@phnx-labs/agents-cli 1.22.117 → 1.22.118

package/dist/lib/secrets-policy.js

@@ -18,7 +18,7 @@ import { isHostPinned, isDevicePinned, managedKnownHostsPath } from './devices/k
 import { machineId, normalizeHost } from './session/sync/config.js';
 import { readFleetSharedDeviceStates, updateFleetSharedDeviceStateAsync, } from './fleet-shared-state.js';
 import { getCacheDir, getUserAgentsDir, readMeta } from './state.js';
-import { listNativeAccounts, readSlots } from './account-registry.js';
+import { dropSlots, listNativeAccounts, readSlots } from './account-registry.js';
 import { claudeAccountTokenKey, isClaudeWorkerHomeSeeded, provisionWorkerSlot, readReservedCredential } from './claude-account-token.js';
 import { configuredDeviceRole, isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
 import { AUTH_STORE_ALIAS, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, } from './reserved-stores.js';
@@ -245,6 +245,26 @@ export async function syncReservedAuthBundle(deps = {}) {
 // The functions below fix both. The plan is per ACCOUNT and per KEY
 // (`<ENV>_<accountId>`), not per bundle, and targets `role=worker` peers only.
 //
+// PRESENCE IS FIRST-HAND + ROTATION-AWARE (PHNX-4116). Each device's account-
+// state daemon publishes a per-account verdict row into `accounts.rows`
+// (`account-state-daemon-service.ts`), and the usage-sync SSH exchange stores
+// each peer's reply at `devices/<peer>/daemon-state.json`. A key counts as
+// present on a peer only when BOTH hold:
+//   1. FIRST-HAND — the peer's own reply reports a NON-`missing` verdict for the
+//      account (its slot materialized). This is what a publisher-side memo alone
+//      could never see: a key removed on the worker out of band flips the next
+//      verdict to `missing`, so the push resumes within a tick.
+//   2. ROTATION — the fingerprint (`workerCredential.mintedAt`) we last delivered
+//      to that peer matches the account's CURRENT fingerprint. A re-mint
+//      (`accounts login`) rotates the reserved key and bumps `mintedAt` while the
+//      peer's OLD token keeps authenticating, so its verdict stays non-`missing`;
+//      verdict alone would read `present` forever and the rotated key would never
+//      reach the worker. The delivery memo is a LOCAL rotation cursor keyed per
+//      (peer, bundle, key) → fingerprint, never synced, never the primary signal.
+// A peer reply with no `accounts.rows` field at all (an older CLI) is not proof
+// of an empty inventory, so the plan FAILS CLOSED and skips it (INFO), rather
+// than treating "no rows" as "holds nothing" and pushing every key blindly.
+//
 // INVARIANT 1 (transport, retain nothing): materializing a worker slot happens
 // on the box where the key LANDED (`reconcileLocalWorkerSlots` ->
 // `provisionWorkerSlot`); the credential itself only ever moves over the
@@ -254,10 +274,34 @@ export async function syncReservedAuthBundle(deps = {}) {
 // `isCredentialSafeToPropagate` stays false).
 // ---------------------------------------------------------------------------
 const EMPTY_KEY_SET = new Set();
+/**
+ * Skip reason for a peer that has never sent a daemon-state reply (no
+ * `devices/<peer>/daemon-state.json`). auth-sync logs these at INFO — a
+ * brand-new or never-dialed worker legitimately has no reply on an early tick,
+ * so it is informational, not a warning. Stable so the service classifies the
+ * skip without matching a substring.
+ */
+export const SKIP_REASON_NO_PEER_REPLY = 'no daemon-state reply from this peer yet';
+/**
+ * Skip reason for a peer whose reply exists but carries no `accounts.rows` field
+ * at all (an older CLI that does not publish per-account verdicts, or a partial
+ * state written before the account-state daemon ran). Without those rows there is
+ * no first-hand knowledge of what the peer holds, so the plan FAILS CLOSED and
+ * skips rather than pushing every key blindly. auth-sync logs it at INFO — it is
+ * transient during a rolling upgrade. An EMPTY `accounts.rows` array (a peer with
+ * no registered account) is NOT this case: it is a legitimate "holds nothing",
+ * and its keys are (correctly) pushed to provision it.
+ */
+export const SKIP_REASON_NO_ACCOUNT_ROWS = 'daemon-state reply carries no account rows (fail closed)';
 /**
  * Pure plan: for each worker peer, push each bundle it is missing at least one
  * key of. Deterministic (peers and bundles sorted) so it pins exactly in tests.
- * A headed peer is skipped BEFORE any key comparison -- it never receives a key.
+ * A headed peer is skipped BEFORE any key comparison -- it never receives a key;
+ * a peer with no reply yet (`hasReply: false`) is skipped next -- there is no
+ * first-hand knowledge of what it holds, so nothing is pushed to it this tick;
+ * a peer whose reply carries no `accounts.rows` field (`hasAccountRows: false`)
+ * is skipped FAIL-CLOSED for the same reason (an older CLI's reply is not proof
+ * of an empty inventory), rather than pushing every key blindly.
  */
 export function planReservedStoreSync(accounts, peers) {
     const keysByBundle = new Map();
@@ -274,6 +318,14 @@ export function planReservedStoreSync(accounts, peers) {
             items.push({ action: 'skip', device: peer.name, reason: 'headed device receives the account row, never a durable key' });
             continue;
         }
+        if (!peer.hasReply) {
+            items.push({ action: 'skip', device: peer.name, reason: SKIP_REASON_NO_PEER_REPLY });
+            continue;
+        }
+        if (!peer.hasAccountRows) {
+            items.push({ action: 'skip', device: peer.name, reason: SKIP_REASON_NO_ACCOUNT_ROWS });
+            continue;
+        }
         if (!peer.reachable) {
             items.push({ action: 'skip', device: peer.name, reason: 'unreachable' });
             continue;
@@ -318,14 +370,44 @@ export function reservedSyncTargets(meta) {
     }
     return out;
 }
-// --- publisher-side delivery memo -----------------------------------------
-// A push sends a WHOLE bundle; the receiver reports no per-key inventory today
-// (that is T3's per-account verdict seam). So the publisher records what it has
-// delivered to each peer, keyed by the credential's fingerprint, to answer "does
-// the peer already have this key" without re-pushing an unchanged bundle every
-// tick. A new account (no memo entry) or a re-mint (fingerprint change) is not a
-// hit, so it propagates within one tick. The memo is LOCAL publisher bookkeeping,
-// never synced.
+/** Narrow a peer's opaque `accounts.rows` to the verdict fields the planner reads. */
+export function readPeerAccountVerdicts(state) {
+    const rows = state?.accounts?.rows;
+    if (!Array.isArray(rows))
+        return [];
+    const out = [];
+    for (const row of rows) {
+        if (!row || typeof row !== 'object' || Array.isArray(row))
+            continue;
+        const r = row;
+        if (typeof r.accountId === 'string' && typeof r.harness === 'string' && typeof r.verdict === 'string') {
+            out.push({ accountId: r.accountId, harness: r.harness, verdict: r.verdict });
+        }
+    }
+    return out;
+}
+/**
+ * True when the peer's reply carried an `accounts.rows` array at all (present,
+ * even if empty). An older CLI, or a partial state written before the account-
+ * state daemon ran, has no such field — and its absence must NOT read as "the
+ * peer holds nothing", or the plan would push every key blindly. An EMPTY array
+ * (a peer with no registered account) IS a valid first-hand "holds nothing".
+ */
+export function peerHasAccountRows(state) {
+    return Array.isArray(state?.accounts?.rows);
+}
+// --- publisher-side delivery memo (rotation) -------------------------------
+// A peer's verdict says WHETHER it holds a working credential for an account, but
+// not WHICH one: a re-mint (`accounts login`) rotates the reserved key and bumps
+// `workerCredential.mintedAt`, yet the peer's OLD token keeps authenticating, so
+// its verdict stays `live`/`unverified` and never flips to `missing`. Verdict
+// alone would therefore read `present` forever and the new key would never reach
+// the worker. The publisher records the fingerprint it last delivered per
+// (peer, bundle, key); presence requires BOTH the peer's own verdict AND a
+// delivered-fingerprint match, so a re-mint (fingerprint change) re-pushes within
+// a tick while a key removed on the worker (verdict `missing`) also re-pushes.
+// LOCAL publisher bookkeeping, never synced — it is a rotation cursor, not a
+// substitute for the first-hand verdict.
 function deliveryMemoPath(root = getCacheDir()) {
     return path.join(root, 'reserved-sync-delivered.json');
 }
@@ -346,18 +428,29 @@ function writeDeliveryMemo(memo, root = getCacheDir()) {
     fs.writeFileSync(deliveryMemoPath(root), `${JSON.stringify(memo, null, 2)}\n`, 'utf-8');
 }
 /**
- * The keys a peer is KNOWN to hold, per bundle, from what we have delivered to it
- * (memo, matched by fingerprint) plus the coarse legacy-`auth` verdict: a peer
- * reporting `auth.status === 'ready'` is known to hold every legacy `auth` key.
- * Reserved `__<harness>__` bundles have no coarse verdict, so their presence comes
- * from the memo alone -- which is what makes a newly-added reserved account push.
+ * The reserved keys a peer is KNOWN to hold, per bundle. Two conditions must BOTH
+ * hold (PHNX-4116):
+ *
+ * 1. FIRST-HAND — the peer's own daemon-state reply reports a NON-`missing`
+ *    verdict for the account, so it has a working credential for it (its slot
+ *    materialized). A `missing` verdict, or no row for the account at all, means
+ *    it does not — self-correcting: a key removed on the worker flips its next
+ *    verdict to `missing` and the push resumes, which a publisher-side memo alone
+ *    could never see.
+ * 2. ROTATION — the fingerprint we last delivered to this peer (`delivered`)
+ *    matches the account's CURRENT fingerprint. A re-mint bumps
+ *    `workerCredential.mintedAt` while the old token still authenticates, so the
+ *    verdict stays non-`missing`; without this the rotated key would never
+ *    propagate. A never-delivered key (no memo entry ⇒ `undefined`) never
+ *    matches, so a newly-added account still pushes.
  */
-export function peerPresentKeys(peer, accounts, memo, legacyAuthReady) {
+export function peerPresentKeys(accounts, verdicts, delivered) {
+    const held = new Set(verdicts.filter((v) => v.verdict !== 'missing').map((v) => `${v.harness}:${v.accountId}`));
     const present = {};
     for (const account of accounts) {
-        const known = memo[memoKey(peer, account.bundle, account.key)] === account.fingerprint
-            || (legacyAuthReady && account.bundle === AUTH_STORE_ALIAS);
-        if (!known)
+        if (!held.has(`${account.harness}:${account.accountId}`))
+            continue;
+        if (delivered(account.bundle, account.key) !== account.fingerprint)
             continue;
         (present[account.bundle] ??= new Set()).add(account.key);
     }
@@ -425,13 +518,18 @@ export async function syncReservedStores(deps = {}) {
     }
     const memo = readDeliveryMemo(deps.cacheDir);
     const pinned = deps.isPinned ?? ((name) => isHostPinned(name, managedKnownHostsPath()));
-    const peers = devices.map((d) => ({
-        name: d.name,
-        headed: isHeadedDeviceRole(peerRole(d.name)),
-        reachable: isDialableDevice(d),
-        pinned: isDevicePinned(d, pinned),
-        presentKeys: peerPresentKeys(d.name, targets, memo, stateByDevice.get(normalizeHost(d.name))?.auth?.status === 'ready'),
-    }));
+    const peers = devices.map((d) => {
+        const state = stateByDevice.get(normalizeHost(d.name));
+        return {
+            name: d.name,
+            headed: isHeadedDeviceRole(peerRole(d.name)),
+            reachable: isDialableDevice(d),
+            pinned: isDevicePinned(d, pinned),
+            hasReply: state !== undefined,
+            hasAccountRows: peerHasAccountRows(state),
+            presentKeys: peerPresentKeys(targets, readPeerAccountVerdicts(state), (bundle, key) => memo[memoKey(d.name, bundle, key)]),
+        };
+    });
     const plan = planReservedStoreSync(targets, peers);
     const byName = new Map(devices.map((d) => [d.name, d]));
     const push = deps.push ?? ((bundle, host) => pushBundleToHostAsync(bundle, host, {
@@ -452,6 +550,9 @@ export async function syncReservedStores(deps = {}) {
             const out = await push(item.bundle, sshTarget(profile));
             if (out.ok) {
                 result.pushed.push({ device: item.device, bundle: item.bundle, keys: item.keys });
+                // Record the fingerprint delivered so an UNCHANGED key is not re-pushed
+                // next tick; a re-mint (new fingerprint) or a removed key (verdict flips
+                // `missing`) still re-pushes.
                 for (const key of item.keys) {
                     const fp = targets.find((t) => t.bundle === item.bundle && t.key === key)?.fingerprint;
                     if (fp)
@@ -469,6 +570,15 @@ export async function syncReservedStores(deps = {}) {
     writeDeliveryMemo(memo, deps.cacheDir ?? getCacheDir());
     return result;
 }
+/**
+ * Fire-and-forget the daemon log without pulling its module graph into every
+ * consumer of this file: `reconcileLocalWorkerSlots` is synchronous and only
+ * runs inside the daemon (where daemon.js is already loaded), so the dynamic
+ * import is paid only on the rare tick that actually drops a slot.
+ */
+function defaultWorkerSlotLog(level, message) {
+    void import('./daemon/daemon.js').then((m) => m.log(level, message)).catch(() => { });
+}
 function defaultSlotSeeded(harness, slotDir) {
     return harness === 'claude' ? isClaudeWorkerHomeSeeded(slotDir) : true;
 }
@@ -482,8 +592,10 @@ function defaultSlotSeeded(harness, slotDir) {
  * seeded (no `hasCompletedOnboarding`) is provisioned again so it converges.
  */
 export function reconcileLocalWorkerSlots(deps = {}) {
-    const result = { provisioned: [], skipped: [], errors: [] };
-    const role = deps.selfRole ?? selfConfiguredDeviceRole();
+    const result = { provisioned: [], dropped: [], skipped: [], errors: [] };
+    // `'selfRole' in deps` (not `??`) so a caller can inject an explicit `undefined`
+    // to mean "unmarked device"; a caller that omits it reads the real machine role.
+    const role = 'selfRole' in deps ? deps.selfRole : selfConfiguredDeviceRole();
     if (isHeadedDeviceRole(role))
         return result; // headed boxes provision via native login
     const meta = (deps.readMetaFn ?? readMeta)();
@@ -492,6 +604,41 @@ export function reconcileLocalWorkerSlots(deps = {}) {
     const provision = deps.provision ?? provisionWorkerSlot;
     const slotSeeded = deps.slotSeeded ?? defaultSlotSeeded;
     const byId = new Map(listNativeAccounts(meta).map((account) => [account.id, account]));
+    // Drop stale worker slots (PHNX-4116). A `deviceAccounts.slots` record whose
+    // accountId is no longer a registered native account is a leftover from an
+    // older account-id generation — every worker held 8 such duplicates, each a
+    // full HOME carrying a live setup-token in `.claude/.oauth_token`. Delete that
+    // credential (a 0600 file) and drop the record, but KEEP the slot directory:
+    // `.claude/projects` holds session transcripts. Fail closed — an empty
+    // registry is a transient read, and stripping every slot on it would wipe a
+    // healthy box's whole slot set, so drop nothing until the registry answers.
+    // This deletion runs ONLY on a device explicitly marked `worker`: provisioning
+    // above is safe on an unmarked box, but destroying a credential is not — an
+    // unmarked device is not headed (`isHeadedDeviceRole(undefined)` is false) yet
+    // must never run a credential-deleting branch.
+    if (role === 'worker' && byId.size > 0) {
+        const stale = Object.values(slots).filter((slot) => !byId.has(slot.accountId));
+        const droppable = [];
+        for (const slot of stale) {
+            try {
+                // force ignores an already-absent token; a real failure (EACCES) keeps
+                // the slot so the record is never dropped while its credential lingers.
+                fs.rmSync(path.join(slot.slotDir, '.claude', '.oauth_token'), { force: true });
+                droppable.push(slot);
+            }
+            catch (err) {
+                result.errors.push({ accountId: slot.accountId, message: `stale slot credential not removed, slot kept: ${err.message}` });
+            }
+        }
+        if (droppable.length > 0) {
+            (deps.dropSlots ?? dropSlots)(droppable.map((slot) => slot.accountId));
+            const log = deps.log ?? defaultWorkerSlotLog;
+            for (const slot of droppable) {
+                result.dropped.push(slot.accountId);
+                log('INFO', `worker-slot: dropped stale slot ${slot.accountId} — no longer a registered account; removed its credential, kept ${slot.slotDir} for transcripts`);
+            }
+        }
+    }
     // Resolve each account to the one (bundle, key) the push plan uses: a T1 row's
     // reserved `__<harness>__` key, or the legacy `auth` key by email for a claude
     // row predating T1. Both are worker credentials this box may already hold, so

package/dist/lib/session/db.d.ts

@@ -14,7 +14,7 @@ import { type TimelineState } from './timeline.js';
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/sessions.md calls the constant the source of truth). */
-export declare const SCHEMA_VERSION = 50;
+export declare const SCHEMA_VERSION = 51;
 /**
  * Bump to force the content extractor (assistant-answer text, alongside the
  * user-prompt text every harness already accumulates) to re-derive on every

package/dist/lib/session/db.js

@@ -29,7 +29,7 @@ const DB_PATH = getSessionsDbPath();
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/sessions.md calls the constant the source of truth). */
-export const SCHEMA_VERSION = 50;
+export const SCHEMA_VERSION = 51;
 /**
  * Bump to force the content extractor (assistant-answer text, alongside the
  * user-prompt text every harness already accumulates) to re-derive on every
@@ -182,6 +182,10 @@ CREATE INDEX IF NOT EXISTS idx_sessions_short_id ON sessions(short_id);
 -- v17 guarantees the machine column exists (same pattern as last_activity);
 -- idx_sessions_mirror_synced likewise waits for migration v46's column add.
 
+-- A row sits at the rowid of the sessions row it describes (v51) and is
+-- addressed by that rowid, never by session_id: an UNINDEXED FTS5 column cannot
+-- be seeked, so a session_id predicate scans every row's content — the same
+-- rule tool_call_text follows against tool_calls.rowid (v36).
 CREATE VIRTUAL TABLE IF NOT EXISTS session_text USING fts5(
   session_id UNINDEXED,
   label,
@@ -1411,6 +1415,39 @@ function migrateSchema(db, fromVersion) {
         if (!cols.has('generated_title_at'))
             db.exec(`ALTER TABLE sessions ADD COLUMN generated_title_at INTEGER`);
     }
+    if (fromVersion < 51) {
+        // v50 -> v51: session_text rows move to the rowid of the sessions row they
+        // describe (PHNX-4154), the repair v36 made to tool_call_text. The only key
+        // was the UNINDEXED session_id, so every delete and content read was a full
+        // scan of the FTS content — 669 MB and 0.2-0.5 s per statement on a real
+        // box — and the mirror ingest issues one per mirrored row (2,298 there)
+        // inside a daemon tick: the event loop froze for minutes, every service
+        // blew its deadline, and browser verbs timed out behind it.
+        //
+        // Same shape as v42: rename, recreate, copy back keyed by sessions.rowid,
+        // drop — search never blacks out. OR REPLACE keeps the newest of any
+        // duplicate session_id rows. A text row whose session is gone has no rowid
+        // to sit at and is dropped; nothing could reach it anyway.
+        db.exec(`ALTER TABLE session_text RENAME TO session_text_v50`);
+        db.exec(`
+      CREATE VIRTUAL TABLE session_text USING fts5(
+        session_id UNINDEXED,
+        label,
+        topic,
+        project,
+        content,
+        assistant,
+        tokenize = 'unicode61 remove_diacritics 2'
+      );
+    `);
+        db.exec(`
+      INSERT OR REPLACE INTO session_text (rowid, session_id, label, topic, project, content, assistant)
+      SELECT s.rowid, t.session_id, t.label, t.topic, t.project, t.content, t.assistant
+      FROM session_text_v50 t JOIN sessions s ON s.id = t.session_id
+      ORDER BY t.rowid
+    `);
+        db.exec(`DROP TABLE session_text_v50`);
+    }
 }
 /**
  * Stamp `account_key` / `account_org` / `account` on every Claude row from its
@@ -2292,8 +2329,15 @@ function enrichCachedSessionMeta(meta) {
         return meta;
     }
 }
-const deleteTextStmt = (db) => db.prepare(`DELETE FROM session_text WHERE session_id = ?`);
-const insertTextStmt = (db) => db.prepare(`INSERT INTO session_text (session_id, label, topic, project, content, assistant) VALUES (?, ?, ?, ?, ?, ?)`);
+/**
+ * The one way to address a session's FTS row: its rowid is the sessions rowid
+ * (schema comment on session_text). A `session_id = ?` predicate scans the whole
+ * index instead — the PHNX-4154 daemon freeze.
+ */
+const SESSION_TEXT_ROWID = `(SELECT rowid FROM sessions WHERE id = ?)`;
+const deleteTextStmt = (db) => db.prepare(`DELETE FROM session_text WHERE rowid = ${SESSION_TEXT_ROWID}`);
+// Binds the session id twice: once for the rowid lookup, once for the column.
+const insertTextStmt = (db) => db.prepare(`INSERT INTO session_text (rowid, session_id, label, topic, project, content, assistant) VALUES (${SESSION_TEXT_ROWID}, ?, ?, ?, ?, ?, ?)`);
 // Read back the label the upsert actually stored (which may be the preserved
 // one, not the incoming blank) so the FTS label column stays consistent with
 // sessions.label after a bare rescan.
@@ -2406,7 +2450,7 @@ export function upsertSession(meta, content, scan, assistantContent = '') {
     const txn = db.transaction(() => {
         upsert.run(row);
         delText.run(meta.id);
-        insText.run(meta.id, 
+        insText.run(meta.id, meta.id, 
         // Use the label the upsert actually stored (preserve-non-empty rule),
         // not the raw incoming one, so FTS label ranking survives a bare rescan.
         storedFtsLabel(readLabel, meta.id), meta.topic ?? '', meta.project ?? '', content ?? '', assistantContent ?? '');
@@ -2427,8 +2471,10 @@ function reconcileCodexFileOwners(db, metas) {
         for (const row of rows) {
             if (owners.get(row.file_path) === row.id)
                 continue;
+            // The text row is keyed by the sessions rowid, so it goes before the row.
+            db.prepare(`DELETE FROM session_text WHERE rowid = ${SESSION_TEXT_ROWID}`).run(row.id);
             db.prepare('DELETE FROM sessions WHERE id = ?').run(row.id);
-            for (const table of ['session_text', 'session_preview_cache', 'session_summaries', 'session_insights', 'session_topics', 'session_phenotypes', 'session_resource_usage', 'resource_scan_ledger']) {
+            for (const table of ['session_preview_cache', 'session_summaries', 'session_insights', 'session_topics', 'session_phenotypes', 'session_resource_usage', 'resource_scan_ledger']) {
                 db.prepare(`DELETE FROM ${table} WHERE session_id = ?`).run(row.id);
             }
             // The tool ledger has a unique file path too; release the wrong binding
@@ -2671,7 +2717,7 @@ export function upsertSessionsBatch(entries) {
                 };
                 upsert.run(row);
                 delText.run(meta.id);
-                insText.run(meta.id, 
+                insText.run(meta.id, meta.id, 
                 // Mirror upsertSession: index the label the upsert actually stored
                 // (preserve-non-empty rule), not the raw incoming one.
                 storedFtsLabel(readLabel, meta.id), meta.topic ?? '', meta.project ?? '', content ?? '', assistantContent ?? '');
@@ -2746,7 +2792,7 @@ export function syncLabels(labelMap) {
     if (updates.length === 0)
         return 0;
     const updSessions = db.prepare(`UPDATE sessions SET label = ? WHERE id = ?`);
-    const updFts = db.prepare(`UPDATE session_text SET label = ? WHERE session_id = ?`);
+    const updFts = db.prepare(`UPDATE session_text SET label = ? WHERE rowid = ${SESSION_TEXT_ROWID}`);
     const txn = db.transaction((items) => {
         for (const { id, label } of items) {
             updSessions.run(label, id);
@@ -2797,7 +2843,7 @@ export function seedLabelsFromNames(nameMap) {
     if (updates.length === 0)
         return 0;
     const updSessions = db.prepare(`UPDATE sessions SET label = ? WHERE id = ?`);
-    const updFts = db.prepare(`UPDATE session_text SET label = ? WHERE session_id = ?`);
+    const updFts = db.prepare(`UPDATE session_text SET label = ? WHERE rowid = ${SESSION_TEXT_ROWID}`);
     const txn = db.transaction((items) => {
         for (const { id, label } of items) {
             updSessions.run(label, id);
@@ -2839,7 +2885,7 @@ export function syncTopics(topicMap) {
     if (updates.length === 0)
         return 0;
     const updSessions = db.prepare(`UPDATE sessions SET topic = ? WHERE id = ?`);
-    const updFts = db.prepare(`UPDATE session_text SET topic = ? WHERE session_id = ?`);
+    const updFts = db.prepare(`UPDATE session_text SET topic = ? WHERE rowid = ${SESSION_TEXT_ROWID}`);
     const txn = db.transaction((items) => {
         for (const { id, topic } of items) {
             updSessions.run(topic, id);
@@ -3231,7 +3277,7 @@ export function querySessions(options = {}) {
     const missingIds = new Set(missing.map(r => r.id));
     const phantomIds = new Set();
     if (missing.length > 0) {
-        const readContent = db.prepare(`SELECT content FROM session_text WHERE session_id = ?`);
+        const readContent = db.prepare(`SELECT content FROM session_text WHERE rowid = ${SESSION_TEXT_ROWID}`);
         const markArchived = db.prepare(`UPDATE sessions SET archived_at = ? WHERE id = ? AND archived_at IS NULL`);
         const now = Date.now();
         const classify = db.transaction(() => {
@@ -3706,7 +3752,7 @@ export function writeRemotePreviewCacheFailure(device, sessionId, reason, backof
  * when no row exists; an empty string when a row exists but carried no content.
  */
 export function readSessionContent(id) {
-    const row = getDB().prepare(`SELECT content FROM session_text WHERE session_id = ?`).get(id);
+    const row = getDB().prepare(`SELECT content FROM session_text WHERE rowid = ${SESSION_TEXT_ROWID}`).get(id);
     return row?.content;
 }
 /**
@@ -3964,11 +4010,11 @@ export function upsertMirrorSession(row, source, syncedAt) {
     if (result.changes === 0)
         return false;
     // Keep the mirror row searchable by topic + first user turn, like a local row.
-    db.prepare(`DELETE FROM session_text WHERE session_id = ?`).run(row.id);
+    db.prepare(`DELETE FROM session_text WHERE rowid = ${SESSION_TEXT_ROWID}`).run(row.id);
     db.prepare(`
-    INSERT INTO session_text (session_id, label, topic, project, content, assistant)
-    VALUES (?, ?, ?, '', ?, '')
-  `).run(row.id, row.label ?? '', row.topic ?? '', row.firstUser ?? '');
+    INSERT INTO session_text (rowid, session_id, label, topic, project, content, assistant)
+    VALUES (${SESSION_TEXT_ROWID}, ?, ?, ?, '', ?, '')
+  `).run(row.id, row.id, row.label ?? '', row.topic ?? '', row.firstUser ?? '');
     // Carry the peer's daemon-computed summary into the same session_summaries
     // cache the local merge reads (PHNX-3939), so a peer session renders its
     // goal/checkpoints/checklist inline with no transcript. Stamp is null: the
@@ -4072,14 +4118,15 @@ export function pruneMirrorSessions(cutoffMs) {
     if (stale.length === 0)
         return 0;
     const delRow = db.prepare(`DELETE FROM sessions WHERE id = ?`);
-    const delText = db.prepare(`DELETE FROM session_text WHERE session_id = ?`);
+    const delText = db.prepare(`DELETE FROM session_text WHERE rowid = ${SESSION_TEXT_ROWID}`);
     const delPreview = db.prepare(`DELETE FROM session_preview_cache WHERE session_id = ?`);
     const delSummary = db.prepare(`DELETE FROM session_summaries WHERE session_id = ?`);
     const delTimeline = db.prepare(`DELETE FROM session_timelines WHERE session_id = ?`);
     const txn = db.transaction(() => {
         for (const { id } of stale) {
-            delRow.run(id);
+            // Text first: its rowid lookup needs the sessions row still present.
             delText.run(id);
+            delRow.run(id);
             delPreview.run(id);
             delSummary.run(id);
             delTimeline.run(id);
@@ -4461,7 +4508,7 @@ export function topSessionsByCost(n, options = {}) {
     // still excluded. archived_at is the persisted signal; stamp it here too (once)
     // so a session first surfaced through the cost rollup reports `archived`
     // consistently with the listing path.
-    const readContent = db.prepare(`SELECT content FROM session_text WHERE session_id = ?`);
+    const readContent = db.prepare(`SELECT content FROM session_text WHERE rowid = ${SESSION_TEXT_ROWID}`);
     const markArchived = db.prepare(`UPDATE sessions SET archived_at = ? WHERE id = ? AND archived_at IS NULL`);
     const now = Date.now();
     const toStamp = [];