@oar-sh/oar 0.9.1 → 0.9.3

package/server/copilot-worker/copilot-sdk-session-worker.mjs

@@ -4,8 +4,7 @@
 // control polling, activity channels) but executes turns through the Copilot
 // SDK's headless runtime instead of the `copilot` TUI under a PTY.
 //
-// Dormant until phase 3 registers a worker kind for it. Run it by hand against
-// a live relay with:
+// Run it by hand against a live relay with:
 //
 //   COPILOT_WEB_RELAY_CONFIG=server/config.json \
 //   COPILOT_WORKSPACE_ROOT=/path/to/workspace \
@@ -17,10 +16,14 @@ import { fileURLToPath } from 'url';
 import {
   loadTokenFromConfig,
   resolveRelayServerUrl,
-} from '../../.github/extensions/web-relay/runtime/config-loader.mjs';
-import { createApiClient } from '../../.github/extensions/web-relay/runtime/api-client.mjs';
-import { createWorkerWebSocketLink } from '../../.github/extensions/web-relay/runtime/worker-websocket-link.mjs';
-import { createHeartbeatController } from '../../.github/extensions/web-relay/polling/heartbeat.mjs';
+} from '../../shared/worker-runtime/config-loader.mjs';
+import { createApiClient } from '../../shared/worker-runtime/api-client.mjs';
+import { createWorkerWebSocketLink } from '../../shared/worker-runtime/worker-websocket-link.mjs';
+import { createHeartbeatController } from '../../shared/worker-runtime/heartbeat.mjs';
+import {
+  createRunnerLinkBridge,
+  failSettlingRowsOnShutdown,
+} from '../../shared/worker-runtime/runner-link-wiring.mjs';
 import { createControlPoller } from '../../shared/control-poller.mjs';
 import { installWorkerCrashGuard } from '../../shared/worker-crash-guard.mjs';
 import {
@@ -69,8 +72,29 @@ async function main() {
     api,
     sdkSessionId,
     abortAckNote: 'copilot session aborted',
+    // A subagent lane's Stop. Lanes are keyed on the envelope agentId, which
+    // is also the runtime's task id, so `rpc.tasks.cancel` is tried; the
+    // runtime refuses ids it does not track (then the control answers "not
+    // supported" and the whole-turn Stop remains). Background agents have no
+    // lane — their Stop is the task panel's. (Late-bound: controls only poll
+    // while a turn is live.)
+    onAbortSubagent: (subagentRunId) => turnRunner.stopBackgroundTask(subagentRunId),
     dbg,
   });
+  // The relay's *Background task timeout* slider (0 = unlimited) rides every
+  // delivery payload, exactly as for the Claude worker: background agents and
+  // shells now have cards and a Stop, so the slider governs them too and a cap
+  // expiry CANCELS them rather than forgetting them. The env var is an
+  // emergency override only.
+  const backgroundTaskTimeoutOverrideMs = readOptionalMs('COPILOT_SDK_RELAY_BACKGROUND_TASK_TIMEOUT_MS');
+  let backgroundTaskTimeoutMs = backgroundTaskTimeoutOverrideMs ?? 0;
+  // The runner reports every flip of its delivery gate; the bridge turns them
+  // into the link's worker.unready / worker.ready frames, so a message queued
+  // while a question card is open is held in the relay queue and steers into
+  // the resumed turn one round trip after the answer.
+  const linkBridge = createRunnerLinkBridge();
+  // Late-bound: the heartbeat controller is built after the runner.
+  let heartbeat = null;
   const turnRunner = createCopilotSdkSessionRunner({
     api,
     sdkSessionId,
@@ -79,30 +103,42 @@ async function main() {
     controlPoller,
     idleShutdownMs: readOptionalMs('COPILOT_SDK_RELAY_IDLE_SHUTDOWN_MS'),
     turnStallTimeoutMs: readOptionalMs('COPILOT_SDK_RELAY_TURN_STALL_TIMEOUT_MS'),
-    // How long live detached shells alone may hold the runtime open (0 = no
-    // limit). Deliberately NOT the relay's `background_task_timeout_minutes`
-    // slider that rides every delivery payload: that slider defaults to
-    // 0/unlimited and governs Claude's background tasks, which the composer
-    // lists and can stop. A Copilot detached shell has neither, so consuming it
-    // would make "a forgotten shell pins a runtime forever" the default with
-    // nothing in the UI to reveal it. The runner's own 30-minute cap applies
-    // unless this says otherwise.
-    ...(() => {
-      const override = readOptionalMs('COPILOT_SDK_RELAY_BACKGROUND_TASK_TIMEOUT_MS');
-      return override === undefined ? {} : { getBackgroundTaskTimeoutMs: () => override };
-    })(),
+    // How long a deferred model switch may wait for its drain before the
+    // explicit selection fails the row (default 10s).
+    modelSwitchTimeoutMs: readOptionalMs('COPILOT_SDK_RELAY_MODEL_SWITCH_TIMEOUT_MS'),
+    getBackgroundTaskTimeoutMs: () => backgroundTaskTimeoutMs,
+    // A readiness flip is a hold starting or ending (question card, approval,
+    // compaction): the composer's steering snapshot changed with it.
+    onDeliveryReadinessChange: (ready) => {
+      linkBridge.onDeliveryReadinessChange(ready);
+      heartbeat?.requestPulse();
+    },
+    // A message became (or stopped being) cancellable: report it now rather
+    // than on the next 10 s heartbeat (coalesced by the controller).
+    onCancellableChange: () => heartbeat?.requestPulse(),
+    canHandBackHeldDelivery: () => linkBridge.canHandBackHeldDelivery(),
     dbg,
   });
 
   let heartbeatTimer = null;
-  const heartbeat = createHeartbeatController({
+  heartbeat = createHeartbeatController({
     api,
     pollMs: HEARTBEAT_MS,
     getSessionReady: () => true,
     getHeartbeatTimer: () => heartbeatTimer,
     setHeartbeatTimer: (timer) => { heartbeatTimer = timer; },
     getActiveQueueMessageId: () => turnRunner.getActiveQueueMessageId(),
-    getActiveQueueMessageIds: () => turnRunner.getActiveQueueMessageIds(),
+    // The runner reports { id, attemptId } entries; the heartbeat's claim
+    // payload is id-only (its String() coercion would mangle an object), while
+    // the crash guard below takes the entries whole so its requeues stay
+    // fenced to this attempt.
+    getActiveQueueMessageIds: () => turnRunner.getActiveQueueMessageIds().map((entry) => entry.id),
+    // The composer's steering snapshot (Steer / Queue + the hold reason, the
+    // un-steerable rows) and the consumed steers whose settle the runner gave
+    // up on — the relay fails those itself, never re-running them.
+    getSteeringState: () => turnRunner.steeringState(),
+    getSettleFailed: () => turnRunner.getSettleFailed(),
+    onSettleFailedHandled: (ids) => turnRunner.acknowledgeSettleFailed(ids),
   });
 
   const wsLink = createWorkerWebSocketLink({
@@ -112,8 +148,22 @@ async function main() {
     getSessionReady: () => true,
     getSessionId: () => sdkSessionId,
     getPid: () => process.pid,
+    // Mid-turn steering opt-in: the link keeps signalling readiness while a
+    // delivery is in flight as long as the runner can absorb another message
+    // into the live turn, and withdraws it while the runner holds.
+    getSteeringReady: () => turnRunner.canAcceptSteering(),
+    getDeliveryHeld: () => turnRunner.isDeliveryHeld(),
+    // A relay that just (re)started knows nothing of this worker until it
+    // heartbeats; the composer's steering snapshot rides that beat.
+    onServerHello: () => heartbeat.requestPulse(),
     onDeliver: async (pending, reason) => {
       dbg('queue.deliver received', `reason=${reason}`, `msgId=${pending?.message?.id || 'none'}`);
+      // Slider changes reach a running worker on its next delivery; an
+      // explicit env override pins the value regardless.
+      const deliveredTimeout = Number(pending?.settings?.backgroundTaskTimeoutMs);
+      if (backgroundTaskTimeoutOverrideMs === undefined && Number.isFinite(deliveredTimeout) && deliveredTimeout >= 0) {
+        backgroundTaskTimeoutMs = deliveredTimeout;
+      }
       try {
         return await turnRunner.handlePendingPayload(pending);
       } catch (error) {
@@ -122,19 +172,38 @@ async function main() {
       }
     },
     onControl: (control) => {
-      // Background-task controls have no Copilot SDK equivalent yet: the
-      // runtime's `session.background_tasks_changed` carries an empty payload
-      // (23 of them fire during a single bash call), so there is no task id to
-      // stop. Logged rather than silently dropped.
-      dbg('worker control ignored (unsupported by the SDK worker)', String(control?.type || '(none)'));
+      const type = String(control?.type || '').trim();
+      if (type === 'cancel_pushed_message') {
+        // Un-steer: pull a pushed-but-unconsumed message back out of the
+        // runtime's queue and cancel its row.
+        void turnRunner.cancelPushedMessage(control?.messageId).catch((error) => {
+          dbg('un-steer failed', error?.message || String(error));
+        });
+        return;
+      }
+      if (type === 'stop_background_task') {
+        // The task panel's per-card Stop → rpc.tasks.cancel.
+        const taskId = String(control?.taskId || '').trim();
+        dbg('stop background task control', taskId);
+        void turnRunner.stopBackgroundTask(taskId).catch((error) => {
+          dbg('stop background task failed', error?.message || String(error));
+        });
+        return;
+      }
+      dbg('worker control ignored (unsupported by the SDK worker)', type || '(none)');
     },
   });
+  linkBridge.attach(wsLink);
 
   const shutdown = async (signal) => {
     dbg(`shutting down (${signal})`);
     try { wsLink.stop(); } catch {}
     try { heartbeat.stopHeartbeat(); } catch {}
     try { controlPoller.stop(); } catch {}
+    // Rows whose prompt the runtime consumed and whose settle marker has not
+    // landed are failed terminally, never left for dead-worker recovery to
+    // requeue (that would run the prompt twice). Bounded.
+    try { await failSettlingRowsOnShutdown({ api, runner: turnRunner }); } catch {}
     // Bounded, like the Cursor worker: stopping the runtime is an RPC, and a
     // hung stop must never make the process ignore the supervisor's SIGTERM.
     try {

package/server/cursor-worker/cursor-session-worker.mjs

@@ -9,10 +9,10 @@ import { fileURLToPath } from 'url';
 import {
   loadTokenFromConfig,
   resolveRelayServerUrl,
-} from '../../.github/extensions/web-relay/runtime/config-loader.mjs';
-import { createApiClient } from '../../.github/extensions/web-relay/runtime/api-client.mjs';
-import { createWorkerWebSocketLink } from '../../.github/extensions/web-relay/runtime/worker-websocket-link.mjs';
-import { createHeartbeatController } from '../../.github/extensions/web-relay/polling/heartbeat.mjs';
+} from '../../shared/worker-runtime/config-loader.mjs';
+import { createApiClient } from '../../shared/worker-runtime/api-client.mjs';
+import { createWorkerWebSocketLink } from '../../shared/worker-runtime/worker-websocket-link.mjs';
+import { createHeartbeatController } from '../../shared/worker-runtime/heartbeat.mjs';
 import { createControlPoller } from '../../shared/control-poller.mjs';
 import { installWorkerCrashGuard } from '../../shared/worker-crash-guard.mjs';
 import { createCursorTurnRunner } from './cursor-turn-runner.mjs';
@@ -131,7 +131,7 @@ async function main() {
   installWorkerCrashGuard({
     api,
     workerName: 'cursor-session-worker',
-    getActiveQueueMessageIds: () => [turnRunner.getActiveQueueMessageId()],
+    getActiveQueueMessageIds: () => [turnRunner.getActiveQueueAttempt()],
   });
 
   dbg(`starting session=${sdkSessionId.slice(0, 8)} server=${serverUrl} cwd=${cwd} model=${defaultModel || 'default'}`);

package/server/cursor-worker/cursor-turn-runner.mjs

@@ -17,6 +17,7 @@ import {
   cursorSubagentRosterFingerprint,
 } from './cursor-subagent-roster.mjs';
 import { createAskUserBridge } from '../../shared/ask-user-bridge.mjs';
+import { renderMediaEmbedInstructionBlock } from '../../shared/media-embed-instructions.mjs';
 import { EMPTY_TURN_COMPLETION_NOTE } from '../../shared/empty-turn-completion.mjs';
 import { resolveFallbackContextLimitTokens } from '../../shared/context-window-fallbacks.mjs';
 import { countPlanLikeLines } from '../../shared/plan-lines.mjs';
@@ -86,6 +87,17 @@ export function buildCursorPlanReadyBoardPayload({
   };
 }
 
+// Delivered rows carry an attemptId the worker echoes on every write so the
+// server can fence out a superseded attempt (HTTP 409 stale_attempt) instead
+// of letting two attempts interleave writes on the same row. The real api
+// client reports the rejection body as a string; tolerate a parsed object too.
+function isStaleAttemptRejection(error) {
+  if (error?.status !== 409) return false;
+  const detail = error?.detail;
+  const text = typeof detail === 'string' ? detail : String(detail?.error || '');
+  return text.includes('stale_attempt');
+}
+
 /**
  * Execute one delivered relay turn against the Cursor SDK, streaming
  * normalized events into the relay's activity channels and publishing the
@@ -131,6 +143,10 @@ export function createCursorTurnRunner({
   // Mirrors the Copilot extension's lastPromptedRelayMode: full mode
   // instructions ride on the first message of a mode and on mode changes only.
   let lastNudgedRelayMode = '';
+  // Like Grok's once-per-worker capability guidance: the Cursor SDK has no
+  // system-prompt seam either, so the media-embed hint rides the first prompt
+  // and the session's history keeps it known from then on.
+  let mediaGuidanceSent = false;
 
   const bridge = createAskUserBridge({
     api,
@@ -177,6 +193,13 @@ export function createCursorTurnRunner({
     return waitingForTurn ? String(activeMessage?.id || '') : '';
   }
 
+  // Crash-guard shape: the attempt id, when known, fences the dying worker's
+  // requeue so it cannot yank back a row a successor attempt now owns.
+  function getActiveQueueAttempt() {
+    if (!waitingForTurn || !activeMessage?.id) return null;
+    return { id: String(activeMessage.id), attemptId: activeMessage.attemptId || null };
+  }
+
   function isTurnActive() {
     return waitingForTurn;
   }
@@ -269,6 +292,7 @@ export function createCursorTurnRunner({
       mode: message.relayMode || 'agent',
       text,
       ...(subagentRunId ? { subagentRunId } : {}),
+      ...(message.attemptId ? { attemptId: message.attemptId } : {}),
     }).catch(() => {});
   }
 
@@ -291,6 +315,7 @@ export function createCursorTurnRunner({
         text: payload.text,
         done: payload.done === true,
         ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+        ...(message.attemptId ? { attemptId: message.attemptId } : {}),
       }).catch(() => {});
       return;
     }
@@ -303,6 +328,7 @@ export function createCursorTurnRunner({
         text: payload.text,
         done: payload.done === true,
         ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+        ...(message.attemptId ? { attemptId: message.attemptId } : {}),
       }).catch(() => {});
       return;
     }
@@ -318,6 +344,7 @@ export function createCursorTurnRunner({
         parentSubagentId: payload.parentSubagentId || undefined,
         displayName: payload.displayName || undefined,
         status: payload.status,
+        ...(message.attemptId ? { attemptId: message.attemptId } : {}),
       }).catch(() => {});
       return;
     }
@@ -396,6 +423,7 @@ export function createCursorTurnRunner({
       mode: message.relayMode || 'agent',
       text: String(text || ''),
       done: true,
+      ...(message.attemptId ? { attemptId: message.attemptId } : {}),
     }).catch(() => {});
   }
 
@@ -408,8 +436,18 @@ export function createCursorTurnRunner({
       modelOrigin: modelOrigin
         || (String(message?.model || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual'),
       ...(terminalError ? { terminalError } : {}),
-    }).catch(async () => {
-      await api('POST', '/api/requeue', { messageId: message.id }).catch(() => {});
+      ...(message.attemptId ? { attemptId: message.attemptId } : {}),
+    }).catch(async (error) => {
+      // A stale_attempt rejection means the server already handed this row to
+      // a newer attempt; requeueing would yank it back, so drop instead.
+      if (isStaleAttemptRejection(error)) {
+        dbg('response rejected as stale_attempt; dropping superseded turn', message.id);
+        return;
+      }
+      await api('POST', '/api/requeue', {
+        messageId: message.id,
+        ...(message.attemptId ? { attemptId: message.attemptId } : {}),
+      }).catch(() => {});
     });
   }
 
@@ -456,7 +494,10 @@ export function createCursorTurnRunner({
       await ensureAgentHandle(message, model);
       const userMessage = buildUserMessageImpl(message);
       const modeNudge = cursorModeNudge(message.relayMode, lastNudgedRelayMode);
-      if (modeNudge) userMessage.text = [modeNudge, userMessage.text].filter(Boolean).join('\n\n');
+      const mediaGuidance = mediaGuidanceSent ? '' : renderMediaEmbedInstructionBlock();
+      if (modeNudge || mediaGuidance) {
+        userMessage.text = [mediaGuidance, modeNudge, userMessage.text].filter(Boolean).join('\n\n');
+      }
       // Committed only once the send reached the transport (before the loop's
       // break below) — a turn that dies before delivery must re-inject the
       // nudge next time, or a mode change would be silently swallowed.
@@ -558,6 +599,7 @@ export function createCursorTurnRunner({
           // harmless duplicate, so under-committing is the safe direction.
           if (!aborted && !abortController.signal.aborted) {
             lastNudgedRelayMode = pendingNudgedRelayMode;
+            if (mediaGuidance) mediaGuidanceSent = true;
           }
           break;
         } catch (error) {
@@ -622,7 +664,10 @@ export function createCursorTurnRunner({
         await publishFinalStream(message, fallbackText);
         await publishResponse(message, { text: fallbackText, model: responseModel });
       } else {
-        await api('POST', '/api/requeue', { messageId: message.id }).catch(() => {});
+        await api('POST', '/api/requeue', {
+          messageId: message.id,
+          ...(message.attemptId ? { attemptId: message.attemptId } : {}),
+        }).catch(() => {});
       }
       return true;
     }
@@ -711,6 +756,7 @@ export function createCursorTurnRunner({
   return {
     handlePendingPayload,
     getActiveQueueMessageId,
+    getActiveQueueAttempt,
     isTurnActive,
     dispose,
   };

package/server/db-schema.mjs

@@ -9,6 +9,7 @@
 // final schema either way.
 import { rebuildRecentWorkspaceRootsTable } from './migrations/0002-recent-workspace-roots-path-key.mjs';
 import { ensurePushSubscriptionsTable } from './migrations/0003-push-subscriptions.mjs';
+import { migrateSteerSettleMarkers } from './migrations/0004-steer-settle-markers.mjs';
 import { migrateImageConversationSchema } from './repositories/image-conversation-repository.mjs';
 
 // Mirrors DEFAULT_RELAY_MODE in server-runtime.mjs; used only by the one-time
@@ -168,7 +169,8 @@ export const SCHEMA_SQL = `
     source_started_at TEXT,
     source_modified_at TEXT,
     updated_at TEXT NOT NULL,
-    last_error TEXT
+    last_error TEXT,
+    origin TEXT
   );
 
   CREATE INDEX IF NOT EXISTS idx_sdk_session_imports_status
@@ -241,6 +243,7 @@ export const SCHEMA_SQL = `
     context_limit_tokens INTEGER,
     long_context_limit_tokens INTEGER,
     pricing_json     TEXT,
+    metadata_json    TEXT,
     enabled          INTEGER NOT NULL DEFAULT 1,
     sort_order       INTEGER NOT NULL DEFAULT 0,
     updated_at       TEXT NOT NULL
@@ -572,6 +575,19 @@ if (!sdkSessionImportColumns.includes('source_started_at')) {
 if (!sdkSessionImportColumns.includes('source_modified_at')) {
   db.exec(`ALTER TABLE sdk_session_imports ADD COLUMN source_modified_at TEXT`);
 }
+if (!sdkSessionImportColumns.includes('origin')) {
+  // 'imported' = the importer created the conversation's runtime binding, so a
+  // later re-import/refresh is safe; 'relay' = the relay queued or executed a
+  // turn, making the relay's history authoritative (re-importing would replace
+  // it with the raw CLI transcript, instruction preambles included). Completed
+  // rows predating the column were written by the importer (relay-born
+  // conversations never get a ledger row — the import guards skip them before
+  // claiming), so backfilling 'imported' restores refreshability; any that the
+  // relay has since continued are re-flagged 'relay' from queue/worker evidence
+  // on their next import attempt.
+  db.exec(`ALTER TABLE sdk_session_imports ADD COLUMN origin TEXT`);
+  db.exec(`UPDATE sdk_session_imports SET origin = 'imported' WHERE status = 'completed'`);
+}
 
 const queueColumns = db.prepare(`PRAGMA table_info(queue)`).all().map((c) => c.name);
 if (!queueColumns.includes('model')) {
@@ -622,12 +638,32 @@ if (!queueColumns.includes('parked_at')) {
 if (!queueColumns.includes('parked_target_session_id')) {
   db.exec(`ALTER TABLE queue ADD COLUMN parked_target_session_id TEXT`);
 }
+if (!queueColumns.includes('consumed_at')) {
+  // Set when the Claude CLI has provably taken a row's prompt (a steer still
+  // pending when the turn it was pushed into finished). A consumed row is
+  // at-most-once: every recovery path fails it terminally instead of
+  // requeueing it, because a re-delivery would run the prompt a second time.
+  db.exec(`ALTER TABLE queue ADD COLUMN consumed_at TEXT`);
+}
 if (!queueColumns.includes('kind')) {
   // 'continuation' rows are synthetic turns for the Claude worker's
   // background-task continuations: born 'processing', never deliverable, and
   // torn down (not requeued) when their worker disappears.
   db.exec(`ALTER TABLE queue ADD COLUMN kind TEXT`);
 }
+if (!queueColumns.includes('attempt_id')) {
+  // One processing attempt = one attempt_id: minted on every pending->processing
+  // transition (and at continuation birth), cleared by every requeue/recovery,
+  // kept on terminal rows so forensics can name the attempt that finalized.
+  // Writers that echo it are fenced; writers that omit it ride legacy semantics
+  // until the extension engine is retired.
+  db.exec(`ALTER TABLE queue ADD COLUMN attempt_id TEXT`);
+}
+if (!queueColumns.includes('continuation_op_id')) {
+  // Worker-supplied idempotency key for POST /api/continuation-turn: a retry
+  // after a lost response must find the row it already created, not mint a twin.
+  db.exec(`ALTER TABLE queue ADD COLUMN continuation_op_id TEXT`);
+}
 
 // recent_workspace_roots gained a case-normalized primary key (path_key). The
 // CREATE TABLE IF NOT EXISTS above only covers fresh databases, so upgrade an
@@ -652,7 +688,20 @@ db.exec(`UPDATE queue SET relay_mode = 'agent' WHERE relay_mode IS NULL OR relay
 db.exec(`CREATE INDEX IF NOT EXISTS idx_queue_next_attempt ON queue(status, next_attempt_at, timestamp)`);
 db.exec(`CREATE INDEX IF NOT EXISTS idx_queue_owner_pending ON queue(status, owner_sdk_session_id, next_attempt_at, timestamp)`);
 db.exec(`CREATE INDEX IF NOT EXISTS idx_queue_parked_release ON queue(status, parked_transaction_id, parked_target_session_id, parked_at, timestamp)`);
+db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_queue_continuation_op ON queue(continuation_op_id) WHERE continuation_op_id IS NOT NULL`);
 migrateImageConversationSchema(db);
+// After the queue's response_message_id exists: the source-link backfill
+// reads it. Not boot-critical — every reader of its columns tolerates their
+// absence — so a failure (e.g. SQLITE_BUSY) is logged and retried next boot
+// instead of keeping the relay down.
+try {
+  const steerSettleMarkersMigration = migrateSteerSettleMarkers(db);
+  if (steerSettleMarkersMigration.foldStubsRekinded) {
+    console.log(`[steering] re-kinded ${steerSettleMarkersMigration.foldStubsRekinded} fold stub(s) as 'folded'`);
+  }
+} catch (error) {
+  console.warn(`[steering] migration 0004 failed; retrying on next boot: ${error?.message || error}`);
+}
 
 const runtimeSessionColumns = db.prepare(`PRAGMA table_info(runtime_sessions)`).all().map((c) => c.name);
 if (runtimeSessionColumns.length) {
@@ -821,6 +870,11 @@ if (relayQuestionColumns.length && !relayQuestionColumns.includes('structured_an
 if (relayQuestionColumns.length && !relayQuestionColumns.includes('request_schema')) {
   db.exec(`ALTER TABLE relay_questions ADD COLUMN request_schema TEXT`);
 }
+if (relayQuestionColumns.length && !relayQuestionColumns.includes('attempt_id')) {
+  // Stamped from the queue row at creation so stale-question cleanup can cancel
+  // cards left behind by a superseded processing attempt.
+  db.exec(`ALTER TABLE relay_questions ADD COLUMN attempt_id TEXT`);
+}
 db.exec(`CREATE INDEX IF NOT EXISTS idx_relay_questions_continuation ON relay_questions(continuation_id, continuation_question_id, status, created_at)`);
 
 db.exec(`
@@ -929,4 +983,10 @@ if (modelVariantColumns.length && !modelVariantColumns.includes('long_context_li
 if (modelVariantColumns.length && !modelVariantColumns.includes('pricing_json')) {
   db.exec(`ALTER TABLE model_variants ADD COLUMN pricing_json TEXT`);
 }
+// Per-model catalog metadata (vendor, picker category, real context window,
+// runtime-reported reasoning efforts, ...) persisted with the variant rows so a
+// restart serves it before the next worker/discovery snapshot arrives.
+if (modelVariantColumns.length && !modelVariantColumns.includes('metadata_json')) {
+  db.exec(`ALTER TABLE model_variants ADD COLUMN metadata_json TEXT`);
+}
 }