@openchambery/web 2.1.7-beta.1 → 2.1.7-beta.10

package/server/lib/content-search/runtime.test.js

@@ -2,6 +2,100 @@ import { expect, test } from 'vitest';
 import { createContentSearchService } from './service.js';
 import { createContentSearchRuntime } from './runtime.js';
 
+test('persists initialization times only after all thirty-day history is covered and resumes partial work', async () => {
+  const service = createContentSearchService({ dbPath: ':memory:' });
+  const day = 86400000;
+  let clock = 40 * day;
+  let fail = true;
+  const reads = [];
+  const dependencies = { service, getRuntimeKey: () => 'host', now: () => clock,
+    listSessions: async () => ({ data: ['a', 'b'].map((id) => ({ id, time: { updated: 40 * day } })), cursor: {} }),
+    listMessages: async ({ sessionID }) => {
+      reads.push(sessionID);
+      if (sessionID === 'b' && fail) throw new Error('offline');
+      return { data: [{ type: 'user', id: sessionID, sessionID, time: { created: 12 * day }, text: 'old history' }], cursor: {} };
+    },
+  };
+  let runtime = createContentSearchRuntime(dependencies);
+  expect(runtime.status().initializationRequired).toBe(true);
+  await runtime.sync();
+  expect(runtime.status()).toMatchObject({ phase: 'partial', initializationRequired: true, indexStartedAt: clock, indexCompletedAt: null });
+  await runtime.stop();
+  clock += 1000;
+  fail = false;
+  runtime = createContentSearchRuntime(dependencies);
+  await runtime.sync();
+  expect(reads).toEqual(['a', 'b', 'b']);
+  expect(runtime.status()).toMatchObject({ phase: 'ready', initializationRequired: false, indexStartedAt: 40 * day, indexCompletedAt: clock });
+  expect(service.search('host', 'old history')).toHaveLength(2);
+  await runtime.stop();
+  runtime = createContentSearchRuntime(dependencies);
+  expect(runtime.status()).toMatchObject({ initializationRequired: false, indexCompletedAt: clock });
+  service.removeSession('host', 'a');
+  await runtime.sync();
+  expect(reads).toEqual(['a', 'b', 'b', 'a']);
+  expect(service.search('host', 'old history')).toHaveLength(2);
+  await runtime.stop(); service.close();
+});
+
+test('expired rows cannot leave a checkpoint claiming coverage that was pruned', async () => {
+  const service = createContentSearchService({ dbPath: ':memory:' });
+  service.replaceSession('host', { id: 's', time: { updated: 10 } }, [], 1);
+  service.prune('host', 5, new Set(['s']));
+  expect(service.updated('host', 's', 1)).toBeUndefined();
+  expect(service.updated('host', 's', 5)).toBe(10);
+  service.close();
+});
+
+test('catalog failure and malformed pages never certify coverage or remove existing results', async () => {
+  const service = createContentSearchService({ dbPath: ':memory:' });
+  service.replaceSession('host', { id: 's', time: { updated: 10 } }, [
+    { info: { id: 'm', role: 'user', time: { created: 10 } }, parts: [{ type: 'text', text: 'preserved' }] },
+  ], 0);
+  for (const data of [undefined, [{ id: 'bad' }]]) {
+    const runtime = createContentSearchRuntime({ service, getRuntimeKey: () => 'host', now: () => 100,
+      listSessions: async () => ({ data, cursor: {} }), listMessages: async () => { throw new Error('unexpected'); },
+    });
+    await runtime.sync();
+    expect(runtime.status()).toMatchObject({ phase: 'error', initializationRequired: true, indexCompletedAt: null });
+    expect(service.search('host', 'preserved')).toHaveLength(1);
+    await runtime.stop();
+  }
+  const empty = createContentSearchRuntime({ service, getRuntimeKey: () => 'host', now: () => 200,
+    listSessions: async () => ({ data: [], cursor: {} }), listMessages: async () => { throw new Error('unexpected'); },
+  });
+  await empty.sync();
+  expect(empty.status()).toMatchObject({ phase: 'ready', initializationRequired: false, indexCompletedAt: 200, messages: 0 });
+  await empty.stop(); service.close();
+});
+
+test('a large warm catalog verifies without rereading transcripts and backfill keeps two-worker concurrency', async () => {
+  const service = createContentSearchService({ dbPath: ':memory:' });
+  const sessions = Array.from({ length: 1000 }, (_, index) => ({ id: String(index), time: { updated: 10 } }));
+  let reads = 0;
+  let active = 0;
+  let peak = 0;
+  const runtime = createContentSearchRuntime({ service, getRuntimeKey: () => 'host', now: () => 100,
+    listSessions: async ({ cursor }) => {
+      const start = Number(cursor ?? 0);
+      return { data: sessions.slice(start, start + 100), cursor: { next: start + 100 < sessions.length ? String(start + 100) : undefined } };
+    },
+    listMessages: async () => {
+      reads++; peak = Math.max(peak, ++active);
+      await Promise.resolve();
+      active--;
+      return { data: [], cursor: {} };
+    },
+  });
+  await runtime.sync();
+  expect(runtime.status()).toMatchObject({ initializationRequired: false, completed: 1000 });
+  expect(peak).toBe(2);
+  expect(reads).toBe(1000);
+  await runtime.sync();
+  expect(reads).toBe(1000);
+  await runtime.stop(); service.close();
+});
+
 test('expands existing seven-day checkpoints to thirty days even when sessions are unchanged', async () => {
   const service = createContentSearchService({ dbPath: ':memory:' });
   const day = 86400000;
@@ -105,5 +199,7 @@ test('runtime switch rejects in-flight message pages', async () => {
   await work;
   expect(service.search('one', 'stale')).toEqual([]);
   expect(service.search('two', 'stale')).toEqual([]);
+  expect(service.coverage('one').indexCompletedAt).toBeNull();
+  expect(runtime.status()).toMatchObject({ runtime: 'two', initializationRequired: true, indexStartedAt: null, indexCompletedAt: null });
   await runtime.stop(); service.close();
 });

package/server/lib/content-search/service.js

@@ -21,15 +21,20 @@ export function createContentSearchService({ dbPath }) {
     CREATE TABLE IF NOT EXISTS search_session(runtime TEXT, id TEXT, directory TEXT, title TEXT, updated REAL, PRIMARY KEY(runtime,id));
     CREATE TABLE IF NOT EXISTS search_message(id INTEGER PRIMARY KEY, runtime TEXT, session TEXT, message TEXT, role TEXT, created REAL, body TEXT, UNIQUE(runtime,session,message));
     CREATE INDEX IF NOT EXISTS search_message_scope ON search_message(runtime,session);
+    CREATE TABLE IF NOT EXISTS search_coverage(runtime TEXT PRIMARY KEY, started_at REAL NOT NULL, completed_at REAL, since REAL, verified_at REAL);
     CREATE VIRTUAL TABLE IF NOT EXISTS search_fts USING fts5(body, content='search_message', content_rowid='id', tokenize='trigram');
     CREATE TRIGGER IF NOT EXISTS search_insert AFTER INSERT ON search_message BEGIN
       INSERT INTO search_fts(rowid,body) VALUES(new.id,new.body); END;
     CREATE TRIGGER IF NOT EXISTS search_delete AFTER DELETE ON search_message BEGIN
       INSERT INTO search_fts(search_fts,rowid,body) VALUES('delete',old.id,old.body); END;
   `);
-  if (!db.prepare('PRAGMA table_info(search_session)').all().some((column) => column.name === 'since')) {
+  const sessionColumns = db.prepare('PRAGMA table_info(search_session)').all();
+  if (!sessionColumns.some((column) => column.name === 'since')) {
     db.exec('ALTER TABLE search_session ADD COLUMN since REAL');
   }
+  if (!sessionColumns.some((column) => column.name === 'indexed_at')) {
+    db.exec('ALTER TABLE search_session ADD COLUMN indexed_at REAL');
+  }
   const remove = db.prepare('DELETE FROM search_message WHERE runtime=? AND session=?');
   const write = db.prepare('INSERT INTO search_message(runtime,session,message,role,created,body) VALUES(?,?,?,?,?,?)');
   const removeSession = db.transaction((runtime, id) => {
@@ -37,23 +42,38 @@ export function createContentSearchService({ dbPath }) {
     db.prepare('DELETE FROM search_session WHERE runtime=? AND id=?').run(runtime, id);
   });
   return {
-    replaceSession: db.transaction((runtime, session, records, since = null) => {
+    coverage(runtime) {
+      return db.prepare('SELECT started_at AS indexStartedAt, completed_at AS indexCompletedAt, since AS coveredSince, verified_at AS verifiedAt FROM search_coverage WHERE runtime=?').get(runtime)
+        ?? { indexStartedAt: null, indexCompletedAt: null, coveredSince: null, verifiedAt: null };
+    },
+    beginInitialization(runtime, timestamp) {
+      db.prepare(`INSERT INTO search_coverage(runtime,started_at) VALUES(?,?)
+        ON CONFLICT(runtime) DO UPDATE SET started_at=excluded.started_at, completed_at=NULL
+        WHERE search_coverage.completed_at IS NOT NULL`).run(runtime, timestamp);
+    },
+    completeInitialization(runtime, since, timestamp) {
+      db.prepare(`UPDATE search_coverage SET completed_at=COALESCE(completed_at,?), since=?, verified_at=? WHERE runtime=?`)
+        .run(timestamp, since, timestamp, runtime);
+    },
+    replaceSession: db.transaction((runtime, session, records, since = null, indexedAt = Date.now()) => {
       remove.run(runtime, session.id);
       for (const record of records) {
         const projected = projectSearchRecord(record);
         if (projected) write.run(runtime, session.id, projected.info.id, projected.info.role, projected.info.time.created, projected.parts[0].text);
       }
-      db.prepare('INSERT OR REPLACE INTO search_session(runtime,id,directory,title,updated,since) VALUES(?,?,?,?,?,?)').run(runtime, session.id,
-        session.location?.directory ?? session.directory ?? '', session.title ?? '', session.time?.updated ?? 0, since);
+      db.prepare('INSERT OR REPLACE INTO search_session(runtime,id,directory,title,updated,since,indexed_at) VALUES(?,?,?,?,?,?,?)').run(runtime, session.id,
+        session.location?.directory ?? session.directory ?? '', session.title ?? '', session.time?.updated ?? 0, since, indexedAt);
     }),
     removeSession,
     updated(runtime, id, since) {
-      const row = db.prepare('SELECT updated,since FROM search_session WHERE runtime=? AND id=?').get(runtime, id);
+      const row = db.prepare('SELECT updated,since,indexed_at FROM search_session WHERE runtime=? AND id=?').get(runtime, id);
+      if (row?.indexed_at == null) return undefined;
       if (since !== undefined && (row?.since == null || row.since > since)) return undefined;
       return row?.updated;
     },
     prune: db.transaction((runtime, since, ids) => {
       db.prepare('DELETE FROM search_message WHERE runtime=? AND created<?').run(runtime, since);
+      db.prepare('UPDATE search_session SET since=MAX(since,?) WHERE runtime=? AND since IS NOT NULL').run(since, runtime);
       for (const row of db.prepare('SELECT id FROM search_session WHERE runtime=?').all(runtime)) {
         if (!ids.has(row.id)) removeSession(runtime, row.id);
       }

package/server/lib/content-search/service.test.js

@@ -1,9 +1,46 @@
 import { afterEach, expect, test } from 'vitest';
 import { createContentSearchService } from './service.js';
+import Database from 'better-sqlite3';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 
 const services = [];
 afterEach(() => services.splice(0).forEach((service) => service.close()));
 
+test.each([false, true])('upgrades old checkpoints (existing boundary: %s) without inventing coverage and persists initialization across database reopen', (hasBoundary) => {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'content-index-'));
+  const dbPath = path.join(directory, 'index.sqlite');
+  let service;
+  try {
+    const old = new Database(dbPath);
+    old.exec(`CREATE TABLE search_session(runtime TEXT, id TEXT, directory TEXT, title TEXT, updated REAL, PRIMARY KEY(runtime,id));
+      INSERT INTO search_session VALUES('host','s','/repo','History',50);`);
+    if (hasBoundary) old.exec('ALTER TABLE search_session ADD COLUMN since REAL; UPDATE search_session SET since=0');
+    old.close();
+    service = createContentSearchService({ dbPath });
+    expect(service.updated('host', 's', 0)).toBeUndefined();
+    expect(service.coverage('host').indexCompletedAt).toBeNull();
+    service.beginInitialization('host', 100);
+    service.beginInitialization('host', 101);
+    service.close();
+    service = createContentSearchService({ dbPath });
+    expect(service.coverage('host')).toMatchObject({ indexStartedAt: 100, indexCompletedAt: null });
+    service.replaceSession('host', { id: 's', time: { updated: 50 } }, [], 0);
+    service.completeInitialization('host', 0, 200);
+    service.close();
+    service = createContentSearchService({ dbPath });
+    expect(service.coverage('host')).toEqual({ indexStartedAt: 100, indexCompletedAt: 200, coveredSince: 0, verifiedAt: 200 });
+    expect(service.updated('host', 's', 0)).toBe(50);
+    expect(service.coverage('other').indexCompletedAt).toBeNull();
+    service.beginInitialization('host', 300);
+    expect(service.coverage('host')).toMatchObject({ indexStartedAt: 300, indexCompletedAt: null, verifiedAt: 200 });
+  } finally {
+    service?.close();
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
 test('indexes only admitted text and replaces FTS entries atomically', () => {
   const service = createContentSearchService({ dbPath: ':memory:' });
   services.push(service);

package/server/lib/notifications/DOCUMENTATION.md

@@ -13,6 +13,11 @@ Android notification-only subscriptions send the App locale in `Accept-Language`
 - `packages/web/server/lib/notifications/apns-runtime.js`: native iOS APNs device-token persistence + delivery, plus a separate Live Activity token store and `end` send path. Two modes: **relay** (default — sign + POST tokens + generic text to the isolated Push Relay in `packages/relay-server/src/push/`, which holds the project APNs key) and **direct** (fallback — sign ES256 JWT with Node crypto + HTTP/2, when `OPENCHAMBER_PUSH_RELAY_DISABLED=true`). Unless `OPENCHAMBER_PUSH_RELAY_URL` is set, the Host maps the effective Relay `wss`/`ws` URL to the same host as `https`/`http` `/v1/push/send`. Before each relay send, the runtime checks an in-memory registration success cache (keyed by current register URL + token + platform) and only POSTs `/v1/push/register-token` for cache misses; only successfully bound tokens are sent. Switching Relay/Push URL clears that cache so persisted tokens re-bind to the new origin on the next send or `reRegisterAllTokens()`. Each server has an auto-generated ECDSA P-256 keypair (`getOrCreateRelayKeypair`, persisted in settings); it binds tokens on the relay (`/v1/push/register-token`) and signs every relay request, so the relay only delivers to tokens bound to that server. APNs is the iOS app's sole notification channel (no local notifications) and is NOT gated on UI visibility — iOS suppresses the foreground banner instead. APNs push carries only generic text (scenario title + session name) — see `APNS.md`. Android uses the separate native notification stream described above. Live Activity tokens are persisted beside alert tokens in the same file (`version` 2, `liveActivityTokensBySession`) without mixing the two token types; v1 files remain readable. Live Activity relay bind/send uses `/v1/push/register-live-activity-token`, `/v1/push/unregister-live-activity-token`, and `/v1/push/live-activity`.
 - `packages/web/server/lib/notifications/emitter-runtime.js`: desktop/stdout + UI SSE notification emission runtime.
 - `packages/web/server/lib/notifications/runtime.js`: trigger runtime for OpenCode event-driven notification fanout.
+- Assistant-owned scheduled results first enter the assistant's read-only result
+  review. They bypass generic scheduled-task fanout: a spoken review uses the
+  existing contact notification path, while an explicit silent review sends
+  nothing. Unowned tasks retain `notifyOnScheduledTasks` and the manual-run gate.
+  Result handoff/recovery belongs to `scheduled-tasks`, not this notification module.
 - `family-completion-gate.js` (with a TypeScript declaration): dependency-free, runtime-local completion barrier shared by Host fanout and the VS Code webview. The Host supplies authoritative HTTP reads; VS Code supplies official SDK reads.
 - `packages/web/server/lib/notifications/live-activity-refresh-runtime.js`: periodic Live Activity snapshot refresh (default 30s, `OPENCHAMBER_LIVE_ACTIVITY_REFRESH_INTERVAL_MS` overrides, `0` disables). Each tick snapshots the authoritative session states once, recomputes every persisted Live Activity token's snapshot, and pushes updates only for real changes — busy→retry transitions, newly visible top-level sessions, idle completions the event path missed, and stale-row recovery. Entries whose recomputed snapshot is unchanged never send (APNs budgets Live Activity updates per hour). Rows for sessions without authoritative server state are preserved as-is; server-side-only sub-states (`permission`/`input`/`tool`) keep their last value while the session stays busy. When no row is working anymore the refresh sends `end` and clears accepted tokens.
 - `packages/web/server/lib/notifications/template-runtime.js`: notification template variables and session text/title enrichment runtime. Zen-model helpers are retained as compatibility stubs only.

package/server/lib/opencode/feature-routes-runtime.js

@@ -337,6 +337,7 @@ export const createFeatureRoutesRuntime = (dependencies) => {
       onSystemSessionPersisted,
       upsertScheduledTask: (projectID, task) => projectConfigRuntime.upsertScheduledTask(projectID, task),
       syncScheduledTaskProject: (projectID) => scheduledTasksRuntime.syncProject(projectID),
+      setTaskResultHandler: (handler) => scheduledTasksRuntime.setTaskResultHandler(handler),
       refreshAllowedRoots: refreshAssistantAllowedRoots,
       globalEventHub: globalMessageStreamHub,
       onRevisionTip: (tip) => broadcastAssistantRevisionTip({

package/server/lib/scheduled-tasks/DOCUMENTATION.md

@@ -10,6 +10,31 @@ Server-owned scheduled task runtime and routes for OpenChamber-only automation.
 - This module is OpenChamber feature logic; it is intentionally separate from OpenCode proxy/runtime internals.
 - Prompt and goal execution preserve hash-prefixed text literally; no snippet discovery or expansion occurs before dispatch.
 
+## Assistant result handoff
+
+`setTaskResultHandler(handler)` installs the Host's assistant result consumer and
+returns its cleanup function. The feature-route composition wires it to the
+assistant service. A handler returns `true` once associated contacts have reviewed
+the result (including explicit silence); `false` retains ordinary scheduled-task
+notification delivery. The scheduler releases its execution slot independently
+of assistant inference. Handler failures keep the result pending.
+
+Run history stores the original execution prompt privately alongside a
+`result_pending` marker. The same terminal history update makes the result
+eligible for delivery, including an in-flight run reconciled after restart.
+`listPendingResults` uses bounded keyset pages of 20; the existing five-second
+recovery pass retries handoffs with at most four in flight per runtime. A failing
+page does not prevent the cursor from reaching later results. `acknowledgeResult`
+clears only the delivery marker, never the execution result. Execution failure,
+history-persistence failure, and assistant delivery failure remain distinct.
+
+The additive migration leaves already-terminal old history acknowledged, avoiding
+an upgrade notification backlog. Old running records enroll when they really
+settle. Public history DTOs expose neither the prompt nor internal delivery state.
+Assistant receipts deduplicate completed reviews, including silent ones; this is
+a retryable handoff, not an exactly-once guarantee for model requests or device
+pushes during crashes/concurrent Hosts. Result review is read-only.
+
 ## Built-in new-session skill
 
 `session-skill.js` intercepts new `POST /api/session` admissions on a Host using

package/server/lib/scheduled-tasks/run-history-store.js

@@ -113,6 +113,12 @@ export const createScheduledTaskRunHistoryStore = ({ dbPath, clock = () => Date.
   if (!hasSlotAt) {
     db.exec('ALTER TABLE scheduled_task_run ADD COLUMN slot_at INTEGER');
   }
+  db.transaction(() => {
+    const columns = new Set(db.prepare("SELECT name FROM pragma_table_info('scheduled_task_run')").all().map((row) => row.name));
+    if (!columns.has('result_pending')) db.exec('ALTER TABLE scheduled_task_run ADD COLUMN result_pending INTEGER NOT NULL DEFAULT 0');
+    if (!columns.has('execution_prompt')) db.exec('ALTER TABLE scheduled_task_run ADD COLUMN execution_prompt TEXT');
+    db.exec("CREATE INDEX IF NOT EXISTS scheduled_task_run_pending_result ON scheduled_task_run(started_at DESC, run_id DESC) WHERE result_pending=1 AND status IN ('success','error')");
+  })();
   db.exec(`
     CREATE UNIQUE INDEX IF NOT EXISTS scheduled_task_run_scheduled_slot
       ON scheduled_task_run (project_id, task_id, slot_at)
@@ -161,9 +167,9 @@ export const createScheduledTaskRunHistoryStore = ({ dbPath, clock = () => Date.
       db.prepare(`
         INSERT INTO scheduled_task_run (
           run_id, project_id, task_id, task_name, trigger, status,
-          session_id, directory, error, started_at, finished_at, duration_ms, slot_at
-        ) VALUES (?, ?, ?, ?, ?, 'running', NULL, ?, NULL, ?, NULL, NULL, ?)
-      `).run(id, projectId, taskId, taskName, trigger, directory, startedAt, slotAt);
+          session_id, directory, error, started_at, finished_at, duration_ms, slot_at, result_pending, execution_prompt
+        ) VALUES (?, ?, ?, ?, ?, 'running', NULL, ?, NULL, ?, NULL, NULL, ?, 1, ?)
+      `).run(id, projectId, taskId, taskName, trigger, directory, startedAt, slotAt, typeof record.prompt === 'string' ? record.prompt : null);
     } catch (error) {
       if (slotAt !== null && SQLITE_UNIQUE_CODES.has(error?.code)) {
         const claimed = new Error('scheduled slot already claimed');
@@ -220,6 +226,7 @@ export const createScheduledTaskRunHistoryStore = ({ dbPath, clock = () => Date.
     const updated = db.prepare(`
       UPDATE scheduled_task_run
       SET status = ?,
+          result_pending = CASE WHEN status='running' THEN 1 ELSE result_pending END,
           session_id = ?,
           error = ?,
           finished_at = ?,
@@ -231,7 +238,7 @@ export const createScheduledTaskRunHistoryStore = ({ dbPath, clock = () => Date.
     return rowToDto(db.prepare('SELECT * FROM scheduled_task_run WHERE run_id = ?').get(id));
   };
 
-  const listRuns = ({ before, limit, projectID, taskID, projectId, taskId } = {}, runningOnly = false) => {
+  const listRuns = ({ before, limit, projectID, taskID, projectId, taskId } = {}, runningOnly = false, pendingOnly = false) => {
     assertOpen();
     const cursor = decodeCursor(before);
     const resolvedLimit = (() => {
@@ -249,6 +256,7 @@ export const createScheduledTaskRunHistoryStore = ({ dbPath, clock = () => Date.
     if (runningOnly) {
       filters.push("status = 'running'");
     }
+    if (pendingOnly) filters.push("result_pending=1 AND status IN ('success','error')");
     const params = [];
     const resolvedProjectID = asNonEmptyString(projectID ?? projectId);
     const resolvedTaskID = asNonEmptyString(taskID ?? taskId);
@@ -278,7 +286,7 @@ export const createScheduledTaskRunHistoryStore = ({ dbPath, clock = () => Date.
     const hasMore = rows.length > resolvedLimit;
     const last = pageRows[pageRows.length - 1];
     return {
-      runs: pageRows.map(rowToDto),
+      runs: pageRows.map((row) => pendingOnly ? { ...rowToDto(row), prompt: row.execution_prompt } : rowToDto(row)),
       nextCursor: hasMore && last
         ? encodeCursor({ startedAt: last.started_at, runID: last.run_id })
         : null,
@@ -300,6 +308,11 @@ export const createScheduledTaskRunHistoryStore = ({ dbPath, clock = () => Date.
     finishRun,
     listRuns,
     listRunningRuns: (options) => listRuns(options, true),
+    listPendingResults: (options) => listRuns(options, false, true),
+    acknowledgeResult: (runID) => {
+      assertOpen();
+      db.prepare("UPDATE scheduled_task_run SET result_pending=0 WHERE run_id=? AND status IN ('success','error')").run(runID);
+    },
     close,
   };
 };

package/server/lib/scheduled-tasks/run-history-store.test.js

@@ -33,6 +33,57 @@ const startSample = (store, overrides = {}) => store.startRun({
 });
 
 describe('scheduled task run history store', () => {
+  it('keeps terminal result handoffs durable, with the execution prompt private and running runs excluded', () => {
+    const dbPath = createTempDbPath();
+    let store = createScheduledTaskRunHistoryStore({ dbPath });
+    try {
+      store.startRun({ id: 'report', projectId: 'p', taskId: 't', prompt: 'Deliver research findings' });
+      expect(store.listPendingResults().runs).toEqual([]);
+      store.finishRun('report', { status: 'success' });
+      expect(store.listRuns().runs[0]).not.toHaveProperty('prompt');
+      store.close();
+      store = createScheduledTaskRunHistoryStore({ dbPath });
+      expect(store.listPendingResults().runs).toEqual([expect.objectContaining({ id: 'report', prompt: 'Deliver research findings' })]);
+      store.acknowledgeResult('report');
+      store.close();
+      store = createScheduledTaskRunHistoryStore({ dbPath });
+      expect(store.listPendingResults().runs).toEqual([]);
+    } finally { store.close(); }
+  });
+
+  it('migrates old history without replaying completed runs and enrolls recovered in-flight work', () => {
+    const dbPath = createTempDbPath();
+    const first = createScheduledTaskRunHistoryStore({ dbPath });
+    startSample(first, { id: 'old-complete' });
+    first.finishRun('old-complete', { status: 'success' });
+    startSample(first, { id: 'old-running' });
+    first.close();
+    const Database = require('better-sqlite3');
+    const db = new Database(dbPath);
+    db.exec('DROP INDEX scheduled_task_run_pending_result; ALTER TABLE scheduled_task_run DROP COLUMN result_pending; ALTER TABLE scheduled_task_run DROP COLUMN execution_prompt');
+    db.close();
+    const store = createScheduledTaskRunHistoryStore({ dbPath });
+    try {
+      expect(store.listPendingResults().runs).toEqual([]);
+      store.finishRun('old-running', { status: 'error', error: 'actual failure' });
+      expect(store.listPendingResults().runs).toEqual([expect.objectContaining({ id: 'old-running', status: 'error', prompt: null })]);
+    } finally { store.close(); }
+  });
+
+  it('does not publish a result when the terminal history write rolls back', () => {
+    const dbPath = createTempDbPath();
+    const store = createScheduledTaskRunHistoryStore({ dbPath });
+    startSample(store, { id: 'failed-write' });
+    const Database = require('better-sqlite3');
+    const db = new Database(dbPath);
+    db.exec("CREATE TRIGGER reject_finish BEFORE UPDATE OF status ON scheduled_task_run BEGIN SELECT RAISE(ABORT, 'disk write failed'); END");
+    try {
+      expect(() => store.finishRun('failed-write', { status: 'success' })).toThrow('disk write failed');
+      expect(store.listRuns().runs[0].status).toBe('running');
+      expect(store.listPendingResults().runs).toEqual([]);
+    } finally { db.close(); store.close(); }
+  });
+
   it('lists runs newest-first and supports stable keyset pagination', () => {
     let now = 1_000;
     const store = createScheduledTaskRunHistoryStore({

package/server/lib/scheduled-tasks/runtime.js

@@ -1327,7 +1327,53 @@ export const createScheduledTasksRuntime = (deps) => {
         runID,
         error: safeErrorMessage(error),
       });
-      return { error };
+      return { persistenceError: error };
+    }
+  };
+
+  let taskResultHandler = null;
+  let resultRecoveryCursor;
+  let resultRecoveryFlight = false;
+  const deliveringResults = new Set();
+  const deliverTaskResult = async (run) => {
+    if (deliveringResults.has(run.id) || deliveringResults.size >= 4) return;
+    deliveringResults.add(run.id);
+    const handler = taskResultHandler;
+    try {
+      const handled = handler ? await handler(run) : false;
+      if (handler !== taskResultHandler) return;
+      if (!handled) {
+        await notifyTaskRun?.({
+          projectID: run.projectId, taskID: run.taskId, taskName: run.taskName,
+          status: run.status, reason: run.trigger,
+          ...(run.sessionId ? { sessionId: run.sessionId } : {}),
+          ...(run.error ? { errorMessage: run.error } : {}),
+        });
+      }
+      runHistoryStore?.acknowledgeResult?.(run.id);
+    } catch (error) {
+      logger.warn?.('[ScheduledTasks] result delivery failed', { runID: run.id, error: safeErrorMessage(error) });
+    } finally {
+      deliveringResults.delete(run.id);
+    }
+  };
+  const recoverTaskResults = async () => {
+    if (resultRecoveryFlight || !taskResultHandler || typeof runHistoryStore?.listPendingResults !== 'function') return;
+    resultRecoveryFlight = true;
+    try {
+      const page = runHistoryStore.listPendingResults({ before: resultRecoveryCursor, limit: 20 });
+      resultRecoveryCursor = page.nextCursor || undefined;
+      let index = 0;
+      await Promise.all(Array.from({ length: Math.min(4, page.runs.length) }, async () => {
+        while (index < page.runs.length && taskResultHandler) {
+          const run = page.runs[index++];
+          await deliverTaskResult(run);
+        }
+      }));
+    } catch (error) {
+      logger.warn?.('[ScheduledTasks] result recovery failed', { error: safeErrorMessage(error) });
+    } finally {
+      resultRecoveryFlight = false;
     }
   };
 
@@ -1375,6 +1421,7 @@ export const createScheduledTasksRuntime = (deps) => {
             trigger: reason === 'manual' ? 'manual' : 'scheduled',
             directory: projectPath,
             startedAt: runStartedAt,
+            prompt: task.execution?.prompt,
             ...(resolvedSlotAt !== undefined ? { slotAt: resolvedSlotAt } : {}),
           });
         } catch (error) {
@@ -1587,9 +1634,9 @@ export const createScheduledTasksRuntime = (deps) => {
         ...(sessionID ? { sessionId: sessionID } : {}),
         ...(status === 'error' ? { error: errorMessage || 'Unknown error' } : {}),
       });
-      if (historyFinalize?.error) {
+      if (historyFinalize?.persistenceError) {
         status = 'error';
-        errorMessage = errorMessage || safeErrorMessage(historyFinalize.error);
+        errorMessage = errorMessage || safeErrorMessage(historyFinalize.persistenceError);
       }
 
       try {
@@ -1606,15 +1653,21 @@ export const createScheduledTasksRuntime = (deps) => {
       // Notification fanout for scheduled (non-manual) runs; the notification
       // runtime owns every delivery gate (settings toggle, channels).
       try {
-        await notifyTaskRun?.({
-          projectID,
-          taskID,
-          taskName,
-          status,
-          reason,
-          ...(sessionID ? { sessionId: sessionID } : {}),
-          ...(status === 'error' ? { errorMessage } : {}),
-        });
+        if (taskResultHandler && historyFinalize && !historyFinalize.persistenceError) {
+          // Reviewing a result is independent of the scheduler's execution slot.
+          void deliverTaskResult({ ...historyFinalize, prompt: task.execution?.prompt });
+        } else {
+          await notifyTaskRun?.({
+            projectID,
+            taskID,
+            taskName,
+            status,
+            reason,
+            ...(sessionID ? { sessionId: sessionID } : {}),
+            ...(status === 'error' ? { errorMessage } : {}),
+          });
+          if (!historyFinalize?.persistenceError && runID) runHistoryStore?.acknowledgeResult?.(runID);
+        }
       } catch (error) {
         logger.warn?.('[ScheduledTasks] task-run notification failed', {
           projectID,
@@ -1813,6 +1866,7 @@ export const createScheduledTasksRuntime = (deps) => {
     if (controller.signal.aborted) return;
     await recoverTaskStates(controller);
     if (controller.signal.aborted) return;
+    void recoverTaskResults();
     historyRecoveryTimer = setTimeout(() => {
       void recoverRunHistory(controller, nextCursor || undefined);
     }, 5_000);
@@ -1994,5 +2048,9 @@ export const createScheduledTasksRuntime = (deps) => {
     runNow,
     getStatus,
     observeSessionEvent,
+    setTaskResultHandler: (handler) => {
+      taskResultHandler = handler;
+      return () => { if (taskResultHandler === handler) taskResultHandler = null; };
+    },
   };
 };