@oar-sh/oar 0.9.2 → 0.9.3

package/server/routes/sessions-routes.mjs

@@ -1,4 +1,5 @@
 'use strict';
+import { liveResendsByOriginal } from '../services/steer-resend.mjs';
 import { killTmuxSession } from '../services/session-worker-launch-service.mjs';
 
 import fs from 'fs';
@@ -947,13 +948,19 @@ export function normalizePreferredReasoningEffort(value) {
   return String(value || '').trim().toLowerCase();
 }
 
-const MAX_CONVERSATION_DRAFT_LENGTH = 20_000;
+// The web client caps what it saves at the same length (MAX_DRAFT_TEXT_LENGTH
+// in public/app/conversation-draft-sync.mjs); a test pins them together.
+export const MAX_CONVERSATION_DRAFT_LENGTH = 20_000;
 
 function normalizeConversationDraftText(value, { maxLength = MAX_CONVERSATION_DRAFT_LENGTH } = {}) {
   const text = String(value ?? '');
   if (!text.trim()) return '';
   if (text.length <= maxLength) return text;
-  return text.slice(0, maxLength);
+  // Never split a surrogate pair: SQLite would store the lone half as U+FFFD,
+  // and the client (which cuts the same way) would no longer match its draft.
+  const cut = text.slice(0, maxLength);
+  const last = cut.charCodeAt(cut.length - 1);
+  return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
 }
 
 export function normalizeOptionalIsoTimestamp(value) {
@@ -1743,11 +1750,16 @@ export function buildConversationMessages({
       .map((row) => [String(row?.id || '').trim(), row])
       .filter(([id]) => !!id),
   );
+  // A stopped steer's marker says "Resent" from the data, so it holds across
+  // reloads and devices (the relay refuses a second Resend on the same basis).
+  const liveResends = liveResendsByOriginal(dbMessages, queueRows);
   const normalizedDbMessages = Array.isArray(dbMessages)
     ? dbMessages.map((message) => {
         const id = String(message?.id || '').trim();
+        // The queue's link is pruned with old rows; the message's own column
+        // keeps it, so a reload still anchors the reply under its prompt.
         const sourceMessageId = message?.role === 'assistant'
-          ? (responseMessageToSourceId.get(id) || undefined)
+          ? (responseMessageToSourceId.get(id) || String(message?.source_message_id || '').trim() || undefined)
           : undefined;
         // A user row's queue entry shares its id; assistant rows reach the same
         // entry through the response mapping. Both need it for the effort tag.
@@ -1775,6 +1787,15 @@ export function buildConversationMessages({
           timestamp: message?.timestamp,
           sourceMessageId,
           executedProvider: message?.executed_provider || message?.executedProvider || undefined,
+          // 'continuation' badges a self-started turn; 'absorbed' marks a
+          // reply that continues through the next (steered) user message;
+          // 'folded'/'stopped' are a steer's settle markers. Without this the
+          // live-appended badge/merge/marker vanished on reload.
+          kind: message?.kind || undefined,
+          resendOfMessageId: message?.role === 'user' ? (message?.resend_of_message_id || undefined) : undefined,
+          resentAs: (message?.role === 'assistant' && message?.kind === 'stopped' && sourceMessageId)
+            ? (liveResends.get(sourceMessageId) || undefined)
+            : undefined,
         };
       })
     : [];
@@ -2112,9 +2133,11 @@ export function registerSessionsRoutes(app, deps) {
     }
   }
 
-  const SDK_DELETE_WAIT_TIMEOUT_MS = 12_000;
-  const SDK_DELETE_POLL_MS = 200;
   const SDK_DELETE_STALE_PROCESSING_MS = 60_000;
+  const CLI_SESSION_DELETE_TIMEOUT_MS = 10_000;
+  const LIVE_WORKER_STATUSES = new Set(['starting', 'ready', 'processing']);
+  // A session id that is safe to join into a path under the session-state root.
+  const SESSION_FOLDER_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
   const markConversationDeleted = db.prepare(`UPDATE conversations SET status = 'deleted', updated_at = ? WHERE id = ?`);
   const getActiveQueueForMessage = db.prepare(`
     SELECT id
@@ -2143,6 +2166,20 @@ export function registerSessionsRoutes(app, deps) {
     WHERE conversation_id = ?
       AND status IN ('pending', 'processing', 'parked')
   `);
+  const countProcessingConversationQueueRows = db.prepare(`
+    SELECT COUNT(*) AS count
+    FROM queue
+    WHERE conversation_id = ?
+      AND status = 'processing'
+  `);
+  const findOtherLiveConversationForSdkSession = db.prepare(`
+    SELECT id
+    FROM conversations
+    WHERE sdk_session_id = ?
+      AND id != ?
+      AND status != 'deleted'
+    LIMIT 1
+  `);
   const getConversationUsageSnapshotAggregate = db.prepare(`
     SELECT
       COUNT(*) AS snapshot_count,
@@ -2206,10 +2243,6 @@ export function registerSessionsRoutes(app, deps) {
   const sessionLaunchMutex = createKeyedMutex();
   const relaunchCoalescer = createRelaunchCoalescer({ windowMs: RELAUNCH_COALESCE_WINDOW_MS });
 
-  function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-
   // Layer every enabled provider's models onto the base Copilot catalog.
   function buildModelCatalogWithProviders(modelState, openAISettings = getOpenAIProviderSettings()) {
     return buildModelCatalogWithGrokProvider(
@@ -2292,16 +2325,121 @@ export function registerSessionsRoutes(app, deps) {
     return true;
   }
 
-  async function waitForSdkDeleteCompletion(sdkSessionId, timeoutMs = SDK_DELETE_WAIT_TIMEOUT_MS) {
-    const sid = String(sdkSessionId || '').trim();
-    if (!sid) return { completed: false };
-    const startedAt = Date.now();
-    while ((Date.now() - startedAt) < timeoutMs) {
-      const row = stmts.getSdkDeleteRequestBySessionId.get(sid);
-      if (!row) return { completed: true };
-      await sleep(SDK_DELETE_POLL_MS);
-    }
-    return { completed: false };
+  /**
+   * Whether a conversation is still working, which blocks deleting it: a turn
+   * is running (including one waiting on a question card or an approval) or
+   * background tasks are live. Both only count while the session's worker is
+   * alive: a dead worker runs nothing, and the processing rows or task set it
+   * left behind would otherwise make the conversation undeletable. A session
+   * the registry has never seen may still be running a turn, so its
+   * processing rows count.
+   *
+   * A worker's pid decides whether it is alive; its status only when it has
+   * none. A turn that fails marks a worker that is still running 'error',
+   * and it stays so until its next turn, background tasks and all.
+   */
+  function describeConversationActivity(conversationId, workerSessionId) {
+    const worker = sessionWorkerRegistry?.getWorker?.(workerSessionId) || null;
+    const workerAlive = !!worker && (worker.pid
+      ? isPidAlive(worker.pid)
+      : LIVE_WORKER_STATUSES.has(String(worker.status || '').trim().toLowerCase()));
+    const processingCount = Number(countProcessingConversationQueueRows.get(conversationId)?.count || 0);
+    const taskKeys = [...new Set([conversationId, workerSessionId])];
+    const liveTasks = workerAlive ? taskKeys.flatMap((key) => backgroundTaskStore?.get?.(key) || []) : [];
+    return {
+      turnRunning: processingCount > 0 && (workerAlive || !worker),
+      backgroundTaskCount: liveTasks.length,
+      // Tasks the panel shows no Stop button for (Copilot detached shells).
+      unstoppableTaskCount: liveTasks.filter((task) => task?.stoppable === false).length,
+    };
+  }
+
+  function withDeadline(promise, timeoutMs, label) {
+    let timer = null;
+    return Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs} ms`)), timeoutMs);
+        timer.unref?.();
+      }),
+    ]).finally(() => clearTimeout(timer));
+  }
+
+  /**
+   * The Claude CLI's footprint for one session: its transcript
+   * (`<projectDir>/<nativeSessionId>.jsonl`) and the per-session folder beside
+   * it. Nothing else in the project folder is touched — it holds every other
+   * session of that workspace and the project memory.
+   */
+  function deleteClaudeCliSession({ conversation, runtimeSession }) {
+    const nativeSessionId = String(runtimeSession?.claude_native_session_id || '').trim();
+    if (!nativeSessionId || typeof resolveClaudeSessionRoot !== 'function') return { deleted: null };
+    const anchors = resolveClaudeSessionRoot({
+      claudeNativeSessionId: nativeSessionId,
+      workspaceRootPath: String(
+        conversation?.runtime_workspace_root_path || conversation?.configured_workspace_root_path || '',
+      ).trim(),
+    });
+    if (!anchors?.projectDirPath) return { deleted: null };
+    const projectDir = path.resolve(anchors.projectDirPath);
+    const targets = [anchors.transcriptPath, anchors.sessionRootExists ? anchors.sessionRootPath : '']
+      .filter(Boolean)
+      .map((target) => path.resolve(target))
+      .filter((target) => path.dirname(target) === projectDir
+        && [nativeSessionId, `${nativeSessionId}.jsonl`].includes(path.basename(target)));
+    for (const target of targets) fs.rmSync(target, { recursive: true, force: true });
+    return { deleted: targets.length > 0 };
+  }
+
+  /**
+   * The Copilot session, through the runtime's own deleteSession(). When that
+   * fails the request goes on the SDK delete queue, which a CLI-side consumer
+   * (the extension engine) still works off.
+   */
+  async function deleteCopilotCliSession({ sdkSessionId, conversationId }) {
+    const stateRoot = String(resolveSessionStateRoot?.() || '').trim();
+    const sessionDir = stateRoot && SESSION_FOLDER_ID_PATTERN.test(sdkSessionId) ? path.join(stateRoot, sdkSessionId) : '';
+    // A conversation deleted before its first turn has no session on disk yet
+    // (the runtime would answer "Session file not found").
+    if (sessionDir && !fs.existsSync(sessionDir)) return { deleted: null };
+    if (typeof sdkSessionImportService?.deleteSession !== 'function') return { deleted: null };
+    try {
+      await withDeadline(
+        sdkSessionImportService.deleteSession(sdkSessionId),
+        CLI_SESSION_DELETE_TIMEOUT_MS,
+        'Copilot deleteSession()',
+      );
+      return { deleted: true };
+    } catch (error) {
+      const reason = String(error?.message || error);
+      if (/Session file not found/i.test(reason)) {
+        // The runtime keeps no session for it, only this session's own
+        // folder (a run that never wrote its session file): nothing to retry.
+        if (sessionDir) fs.rmSync(sessionDir, { recursive: true, force: true });
+        return { deleted: sessionDir ? true : null };
+      }
+      console.warn(`[delete] Copilot session ${shortId(sdkSessionId)} was not deleted: ${reason}`);
+      enqueueSdkDeleteRequest(sdkSessionId, conversationId);
+      return { deleted: false, queued: true };
+    }
+  }
+
+  /** The conversation's CLI-side session, per provider; null where the relay keeps none. */
+  async function deleteCliSession({ conversation, conversationId, sdkSessionId, runtimeSession }) {
+    const provider = String(runtimeSession?.provider_type || '').trim().toLowerCase();
+    try {
+      if (provider === 'claude') return deleteClaudeCliSession({ conversation, runtimeSession });
+      if (!sdkSessionId) return { deleted: null };
+      if (!provider || provider === 'github' || provider === 'openai') {
+        return await deleteCopilotCliSession({ sdkSessionId, conversationId });
+      }
+      return { deleted: null };
+    } catch (error) {
+      // The conversation is already tombstoned: a file the OS will not let go
+      // of must not leave it half deleted.
+      console.warn(`[delete] CLI session of ${shortId(conversationId)} was not deleted: ${error?.message || error}`);
+      return { deleted: false };
+    }
   }
 
   function finalizeDeletedConversationsForSdkSession(sdkSessionId) {
@@ -2436,7 +2574,7 @@ export function registerSessionsRoutes(app, deps) {
       (stmts.getSharedMessages || stmts.getMessages).all(resolvedConversationId),
     );
     const queueRows = db.prepare(`
-      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model
+      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model, status
       FROM queue
       WHERE conversation_id = ?
     `).all(resolvedConversationId);
@@ -3181,7 +3319,7 @@ export function registerSessionsRoutes(app, deps) {
     });
     const dbMessages = stmts.getMessages.all(conversationId);
     const queueRows = db.prepare(`
-      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model
+      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model, status
       FROM queue
       WHERE conversation_id = ?
     `).all(conversationId);
@@ -3583,7 +3721,7 @@ export function registerSessionsRoutes(app, deps) {
     });
     const dbMessages = stmts.getMessages.all(resolvedConversationId);
     const queueRows = db.prepare(`
-      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model
+      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model, status
       FROM queue
       WHERE conversation_id = ?
     `).all(resolvedConversationId);
@@ -3854,15 +3992,30 @@ export function registerSessionsRoutes(app, deps) {
     if (!existing || String(existing.status || '').trim() === 'deleted') {
       return res.status(404).json({ error: 'Conversation not found' });
     }
-    const baseDraftUpdatedAtValue = req.body?.baseDraftUpdatedAt ?? req.body?.base_draft_updated_at;
-    const comparesDraftVersion = baseDraftUpdatedAtValue !== undefined;
+    // A null base means "I have seen no draft" and conflicts with any versioned
+    // draft — but only from clients that declare the versioned protocol. Older
+    // tabs also send an explicit null (after every keystroke), and a 409 there
+    // would revert their typing, so for them null stays unconditional.
+    const baseDraftUpdatedAtValue = req.body?.baseDraftUpdatedAt !== undefined
+      ? req.body.baseDraftUpdatedAt
+      : req.body?.base_draft_updated_at;
+    const speaksVersionedDraftProtocol = Number(req.body?.draftSyncVersion) >= 2;
+    const comparesDraftVersion = baseDraftUpdatedAtValue !== undefined
+      && (baseDraftUpdatedAtValue !== null || speaksVersionedDraftProtocol);
     const normalizedBaseDraftUpdatedAt = normalizeOptionalIsoTimestamp(baseDraftUpdatedAtValue);
     const suppliedBaseTimestamp = String(baseDraftUpdatedAtValue ?? '').trim();
     if (comparesDraftVersion && suppliedBaseTimestamp && !normalizedBaseDraftUpdatedAt) {
       return res.status(400).json({ error: 'Invalid baseDraftUpdatedAt timestamp' });
     }
     const existingDraftUpdatedAt = normalizeOptionalIsoTimestamp(existing.draft_updated_at);
-    if (hasConversationDraftVersionConflict({
+    // A pagehide copy taken while this client's own send was in flight carries
+    // the pre-send base; the send transaction has since moved the version. That
+    // move (recorded with the sender's client id) is the only mismatch it may
+    // pass — a newer draft from anyone else still conflicts.
+    const acceptsOwnSendVersion = req.body?.acceptOwnSend === true
+      && !!senderClientId
+      && String(existing.draft_updated_by_client_id || '') === senderClientId;
+    if (!acceptsOwnSendVersion && hasConversationDraftVersionConflict({
       existingDraftUpdatedAt,
       baseDraftUpdatedAt: normalizedBaseDraftUpdatedAt,
       compareEnabled: comparesDraftVersion,
@@ -3874,6 +4027,7 @@ export function registerSessionsRoutes(app, deps) {
         conflict: true,
         conversationId,
         draftText: String(existing.draft_text || ''),
+        draftAttachments: parseDraftAttachmentsColumn(existing.draft_attachments),
         draftUpdatedAt: existingDraftUpdatedAt,
         draftUpdatedByClientId: existing.draft_updated_by_client_id || null,
       });
@@ -4275,42 +4429,131 @@ export function registerSessionsRoutes(app, deps) {
     }
 
     try {
-      const sdkSessionId = String(existing.sdk_session_id || '').trim() || null;
-      if (!sdkSessionId) {
-        stmts.markDeletedSdkSession.run(id, new Date().toISOString());
-        cleanupGeneratedImagesForConversation({
-          conversationId: id,
-          sdkSessionId: null,
-          messageRows: stmts.getMessages?.all?.(id) || [],
-          parseAttachments,
-          hydrateAttachment,
-          resolveSessionStateRoot,
-        });
-        const orphanedUploads = collectOrphanedUploadsFromConversation(id);
-        hardDeleteConversationRows(id);
-        deleteOrphanedUploads(orphanedUploads);
-        io.emit('conversation_deleted', { conversationId: id });
-        return res.json({ ok: true });
-      }
-
-      markConversationDeleted.run(new Date().toISOString(), id);
-      stmts.markDeletedSdkSession.run(sdkSessionId, new Date().toISOString());
-      if (sdkSessionId !== id) {
-        // Also tombstone the conversation id itself for legacy/synthetic sdk id fallback paths.
-        stmts.markDeletedSdkSession.run(id, new Date().toISOString());
-      }
-      enqueueSdkDeleteRequest(sdkSessionId, id);
-      const awaited = await waitForSdkDeleteCompletion(sdkSessionId);
-      if (awaited.completed) return res.json({ ok: true });
-
-      io.emit('conversation_delete_pending', { conversationId: id });
-      return res.json({ ok: true, pending: true });
+      // Session workers are keyed by the SDK session id, which is the
+      // conversation id until a session is bound. Serialized with launches and
+      // relaunches of that session, and with a second delete of it.
+      const workerSessionId = String(existing.sdk_session_id || '').trim() || id;
+      const outcome = await sessionLaunchMutex.runExclusive(
+        workerSessionId,
+        () => deleteConversationNow(id),
+      );
+      return res.status(outcome.statusCode).json(outcome.body);
     } catch (error) {
       console.warn(`[archive] Delete failed for ${id}: ${error?.message || error}`);
       return res.status(500).json({ error: 'Failed to delete conversation' });
     }
   });
 
+  /** DELETE /api/conversation/:id under its session's lock; see the route. */
+  async function deleteConversationNow(id) {
+    const existing = stmts.getConvAnyStatus.get(id);
+    if (!existing) return { statusCode: 200, body: { ok: true, alreadyDeleted: true } };
+    const sdkSessionId = String(existing.sdk_session_id || '').trim() || null;
+    const workerSessionId = sdkSessionId || id;
+
+    const activity = describeConversationActivity(id, workerSessionId);
+    if (activity.turnRunning) {
+      return {
+        statusCode: 409,
+        body: {
+          ok: false,
+          error: 'conversation-active',
+          reason: 'turn-running',
+          message: 'This conversation is still working on a reply. Stop it, then delete it.',
+        },
+      };
+    }
+    if (activity.backgroundTaskCount > 0) {
+      return {
+        statusCode: 409,
+        body: {
+          ok: false,
+          error: 'conversation-active',
+          reason: 'background-tasks',
+          // Kill session stops the session's worker, and the delete counts no
+          // tasks for a conversation whose worker is gone.
+          message: activity.unstoppableTaskCount > 0
+            ? 'Background tasks are still running in this conversation, and some have no Stop button. Use Kill session in its ⋯ menu, then delete it.'
+            : 'Background tasks are still running in this conversation. Stop them in the task panel, then delete it.',
+        },
+      };
+    }
+
+    // A worker and CLI session that another live conversation still uses
+    // stay; only this conversation's own data goes.
+    const sharedWithConversationId = sdkSessionId
+      ? String(findOtherLiveConversationForSdkSession.get(sdkSessionId, id)?.id || '').trim() || null
+      : null;
+    // A Copilot session the relay only imported, and never ran, belongs to
+    // whoever started it in the CLI. Deleting the conversation hides and
+    // tombstones it, and nothing more: the relay started no process for it
+    // (the process scan would find that user's own `copilot --resume`), and
+    // its CLI session stays. Asked before the stop, which removes the registry
+    // entry that shows the relay has run it.
+    const importedOnly = !!sdkSessionId && sdkSessionImportService?.isImportedOnly?.(sdkSessionId) === true;
+
+    // An idle worker is stopped before anything is deleted: the route used to
+    // leave it running (and holding its workspace) until the relay restarted.
+    // Nothing is touched when it will not die.
+    let workerStopped = false;
+    if (!sharedWithConversationId && !importedOnly) {
+      const stopped = await stopIdleWorkspaceRootSession({
+        sdkSessionId: workerSessionId,
+        worker: sessionWorkerRegistry?.getWorker?.(workerSessionId) || null,
+        sessionWorkerSupervisor,
+        sessionWorkerRegistry,
+        sessionWorkerProcessInspector,
+        stopOverrides: sessionWorkerStopOverrides,
+      });
+      if (!stopped.ok) {
+        return {
+          statusCode: 409,
+          body: {
+            ok: false,
+            error: 'worker-stop-failed',
+            message: "Couldn't stop this conversation's session, so nothing was deleted. Try again in a moment.",
+            remainingPids: stopped.remainingPids || [],
+          },
+        };
+      }
+      workerStopped = (stopped.stoppedPids || []).length > 0;
+      // Re-armed after the stop, which can outlast the kill block's grace
+      // window: nothing may respawn a worker for the rows deleted below.
+      sessionWorkerSupervisor?.markKilled?.(workerSessionId);
+      for (const key of new Set([id, workerSessionId])) backgroundTaskStore?.replace?.(key, []);
+    }
+
+    const deletedAt = new Date().toISOString();
+    markConversationDeleted.run(deletedAt, id);
+    // Tombstones keep the SDK session importer from bringing it back.
+    stmts.markDeletedSdkSession.run(sdkSessionId || id, deletedAt);
+    if (sdkSessionId && sdkSessionId !== id) stmts.markDeletedSdkSession.run(id, deletedAt);
+
+    const cliSession = sharedWithConversationId || importedOnly
+      ? { deleted: null }
+      : await deleteCliSession({
+        conversation: existing,
+        conversationId: id,
+        sdkSessionId,
+        runtimeSession: stmts.getRuntimeSessionByConversation?.get?.(id) || null,
+      });
+
+    cleanupGeneratedImagesForConversation({
+      conversationId: id,
+      sdkSessionId,
+      messageRows: stmts.getMessages?.all?.(id) || [],
+      parseAttachments,
+      hydrateAttachment,
+      resolveSessionStateRoot,
+    });
+    const orphanedUploads = collectOrphanedUploadsFromConversation(id);
+    hardDeleteConversationRows(id);
+    deleteOrphanedUploads(orphanedUploads);
+    if (sdkSessionId && !cliSession.queued) stmts.deleteSdkDeleteRequest?.run?.(sdkSessionId);
+    io.emit('conversation_deleted', { conversationId: id });
+    return { statusCode: 200, body: { ok: true, workerStopped, cliSessionDeleted: cliSession.deleted } };
+  }
+
   // POST /api/conversation/:id/archive — archive conversation
   app.post('/api/conversation/:id/archive', auth, async (req, res) => {
     const id = String(req.params.id || '').trim();

package/server/server-runtime.mjs

@@ -24,6 +24,9 @@ import {
   normalizeWorkspaceRootKey,
 } from './services/workspace-root-path-policy.mjs';
 import { stopSessionWorkerProcesses } from './services/session-worker-stop-service.mjs';
+import { pickLiveTurnRowId } from './services/live-turn-picker.mjs';
+import { buildSteerSettleFailure, steerAgentLabelForProvider } from '../shared/steer-settle-failure.mjs';
+import { sanitizeRelayQuestionContext as sanitizeRelayQuestionContextWith } from './services/relay-question-context.mjs';
 import { isRealPathWithinRoot } from './services/workspace-symlink-guard.mjs';
 import { applySchema } from './db-schema.mjs';
 import { createSessionRepository } from './repositories/session-repository.mjs';
@@ -4880,8 +4883,35 @@ const backgroundTaskStore = {
   },
 };
 
+// The live turn among a conversation's processing rows. Mid-turn steering can
+// leave several processing at once — the running turn, steered messages the
+// CLI folded into it (no output of their own), a handed-off row still settling
+// — so the live turn is the row that produced output most recently; with
+// nothing to separate them yet, the oldest processing row (the turn a steered
+// message joins) wins. See live-turn-picker.mjs for why recency, not per-row
+// stream seq. Returns the whole row so callers get relay_mode/timestamps too.
+function resolveLiveTurnQueueRow(conversationId) {
+  const rows = stmts.listProcessingQueueByConversation?.all(conversationId)
+    || (stmts.getLatestProcessingQueueByConversation.get(conversationId)
+      ? [stmts.getLatestProcessingQueueByConversation.get(conversationId)]
+      : []);
+  if (!rows.length) return null;
+  if (rows.length === 1) return rows[0];
+  const byId = new Map(rows.map((row) => [String(row.id), row]));
+  const liveId = pickLiveTurnRowId(rows.map((row) => {
+    const output = stmts.getLastOutputAtByQueueMessage?.get({ id: row.id }) || null;
+    return {
+      id: String(row.id),
+      lastOutputAtMs: Date.parse(String(output?.last_output_at || '')) || 0,
+      streamDone: Number(output?.stream_done || 0) === 1,
+      processingAtMs: Date.parse(String(row.processing_at || row.timestamp || '')) || 0,
+    };
+  }));
+  return byId.get(liveId) || rows[0];
+}
+
 function inFlightStateForConversation(conversationId) {
-  const row = stmts.getLatestProcessingQueueByConversation.get(conversationId);
+  const row = resolveLiveTurnQueueRow(conversationId);
   if (!row) return null;
   const streamEvents = relayStreamEventsForQueueMessage(row.id);
   const lastStreamEvent = streamEvents.length ? streamEvents[streamEvents.length - 1] : null;
@@ -4906,17 +4936,17 @@ function inFlightStateForConversation(conversationId) {
 // retry_count like /api/requeue does, but bypasses that route's budget check,
 // so the sweep enforces it here). Minimal mirror of the route-side
 // failQueueMessage: mark failed, insert the assistant failure message, emit.
-function failRecoveredRowTerminally(row, reason) {
+function failRecoveredRowTerminally(row, reason, { failureRecord = null, failureText: presetText = null } = {}) {
   const now = new Date().toISOString();
   const responseId = uuidv4();
   const retryCount = Number(row?.retry_count || 0) + 1;
-  const failureText = `Relay recovery limit reached after ${retryCount} attempts (${reason}). The worker kept dying before completing this turn, so the message was failed to keep the queue moving. Send it again to retry.`;
+  const failureText = presetText || `Relay recovery limit reached after ${retryCount} attempts (${reason}). The worker kept dying before completing this turn, so the message was failed to keep the queue moving. Send it again to retry.`;
   const requestedModel = String(row?.model || '').trim() || null;
   const tx = db.transaction(() => {
     // setFailed is compare-and-set on status (processing/pending/parked): a
     // row that settled between the sweep's listing and this write must not
     // grow an orphan failure bubble on top of its real outcome.
-    const result = stmts.setFailed.run(JSON.stringify({
+    const result = stmts.setFailed.run(JSON.stringify(failureRecord || {
       kind: 'recovery-limit',
       error: 'recovery-limit',
       code: 'recovery-limit',
@@ -4940,6 +4970,7 @@ function failRecoveredRowTerminally(row, reason) {
       null,
       requestedModel ? 'user' : 'auto',
     );
+    stmts.setMessageSourceId?.run(row.id, responseId);
     stmts.linkActivityToResponse?.run(responseId, row.id);
     stmts.linkStreamEventsToResponse?.run(responseId, row.id);
     stmts.linkThoughtsToResponse?.run(responseId, row.id);
@@ -4954,7 +4985,20 @@ function failRecoveredRowTerminally(row, reason) {
     message: { role: 'assistant', text: failureText, model: requestedModel || 'unknown', mode: String(row?.relay_mode || '').trim() || null, timestamp: now },
   });
   io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
-  console.warn(`${runtimeLogPrefix()}RECOVERY LIMIT ${String(row.id).slice(0, 8)} conv=${String(row.conversation_id).slice(0, 8)} retries=${retryCount} reason=${reason}`);
+  console.warn(`${runtimeLogPrefix()}${failureRecord ? 'CONSUMED FAILED' : 'RECOVERY LIMIT'} ${String(row.id).slice(0, 8)} conv=${String(row.conversation_id).slice(0, 8)} retries=${retryCount} reason=${reason}`);
+}
+
+// A row whose prompt the worker's runtime already consumed (queue.consumed_at)
+// is at-most-once: recovery must never requeue it — a re-delivery would run the
+// prompt twice — so it fails terminally with the steer-settle wording, naming
+// the provider's runtime the way the workers' own settle wording does.
+function failConsumedRowTerminally(row, reason) {
+  const providerType = stmts.getRuntimeSessionByConversation?.get?.(row?.conversation_id)?.provider_type;
+  const failureRecord = buildSteerSettleFailure(row, { agentLabel: steerAgentLabelForProvider(providerType) });
+  failRecoveredRowTerminally(row, reason, {
+    failureRecord: { ...failureRecord, error: 'terminal-error', reason: String(reason || 'recovery') },
+    failureText: `${failureRecord.message} Error code: ${failureRecord.stableCode}. ${failureRecord.guidance}`,
+  });
 }
 
 function recoverProcessingOlderThan(cutoffIso, requeueAtIso, { ceilingBeforeIso = null } = {}) {
@@ -4966,7 +5010,9 @@ function recoverProcessingOlderThan(cutoffIso, requeueAtIso, { ceilingBeforeIso
     stmts.dropStaleContinuation?.run?.(row.id);
     io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
   }
-  const allRows = stmts.listRecoverableProcessing.all(params);
+  const listedRows = stmts.listRecoverableProcessing.all(params);
+  for (const row of listedRows.filter((entry) => entry?.consumed_at)) failConsumedRowTerminally(row, 'stale-recovery');
+  const allRows = listedRows.filter((entry) => !entry?.consumed_at);
   if (!allRows.length) return [];
   // Enforce the retry budget before requeueing: failing these rows first
   // flips them out of 'processing' so the recovery UPDATE below skips them.
@@ -5772,6 +5818,10 @@ function recoverDeadWorkerProcessingRows(sessionId, reason) {
       io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
       continue;
     }
+    if (row.consumed_at) {
+      failConsumedRowTerminally(row, `worker-died-${reason}`);
+      continue;
+    }
     if (Number(row.retry_count || 0) + 1 >= MAX_REQUEUE_RETRIES) {
       failRecoveredRowTerminally(row, `worker-died-${reason}`);
       continue;
@@ -5814,11 +5864,15 @@ function handleWorkerSocketClosed({ sessionId, pid = null } = {}) {
   const sid = String(sessionId || '').trim();
   if (!sid) return;
   const owned = stmts.listProcessingRowsForOwner?.all?.(sid) || [];
-  if (!owned.length) return;
+  // A dead worker's steering snapshot must not keep holding the composer even
+  // when it owned no rows (the hold can outlive them, e.g. a continuation's).
+  const heldSteering = Boolean(sessionWorkerRegistry?.getWorker?.(sid)?.steering);
+  if (!owned.length && !heldSteering) return;
   const timer = setTimeout(() => {
     try {
       if (runtimeShutdownStarted) return;
       if (isWorkerSessionProcessAlive(sid, pid)) return; // reconnect or socket flap
+      sessionWorkerRegistry?.clearSteering?.(sid);
       const stillOwned = stmts.listProcessingRowsForOwner?.all?.(sid) || [];
       if (!stillOwned.length) return;
       console.warn(`${runtimeLogPrefix()}WORKER DIED session=${sid.slice(0, 8)} rows=${stillOwned.length} trigger=socket-close — recovering owned turns`);
@@ -6113,6 +6167,7 @@ const sharedRouteDeps = {
   previewCardsForResponse,
   sanitizeActivityText,
   inFlightStateForConversation,
+  resolveLiveTurnQueueRow,
   backgroundTaskStore,
   // A closure, not the registry itself: this deps object is built before the
   // preview lane is constructed further down the file.
@@ -6523,25 +6578,10 @@ function sanitizeRelayQuestionRequest(requestBody) {
   }
 }
 
+// The allow-list lives in services/relay-question-context.mjs (unit-tested);
+// this binds it to the relay's own mode normalizer.
 function sanitizeRelayQuestionContext(rawContext) {
-  if (!rawContext || typeof rawContext !== 'object' || Array.isArray(rawContext)) return null;
-  const context = {};
-  if (typeof rawContext.source === 'string' && rawContext.source.trim()) {
-    context.source = rawContext.source.trim().slice(0, 64);
-  }
-  if (typeof rawContext.rationale === 'string' && rawContext.rationale.trim()) {
-    context.rationale = rawContext.rationale.trim().slice(0, 240);
-  }
-  if (typeof rawContext.queueMessageId === 'string' && rawContext.queueMessageId.trim()) {
-    context.queueMessageId = rawContext.queueMessageId.trim();
-  }
-  if (typeof rawContext.conversationId === 'string' && rawContext.conversationId.trim()) {
-    context.conversationId = rawContext.conversationId.trim();
-  }
-  if (typeof rawContext.relayMode === 'string' && rawContext.relayMode.trim()) {
-    context.relayMode = normalizeRelayMode(rawContext.relayMode) || DEFAULT_RELAY_MODE;
-  }
-  return Object.keys(context).length ? context : null;
+  return sanitizeRelayQuestionContextWith(rawContext, { normalizeRelayMode, defaultRelayMode: DEFAULT_RELAY_MODE });
 }