    }
+    reconcileCronRunsResult(sourceId, jobId, runs) {
+        const channel = this.cronChannel(sourceId, jobId);
+        if (channel === undefined) {
+            throw new WebConsoleError("cron_job_not_found", "Cron channel not found.", 404);
+        }
+        const jobRow = this.database.prepare(`
+      SELECT payload_json FROM cron_job_snapshots WHERE source_id = ? AND job_id = ?
+    `).get(sourceId, jobId);
+        const conversationId = jobRow === undefined
+            ? `cron:${jobId}`
+            : parseStoredCronJob(jobRow.payload_json).conversationId;
+        const ordered = [...runs].sort(compareCronRuns);
+        if (ordered.length === 0)
+            return { messages: [], changed: false };
+        const now = this.now();
+        const messageIds = [];
+        let changed = false;
+        this.transaction(() => {
+            for (const run of ordered) {
+                if (run.jobId !== jobId) {
+                    throw new WebConsoleError("invalid_cron_response", "Cron run belongs to another job.", 502);
+                }
+                const mapped = this.database.prepare(`
+          SELECT thread_id, turn_id, message_id, ordered_at, sequence, payload_json
+          FROM cron_run_messages
+          WHERE source_id = ? AND job_id = ? AND run_id = ?
+        `).get(sourceId, jobId, run.runId);
+                if (mapped !== undefined && (mapped.ordered_at !== run.orderedAt || mapped.sequence !== run.sequence)) {
+                    throw new WebConsoleError("invalid_cron_response", "Cron run ordering identity changed after admission.", 502);
+                }
+                const delivered = mapped === undefined
+                    ? this.database.prepare(`
+              SELECT d.message_id, m.turn_id
+              FROM notification_deliveries d
+              JOIN messages m ON m.id = d.message_id
+              WHERE d.source_id = ? AND d.job_id = ? AND d.run_id = ?
+                AND d.thread_id = ? AND d.completed_at IS NOT NULL
+              ORDER BY d.completed_at DESC LIMIT 1
+            `).get(sourceId, jobId, run.runId, channel.thread_id)
+                    : undefined;
+                const turnId = mapped?.turn_id ?? delivered?.turn_id ?? cronEntityId("turn", sourceId, jobId, run.runId);
+                const messageId = mapped?.message_id ?? delivered?.message_id ?? cronEntityId("message", sourceId, jobId, run.runId);
+                messageIds.push(messageId);
+                const prior = this.database.prepare(`
+          SELECT thread_id, turn_id, parts_json, created_at, status FROM messages WHERE id = ?
+        `).get(messageId);
+                const priorParts = prior === undefined ? [] : parseParts(prior.parts_json);
+                const parts = cronRunParts(run, priorParts, conversationId);
+                const serializedParts = serializeParts(parts);
+                const status = cronMessageStatus(run.status);
+                const turnStatus = status === "running" ? "running" : status;
+                const finishedAt = status === "running" ? null : run.completedAt ?? run.orderedAt;
+                const existingTurn = this.database.prepare(`
+          SELECT thread_id, status, text, assistant_message_id, started_at, finished_at,
+            error_code, error_message FROM turns WHERE id = ?
+        `).get(turnId);
+                const preserveLoadedText = run.projection === "summary"
+                    && run.fieldsTruncated?.includes("text") === true
+                    && priorParts.some((part) => part.type === "telemetry"
+                        && part.event === "cron_run"
+                        && record(part.data)?.activityLoaded === true);
+                const preserveLoadedError = run.projection === "summary"
+                    && priorParts.some((part) => part.type === "telemetry"
+                        && part.event === "cron_run"
+                        && record(part.data)?.activityLoaded === true)
+                    && (run.fieldsTruncated?.includes("error") === true
+                        || run.fieldsTruncated?.includes("failureKind") === true);
+                const turnText = preserveLoadedText && existingTurn !== undefined
+                    ? existingTurn.text
+                    : run.text ?? "";
+                const turnErrorCode = preserveLoadedError && existingTurn !== undefined
+                    ? existingTurn.error_code
+                    : run.failureKind ?? null;
+                const turnErrorMessage = preserveLoadedError && existingTurn !== undefined
+                    ? existingTurn.error_message
+                    : run.error ?? null;
+                if (existingTurn === undefined) {
+                    this.database.prepare(`
+            INSERT INTO turns (
+              id, thread_id, status, text, model, effort, assistant_message_id,
+              started_at, finished_at, error_code, error_message
+            ) VALUES (?, ?, ?, ?, NULL, NULL, ?, ?, ?, ?, ?)
+          `).run(turnId, channel.thread_id, turnStatus, turnText, messageId, run.orderedAt, finishedAt, turnErrorCode, turnErrorMessage);
+                    changed = true;
+                }
+                else if (existingTurn.thread_id !== channel.thread_id
+                    || existingTurn.status !== turnStatus
+                    || existingTurn.text !== turnText
+                    || existingTurn.assistant_message_id !== messageId
+                    || existingTurn.started_at !== run.orderedAt
+                    || existingTurn.finished_at !== finishedAt
+                    || existingTurn.error_code !== turnErrorCode
+                    || existingTurn.error_message !== turnErrorMessage) {
+                    this.database.prepare(`
+            UPDATE turns SET thread_id = ?, status = ?, text = ?, assistant_message_id = ?,
+              started_at = ?, finished_at = ?, error_code = ?, error_message = ?
+            WHERE id = ?
+          `).run(channel.thread_id, turnStatus, turnText, messageId, run.orderedAt, finishedAt, turnErrorCode, turnErrorMessage, turnId);
+                    changed = true;
+                }
+                if (prior === undefined) {
+                    this.database.prepare(`
+            INSERT INTO messages (
+              id, thread_id, turn_id, role, parts_json, created_at, updated_at, status
+            ) VALUES (?, ?, ?, 'assistant', ?, ?, ?, ?)
+          `).run(messageId, channel.thread_id, turnId, serializedParts, run.orderedAt, now, status);
+                    changed = true;
+                }
+                else if (prior.thread_id !== channel.thread_id
+                    || prior.turn_id !== turnId
+                    || prior.parts_json !== serializedParts
+                    || prior.created_at !== run.orderedAt
+                    || prior.status !== status) {
+                    this.database.prepare(`
+            UPDATE messages SET thread_id = ?, turn_id = ?, parts_json = ?,
+              created_at = ?, updated_at = ?, status = ? WHERE id = ?
+          `).run(channel.thread_id, turnId, serializedParts, run.orderedAt, now, status, messageId);
+                    changed = true;
+                }
+                // Detail is a message projection, not a replacement for the compact
+                // page identity. Keeping the existing summary prevents the next
+                // unchanged page poll from undoing a detail load and creating churn.
+                const serializedRun = run.projection === "detail" && mapped !== undefined
+                    ? mapped.payload_json
+                    : JSON.stringify(cronRunSummary(run));
+                if (mapped === undefined
+                    || mapped.thread_id !== channel.thread_id
+                    || mapped.turn_id !== turnId
+                    || mapped.message_id !== messageId
+                    || mapped.payload_json !== serializedRun) {
+                    this.database.prepare(`
+            INSERT INTO cron_run_messages (
+              source_id, job_id, run_id, thread_id, turn_id, message_id,
+              ordered_at, sequence, payload_json, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            ON CONFLICT(source_id, job_id, run_id) DO UPDATE SET
+              thread_id = excluded.thread_id,
+              turn_id = excluded.turn_id,
+              message_id = excluded.message_id,
+              payload_json = excluded.payload_json,
+              updated_at = excluded.updated_at
+          `).run(sourceId, jobId, run.runId, channel.thread_id, turnId, messageId, run.orderedAt, run.sequence, serializedRun, now);
+                    changed = true;
+                }
+            }
+            if (changed) {
+                const newest = ordered.at(-1);
+                this.database.prepare(`
+          UPDATE threads SET updated_at = MAX(updated_at, ?), revision = revision + 1 WHERE id = ?
+        `).run(newest.completedAt ?? newest.startedAt ?? newest.orderedAt, channel.thread_id);
+                this.recordThreadRevision(channel.thread_id, "cron_runs_reconciled", now);
+                const excess = this.database.prepare(`
+          SELECT turn_id FROM (
+            SELECT turn_id, ROW_NUMBER() OVER (
+              PARTITION BY source_id, job_id ORDER BY ordered_at DESC, sequence DESC, run_id DESC
+            ) AS retained_row
+            FROM cron_run_messages WHERE source_id = ? AND job_id = ?
+          ) WHERE retained_row > 500
+        `).all(sourceId, jobId);
+                const remove = this.database.prepare("DELETE FROM turns WHERE id = ?");
+                for (const row of excess)
+                    remove.run(row.turn_id);
+            }
+        });
+        return {
+            messages: [...new Set(messageIds)].map((messageId) => this.requireMessage(messageId)),
+            changed,
+        };
+    }
+    /** Append or update exactly one retained card for a web-origin process job. */
+    upsertProcessJobCard(input) {
+        const projection = parseProcessJobProjection(input.processJob);
+        const thread = this.requireThread(input.threadId);
+        if (thread.sourceId !== input.sourceId) {
+            throw new WebConsoleError("invalid_notification", "The process job does not belong to this agent thread.", 409);
+        }
+        const originConversation = projection.origin.conversationId.split("#", 1)[0];
+        if (projection.origin.channel !== "web" || originConversation !== `web:${input.threadId}`) {
+            throw new WebConsoleError("invalid_notification", "The process job origin does not match this web thread.", 409);
+        }
+        if (input.deliveryKey !== projection.wake.deliveryKey) {
+            throw new WebConsoleError("invalid_notification", "The process job delivery key does not match its projection.", 409);
+        }
+        if (input.responseText !== undefined
+            && (input.responseText.trim().length === 0 || input.responseText.length > 8_000)) {
+            throw new WebConsoleError("invalid_notification", "The process job response must contain 1 to 8000 characters.", 413);
+        }
+        const existing = this.database.prepare(`
+      SELECT * FROM process_job_cards WHERE source_id = ? AND job_id = ?
+    `).get(input.sourceId, projection.jobId);
+        const projectionJson = JSON.stringify(projection);
+        const projectionSha256 = createHash("sha256").update(projectionJson).digest("hex");
+        const now = this.now();
+        if (existing === undefined) {
+            const messageId = randomUUID();
+            const parts = processJobCardParts(projection, input.responseText, input.replyParts);
+            this.transaction(() => {
+                this.database.prepare(`
+          INSERT INTO messages (id, thread_id, turn_id, role, parts_json, created_at, updated_at, status)
+          VALUES (?, ?, NULL, 'assistant', ?, ?, ?, ?)
+        `).run(messageId, input.threadId, serializeParts(parts), now, now, isTerminalJobState(projection.state) ? "complete" : "running");
+                this.database.prepare(`
+          INSERT INTO process_job_cards (
+            source_id, job_id, delivery_key, thread_id, message_id,
+            projection_sha256, response_text, created_at, updated_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(input.sourceId, projection.jobId, input.deliveryKey, input.threadId, messageId, projectionSha256, input.responseText ?? null, now, now);
+                this.database.prepare("UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?")
+                    .run(now, input.threadId);
+                this.recordThreadRevision(input.threadId, "process_job_card_created", now);
+            });
+            return { thread: this.requireThread(input.threadId), duplicate: false };
+        }
+        if (existing.thread_id !== input.threadId || existing.delivery_key !== input.deliveryKey) {
+            throw new WebConsoleError("notification_idempotency_conflict", "The process job was already bound to a different web thread or delivery key.", 409);
+        }
+        const message = this.database.prepare("SELECT * FROM messages WHERE id = ?")
+            .get(existing.message_id);
+        if (message === undefined || message.thread_id !== input.threadId) {
+            throw new WebConsoleError("storage_corrupt", "A retained process-job card is missing its message.", 500);
+        }
+        const priorParts = parseParts(message.parts_json);
+        const priorJobParts = priorParts.filter((part) => part.type === "process-job");
+        const priorReplyParts = priorParts.filter(isDurableWebReplyPart);
+        const priorPart = priorJobParts[0];
+        if (priorJobParts.length !== 1
+            || priorPart === undefined
+            || priorPart.job.jobId !== projection.jobId
+            || priorParts.length !== 1 + priorReplyParts.length) {
+            throw new WebConsoleError("storage_corrupt", "A retained process-job card has invalid content.", 500);
+        }
+        assertProcessJobCardTransition(priorPart.job, projection);
+        const hasPriorWakeResponse = existing.response_text !== null || priorReplyParts.length > 0;
+        if (hasPriorWakeResponse
+            && input.responseText !== undefined
+            && input.responseText !== (existing.response_text ?? undefined)) {
+            throw new WebConsoleError("notification_idempotency_conflict", "The process-job wake response cannot be replaced by different text.", 409);
+        }
+        const responseText = input.responseText ?? existing.response_text ?? undefined;
+        const nextReplyParts = input.replyParts === undefined
+            ? priorReplyParts
+            : boundedWebReplyParts(input.replyParts, []);
+        if (hasPriorWakeResponse
+            && input.replyParts !== undefined
+            && !isDeepStrictEqual(nextReplyParts, priorReplyParts)) {
+            throw new WebConsoleError("notification_idempotency_conflict", "The process-job wake reply parts cannot be replaced by different parts.", 409);
+        }
+        const replyPartsChanged = !isDeepStrictEqual(nextReplyParts, priorReplyParts);
+        if (existing.projection_sha256 === projectionSha256
+            && responseText === (existing.response_text ?? undefined)
+            && !replyPartsChanged) {
+            return { thread, duplicate: true };
+        }
+        this.transaction(() => {
+            this.database.prepare(`
+        UPDATE messages SET parts_json = ?, updated_at = ?, status = ? WHERE id = ?
+      `).run(serializeParts([processJobPart(projection, responseText), ...nextReplyParts]), now, isTerminalJobState(projection.state) ? "complete" : "running", existing.message_id);
+            this.database.prepare(`
+        UPDATE process_job_cards
+        SET projection_sha256 = ?, response_text = ?, updated_at = ?
+        WHERE source_id = ? AND job_id = ?
+      `).run(projectionSha256, responseText ?? null, now, input.sourceId, projection.jobId);
+            this.database.prepare("UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?")
+                .run(now, input.threadId);
+            this.recordThreadRevision(input.threadId, "process_job_card_updated", now);
+        });
+        return { thread: this.requireThread(input.threadId), duplicate: false };
+    }
+    /** Exact retained binding used before proxying a single operator job. */
+    processJobCardBelongsToThread(sourceId, threadId, jobId) {
+        return this.database.prepare(`
+      SELECT 1 FROM process_job_cards
+      WHERE source_id = ? AND thread_id = ? AND job_id = ?
+    `).get(sourceId, threadId, jobId) !== undefined;
     }
     createThread(sourceId) {
         const agent = this.getAgent(sourceId);
@@ -220,42 +828,152 @@ export class WebStore {
         });
         return this.requireThread(id);
     }
+    /** Bounded bootstrap: at most one 200-row bucket per (source_id, archived). */
     listThreads() {
-        const rows = this.database.prepare(threadSelectSql("ORDER BY t.updated_at DESC, t.id")).all();
+        const rows = this.database.prepare(threadSelectSql(`
+      WHERE t.id IN (
+        SELECT id FROM (
+          SELECT id,
+                 ROW_NUMBER() OVER (
+                   PARTITION BY source_id, CASE WHEN archived_at IS NULL THEN 0 ELSE 1 END
+                   ORDER BY updated_at DESC, id DESC
+                 ) AS bucket_row
+          FROM threads
+        ) WHERE bucket_row <= ${String(WEB_THREAD_PAGE_MAX)}
+      )
+      ORDER BY t.updated_at DESC, t.id DESC
+    `)).all();
         return rows.map((row) => this.mapThread(row));
     }
+    listThreadsPage(input) {
+        if (this.getAgent(input.sourceId) === undefined) {
+            throw new WebConsoleError("agent_not_found", "Agent not found.", 404);
+        }
+        const limit = boundedPageLimit(input.limit, WEB_THREAD_PAGE_MAX);
+        const cursor = input.before === undefined ? undefined : decodeThreadCursor(input.before);
+        const archivedSql = input.archived ? "t.archived_at IS NOT NULL" : "t.archived_at IS NULL";
+        const beforeSql = cursor === undefined
+            ? ""
+            : "AND (t.updated_at < ? OR (t.updated_at = ? AND t.id < ?))";
+        const values = [input.sourceId];
+        if (cursor !== undefined)
+            values.push(cursor.updatedAt, cursor.updatedAt, cursor.id);
+        values.push(limit + 1);
+        const rows = this.database.prepare(threadSelectSql(`
+      WHERE t.source_id = ? AND ${archivedSql} ${beforeSql}
+      ORDER BY t.updated_at DESC, t.id DESC LIMIT ?
+    `)).all(...values);
+        const hasMore = rows.length > limit;
+        const pageRows = rows.slice(0, limit);
+        const last = pageRows.at(-1);
+        return {
+            threads: pageRows.map((row) => this.mapThread(row)),
+            ...(hasMore && last !== undefined
+                ? { nextCursor: encodeCursor({ updatedAt: last.updated_at, id: last.id }) }
+                : {}),
+        };
+    }
+    resolveThreadId(id) {
+        let resolved = id;
+        const seen = new Set();
+        for (let depth = 0; depth < 32; depth += 1) {
+            if (seen.has(resolved)) {
+                throw new WebConsoleError("storage_corrupt", "Conversation redirects contain a cycle.", 500);
+            }
+            seen.add(resolved);
+            const row = this.database.prepare("SELECT new_thread_id FROM thread_redirects WHERE old_thread_id = ?")
+                .get(resolved);
+            if (row === undefined)
+                return resolved;
+            resolved = row.new_thread_id;
+        }
+        throw new WebConsoleError("storage_corrupt", "Conversation redirect chain is too deep.", 500);
+    }
     getThread(id) {
-        const row = this.database.prepare(threadSelectSql("WHERE t.id = ?")).get(id);
+        const resolved = this.resolveThreadId(id);
+        const row = this.database.prepare(threadSelectSql("WHERE t.id = ?")).get(resolved);
         return row === undefined ? undefined : this.mapThread(row);
     }
     getThreadDetail(id) {
-        const thread = this.getThread(id);
+        const resolved = this.resolveThreadId(id);
+        const thread = this.getThread(resolved);
         if (thread === undefined)
             return undefined;
+        const page = this.listMessagesPage(resolved);
+        return {
+            thread,
+            messages: page.messages,
+            ...(page.nextCursor === undefined ? {} : { messagesNextCursor: page.nextCursor }),
+        };
+    }
+    getMessage(id) {
+        const row = this.database.prepare("SELECT * FROM messages WHERE id = ?")
+            .get(id);
+        return row === undefined ? undefined : this.mapMessage(row);
+    }
+    listMessagesPage(id, input = {}) {
+        const resolved = this.resolveThreadId(id);
+        if (this.getThread(resolved) === undefined) {
+            throw new WebConsoleError("thread_not_found", "Conversation not found.", 404);
+        }
+        const limit = boundedPageLimit(input.limit, WEB_MESSAGE_PAGE_MAX);
+        const cursor = input.before === undefined ? undefined : decodeMessageCursor(input.before);
+        const rank = messageRoleRankSql("m", "t");
+        const orderedAt = "COALESCE(t.started_at, m.created_at)";
+        const beforeSql = cursor === undefined ? "" : `AND (
+      ${orderedAt} < ?
+      OR (${orderedAt} = ? AND ${rank} < ?)
+      OR (${orderedAt} = ? AND ${rank} = ? AND m.created_at < ?)
+      OR (${orderedAt} = ? AND ${rank} = ? AND m.created_at = ? AND m.rowid < ?)
+    )`;
+        const values = [resolved];
+        if (cursor !== undefined) {
+            values.push(cursor.orderedAt, cursor.orderedAt, cursor.roleRank, cursor.orderedAt, cursor.roleRank, cursor.createdAt, cursor.orderedAt, cursor.roleRank, cursor.createdAt, cursor.rowid);
+        }
+        values.push(limit + 1);
         const rows = this.database.prepare(`
-      SELECT m.* FROM messages m
+      SELECT m.*, ${orderedAt} AS ordered_at, ${rank} AS role_rank, m.rowid AS storage_rowid
+      FROM messages m
       LEFT JOIN turns t ON t.id = m.turn_id
-      WHERE m.thread_id = ?
-      ORDER BY COALESCE(t.started_at, m.created_at),
-        CASE WHEN m.turn_id IS NOT NULL AND m.role = 'user' THEN 0
-             WHEN m.turn_id IS NOT NULL AND m.role = 'system' THEN 1
-             WHEN m.turn_id IS NOT NULL THEN 2
-             ELSE 3 END,
-        m.created_at, m.rowid
-    `).all(id);
-        return { thread, messages: rows.map((row) => this.mapMessage(row)) };
+      WHERE m.thread_id = ? ${beforeSql}
+      ORDER BY ordered_at DESC, role_rank DESC, m.created_at DESC, storage_rowid DESC
+      LIMIT ?
+    `).all(...values);
+        const hasMore = rows.length > limit;
+        const pageRows = rows.slice(0, limit).reverse();
+        const oldest = pageRows[0];
+        return {
+            messages: pageRows.map((row) => this.mapMessage(row)),
+            ...(hasMore && oldest !== undefined
+                ? {
+                    nextCursor: encodeCursor({
+                        orderedAt: oldest.ordered_at,
+                        roleRank: oldest.role_rank,
+                        createdAt: oldest.created_at,
+                        rowid: oldest.storage_rowid,
+                    }),
+                }
+                : {}),
+        };
     }
     currentThreadId() {
         const row = this.database.prepare("SELECT value FROM settings WHERE key = 'current_thread_id'").get();
-        if (row === undefined || this.getThread(row.value) === undefined)
+        if (row === undefined)
+            return undefined;
+        const resolved = this.resolveThreadId(row.value);
+        if (this.getThread(resolved) === undefined)
             return undefined;
-        return row.value;
+        if (resolved !== row.value)
+            this.setSetting("current_thread_id", resolved);
+        return resolved;
     }
     selectThread(id) {
-        this.requireThread(id);
-        this.setSetting("current_thread_id", id);
+        const resolved = this.resolveThreadId(id);
+        this.requireThread(resolved);
+        this.setSetting("current_thread_id", resolved);
     }
     patchThread(id, patch) {
+        id = this.resolveThreadId(id);
         const current = this.requireThread(id);
         const now = this.now();
         const title = patch.title === undefined ? undefined : normalizeTitle(patch.title);
@@ -281,10 +999,16 @@ export class WebStore {
         return { ...this.requireThread(id), sourceId: current.sourceId };
     }
     async deleteArchivedThread(id) {
+        id = this.resolveThreadId(id);
         const thread = this.requireThread(id);
         if (thread.archivedAt === null) {
             throw new WebConsoleError("thread_not_archived", "Archive the conversation before deleting it.", 409);
         }
+        const cronChannel = this.database.prepare("SELECT * FROM cron_channels WHERE thread_id = ?")
+            .get(id);
+        if (cronChannel?.configured === 1) {
+            throw new WebConsoleError("cron_channel_configured", "Configured cron channels can be archived but not deleted.", 409);
+        }
         const attachments = this.database.prepare("SELECT * FROM attachments WHERE thread_id = ?")
             .all(id);
         this.transaction(() => {
@@ -294,7 +1018,21 @@ export class WebStore {
         WHERE event_id IN (SELECT id FROM push_events WHERE thread_id = ?)
           AND status IN ('pending', 'sending')
       `).run(now, now, id);
-            this.database.prepare("DELETE FROM notification_deliveries WHERE thread_id = ?").run(id);
+            // Keep the delivery receipt after its channel is removed. Replays remain
+            // duplicates and can never resurrect a deleted historical channel.
+            this.database.prepare(`
+        UPDATE notification_deliveries
+        SET thread_id = NULL, message_id = NULL, completed_at = COALESCE(completed_at, ?)
+        WHERE thread_id = ?
+      `).run(now, id);
+            if (cronChannel !== undefined) {
+                this.database.prepare(`
+          INSERT INTO cron_channel_deletions (source_id, job_id, deleted_at)
+          VALUES (?, ?, ?)
+          ON CONFLICT(source_id, job_id) DO UPDATE SET deleted_at = excluded.deleted_at
+        `).run(cronChannel.source_id, cronChannel.job_id, now);
+            }
+            this.database.prepare("DELETE FROM cron_channels WHERE thread_id = ?").run(id);
             this.database.prepare("DELETE FROM revisions WHERE entity_kind = 'thread' AND entity_id = ?").run(id);
             this.database.prepare("DELETE FROM threads WHERE id = ?").run(id);
             this.database.prepare("DELETE FROM settings WHERE key = 'current_thread_id' AND value = ?").run(id);
@@ -410,14 +1148,17 @@ export class WebStore {
         return removed;
     }
     beginTurn(input) {
-        const thread = this.requireThread(input.threadId);
+        const threadId = this.resolveThreadId(input.threadId);
+        const thread = this.requireThread(threadId);
         if (thread.archivedAt !== null) {
             throw new WebConsoleError("thread_archived", "Unarchive this conversation before sending another message.", 409);
         }
+        if (thread.trigger?.kind === "cron")
+            throw cronChannelReadOnlyError();
         if (!thread.canSend) {
             throw new WebConsoleError("agent_offline", "This agent is offline. The conversation remains available read-only.", 409);
         }
-        const active = this.database.prepare("SELECT id FROM turns WHERE thread_id = ? AND status = 'running'").get(input.threadId);
+        const active = this.database.prepare("SELECT id FROM turns WHERE thread_id = ? AND status = 'running'").get(threadId);
         if (active !== undefined) {
             throw new WebConsoleError("turn_active", "This conversation already has an active turn.", 409);
         }
@@ -445,7 +1186,7 @@ export class WebStore {
             if (input.quote.text.trim().length === 0 || input.quote.messageId.trim().length === 0) {
                 throw new WebConsoleError("invalid_quote", "Quoted text and its source message are required.", 400);
             }
-            const source = this.database.prepare("SELECT id FROM messages WHERE id = ? AND thread_id = ?").get(input.quote.messageId, input.threadId);
+            const source = this.database.prepare("SELECT id FROM messages WHERE id = ? AND thread_id = ?").get(input.quote.messageId, threadId);
             if (source === undefined) {
                 throw new WebConsoleError("invalid_quote", "The quoted message does not belong to this conversation.", 400);
             }
@@ -460,7 +1201,7 @@ export class WebStore {
           id, thread_id, status, text, model, effort, assistant_message_id,
           started_at, finished_at, error_code, error_message
         ) VALUES (?, ?, 'running', ?, ?, ?, ?, ?, NULL, NULL, NULL)
-      `).run(turnId, input.threadId, input.text, input.model ?? null, input.effort ?? null, assistantMessageId, now);
+      `).run(turnId, threadId, input.text, input.model ?? null, input.effort ?? null, assistantMessageId, now);
             const userParts = [
                 ...(input.quote === undefined
                     ? []
@@ -470,18 +1211,18 @@ export class WebStore {
             this.database.prepare(`
         INSERT INTO messages (id, thread_id, turn_id, role, parts_json, created_at, updated_at, status)
         VALUES (?, ?, ?, 'user', ?, ?, ?, 'complete')
-      `).run(userMessageId, input.threadId, turnId, JSON.stringify(userParts), now, now);
+      `).run(userMessageId, threadId, turnId, serializeParts(userParts), now, now);
             this.database.prepare(`
         INSERT INTO messages (id, thread_id, turn_id, role, parts_json, created_at, updated_at, status)
         VALUES (?, ?, ?, 'assistant', '[]', ?, ?, 'running')
-      `).run(assistantMessageId, input.threadId, turnId, now, now);
+      `).run(assistantMessageId, threadId, turnId, now, now);
             const commitAttachment = this.database.prepare(`
         UPDATE attachments
         SET thread_id = ?, message_id = ?, status = 'committed', updated_at = ?
         WHERE id = ?
       `);
             for (const attachment of attachments) {
-                commitAttachment.run(input.threadId, userMessageId, now, attachment.id);
+                commitAttachment.run(threadId, userMessageId, now, attachment.id);
             }
             const title = deriveAutomaticTitle(input.text, attachments);
             this.database.prepare(`
@@ -489,26 +1230,29 @@ export class WebStore {
         SET title = CASE WHEN title_manual = 0 AND title = 'New conversation' THEN ? ELSE title END,
             updated_at = ?, revision = revision + 1
         WHERE id = ?
-      `).run(title, now, input.threadId);
-            this.recordThreadRevision(input.threadId, "turn_started", now);
-            this.setSetting("current_thread_id", input.threadId);
+      `).run(title, now, threadId);
+            this.recordThreadRevision(threadId, "turn_started", now);
+            this.setSetting("current_thread_id", threadId);
         });
         return {
             turnId,
-            conversationId: `web:${input.threadId}`,
+            conversationId: `web:${threadId}`,
             text: input.text,
             ...(input.quote === undefined ? {} : { quote: input.quote }),
             userMessageId,
             assistantMessageId,
             attachments: attachments.map((attachment) => this.requireStoredAttachment(attachment.id)),
-            thread: this.requireThread(input.threadId),
+            thread: this.requireThread(threadId),
         };
     }
     reserveLiveInput(threadId, text) {
+        threadId = this.resolveThreadId(threadId);
         const thread = this.requireThread(threadId);
         if (thread.archivedAt !== null) {
             throw new WebConsoleError("thread_archived", "Unarchive this conversation before sending another message.", 409);
         }
+        if (thread.trigger?.kind === "cron")
+            throw cronChannelReadOnlyError();
         if (!thread.canSend) {
             throw new WebConsoleError("agent_offline", "This agent is offline. The conversation remains available read-only.", 409);
         }
@@ -535,7 +1279,7 @@ export class WebStore {
             this.database.prepare(`
         INSERT INTO messages (id, thread_id, turn_id, role, parts_json, created_at, updated_at, status)
         VALUES (?, ?, ?, 'user', ?, ?, ?, 'complete')
-      `).run(messageId, threadId, active?.id ?? null, JSON.stringify(parts), now, now);
+      `).run(messageId, threadId, active?.id ?? null, serializeParts(parts), now, now);
             this.database.prepare(`
         INSERT INTO live_inputs (
           id, thread_id, message_id, active_turn_id, text, model, effort, status, created_at, updated_at
@@ -567,7 +1311,7 @@ export class WebStore {
         const now = this.now();
         this.transaction(() => {
             this.database.prepare("UPDATE messages SET parts_json = ?, updated_at = ? WHERE id = ?")
-                .run(JSON.stringify(withLiveInputStatus(message.parts, "applied")), now, row.message_id);
+                .run(serializeParts(withLiveInputStatus(message.parts, "applied")), now, row.message_id);
             this.database.prepare("DELETE FROM live_inputs WHERE id = ?").run(id);
             this.database.prepare("UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?")
                 .run(now, row.thread_id);
@@ -586,7 +1330,7 @@ export class WebStore {
         UPDATE live_inputs SET status = 'queued', active_turn_id = NULL, updated_at = ? WHERE id = ?
       `).run(now, id);
             this.database.prepare("UPDATE messages SET turn_id = NULL, parts_json = ?, updated_at = ? WHERE id = ?")
-                .run(JSON.stringify(withLiveInputStatus(message.parts, "queued")), now, row.message_id);
+                .run(serializeParts(withLiveInputStatus(message.parts, "queued")), now, row.message_id);
             this.database.prepare("UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?")
                 .run(now, row.thread_id);
             this.recordThreadRevision(row.thread_id, "live_input_queued", now);
@@ -601,7 +1345,7 @@ export class WebStore {
         const now = this.now();
         this.transaction(() => {
             this.database.prepare("UPDATE messages SET turn_id = NULL, parts_json = ?, updated_at = ? WHERE id = ?")
-                .run(JSON.stringify(withLiveInputStatus(message.parts, "cancelled")), now, row.message_id);
+                .run(serializeParts(withLiveInputStatus(message.parts, "cancelled")), now, row.message_id);
             this.database.prepare("DELETE FROM live_inputs WHERE id = ?").run(id);
             this.database.prepare("UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?")
                 .run(now, row.thread_id);
@@ -610,6 +1354,7 @@ export class WebStore {
         return this.requireMessage(row.message_id);
     }
     cancelLiveInputs(threadId) {
+        threadId = this.resolveThreadId(threadId);
         const rows = this.database.prepare("SELECT * FROM live_inputs WHERE thread_id = ? ORDER BY created_at, rowid").all(threadId);
         if (rows.length === 0)
             return [];
@@ -618,7 +1363,7 @@ export class WebStore {
             const update = this.database.prepare("UPDATE messages SET turn_id = NULL, parts_json = ?, updated_at = ? WHERE id = ?");
             for (const row of rows) {
                 const message = this.requireMessage(row.message_id);
-                update.run(JSON.stringify(withLiveInputStatus(message.parts, "cancelled")), now, row.message_id);
+                update.run(serializeParts(withLiveInputStatus(message.parts, "cancelled")), now, row.message_id);
             }
             this.database.prepare("DELETE FROM live_inputs WHERE thread_id = ?").run(threadId);
             this.database.prepare("UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?")
@@ -634,6 +1379,7 @@ export class WebStore {
     `).all().map((row) => row.thread_id);
     }
     promoteNextQueuedLiveInput(threadId) {
+        threadId = this.resolveThreadId(threadId);
         const active = this.database.prepare("SELECT id FROM turns WHERE thread_id = ? AND status = 'running'").get(threadId);
         if (active !== undefined)
             return undefined;
@@ -659,7 +1405,7 @@ export class WebStore {
         ) VALUES (?, ?, 'running', ?, ?, ?, ?, ?, NULL, NULL, NULL)
       `).run(turnId, threadId, row.text, row.model, row.effort, assistantMessageId, now);
             this.database.prepare("UPDATE messages SET turn_id = ?, parts_json = ?, updated_at = ? WHERE id = ?")
-                .run(turnId, JSON.stringify(withoutLiveInputTelemetry(userMessage.parts)), now, row.message_id);
+                .run(turnId, serializeParts(withoutLiveInputTelemetry(userMessage.parts)), now, row.message_id);
             this.database.prepare(`
         INSERT INTO messages (id, thread_id, turn_id, role, parts_json, created_at, updated_at, status)
         VALUES (?, ?, ?, 'assistant', '[]', ?, ?, 'running')
@@ -713,7 +1459,7 @@ export class WebStore {
         const now = this.now();
         this.transaction(() => {
             this.database.prepare("UPDATE messages SET parts_json = ?, updated_at = ? WHERE id = ?")
-                .run(JSON.stringify(parts), now, message.id);
+                .run(serializeParts(parts), now, message.id);
             if (actualModel !== undefined || actualEffort !== undefined) {
                 this.database.prepare(`
           UPDATE turns SET
@@ -725,9 +1471,9 @@ export class WebStore {
         });
         return this.requireMessage(message.id);
     }
-    completeTurn(turnId, finalText, metadata) {
+    completeTurn(turnId, finalText, metadata, replyParts) {
         const runtime = runtimeMetadata(metadata);
-        return this.finishTurn(turnId, "complete", finalText, undefined, undefined, runtime);
+        return this.finishTurn(turnId, "complete", finalText, undefined, undefined, runtime, replyParts);
     }
     failTurn(turnId, error) {
         return this.finishTurn(turnId, error.cancelled === true ? "cancelled" : "failed", undefined, error.code, error.message, undefined);
@@ -736,6 +1482,7 @@ export class WebStore {
         return this.finishTurn(turnId, "interrupted", undefined, "interrupted", message, undefined);
     }
     activeTurn(threadId) {
+        threadId = this.resolveThreadId(threadId);
         const row = this.database.prepare("SELECT id FROM turns WHERE thread_id = ? AND status = 'running'").get(threadId);
         return row === undefined ? undefined : { id: row.id, conversationId: `web:${threadId}` };
     }
@@ -778,6 +1525,23 @@ export class WebStore {
         });
         return { ...generated, fingerprint: generatedFingerprint };
     }
+    /** Stable owner-private key for short-lived message-bound rich-part URLs. */
+    ensureReplyAccessKey(generate) {
+        const existing = this.database.prepare("SELECT value FROM settings WHERE key = 'reply_access_key_v1'")
+            .get();
+        if (existing !== undefined) {
+            if (!/^[A-Za-z0-9_-]{43}$/u.test(existing.value)) {
+                throw new WebConsoleError("reply_access_key_corrupt", "The stored reply access key is invalid.", 500);
+            }
+            return existing.value;
+        }
+        const created = generate();
+        if (!/^[A-Za-z0-9_-]{43}$/u.test(created)) {
+            throw new WebConsoleError("reply_access_key_generation_failed", "Unable to generate a reply access key.", 500);
+        }
+        this.setSetting("reply_access_key_v1", created);
+        return created;
+    }
     registerWebPushSubscription(input) {
         const endpointSha256 = createHash("sha256").update(input.endpoint).digest("hex");
         const previousEndpointSha256 = input.previousEndpoint === undefined
@@ -1076,6 +1840,9 @@ export class WebStore {
         default_effort TEXT,
         efforts_json TEXT,
         model_options_json TEXT,
+        cron_read INTEGER NOT NULL DEFAULT 0,
+        cron_actions INTEGER NOT NULL DEFAULT 0,
+        ask_by_id INTEGER NOT NULL DEFAULT 0,
         updated_at TEXT NOT NULL
       );
       CREATE TABLE IF NOT EXISTS threads (
@@ -1161,13 +1928,87 @@ export class WebStore {
       CREATE TABLE IF NOT EXISTS notification_deliveries (
         source_id TEXT NOT NULL REFERENCES agents(source_id),
         delivery_key TEXT NOT NULL,
-        thread_id TEXT NOT NULL UNIQUE,
+        thread_id TEXT,
+        message_id TEXT,
         trigger_kind TEXT NOT NULL CHECK (trigger_kind IN ('cron', 'webhook')),
+        job_id TEXT,
+        run_id TEXT,
         payload_sha256 TEXT NOT NULL,
         created_at TEXT NOT NULL,
         completed_at TEXT,
+        CHECK ((job_id IS NULL AND run_id IS NULL) OR (trigger_kind = 'cron' AND job_id IS NOT NULL AND run_id IS NOT NULL)),
         PRIMARY KEY (source_id, delivery_key)
       );
+      CREATE INDEX IF NOT EXISTS notification_deliveries_by_thread
+        ON notification_deliveries(thread_id) WHERE thread_id IS NOT NULL;
+      CREATE TABLE IF NOT EXISTS cron_channels (
+        source_id TEXT NOT NULL REFERENCES agents(source_id),
+        job_id TEXT NOT NULL,
+        thread_id TEXT NOT NULL UNIQUE REFERENCES threads(id) ON DELETE CASCADE,
+        configured INTEGER NOT NULL CHECK (configured IN (0, 1)),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (source_id, job_id)
+      );
+      CREATE INDEX IF NOT EXISTS cron_channels_by_source
+        ON cron_channels(source_id, configured, job_id);
+      CREATE TABLE IF NOT EXISTS cron_channel_deletions (
+        source_id TEXT NOT NULL REFERENCES agents(source_id) ON DELETE CASCADE,
+        job_id TEXT NOT NULL,
+        deleted_at TEXT NOT NULL,
+        PRIMARY KEY (source_id, job_id)
+      );
+      CREATE TABLE IF NOT EXISTS cron_overviews (
+        source_id TEXT PRIMARY KEY REFERENCES agents(source_id) ON DELETE CASCADE,
+        generated_at TEXT NOT NULL,
+        actions_enabled INTEGER NOT NULL CHECK (actions_enabled IN (0, 1)),
+        degraded_reason TEXT,
+        jobs_truncated INTEGER NOT NULL DEFAULT 0 CHECK (jobs_truncated IN (0, 1)),
+        updated_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS cron_job_snapshots (
+        source_id TEXT NOT NULL,
+        job_id TEXT NOT NULL,
+        payload_json TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (source_id, job_id),
+        FOREIGN KEY (source_id, job_id) REFERENCES cron_channels(source_id, job_id) ON DELETE CASCADE
+      );
+      CREATE TABLE IF NOT EXISTS cron_run_messages (
+        source_id TEXT NOT NULL,
+        job_id TEXT NOT NULL,
+        run_id TEXT NOT NULL,
+        thread_id TEXT NOT NULL REFERENCES threads(id) ON DELETE CASCADE,
+        turn_id TEXT NOT NULL UNIQUE REFERENCES turns(id) ON DELETE CASCADE,
+        message_id TEXT NOT NULL UNIQUE REFERENCES messages(id) ON DELETE CASCADE,
+        ordered_at TEXT NOT NULL,
+        sequence INTEGER NOT NULL,
+        payload_json TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (source_id, job_id, run_id),
+        FOREIGN KEY (source_id, job_id) REFERENCES cron_channels(source_id, job_id) ON DELETE CASCADE
+      );
+      CREATE INDEX IF NOT EXISTS cron_run_messages_by_order
+        ON cron_run_messages(source_id, job_id, ordered_at DESC, sequence DESC, run_id DESC);
+      CREATE TABLE IF NOT EXISTS thread_redirects (
+        old_thread_id TEXT PRIMARY KEY,
+        new_thread_id TEXT NOT NULL REFERENCES threads(id) ON DELETE CASCADE,
+        created_at TEXT NOT NULL,
+        CHECK (old_thread_id <> new_thread_id)
+      );
+      CREATE TABLE IF NOT EXISTS process_job_cards (
+        source_id TEXT NOT NULL REFERENCES agents(source_id),
+        job_id TEXT NOT NULL,
+        delivery_key TEXT NOT NULL,
+        thread_id TEXT NOT NULL REFERENCES threads(id) ON DELETE CASCADE,
+        message_id TEXT NOT NULL UNIQUE REFERENCES messages(id) ON DELETE CASCADE,
+        projection_sha256 TEXT NOT NULL,
+        response_text TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (source_id, job_id),
+        UNIQUE (source_id, delivery_key)
+      );
       CREATE TABLE IF NOT EXISTS push_subscriptions (
         id TEXT PRIMARY KEY,
         endpoint TEXT NOT NULL,
@@ -1227,6 +2068,15 @@ export class WebStore {
                         this.database.exec("ALTER TABLE threads ADD COLUMN trigger_kind TEXT CHECK (trigger_kind IN ('cron', 'webhook'))");
                     }
                 }
+                if (versionRow.user_version < 5)
+                    this.migrateCronChannels();
+                if (versionRow.user_version < 6) {
+                    const columns = new Set(this.database.prepare("PRAGMA table_info(cron_overviews)").all()
+                        .map((column) => column.name));
+                    if (!columns.has("jobs_truncated")) {
+                        this.database.exec("ALTER TABLE cron_overviews ADD COLUMN jobs_truncated INTEGER NOT NULL DEFAULT 0 CHECK (jobs_truncated IN (0, 1))");
+                    }
+                }
                 if (migrating)
                     this.database.exec(`PRAGMA user_version = ${WEB_STORAGE_SCHEMA_VERSION}; COMMIT`);
             }
@@ -1243,6 +2093,140 @@ export class WebStore {
             throw new WebConsoleError("storage_corrupt", `Unable to initialize web state: ${error instanceof Error ? error.message : String(error)}`, 500);
         }
     }
+    /**
+     * Schema-v5 adoption runs after every older fixup inside the same
+     * BEGIN IMMEDIATE transaction. Each operation is guarded by the resulting
+     * schema/keys, so reopening an interrupted migration is idempotent.
+     */
+    migrateCronChannels() {
+        const agentColumns = new Set(this.database.prepare("PRAGMA table_info(agents)").all()
+            .map((column) => column.name));
+        if (!agentColumns.has("cron_read")) {
+            this.database.exec("ALTER TABLE agents ADD COLUMN cron_read INTEGER NOT NULL DEFAULT 0");
+        }
+        if (!agentColumns.has("cron_actions")) {
+            this.database.exec("ALTER TABLE agents ADD COLUMN cron_actions INTEGER NOT NULL DEFAULT 0");
+        }
+        if (!agentColumns.has("ask_by_id")) {
+            this.database.exec("ALTER TABLE agents ADD COLUMN ask_by_id INTEGER NOT NULL DEFAULT 0");
+        }
+        const deliveryColumns = this.database.prepare("PRAGMA table_info(notification_deliveries)")
+            .all();
+        const threadColumn = deliveryColumns.find((column) => column.name === "thread_id");
+        if (!deliveryColumns.some((column) => column.name === "job_id") || threadColumn?.notnull === 1) {
+            const legacyRows = this.database.prepare("SELECT * FROM notification_deliveries")
+                .all();
+            this.database.exec(`
+        DROP TABLE notification_deliveries;
+        CREATE TABLE notification_deliveries (
+          source_id TEXT NOT NULL REFERENCES agents(source_id),
+          delivery_key TEXT NOT NULL,
+          thread_id TEXT,
+          message_id TEXT,
+          trigger_kind TEXT NOT NULL CHECK (trigger_kind IN ('cron', 'webhook')),
+          job_id TEXT,
+          run_id TEXT,
+          payload_sha256 TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          completed_at TEXT,
+          CHECK ((job_id IS NULL AND run_id IS NULL) OR (trigger_kind = 'cron' AND job_id IS NOT NULL AND run_id IS NOT NULL)),
+          PRIMARY KEY (source_id, delivery_key)
+        );
+        CREATE INDEX notification_deliveries_by_thread
+          ON notification_deliveries(thread_id) WHERE thread_id IS NOT NULL;
+      `);
+            const insert = this.database.prepare(`
+        INSERT INTO notification_deliveries (
+          source_id, delivery_key, thread_id, trigger_kind, job_id, run_id,
+          message_id, payload_sha256, created_at, completed_at
+        ) VALUES (?, ?, ?, ?, ?, ?, NULL, ?, ?, ?)
+      `);
+            for (const row of legacyRows) {
+                const identity = row.trigger_kind === "cron" ? legacyCronDeliveryIdentity(row.delivery_key) : undefined;
+                insert.run(row.source_id, row.delivery_key, row.thread_id, row.trigger_kind, identity?.jobId ?? null, identity?.runId ?? null, row.payload_sha256, row.created_at, row.completed_at);
+            }
+            this.database.exec(`
+        UPDATE notification_deliveries
+        SET message_id = (
+          SELECT m.id FROM messages m
+          WHERE m.thread_id = notification_deliveries.thread_id AND m.role = 'assistant'
+          ORDER BY m.created_at DESC, m.rowid DESC LIMIT 1
+        )
+        WHERE completed_at IS NOT NULL
+      `);
+        }
+        // Startup recovery normally runs after schema initialization. Cron adoption
+        // can merge several legacy notification threads into one thread, though,
+        // and two independently-running legacy turns would violate the one-active-
+        // turn index during that reparenting. Settle them while this migration's
+        // BEGIN IMMEDIATE transaction still owns the database, before any merge.
+        this.recoverInterruptedTurnsInTransaction();
+        const adoptable = this.database.prepare(`
+      SELECT d.source_id, d.job_id, d.thread_id, d.created_at, t.created_at AS thread_created_at
+      FROM notification_deliveries d
+      JOIN threads t ON t.id = d.thread_id
+      WHERE d.trigger_kind = 'cron' AND d.job_id IS NOT NULL AND d.run_id IS NOT NULL
+        AND d.thread_id IS NOT NULL AND d.completed_at IS NOT NULL
+      ORDER BY d.source_id, d.job_id, t.created_at, d.created_at, d.thread_id
+    `).all();
+        const groups = new Map();
+        for (const row of adoptable) {
+            const key = `${row.source_id}\0${row.job_id}`;
+            const group = groups.get(key) ?? [];
+            if (!group.some((entry) => entry.thread_id === row.thread_id))
+                group.push(row);
+            groups.set(key, group);
+        }
+        const now = this.now();
+        for (const rows of groups.values()) {
+            const canonical = rows[0];
+            if (canonical === undefined)
+                continue;
+            const existing = this.cronChannel(canonical.source_id, canonical.job_id);
+            const canonicalId = existing?.thread_id ?? canonical.thread_id;
+            const conversationId = cronConsoleConversationId(canonical.source_id, canonical.job_id);
+            this.database.prepare(`
+        UPDATE threads SET conversation_id = ?, trigger_kind = 'cron', title = ?, updated_at = MAX(updated_at, ?)
+        WHERE id = ?
+      `).run(conversationId, `Cron · ${canonical.job_id}`, canonical.created_at, canonicalId);
+            this.database.prepare(`
+        INSERT INTO cron_channels (source_id, job_id, thread_id, configured, created_at, updated_at)
+        VALUES (?, ?, ?, 0, ?, ?)
+        ON CONFLICT(source_id, job_id) DO NOTHING
+      `).run(canonical.source_id, canonical.job_id, canonicalId, canonical.thread_created_at, now);
+            for (const legacy of rows) {
+                if (legacy.thread_id === canonicalId)
+                    continue;
+                this.database.prepare("UPDATE turns SET thread_id = ? WHERE thread_id = ?")
+                    .run(canonicalId, legacy.thread_id);
+                this.database.prepare("UPDATE messages SET thread_id = ? WHERE thread_id = ?")
+                    .run(canonicalId, legacy.thread_id);
+                this.database.prepare("UPDATE live_inputs SET thread_id = ? WHERE thread_id = ?")
+                    .run(canonicalId, legacy.thread_id);
+                this.database.prepare("UPDATE attachments SET thread_id = ? WHERE thread_id = ?")
+                    .run(canonicalId, legacy.thread_id);
+                this.database.prepare("UPDATE push_events SET thread_id = ? WHERE thread_id = ?")
+                    .run(canonicalId, legacy.thread_id);
+                this.database.prepare("UPDATE notification_deliveries SET thread_id = ? WHERE thread_id = ?")
+                    .run(canonicalId, legacy.thread_id);
+                this.database.prepare(`
+          UPDATE revisions SET entity_id = ? WHERE entity_kind = 'thread' AND entity_id = ?
+        `).run(canonicalId, legacy.thread_id);
+                this.database.prepare("UPDATE settings SET value = ? WHERE key = 'current_thread_id' AND value = ?")
+                    .run(canonicalId, legacy.thread_id);
+                this.database.prepare(`
+          INSERT INTO thread_redirects (old_thread_id, new_thread_id, created_at)
+          VALUES (?, ?, ?) ON CONFLICT(old_thread_id) DO UPDATE SET new_thread_id = excluded.new_thread_id
+        `).run(legacy.thread_id, canonicalId, now);
+                this.database.prepare("DELETE FROM threads WHERE id = ?").run(legacy.thread_id);
+            }
+            this.database.prepare(`
+        UPDATE threads SET revision = revision + 1,
+          updated_at = MAX(updated_at, COALESCE((SELECT MAX(created_at) FROM messages WHERE thread_id = ?), updated_at))
+        WHERE id = ?
+      `).run(canonicalId, canonicalId);
+        }
+    }
     validateStorage() {
         const check = this.database.prepare("PRAGMA quick_check(1)").get();
         if (check === undefined || !Object.values(check).includes("ok")) {
@@ -1258,6 +2242,13 @@ export class WebStore {
             "revisions",
             "settings",
             "notification_deliveries",
+            "cron_channels",
+            "cron_channel_deletions",
+            "cron_overviews",
+            "cron_job_snapshots",
+            "cron_run_messages",
+            "thread_redirects",
+            "process_job_cards",
             "push_subscriptions",
             "push_events",
             "push_deliveries",
@@ -1284,6 +2275,12 @@ export class WebStore {
             this.interruptTurn(turnId, "The web service restarted before this turn completed.");
         }
     }
+    recoverInterruptedTurnsInTransaction() {
+        const active = this.listActiveTurnIds();
+        for (const turnId of active) {
+            this.finishTurnInTransaction(turnId, "interrupted", undefined, "interrupted", "The web service restarted before this turn completed.", undefined);
+        }
+    }
     recoverLiveInputs() {
         const rows = this.database.prepare("SELECT * FROM live_inputs WHERE status = 'offered' ORDER BY created_at, rowid").all();
         if (rows.length === 0)
@@ -1302,7 +2299,7 @@ export class WebStore {
                     throw new WebConsoleError("storage_corrupt", `Live input ${row.id} has no message.`, 500);
                 }
                 updateInput.run(now, row.id);
-                updateMessage.run(JSON.stringify(withLiveInputStatus(parseParts(persisted.parts_json), "queued")), now, row.message_id);
+                updateMessage.run(serializeParts(withLiveInputStatus(parseParts(persisted.parts_json), "queued")), now, row.message_id);
             }
             for (const threadId of threadIds) {
                 this.database.prepare("UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?")
@@ -1318,72 +2315,83 @@ export class WebStore {
       WHERE status = 'sending'
     `).run(now, now);
     }
-    finishTurn(turnId, status, finalText, errorCode, errorMessage, runtime) {
+    finishTurn(turnId, status, finalText, errorCode, errorMessage, runtime, replyParts) {
         const turn = this.requireTurn(turnId);
-        const existing = this.requireMessage(turn.assistant_message_id);
         if (turn.status !== "running") {
             return this.requireThreadDetail(turn.thread_id);
         }
-        const parts = [...existing.parts];
+        this.transaction(() => {
+            this.finishTurnInTransaction(turnId, status, finalText, errorCode, errorMessage, runtime, replyParts);
+        });
+        return this.requireThreadDetail(turn.thread_id);
+    }
+    finishTurnInTransaction(turnId, status, finalText, errorCode, errorMessage, runtime, replyParts) {
+        const turn = this.requireTurn(turnId);
+        if (turn.status !== "running")
+            return;
+        const existing = this.requireMessage(turn.assistant_message_id);
+        let parts = [...existing.parts];
         if (finalText !== undefined && finalText.length > 0)
             reconcileFinalText(parts, finalText);
+        if (replyParts !== undefined)
+            parts = boundedWebReplyParts(replyParts, parts);
         if (errorMessage !== undefined) {
             parts.push({ type: "error", ...(errorCode === undefined ? {} : { code: errorCode }), message: errorMessage });
         }
         const now = this.now();
         const thread = this.requireThread(turn.thread_id);
         const agent = this.getAgent(thread.sourceId);
-        this.transaction(() => {
-            this.database.prepare(`
+        this.database.prepare(`
         UPDATE turns SET status = ?, finished_at = ?, error_code = ?, error_message = ?,
           model = CASE WHEN ? IS NULL THEN model ELSE ? END,
           effort = CASE WHEN ? IS NULL THEN effort ELSE ? END
         WHERE id = ?
-      `).run(status, now, errorCode ?? null, errorMessage ?? null, runtime?.model ?? null, runtime?.model ?? null, runtime?.effort ?? null, runtime?.effort ?? null, turnId);
-            this.database.prepare("UPDATE messages SET parts_json = ?, status = ?, updated_at = ? WHERE id = ?")
-                .run(JSON.stringify(parts), status, now, existing.id);
-            this.database.prepare("UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?")
-                .run(now, turn.thread_id);
-            this.recordThreadRevision(turn.thread_id, `turn_${status}`, now);
-            const recentEnoughForRecoveredInterruption = status !== "interrupted"
-                || new Date(now).getTime() - new Date(existing.updatedAt).getTime() <= 60 * 60 * 1_000;
-            if (recentEnoughForRecoveredInterruption) {
-                const kind = status === "complete"
-                    ? "response.ready"
-                    : status === "cancelled"
-                        ? "run.cancelled"
-                        : status === "interrupted"
-                            ? "run.interrupted"
-                            : "run.failed";
-                const label = agent?.label ?? "mono-agent";
-                const body = status === "complete"
-                    ? parts.filter((part) => part.type === "text")
-                        .map((part) => part.text)
-                        .join(" ")
+    `).run(status, now, errorCode ?? null, errorMessage ?? null, runtime?.model ?? null, runtime?.model ?? null, runtime?.effort ?? null, runtime?.effort ?? null, turnId);
+        this.database.prepare("UPDATE messages SET parts_json = ?, status = ?, updated_at = ? WHERE id = ?")
+            .run(serializeParts(parts), status, now, existing.id);
+        this.database.prepare("UPDATE threads SET updated_at = ?, revision = revision + 1 WHERE id = ?")
+            .run(now, turn.thread_id);
+        this.recordThreadRevision(turn.thread_id, `turn_${status}`, now);
+        const recentEnoughForRecoveredInterruption = status !== "interrupted"
+            || new Date(now).getTime() - new Date(existing.updatedAt).getTime() <= 60 * 60 * 1_000;
+        // Projected cron turns are agent-owned scheduler state. Restart recovery
+        // still settles the local projection, but only web-owned turns may emit a
+        // Web Push terminal notification from this service.
+        if (thread.trigger?.kind !== "cron" && recentEnoughForRecoveredInterruption) {
+            const kind = status === "complete"
+                ? "response.ready"
+                : status === "cancelled"
+                    ? "run.cancelled"
+                    : status === "interrupted"
+                        ? "run.interrupted"
+                        : "run.failed";
+            const label = agent?.label ?? "mono-agent";
+            const body = status === "complete"
+                ? parts.filter((part) => part.type === "text")
+                    .map((part) => part.text)
+                    .join(" ")
+                : status === "cancelled"
+                    ? "The run was cancelled."
+                    : status === "interrupted"
+                        ? "The run was interrupted when the web service stopped."
+                        : errorMessage ?? "The run failed.";
+            this.enqueueWebPushEventInTransaction({
+                logicalKey: `turn:${turnId}:terminal`,
+                kind,
+                threadId: turn.thread_id,
+                sourceId: thread.sourceId,
+                title: status === "complete"
+                    ? `${label} replied`
                     : status === "cancelled"
-                        ? "The run was cancelled."
+                        ? `${label} run cancelled`
                         : status === "interrupted"
-                            ? "The run was interrupted when the web service stopped."
-                            : errorMessage ?? "The run failed.";
-                this.enqueueWebPushEventInTransaction({
-                    logicalKey: `turn:${turnId}:terminal`,
-                    kind,
-                    threadId: turn.thread_id,
-                    sourceId: thread.sourceId,
-                    title: status === "complete"
-                        ? `${label} replied`
-                        : status === "cancelled"
-                            ? `${label} run cancelled`
-                            : status === "interrupted"
-                                ? `${label} run interrupted`
-                                : `${label} run failed`,
-                    body,
-                    expiresAt: new Date(new Date(now).getTime() + (status === "complete" ? 24 : 1) * 60 * 60 * 1_000).toISOString(),
-                    notBefore: new Date(new Date(now).getTime() + 3_000).toISOString(),
-                });
-            }
-        });
-        return this.requireThreadDetail(turn.thread_id);
+                            ? `${label} run interrupted`
+                            : `${label} run failed`,
+                body,
+                expiresAt: new Date(new Date(now).getTime() + (status === "complete" ? 24 : 1) * 60 * 60 * 1_000).toISOString(),
+                notBefore: new Date(new Date(now).getTime() + 3_000).toISOString(),
+            });
+        }
     }
     mapThread(row) {
         const runState = this.latestRunState(row.id);
@@ -1396,9 +2404,17 @@ export class WebStore {
             createdAt: row.created_at,
             updatedAt: row.updated_at,
             revision: row.revision,
-            ...(row.trigger_kind === "cron" || row.trigger_kind === "webhook"
-                ? { trigger: { kind: row.trigger_kind } }
-                : {}),
+            ...(row.trigger_kind === "cron"
+                ? {
+                    trigger: {
+                        kind: "cron",
+                        ...(row.cron_job_id === null ? {} : { jobId: row.cron_job_id }),
+                        ...(row.cron_configured === null ? {} : { configured: row.cron_configured === 1 }),
+                    },
+                }
+                : row.trigger_kind === "webhook"
+                    ? { trigger: { kind: "webhook" } }
+                    : {}),
             ...(preview === undefined ? {} : { lastMessagePreview: preview }),
             messageCount: row.message_count,
             runState,
@@ -1458,6 +2474,11 @@ export class WebStore {
             .trim();
         return text.length === 0 ? undefined : text.slice(0, 160);
     }
+    cronChannel(sourceId, jobId) {
+        return this.database.prepare(`
+      SELECT * FROM cron_channels WHERE source_id = ? AND job_id = ?
+    `).get(sourceId, jobId);
+    }
     requireThread(id) {
         const thread = this.getThread(id);
         if (thread === undefined)
@@ -1586,6 +2607,13 @@ export class WebStore {
         const row = this.database.prepare("SELECT revision FROM threads WHERE id = ?").get(threadId);
         this.database.prepare("INSERT INTO revisions (entity_kind, entity_id, revision, event, created_at) VALUES ('thread', ?, ?, ?, ?)")
             .run(threadId, row.revision, event, now);
+        this.database.prepare(`
+      DELETE FROM revisions WHERE id IN (
+        SELECT id FROM revisions
+        WHERE entity_kind = 'thread' AND entity_id = ?
+        ORDER BY revision DESC, id DESC LIMIT -1 OFFSET ?
+      )
+    `).run(threadId, MAX_REVISIONS_PER_THREAD);
     }
     setSetting(key, value) {
         this.database.prepare("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value")
@@ -1684,10 +2712,14 @@ function isValidVapidKeyPair(publicKey, privateKey) {
 function threadSelectSql(suffix) {
     return `
     SELECT t.id, t.source_id, t.title, t.trigger_kind, t.archived_at, t.created_at, t.updated_at, t.revision,
-           CASE WHEN a.status = 'online' OR a.status = 'degraded' THEN 1 ELSE 0 END AS can_send,
-           CASE WHEN (a.status = 'online' OR a.status = 'degraded') AND a.supports_attachments = 1 THEN 1 ELSE 0 END AS can_upload,
+           cc.job_id AS cron_job_id, cc.configured AS cron_configured,
+           CASE WHEN t.trigger_kind = 'cron' THEN 0
+                WHEN a.status = 'online' OR a.status = 'degraded' THEN 1 ELSE 0 END AS can_send,
+           CASE WHEN t.trigger_kind = 'cron' THEN 0
+                WHEN (a.status = 'online' OR a.status = 'degraded') AND a.supports_attachments = 1 THEN 1 ELSE 0 END AS can_upload,
            (SELECT COUNT(*) FROM messages m WHERE m.thread_id = t.id) AS message_count
     FROM threads t JOIN agents a ON a.source_id = t.source_id
+    LEFT JOIN cron_channels cc ON cc.thread_id = t.id
     ${suffix}
   `;
 }
@@ -1714,6 +2746,21 @@ function notificationThreadId(sourceId, deliveryKey) {
         .slice(0, 32);
     return `notification-${digest}`;
 }
+function cronChannelThreadId(sourceId, jobId) {
+    return `cron-${stableDigest(sourceId, jobId)}`;
+}
+function cronConsoleConversationId(sourceId, jobId) {
+    return `web-cron:${stableDigest(sourceId, jobId)}`;
+}
+function cronEntityId(kind, sourceId, jobId, runId) {
+    return `cron-${kind}-${stableDigest(sourceId, jobId, runId)}`;
+}
+function stableDigest(...values) {
+    const hash = createHash("sha256");
+    for (const value of values)
+        hash.update(value).update("\0");
+    return hash.digest("hex").slice(0, 32);
+}
 function notificationPayloadSha256(kind, text) {
     return createHash("sha256")
         .update(kind)
@@ -1721,6 +2768,282 @@ function notificationPayloadSha256(kind, text) {
         .update(text)
         .digest("hex");
 }
+export function notificationPushLogicalKey(sourceId, deliveryKey) {
+    return `web-new:${stableDigest(sourceId, deliveryKey)}`;
+}
+function legacyCronDeliveryIdentity(deliveryKey) {
+    // Parse from the anchored terminal suffix and fixed-width canonical UTC
+    // timestamp. The greedy job segment may therefore contain legal literal
+    // colons while malformed prefixes/suffixes remain unadoptable.
+    const isoTimestamp = "(\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z)";
+    const success = new RegExp(`^cron:(.+):${isoTimestamp}:success$`, "u").exec(deliveryKey);
+    const failure = new RegExp(`^cron:(.+):${isoTimestamp}:failure:[^:]+$`, "u").exec(deliveryKey);
+    const match = success ?? failure;
+    if (match === null)
+        return undefined;
+    const encodedJobId = match[1];
+    const middle = match[2];
+    if (encodedJobId === undefined || middle === undefined)
+        return undefined;
+    const timestamp = Date.parse(middle);
+    if (!Number.isFinite(timestamp) || new Date(timestamp).toISOString() !== middle)
+        return undefined;
+    try {
+        const jobId = decodeURIComponent(encodedJobId);
+        if (jobId.length === 0)
+            return undefined;
+        return { jobId, runId: `cron:${encodedJobId}:${middle}` };
+    }
+    catch {
+        return undefined;
+    }
+}
+function compareCronRuns(left, right) {
+    return left.orderedAt.localeCompare(right.orderedAt)
+        || left.sequence - right.sequence
+        || left.runId.localeCompare(right.runId);
+}
+function cronMessageStatus(status) {
+    if (status === "running")
+        return "running";
+    if (status === "failed")
+        return "failed";
+    if (status === "cancelled")
+        return "cancelled";
+    return "complete";
+}
+function cronRunParts(run, prior, conversationId) {
+    const silent = run.status === "succeeded" && classifyNotifySuppression(run.text) !== "none";
+    const priorCron = prior.find((part) => part.type === "telemetry" && part.event === "cron_run");
+    const priorCronData = record(priorCron?.data);
+    const priorActivityLoaded = priorCronData?.activityLoaded === true;
+    const priorLoadedEventCount = Number.isSafeInteger(priorCronData?.loadedEventCount)
+        ? Number(priorCronData?.loadedEventCount)
+        : undefined;
+    const priorActivityEventCount = Number.isSafeInteger(priorCronData?.activityEventCount)
+        ? Number(priorCronData?.activityEventCount)
+        : priorLoadedEventCount;
+    const activityLoaded = run.projection === "detail"
+        || (priorActivityLoaded && priorActivityEventCount === run.eventCount);
+    const activityStale = run.projection === "summary"
+        && priorActivityLoaded
+        && priorActivityEventCount !== run.eventCount;
+    const eventsTruncated = run.projection === "detail"
+        ? run.eventsTruncated === true
+        : run.eventsTruncated === true || (priorActivityLoaded && priorCronData?.eventsTruncated === true);
+    // Reconciliation updates one durable message in place. Strip the prior
+    // synthetic state/identity before rebuilding it, while retaining a genuine
+    // notification text that arrived before the operator run projection.
+    const retained = prior.filter((part) => !(part.type === "telemetry" && part.event === "cron_run")
+        && !(part.type === "text" && isSyntheticCronStateText(part.text)));
+    const parts = run.projection === "summary"
+        ? [...retained]
+        : retained.filter((part) => part.type === "text" || part.type === "error");
+    for (const event of run.projection === "detail" ? run.events : [])
+        applyEvent(parts, event);
+    const preserveLoadedText = run.projection === "summary"
+        && run.fieldsTruncated?.includes("text") === true
+        && priorActivityLoaded;
+    const preserveLoadedError = run.projection === "summary"
+        && priorActivityLoaded
+        && (run.fieldsTruncated?.includes("error") === true
+            || run.fieldsTruncated?.includes("failureKind") === true);
+    if (!silent && !preserveLoadedText && run.text !== undefined && run.text.length > 0) {
+        reconcileFinalText(parts, run.text);
+    }
+    const hasText = parts.some((part) => part.type === "text" && part.text.trim().length > 0);
+    if (!hasText) {
+        const stateText = run.status === "succeeded"
+            ? "Completed silently (no message was reported)."
+            : run.status === "skipped_overlap"
+                ? run.blockedByTrigger === "manual"
+                    ? "Scheduled firing skipped because an operator-started manual run was still in flight."
+                    : "Firing skipped because the previous run was still in flight."
+                : run.status === "queued"
+                    ? `Queued behind an active run${run.queueDepth === undefined ? "." : ` (position ${String(run.queueDepth)}).`}`
+                    : run.status === "dropped"
+                        ? "Dropped because the pending-run queue was full."
+                        : run.status === "cancelled"
+                            ? "Run cancelled."
+                            : run.status === "failed"
+                                ? "Run failed."
+                                : run.status === "admitted"
+                                    ? "Run admitted and waiting to start."
+                                    : "Run is in progress.";
+        parts.push({ type: "text", text: stateText });
+    }
+    if (!preserveLoadedError
+        && run.error !== undefined
+        && !parts.some((part) => part.type === "error" && part.message === run.error)) {
+        parts.push({
+            type: "error",
+            ...(run.failureKind === undefined ? {} : { code: run.failureKind }),
+            message: run.error,
+        });
+    }
+    parts.push({
+        type: "telemetry",
+        event: "cron_run",
+        data: {
+            runId: run.runId,
+            conversationId,
+            scheduledAt: run.scheduledAt,
+            orderedAt: run.orderedAt,
+            sequence: run.sequence,
+            trigger: run.trigger,
+            status: run.status,
+            ...(silent ? { silent: true } : {}),
+            ...(run.startedAt === undefined ? {} : { startedAt: run.startedAt }),
+            ...(run.completedAt === undefined ? {} : { completedAt: run.completedAt }),
+            ...(run.artifactRunId === undefined ? {} : { artifactRunId: run.artifactRunId }),
+            ...(run.blockedByRunId === undefined ? {} : { blockedByRunId: run.blockedByRunId }),
+            eventCount: run.eventCount,
+            ...(activityLoaded
+                ? {
+                    activityLoaded: true,
+                    activityEventCount: run.eventCount,
+                    loadedEventCount: run.projection === "detail" ? run.eventsIncluded : priorLoadedEventCount ?? run.eventCount,
+                }
+                : {}),
+            ...(activityStale ? { activityStale: true, loadedEventCount: priorLoadedEventCount } : {}),
+            ...(eventsTruncated ? { eventsTruncated: true } : {}),
+            ...(run.fieldsTruncated === undefined ? {} : { fieldsTruncated: run.fieldsTruncated }),
+        },
+    });
+    return parts;
+}
+function cronRunSummary(run) {
+    if (run.projection === "summary")
+        return run;
+    const { events: _events, eventsIncluded: _eventsIncluded, ...base } = run;
+    return { ...base, projection: "summary" };
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function isSyntheticCronStateText(text) {
+    return text === "Completed silently (no message was reported)."
+        || text === "Scheduled firing skipped because an operator-started manual run was still in flight."
+        || text === "Firing skipped because the previous run was still in flight."
+        || text.startsWith("Queued behind an active run")
+        || text === "Dropped because the pending-run queue was full."
+        || text === "Run cancelled."
+        || text === "Run failed."
+        || text === "Run admitted and waiting to start."
+        || text === "Run is in progress.";
+}
+function parseStoredCronJob(serialized) {
+    let value;
+    try {
+        value = JSON.parse(serialized);
+    }
+    catch {
+        throw new WebConsoleError("storage_corrupt", "Stored cron job metadata is invalid JSON.", 500);
+    }
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new WebConsoleError("storage_corrupt", "Stored cron job metadata is invalid.", 500);
+    }
+    const job = value;
+    if (typeof job.jobId !== "string"
+        || typeof job.conversationId !== "string"
+        || typeof job.configured !== "boolean"
+        || typeof job.declaredEnabled !== "boolean"
+        || typeof job.effectiveEnabled !== "boolean"
+        || !["healthy", "warning", "unhealthy", "disabled", "unknown"].includes(String(job.health))) {
+        throw new WebConsoleError("storage_corrupt", "Stored cron job metadata is invalid.", 500);
+    }
+    return job;
+}
+function parseStoredCronRun(serialized) {
+    let value;
+    try {
+        value = JSON.parse(serialized);
+    }
+    catch {
+        throw new WebConsoleError("storage_corrupt", "Stored cron run metadata is invalid JSON.", 500);
+    }
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new WebConsoleError("storage_corrupt", "Stored cron run metadata is invalid.", 500);
+    }
+    const raw = value;
+    const legacyEvents = Array.isArray(raw.events) ? raw.events : undefined;
+    const { events: _legacyEvents, ...legacyBase } = raw;
+    const run = (raw.projection === undefined
+        ? {
+            ...legacyBase,
+            projection: "summary",
+            eventCount: legacyEvents?.length ?? 0,
+            ...(legacyEvents === undefined ? {} : { eventsTruncated: true }),
+        }
+        : raw);
+    if (run.projection !== "summary"
+        || typeof run.runId !== "string"
+        || typeof run.jobId !== "string"
+        || typeof run.scheduledAt !== "string"
+        || typeof run.orderedAt !== "string"
+        || !Number.isSafeInteger(run.sequence)
+        || (run.trigger !== "scheduled" && run.trigger !== "manual")
+        || !["admitted", "running", "queued", "succeeded", "failed", "cancelled", "skipped_overlap", "dropped"]
+            .includes(String(run.status))
+        || !Number.isSafeInteger(run.eventCount)
+        || Number(run.eventCount) < 0) {
+        throw new WebConsoleError("storage_corrupt", "Stored cron run metadata is invalid.", 500);
+    }
+    return run;
+}
+function messageRoleRankSql(messageAlias, turnAlias) {
+    return `CASE WHEN ${messageAlias}.turn_id IS NOT NULL AND ${messageAlias}.role = 'user' THEN 0
+    WHEN ${messageAlias}.turn_id IS NOT NULL AND ${messageAlias}.role = 'system' THEN 1
+    WHEN ${messageAlias}.turn_id IS NOT NULL THEN 2 ELSE 3 END`;
+}
+function boundedPageLimit(value, maximum) {
+    const normalized = value ?? maximum;
+    if (!Number.isSafeInteger(normalized) || normalized < 1 || normalized > maximum) {
+        throw new WebConsoleError("invalid_page", `limit must be 1-${String(maximum)}.`, 400);
+    }
+    return normalized;
+}
+function encodeCursor(value) {
+    return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+}
+function decodeCursor(value) {
+    if (value.length === 0 || value.length > 4_096 || !/^[A-Za-z0-9_-]+$/u.test(value)) {
+        throw new WebConsoleError("invalid_page", "Pagination cursor is invalid.", 400);
+    }
+    try {
+        const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("invalid");
+        return parsed;
+    }
+    catch {
+        throw new WebConsoleError("invalid_page", "Pagination cursor is invalid.", 400);
+    }
+}
+function decodeThreadCursor(value) {
+    const cursor = decodeCursor(value);
+    if (typeof cursor.updatedAt !== "string" || typeof cursor.id !== "string") {
+        throw new WebConsoleError("invalid_page", "Pagination cursor is invalid.", 400);
+    }
+    return { updatedAt: cursor.updatedAt, id: cursor.id };
+}
+function decodeMessageCursor(value) {
+    const cursor = decodeCursor(value);
+    if (typeof cursor.orderedAt !== "string"
+        || !Number.isSafeInteger(cursor.roleRank)
+        || typeof cursor.createdAt !== "string"
+        || !Number.isSafeInteger(cursor.rowid)) {
+        throw new WebConsoleError("invalid_page", "Pagination cursor is invalid.", 400);
+    }
+    return {
+        orderedAt: cursor.orderedAt,
+        roleRank: cursor.roleRank,
+        createdAt: cursor.createdAt,
+        rowid: cursor.rowid,
+    };
+}
 function mapAgent(row) {
     const models = parseStringArray(row.models_json);
     const efforts = parseStringArray(row.efforts_json);
@@ -1737,6 +3060,10 @@ function mapAgent(row) {
         ...(row.default_effort === null ? {} : { defaultEffort: row.default_effort }),
         ...(efforts === undefined ? {} : { efforts }),
         ...(modelOptions === undefined ? {} : { modelOptions }),
+        ...(row.cron_read === 1
+            ? { cron: { read: true, actions: row.cron_actions === 1 } }
+            : {}),
+        ...(row.ask_by_id === 1 ? { supportsAskById: true } : {}),
         updatedAt: row.updated_at,
     };
 }
@@ -1785,19 +3112,25 @@ function applyEvent(parts, event) {
         return;
     }
     if (event.type === "tool_call_started") {
+        const historyUpdate = canonicalEventHistoryUpdate(event.history);
         const subagent = subagentOf(event);
         if (subagent !== undefined) {
             const group = ensureSubagentPart(parts, subagent);
             // The bookend only announces the subagent; the group it belongs to is the
             // whole of its contribution here.
-            if (event.metadata?.subagentLifecycle !== true) {
-                upsertSubagentCall(parts, group, {
-                    toolCallId: event.id,
-                    toolName: subagentToolName(event.name),
+            if (event.metadata?.subagentLifecycle === true) {
+                replaceSubagentPart(parts, withEventHistoryUpdate({
+                    ...group,
                     ...(event.arguments === undefined ? {} : { args: event.arguments }),
-                    status: "running",
-                });
+                }, historyUpdate));
+                return;
             }
+            upsertSubagentCall(parts, group, {
+                toolCallId: event.id,
+                toolName: subagentToolName(event.name),
+                ...(event.arguments === undefined ? {} : { args: event.arguments }),
+                status: "running",
+            }, historyUpdate);
             return;
         }
         upsertToolCall(parts, {
@@ -1806,7 +3139,7 @@ function applyEvent(parts, event) {
             toolName: event.name,
             ...(event.arguments === undefined ? {} : { args: event.arguments }),
             status: "running",
-        });
+        }, historyUpdate);
         return;
     }
     if (event.type === "tool_call_progress") {
@@ -1821,16 +3154,17 @@ function applyEvent(parts, event) {
     }
     if (event.type === "tool_call_completed") {
         const status = event.isError === true ? "failed" : "complete";
+        const historyUpdate = canonicalEventHistoryUpdate(event.history);
         const subagent = subagentOf(event);
         if (subagent !== undefined) {
             const group = ensureSubagentPart(parts, subagent);
             if (event.metadata?.subagentLifecycle === true) {
-                replaceSubagentPart(parts, {
+                replaceSubagentPart(parts, withEventHistoryUpdate({
                     ...group,
                     status,
                     ...(event.executionMs === undefined ? {} : { executionMs: event.executionMs }),
                     ...(subagent.costUsd === undefined ? {} : { costUsd: subagent.costUsd }),
-                });
+                }, historyUpdate));
                 return;
             }
             upsertSubagentCall(parts, group, {
@@ -1839,19 +3173,19 @@ function applyEvent(parts, event) {
                 ...(event.arguments === undefined ? {} : { args: event.arguments }),
                 ...(event.content === undefined ? {} : { result: event.content }),
                 status,
-            });
+            }, historyUpdate);
             return;
         }
         // The parent `Agent` call completes against the group that replaced its
         // tool-call part, so its answer and outcome are not lost to the conversion.
         const group = findSubagentPart(parts, event.id);
         if (group !== undefined) {
-            replaceSubagentPart(parts, {
+            replaceSubagentPart(parts, withEventHistoryUpdate({
                 ...group,
                 status,
                 ...(event.content === undefined ? {} : { result: event.content }),
                 ...(event.executionMs === undefined ? {} : { executionMs: event.executionMs }),
-            });
+            }, historyUpdate));
             return;
         }
         upsertToolCall(parts, {
@@ -1861,7 +3195,7 @@ function applyEvent(parts, event) {
             ...(event.arguments === undefined ? {} : { args: event.arguments }),
             ...(event.content === undefined ? {} : { result: event.content }),
             status,
-        });
+        }, historyUpdate);
         return;
     }
     if (event.type === "runtime_telemetry" && event.kind === "context_compaction") {
@@ -1899,6 +3233,14 @@ function existingToolName(parts, id) {
     const existing = parts.find((part) => part.type === "tool-call" && part.toolCallId === id);
     return existing?.type === "tool-call" ? existing.toolName : undefined;
 }
+function canonicalEventHistoryUpdate(value) {
+    return value === undefined
+        ? undefined
+        : { value: canonicalSessionToolHistoryMetadata(value) };
+}
+function withEventHistoryUpdate(value, update) {
+    return update === undefined ? value : withSessionToolHistory(value, update.value);
+}
 /**
  * The subagent this tool event belongs to, or undefined for the agent's own
  * work. Validated rather than cast: `metadata` is an open record arriving over
@@ -1962,6 +3304,7 @@ function ensureSubagentPart(parts, subagent) {
         ...(subagent.label === undefined ? {} : { label: subagent.label }),
         ...(previous?.type === "tool-call" && previous.args !== undefined ? { args: previous.args } : {}),
         ...(previous?.type === "tool-call" && previous.result !== undefined ? { result: previous.result } : {}),
+        ...(previous?.type === "tool-call" && previous.history !== undefined ? { history: previous.history } : {}),
         status: previous?.type === "tool-call" ? previous.status : "running",
         calls: [],
     };
@@ -1978,22 +3321,32 @@ function replaceSubagentPart(parts, next) {
     else
         parts[index] = next;
 }
-function upsertSubagentCall(parts, group, next) {
+function upsertSubagentCall(parts, group, next, historyUpdate) {
     const index = group.calls.findIndex((call) => call.toolCallId === next.toolCallId);
+    const merged = index < 0
+        ? next
+        : { ...group.calls[index], ...next };
+    const updated = historyUpdate === undefined
+        ? merged
+        : withSessionToolHistory(merged, historyUpdate.value);
     const calls = index < 0
-        ? [...group.calls, next]
-        : group.calls.map((call, at) => at === index ? { ...call, ...next } : call);
+        ? [...group.calls, updated]
+        : group.calls.map((call, at) => at === index ? updated : call);
     replaceSubagentPart(parts, { ...group, calls });
 }
-function upsertToolCall(parts, next) {
+function upsertToolCall(parts, next, historyUpdate) {
     const index = parts.findIndex((part) => part.type === "tool-call" && part.toolCallId === next.toolCallId);
+    const previous = index < 0 ? undefined : parts[index];
+    const merged = previous?.type === "tool-call" ? { ...previous, ...next } : next;
+    const updated = historyUpdate === undefined
+        ? merged
+        : withSessionToolHistory(merged, historyUpdate.value);
     if (index < 0) {
-        parts.push(next);
+        parts.push(updated);
         return;
     }
-    const previous = parts[index];
     if (previous?.type === "tool-call")
-        parts[index] = { ...previous, ...next };
+        parts[index] = updated;
 }
 /**
  * Whether a stored part reaches the transcript at all. The console renders
@@ -2147,6 +3500,290 @@ function normalizeTitle(value) {
         throw new WebConsoleError("invalid_title", "A conversation title cannot be empty.", 400);
     return title;
 }
+const REPLY_FAILURE_CODES = new Set([
+    "app_capability_mismatch",
+    "app_connection_closed",
+    "app_resource_invalid",
+    "artifact_expired",
+    "artifact_integrity_failed",
+    "artifact_missing",
+    "artifact_publish_failed",
+    "artifact_too_large",
+    "reply_part_too_large",
+    "unsupported_destination",
+]);
+const REPLY_PARTS_TRUNCATED_ID = "web-reply-parts-truncated";
+const INVALID_REPLY_PART_ID = "invalid-rich-part";
+/**
+ * The SQLite boundary does not trust the operator wire parser. A truncated
+ * reply reserves one of the shared outcome slots for a durable diagnostic so
+ * every omitted suffix is visible without allowing this completion to take a
+ * message beyond the producer/wire limit. Legacy over-cap state is repaired by
+ * retaining a deterministic prefix and reserving the final slot for the same
+ * bounded diagnostic.
+ */
+function nextSyntheticReplyPartId(base, ids) {
+    let failureId = base;
+    for (let suffix = 2; ids.has(failureId); suffix += 1) {
+        failureId = `${base}-${suffix}`;
+    }
+    ids.add(failureId);
+    return failureId;
+}
+function replyPartIds(values) {
+    const ids = new Set();
+    for (const value of values) {
+        const id = record(value)?.id;
+        if (validRichId(id))
+            ids.add(id);
+    }
+    return ids;
+}
+function replyPartIdCounts(values) {
+    const counts = new Map();
+    for (const value of values) {
+        const id = record(value)?.id;
+        if (validRichId(id))
+            counts.set(id, (counts.get(id) ?? 0) + 1);
+    }
+    return counts;
+}
+function isDurableWebReplyPart(part) {
+    return part.type === "attachment" || part.type === "mcp_app" || part.type === "failure";
+}
+function boundedWebReplyParts(input, existingParts) {
+    const existingReplyParts = existingParts.filter(isDurableWebReplyPart);
+    const existingReplyPartCount = existingReplyParts.length;
+    const existingIds = replyPartIds(existingReplyParts);
+    const ids = new Set(existingIds);
+    const claimedIds = new Set(existingIds);
+    const availableSlots = Math.max(0, MAX_AGENT_REPLY_PARTS - existingReplyPartCount);
+    const inputParts = Array.isArray(input) ? input : undefined;
+    const needsDiagnostic = inputParts === undefined
+        || existingReplyPartCount > MAX_AGENT_REPLY_PARTS
+        || inputParts.length > availableSlots;
+    const retainedExistingCount = needsDiagnostic
+        ? Math.min(existingReplyPartCount, MAX_AGENT_REPLY_PARTS - 1)
+        : existingReplyPartCount;
+    let seenExistingReplyParts = 0;
+    const retainedExistingParts = existingParts.filter((part) => {
+        if (!isDurableWebReplyPart(part))
+            return true;
+        seenExistingReplyParts += 1;
+        return seenExistingReplyParts <= retainedExistingCount;
+    });
+    if (inputParts === undefined) {
+        const invalidRecord = record(input);
+        const legacyValues = invalidRecord === undefined ? [input] : [input, ...Object.values(invalidRecord)];
+        for (const id of replyPartIds(legacyValues))
+            ids.add(id);
+        const omittedExistingCount = existingReplyPartCount - retainedExistingCount;
+        return [...retainedExistingParts, {
+                type: "failure",
+                id: nextSyntheticReplyPartId(REPLY_PARTS_TRUNCATED_ID, ids),
+                code: "unsupported_destination",
+                message: `The web console retained ${retainedExistingCount} existing rich reply parts, omitted ${omittedExistingCount} existing parts, and rejected an invalid incoming rich reply collection; ${availableSlots} of ${MAX_AGENT_REPLY_PARTS} outcome slots were available before this bounded diagnostic.`,
+            }];
+    }
+    // Object.values visits only populated entries, so a legacy sparse array with
+    // a very large length cannot make this collision scan walk every empty slot.
+    const populated = Object.values(inputParts);
+    const inputIdCounts = replyPartIdCounts(populated);
+    for (const id of inputIdCounts.keys())
+        ids.add(id);
+    const retainedCount = Math.min(inputParts.length, Math.max(0, MAX_AGENT_REPLY_PARTS - retainedExistingCount - (needsDiagnostic ? 1 : 0)));
+    const retained = Array.from({ length: retainedCount }, (_, index) => {
+        const converted = toWebReplyPart(inputParts[index], () => {
+            const inputId = record(inputParts[index])?.id;
+            return validRichId(inputId)
+                && !existingIds.has(inputId)
+                && inputIdCounts.get(inputId) === 1
+                ? inputId
+                : nextSyntheticReplyPartId(INVALID_REPLY_PART_ID, ids);
+        });
+        if (!claimedIds.has(converted.id)) {
+            claimedIds.add(converted.id);
+            return converted;
+        }
+        const collision = {
+            type: "failure",
+            id: nextSyntheticReplyPartId(INVALID_REPLY_PART_ID, ids),
+            code: "unsupported_destination",
+            message: "A rich reply part reused an existing identifier and could not be displayed.",
+        };
+        claimedIds.add(collision.id);
+        return collision;
+    });
+    const merged = [...retainedExistingParts, ...retained];
+    if (!needsDiagnostic)
+        return merged;
+    const omittedExistingCount = existingReplyPartCount - retainedExistingCount;
+    const omittedIncomingCount = inputParts.length - retainedCount;
+    merged.push({
+        type: "failure",
+        id: nextSyntheticReplyPartId(REPLY_PARTS_TRUNCATED_ID, ids),
+        code: "reply_part_too_large",
+        message: `The web console retained ${retainedExistingCount} existing and ${retainedCount} incoming rich reply parts, omitted ${omittedExistingCount} existing and ${omittedIncomingCount} incoming parts, and used one diagnostic slot; before reserving it, ${availableSlots} of ${MAX_AGENT_REPLY_PARTS} outcome slots were available to incoming parts.`,
+    });
+    return merged;
+}
+function isMcpAppProtocolVersion(value) {
+    return value === "2026-01-26" || value === "2025-11-21";
+}
+function toWebReplyPart(input, syntheticId) {
+    const part = record(input);
+    const failure = (code) => ({
+        type: "failure",
+        id: syntheticId(),
+        code,
+        message: code === "artifact_too_large"
+            ? "The generated file exceeded the web console attachment limit."
+            : code === "app_resource_invalid"
+                ? "The MCP App metadata was invalid and could not be displayed."
+                : "The generated file metadata was invalid and could not be displayed.",
+    });
+    if (part?.type === "attachment") {
+        const reference = record(part.reference);
+        if (!validRichId(part.id)
+            || reference?.scheme !== "mono-agent-artifact"
+            || !validRichId(reference.id)
+            || typeof part.name !== "string"
+            || part.name.length === 0
+            || part.name.length > 255
+            || /[\u0000-\u001f\u007f/\\]/u.test(part.name)
+            || typeof part.mediaType !== "string"
+            || !validReplyMimeType(part.mediaType)
+            || !Number.isSafeInteger(part.sizeBytes)
+            || Number(part.sizeBytes) < 0
+            || typeof part.integrityId !== "string"
+            || !/^sha256:[0-9a-f]{64}$/u.test(part.integrityId)
+            || !validOptionalDate(part.expiresAt))
+            return failure("artifact_publish_failed");
+        if (Number(part.sizeBytes) > 20 * 1024 * 1024)
+            return failure("artifact_too_large");
+        return {
+            type: "attachment",
+            id: part.id,
+            artifactId: reference.id,
+            name: part.name,
+            mediaType: part.mediaType,
+            sizeBytes: part.sizeBytes,
+            integrityId: part.integrityId,
+            ...(part.expiresAt === undefined ? {} : { expiresAt: part.expiresAt }),
+        };
+    }
+    if (part?.type === "mcp_app") {
+        if (!validRichId(part.id)
+            || part.invocationId !== part.id
+            || !validRichId(part.invocationId)
+            || !validRichId(part.connectionId)
+            || typeof part.serverName !== "string"
+            || typeof part.toolName !== "string"
+            || typeof part.resourceUri !== "string"
+            || !part.resourceUri.startsWith("ui://")
+            || part.mediaType !== "text/html;profile=mcp-app"
+            || !isMcpAppProtocolVersion(part.protocolVersion)
+            || !validOptionalBoundedText(part.title, 240)
+            || !validOptionalBoundedText(part.description, 1_000)
+            || !validOptionalDate(part.expiresAt))
+            return failure("app_resource_invalid");
+        return {
+            type: "mcp_app",
+            id: part.id,
+            invocationId: part.invocationId,
+            connectionId: part.connectionId,
+            serverName: part.serverName.slice(0, 256),
+            toolName: part.toolName.slice(0, 256),
+            resourceUri: part.resourceUri.slice(0, 4_096),
+            mediaType: "text/html;profile=mcp-app",
+            protocolVersion: part.protocolVersion,
+            ...(part.title === undefined ? {} : { title: part.title }),
+            ...(part.description === undefined ? {} : { description: part.description }),
+            ...(part.expiresAt === undefined ? {} : { expiresAt: part.expiresAt }),
+        };
+    }
+    if (part?.type === "failure"
+        && validRichId(part.id)
+        && typeof part.code === "string"
+        && REPLY_FAILURE_CODES.has(part.code)
+        && typeof part.message === "string"
+        && Buffer.byteLength(part.message, "utf8") <= 1_024
+        && (part.relatedPartId === undefined || validRichId(part.relatedPartId))) {
+        return {
+            type: "failure",
+            id: part.id,
+            code: part.code,
+            message: part.message,
+            ...(part.relatedPartId === undefined ? {} : { relatedPartId: part.relatedPartId }),
+        };
+    }
+    return {
+        type: "failure",
+        id: syntheticId(),
+        code: "unsupported_destination",
+        message: "A rich reply part used an unsupported format and could not be displayed.",
+    };
+}
+/** Persist only the inert durable projection; browser capabilities are DTO-only. */
+function durableMessagePart(part) {
+    if (part.type === "attachment") {
+        return {
+            type: "attachment",
+            id: part.id,
+            artifactId: part.artifactId,
+            name: part.name,
+            mediaType: part.mediaType,
+            sizeBytes: part.sizeBytes,
+            integrityId: part.integrityId,
+            ...(part.expiresAt === undefined ? {} : { expiresAt: part.expiresAt }),
+        };
+    }
+    if (part.type === "mcp_app") {
+        return {
+            type: "mcp_app",
+            id: part.id,
+            invocationId: part.invocationId,
+            connectionId: part.connectionId,
+            serverName: part.serverName,
+            toolName: part.toolName,
+            resourceUri: part.resourceUri,
+            mediaType: part.mediaType,
+            protocolVersion: part.protocolVersion,
+            ...(part.title === undefined ? {} : { title: part.title }),
+            ...(part.description === undefined ? {} : { description: part.description }),
+            ...(part.expiresAt === undefined ? {} : { expiresAt: part.expiresAt }),
+        };
+    }
+    if (part.type === "failure") {
+        return {
+            type: "failure",
+            id: part.id,
+            code: part.code,
+            message: part.message,
+            ...(part.relatedPartId === undefined ? {} : { relatedPartId: part.relatedPartId }),
+        };
+    }
+    return part;
+}
+function serializeParts(parts) {
+    return JSON.stringify(parts.map(durableMessagePart));
+}
+function validRichId(value) {
+    return typeof value === "string"
+        && value.length > 0
+        && Buffer.byteLength(value, "utf8") <= 256
+        && !/[\u0000-\u001f\u007f]/u.test(value);
+}
+function validReplyMimeType(value) {
+    return value.length <= 256
+        && /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*(?:;[a-z0-9=._+-]+)*$/iu.test(value);
+}
+function validOptionalDate(value) {
+    return value === undefined || (typeof value === "string" && !Number.isNaN(Date.parse(value)));
+}
+function validOptionalBoundedText(value, maxBytes) {
+    return value === undefined || (typeof value === "string" && Buffer.byteLength(value, "utf8") <= maxBytes);
+}
 function parseParts(value) {
     let parsed;
     try {
@@ -2155,11 +3792,14 @@ function parseParts(value) {
     catch {
         throw new WebConsoleError("storage_corrupt", "Persisted message parts are not valid JSON.", 500);
     }
-    if (!Array.isArray(parsed) || !parsed.every(isWebMessagePart)) {
+    const parts = Array.isArray(parsed)
+        ? parsed.map(canonicalizePersistedPartHistory)
+        : parsed;
+    if (!Array.isArray(parts) || !parts.every(isWebMessagePart)) {
         throw new WebConsoleError("storage_corrupt", "Persisted message parts have an invalid shape.", 500);
     }
-    quoteFromParts(parsed);
-    return parsed;
+    quoteFromParts(parts);
+    return parts;
 }
 const QUOTE_TELEMETRY_EVENT = "quote";
 const LIVE_INPUT_TELEMETRY_EVENT = "live_input";
@@ -2216,7 +3856,132 @@ function isWebToolCall(value) {
     const call = value;
     return typeof call.toolCallId === "string"
         && typeof call.toolName === "string"
-        && isWebToolCallStatus(call.status);
+        && isWebToolCallStatus(call.status)
+        && (call.history === undefined || isSessionToolHistoryMetadata(call.history));
+}
+const SESSION_TOOL_HISTORY_TERMINAL_STATES = new Set([
+    "success", "rejected", "error", "exit_nonzero", "timeout", "signal", "cancelled", "interrupted",
+]);
+/**
+ * Canonicalize the open wire record before it reaches SQLite or rendering.
+ * Unknown fields are deliberately omitted so a future/stale producer cannot
+ * turn this bounded display record into an unbounded persistence side channel.
+ */
+function canonicalSessionToolHistoryMetadata(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const history = value;
+    const valid = (history.persistence === "persisted" || history.persistence === "failed")
+        && history.untrusted === true
+        && (history.recordId === undefined || boundedHistoryString(history.recordId, 4_096))
+        && (history.sequence === undefined || positiveSafeInteger(history.sequence))
+        && (history.terminalState === undefined || (typeof history.terminalState === "string"
+            && SESSION_TOOL_HISTORY_TERMINAL_STATES.has(history.terminalState)))
+        && (history.truncated === undefined || typeof history.truncated === "boolean")
+        && (history.originalBytes === undefined || nonNegativeSafeInteger(history.originalBytes))
+        && (history.retainedBytes === undefined || nonNegativeSafeInteger(history.retainedBytes))
+        && (history.errorCode === undefined || boundedHistoryString(history.errorCode, 256))
+        && (history.artifactReferences === undefined || (Array.isArray(history.artifactReferences)
+            && history.artifactReferences.length <= 32
+            && history.artifactReferences.every((entry) => {
+                if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+                    return false;
+                const artifact = entry;
+                return boundedHistoryString(artifact.id, 4_096) && typeof artifact.available === "boolean";
+            })));
+    if (!valid)
+        return undefined;
+    return {
+        persistence: history.persistence,
+        untrusted: true,
+        ...(history.recordId === undefined ? {} : { recordId: history.recordId }),
+        ...(history.sequence === undefined ? {} : { sequence: history.sequence }),
+        ...(history.terminalState === undefined
+            ? {}
+            : { terminalState: history.terminalState }),
+        ...(history.truncated === undefined ? {} : { truncated: history.truncated }),
+        ...(history.originalBytes === undefined ? {} : { originalBytes: history.originalBytes }),
+        ...(history.retainedBytes === undefined ? {} : { retainedBytes: history.retainedBytes }),
+        ...(history.errorCode === undefined ? {} : { errorCode: history.errorCode }),
+        ...(history.artifactReferences === undefined
+            ? {}
+            : {
+                artifactReferences: history.artifactReferences.map((entry) => {
+                    const artifact = entry;
+                    return { id: artifact.id, available: artifact.available };
+                }),
+            }),
+    };
+}
+function isSessionToolHistoryMetadata(value) {
+    return canonicalSessionToolHistoryMetadata(value) !== undefined;
+}
+/** An explicitly supplied invalid frame replaces, rather than retaining, stale metadata. */
+function withSessionToolHistory(value, history) {
+    const { history: _staleHistory, ...withoutHistory } = value;
+    return {
+        ...withoutHistory,
+        ...(history === undefined ? {} : { history }),
+    };
+}
+/**
+ * Older builds could persist an unchecked history record. Salvage the otherwise
+ * valid message by dropping only that optional record; unrelated corruption
+ * remains a storage error.
+ */
+function canonicalizePersistedPartHistory(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return value;
+    const part = value;
+    if (part.type === "tool-call")
+        return canonicalizePersistedHistoryRecord(part);
+    if (part.type !== "subagent")
+        return value;
+    const canonicalPart = canonicalizePersistedObjectHistory(part);
+    return {
+        ...canonicalPart,
+        ...(Array.isArray(part.calls)
+            ? { calls: part.calls.map((call) => canonicalizePersistedHistoryRecord(call)) }
+            : {}),
+    };
+}
+function canonicalizePersistedHistoryRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return value;
+    return canonicalizePersistedObjectHistory(value);
+}
+function canonicalizePersistedObjectHistory(record) {
+    const { history: rawHistory, ...withoutHistory } = record;
+    const history = canonicalSessionToolHistoryMetadata(rawHistory);
+    return {
+        ...withoutHistory,
+        ...(history === undefined ? {} : { history }),
+    };
+}
+function boundedHistoryString(value, maxBytes) {
+    return typeof value === "string"
+        && value.length > 0
+        && Buffer.byteLength(value, "utf8") <= maxBytes
+        && !/[\u0000-\u001f\u007f]/u.test(value);
+}
+function positiveSafeInteger(value) {
+    return Number.isSafeInteger(value) && Number(value) > 0;
+}
+function nonNegativeSafeInteger(value) {
+    return Number.isSafeInteger(value) && Number(value) >= 0;
+}
+const DURABLE_REPLY_ATTACHMENT_KEYS = new Set([
+    "type", "id", "artifactId", "name", "mediaType", "sizeBytes", "integrityId", "expiresAt",
+]);
+const DURABLE_MCP_APP_KEYS = new Set([
+    "type", "id", "invocationId", "connectionId", "serverName", "toolName", "resourceUri",
+    "mediaType", "protocolVersion", "title", "description", "expiresAt",
+]);
+const DURABLE_REPLY_FAILURE_KEYS = new Set([
+    "type", "id", "code", "message", "relatedPartId",
+]);
+function hasOnlyKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.has(key));
 }
 function isWebMessagePart(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value))
@@ -2232,14 +3997,133 @@ function isWebMessagePart(value) {
             && (part.label === undefined || typeof part.label === "string")
             && (part.executionMs === undefined || typeof part.executionMs === "number")
             && (part.costUsd === undefined || typeof part.costUsd === "number")
+            && (part.history === undefined || isSessionToolHistoryMetadata(part.history))
             && isWebToolCallStatus(part.status)
             && Array.isArray(part.calls)
             && part.calls.every(isWebToolCall);
     }
+    if (part.type === "process-job") {
+        if (part.responseText !== undefined && (typeof part.responseText !== "string" || part.responseText.length > 8_000)) {
+            return false;
+        }
+        try {
+            parseProcessJobProjection(part.job);
+            return Object.keys(part).every((key) => key === "type" || key === "job" || key === "responseText")
+                && Object.keys(part).length === (part.responseText === undefined ? 2 : 3);
+        }
+        catch {
+            return false;
+        }
+    }
     if (part.type === "telemetry")
         return typeof part.event === "string";
     if (part.type === "error")
         return typeof part.message === "string" && (part.code === undefined || typeof part.code === "string");
+    if (part.type === "attachment") {
+        return hasOnlyKeys(part, DURABLE_REPLY_ATTACHMENT_KEYS)
+            && validRichId(part.id)
+            && validRichId(part.artifactId)
+            && typeof part.name === "string"
+            && part.name.length > 0
+            && !/[\u0000-\u001f\u007f/\\]/u.test(part.name)
+            && typeof part.mediaType === "string"
+            && validReplyMimeType(part.mediaType)
+            && Number.isSafeInteger(part.sizeBytes)
+            && Number(part.sizeBytes) >= 0
+            && Number(part.sizeBytes) <= 20 * 1024 * 1024
+            && typeof part.integrityId === "string"
+            && /^sha256:[0-9a-f]{64}$/u.test(part.integrityId)
+            && validOptionalDate(part.expiresAt);
+    }
+    if (part.type === "mcp_app") {
+        return hasOnlyKeys(part, DURABLE_MCP_APP_KEYS)
+            && validRichId(part.id)
+            && part.invocationId === part.id
+            && validRichId(part.connectionId)
+            && typeof part.serverName === "string"
+            && typeof part.toolName === "string"
+            && typeof part.resourceUri === "string"
+            && part.resourceUri.startsWith("ui://")
+            && part.mediaType === "text/html;profile=mcp-app"
+            && isMcpAppProtocolVersion(part.protocolVersion)
+            && validOptionalBoundedText(part.title, 240)
+            && validOptionalBoundedText(part.description, 1_000)
+            && validOptionalDate(part.expiresAt);
+    }
+    if (part.type === "failure") {
+        return hasOnlyKeys(part, DURABLE_REPLY_FAILURE_KEYS)
+            && validRichId(part.id)
+            && typeof part.code === "string"
+            && REPLY_FAILURE_CODES.has(part.code)
+            && typeof part.message === "string"
+            && Buffer.byteLength(part.message, "utf8") <= 1_024
+            && (part.relatedPartId === undefined || validRichId(part.relatedPartId));
+    }
+    return false;
+}
+function processJobPart(job, responseText) {
+    return {
+        type: "process-job",
+        job,
+        ...(responseText === undefined ? {} : { responseText }),
+    };
+}
+function processJobCardParts(job, responseText, replyParts) {
+    const card = processJobPart(job, responseText);
+    return replyParts === undefined ? [card] : boundedWebReplyParts(replyParts, [card]);
+}
+function isTerminalJobState(state) {
+    return state === "succeeded"
+        || state === "failed"
+        || state === "timed_out"
+        || state === "cancelled"
+        || state === "spawn_failed"
+        || state === "queue_expired"
+        || state === "interrupted";
+}
+function assertProcessJobCardTransition(previous, next) {
+    if (previous.tool !== next.tool
+        || previous.summary !== next.summary
+        || previous.origin.conversationId !== next.origin.conversationId
+        || previous.origin.channel !== next.origin.channel
+        || previous.origin.runId !== next.origin.runId
+        || previous.origin.historyBoundary !== next.origin.historyBoundary
+        || previous.origin.bucket !== next.origin.bucket
+        || previous.timestamps.admittedAt !== next.timestamps.admittedAt
+        || previous.timestamps.queueDeadlineAt !== next.timestamps.queueDeadlineAt
+        || JSON.stringify(previous.limits) !== JSON.stringify(next.limits)
+        || previous.wake.deliveryKey !== next.wake.deliveryKey) {
+        throw new WebConsoleError("notification_idempotency_conflict", "The process-job projection changed immutable identity fields.", 409);
+    }
+    if (!allowedProcessJobTransition(previous.state, next.state)) {
+        throw new WebConsoleError("notification_idempotency_conflict", `Process-job card lifecycle cannot transition from ${previous.state} to ${next.state}.`, 409);
+    }
+    if ((previous.timestamps.startedAt !== null && previous.timestamps.startedAt !== next.timestamps.startedAt)
+        || (previous.timestamps.runtimeDeadlineAt !== null
+            && previous.timestamps.runtimeDeadlineAt !== next.timestamps.runtimeDeadlineAt)
+        || (previous.timestamps.completedAt !== null && previous.timestamps.completedAt !== next.timestamps.completedAt)) {
+        throw new WebConsoleError("notification_idempotency_conflict", "Process-job card timing changed after becoming durable.", 409);
+    }
+    if (next.wake.attempts < previous.wake.attempts
+        || (previous.wake.state !== "pending" && previous.wake.state !== next.wake.state)) {
+        throw new WebConsoleError("notification_idempotency_conflict", "Process-job wake settlement cannot move backwards.", 409);
+    }
+}
+function allowedProcessJobTransition(previous, next) {
+    if (previous === next)
+        return true;
+    if (previous === "queued") {
+        // Retained surfaces are sampled; a fast launch/completion may skip one or
+        // both internal nonterminal states between card updates.
+        return next === "starting" || next === "running" || isTerminalJobState(next);
+    }
+    if (previous === "starting") {
+        return next === "running" || (isTerminalJobState(next) && next !== "queue_expired");
+    }
+    if (previous === "running") {
+        return next === "succeeded" || next === "failed" || next === "timed_out"
+            || next === "cancelled" || next === "spawn_failed" || next === "interrupted";
+    }
     return false;
 }
 function parseStringArray(value) {