@vellumai/assistant 0.11.2-dev.202608070442.84135c4 → 0.11.2-dev.202608070534.d55eaf1

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -157,6 +157,8 @@ export {
   hashVerificationSecret,
   IdentityBindingStatusSchema,
   ResolveBootstrapSessionIpcParamsSchema,
+  bindsSameIdentity,
+  boundIdentity,
   RevokePendingSessionsIpcParamsSchema,
   SessionLookupIpcResponseSchema,
   SessionMutationIpcResponseSchema,
@@ -172,6 +174,7 @@ export {
 
 export type {
   BindSessionIdentityIpcParams,
+  BoundIdentity,
   CountRecentSendsIpcParams,
   CountRecentSendsIpcResponse,
   CreateInboundSessionIpcParams,
@@ -183,6 +186,7 @@ export type {
   FindActiveSessionIpcParams,
   GetPendingSessionIpcParams,
   IdentityBindingStatus,
+  IdentityBoundSession,
   ResolveBootstrapSessionIpcParams,
   RevokePendingSessionsIpcParams,
   SessionLookupIpcResponse,

package/node_modules/@vellumai/gateway-client/src/verification-session-contract.ts

@@ -113,6 +113,78 @@ export const VerificationSessionSchema = z.object({
 
 export type VerificationSessionWire = z.infer<typeof VerificationSessionSchema>;
 
+// ---------------------------------------------------------------------------
+// Bound identity (which of the three identity columns decides who may redeem)
+// ---------------------------------------------------------------------------
+
+/** The identity fields the rules read. Callers may pass a full session row. */
+export interface IdentityBoundSession {
+  expectedExternalUserId?: string | null;
+  expectedChatId?: string | null;
+  expectedPhoneE164?: string | null;
+}
+
+/**
+ * The identity a session redeems on.
+ *
+ * `chatId` is compared against the actor's conversation and everything else
+ * against the actor themselves, which is why the field travels with the value.
+ */
+export interface BoundIdentity {
+  field: "phoneE164" | "externalUserId" | "chatId";
+  value: string;
+}
+
+/**
+ * The one identity a session is bound to, or null when it is bound to none
+ * (an inbound challenge, or a bootstrap session before its deep link is
+ * redeemed).
+ *
+ * This lives in the contract because more than one side has to agree on it:
+ * the gateway consume path decides who may redeem a code, and the supersede
+ * scope decides whose earlier codes a fresh mint kills. Those two disagreeing
+ * is a silent one-time-code bug, so the rule is stated once.
+ *
+ * Precedence, most to least specific:
+ *
+ * 1. `expectedPhoneE164` (a voice session's subject is the number itself).
+ * 2. `expectedExternalUserId` (the person).
+ * 3. `expectedChatId` (the conversation), and only when nothing identifies a
+ *    person. A chat id can be shared (a Slack channel, a Telegram group), so
+ *    on its own it would let any participant satisfy the binding. It counts
+ *    only where there is no better answer.
+ */
+export function boundIdentity(
+  session: IdentityBoundSession,
+): BoundIdentity | null {
+  // Presence, not truthiness. An empty string is a set-but-useless identity,
+  // and treating it as absent would report the session unbound, which the
+  // consume path reads as "no identity to check" and admits anyone holding
+  // the code. Kept as a value it can compare against and fail instead.
+  if (session.expectedPhoneE164 != null) {
+    return { field: "phoneE164", value: session.expectedPhoneE164 };
+  }
+  if (session.expectedExternalUserId != null) {
+    return { field: "externalUserId", value: session.expectedExternalUserId };
+  }
+  if (session.expectedChatId != null) {
+    return { field: "chatId", value: session.expectedChatId };
+  }
+  return null;
+}
+
+/**
+ * Whether two sessions are bound to the same identity. Two sessions bound to
+ * no identity are not the same: bootstrap sessions are claimed by id, so an
+ * unbound mint must not sweep up every other unbound row.
+ */
+export function bindsSameIdentity(
+  a: BoundIdentity | null,
+  b: BoundIdentity | null,
+): boolean {
+  return a !== null && b !== null && a.field === b.field && a.value === b.value;
+}
+
 // ---------------------------------------------------------------------------
 // IPC methods
 // ---------------------------------------------------------------------------
@@ -193,9 +265,12 @@ export type CreateInboundSessionIpcResponse = z.infer<
 /** Request for `verification_sessions_create_outbound`. */
 export const CreateOutboundSessionIpcParamsSchema = z.object({
   channel: z.string().min(1),
-  expectedExternalUserId: z.string().optional(),
-  expectedChatId: z.string().optional(),
-  expectedPhoneE164: z.string().optional(),
+  // An identity field is either absent or a real value. An empty string is
+  // neither, and a session bound to one can never be redeemed by anybody,
+  // so reject it at the boundary rather than mint a dead code.
+  expectedExternalUserId: z.string().min(1).optional(),
+  expectedChatId: z.string().min(1).optional(),
+  expectedPhoneE164: z.string().min(1).optional(),
   identityBindingStatus: IdentityBindingStatusSchema.optional(),
   destinationAddress: z.string().optional(),
   codeDigits: z.number().int().positive().optional(),

package/openapi.yaml

@@ -9293,8 +9293,10 @@ paths:
   /v1/conversations/reorder:
     post:
       operationId: conversations_reorder_post
-      summary: Reorder conversations
-      description: Batch-update display order and pin state for conversations.
+      summary: Move conversations between sections
+      description:
+        Batch-update which group holds each conversation, and its pin state. Lists are ordered by recency, so this
+        sets placement, not order.
       tags:
         - conversations
       requestBody:
@@ -9311,8 +9313,6 @@ paths:
                     properties:
                       conversationId:
                         type: string
-                      displayOrder:
-                        type: number
                       isPinned:
                         type: boolean
                       groupId:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.2-dev.202608070442.84135c4",
+  "version": "0.11.2-dev.202608070534.d55eaf1",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/background-workers-disk-pressure.test.ts

@@ -61,7 +61,7 @@ mock.module("../persistence/conversation-crud.js", () => ({
   getConversationPersistedSeq: () => null,
   addMessage: mock(() => ({ id: "msg-1" })),
   archiveConversation: mock(() => true),
-  batchSetDisplayOrders: mock(() => {}),
+  batchSetConversationPlacement: mock(() => {}),
   createConversation: (opts: { conversationType: string }) => {
     createdConversations.push(opts);
     return { id: "conv-1", ...opts };

package/src/__tests__/channel-guardian.test.ts

@@ -1782,26 +1782,46 @@ describe("outbound verification sessions", () => {
     expect(result.success).toBe(true);
   });
 
-  // ── Voice identity match via expectedExternalUserId ──
+  // ── Voice identity is the number ──
 
-  test("Voice identity match succeeds via expectedExternalUserId", async () => {
+  test("a voice session is redeemed by the number it was sent to", async () => {
+    // Voice knows the caller by one thing, so the consume path receives that
+    // number as both actor axes. Every voice mint records it in both
+    // identity columns, and either way the session is bound to the number.
     const { secret } = await createOutboundSession({
       channel: "phone",
-      expectedExternalUserId: "voice-user-42",
-      expectedPhoneE164: "+15551234567",
-      destinationAddress: "+15551234567",
+      expectedExternalUserId: "+15555550101",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
     });
 
-    // Actor matches expectedExternalUserId
     const result = await validateAndConsumeVerification(
       "phone",
       secret,
-      "voice-user-42",
-      "voice-chat-1",
+      "+15555550101",
+      "+15555550101",
     );
 
     expect(result.success).toBe(true);
   });
+
+  test("a voice session refuses a caller on a different number", async () => {
+    const { secret } = await createOutboundSession({
+      channel: "phone",
+      expectedExternalUserId: "+15555550101",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
+
+    const result = await validateAndConsumeVerification(
+      "phone",
+      secret,
+      "+15555550102",
+      "+15555550102",
+    );
+
+    expect(result.success).toBe(false);
+  });
 });
 
 // ═══════════════════════════════════════════════════════════════════════════

package/src/__tests__/conversation-placement-promotion.test.ts

@@ -17,7 +17,7 @@
 import { beforeEach, describe, expect, test } from "bun:test";
 
 import {
-  batchSetDisplayOrders,
+  batchSetConversationPlacement,
   createConversation,
 } from "../persistence/conversation-crud.js";
 import { listConversations } from "../persistence/conversation-queries.js";
@@ -58,22 +58,16 @@ describe("pinning a background conversation", () => {
     const conv = seedRoutedBackground("bg-job", "background");
     expect(visibleTitles()).toEqual([]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: "system:pinned" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:pinned" }]);
 
     expect(titlesInGroup("system:pinned")).toEqual(["bg-job"]);
   });
 
   test("unpinning lands it in Recents rather than hiding it again", () => {
     const conv = seedRoutedBackground("bg-job", "background");
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: "system:pinned" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:pinned" }]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:all" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:all" }]);
 
     expect(titlesInGroup("system:all")).toEqual(["bg-job"]);
   });
@@ -84,9 +78,7 @@ describe("filing a background conversation into a custom group", () => {
     const group = createGroup("Car Chat");
     const conv = seedRoutedBackground("bg-job", "background");
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: group.id },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: group.id }]);
 
     expect(titlesInGroup(group.id)).toEqual(["bg-job"]);
   });
@@ -94,13 +86,9 @@ describe("filing a background conversation into a custom group", () => {
   test("removing it from the group lands it in Recents rather than losing it", () => {
     const group = createGroup("Car Chat");
     const conv = seedRoutedBackground("bg-job", "background");
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: group.id },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: group.id }]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:all" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:all" }]);
 
     expect(titlesInGroup("system:all")).toEqual(["bg-job"]);
     expect(visibleTitles()).toEqual(["bg-job"]);
@@ -110,12 +98,8 @@ describe("filing a background conversation into a custom group", () => {
     const group = createGroup("Morning Briefs");
     const conv = seedRoutedBackground("sched-job", "scheduled");
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: group.id },
-    ]);
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:all" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: group.id }]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:all" }]);
 
     expect(titlesInGroup("system:all")).toEqual(["sched-job"]);
   });
@@ -125,13 +109,11 @@ describe("what promotion must not do", () => {
   test("filing into system:background still demotes", () => {
     const conv = seedRoutedBackground("bg-job", "background");
     // Promote first, so the demotion has something to undo.
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: "system:pinned" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:pinned" }]);
     expect(titlesInGroup("system:pinned")).toEqual(["bg-job"]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:background" },
+    batchSetConversationPlacement([
+      { id: conv.id, groupId: "system:background" },
     ]);
 
     expect(visibleTitles()).toEqual([]);
@@ -149,9 +131,7 @@ describe("what promotion must not do", () => {
     // system bucket.
     const conv = seedRoutedBackground("bg-job", "background");
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:all" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:all" }]);
 
     expect(visibleTitles()).toEqual([]);
   });
@@ -168,13 +148,9 @@ describe("what promotion must not do", () => {
     // came from, `surfaced_at` records that the user promoted it, and only
     // an explicit demotion clears the latter.
     const conv = seedRoutedBackground("bg-job", "background");
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: "system:pinned" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:pinned" }]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, isPinned: false },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, isPinned: false }]);
 
     expect(visibleTitles()).toEqual(["bg-job"]);
     expect(titlesInGroup("system:all")).toEqual(["bg-job"]);
@@ -186,9 +162,7 @@ describe("what promotion must not do", () => {
     const group = createGroup("Car Chat");
     const conv = createConversation("plain-chat");
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: group.id },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: group.id }]);
 
     const row = getDb()
       .all(`SELECT surfaced_at FROM conversations WHERE id = '${conv.id}'`)

package/src/__tests__/conversation-retry-route.test.ts

@@ -74,7 +74,7 @@ const getConversationMock = mock((id: string) =>
 mock.module("../persistence/conversation-crud.js", () => ({
   addMessage: async () => ({ id: "unused", deduplicated: false }),
   archiveConversation: () => true,
-  batchSetDisplayOrders: () => {},
+  batchSetConversationPlacement: () => {},
   countConversationsByScheduleJobId: () => 0,
   deleteConversation: () => ({ segmentIds: [], deletedSummaryIds: [] }),
   extractImageSourcePaths: () => undefined,

package/src/__tests__/conversation-summarize-route.test.ts

@@ -53,7 +53,7 @@ const getConversationMock = mock((id: string) =>
 mock.module("../persistence/conversation-crud.js", () => ({
   addMessage: addMessageMock,
   archiveConversation: () => true,
-  batchSetDisplayOrders: () => {},
+  batchSetConversationPlacement: () => {},
   countConversationsByScheduleJobId: () => 0,
   deleteConversation: () => ({ segmentIds: [], deletedSummaryIds: [] }),
   extractImageSourcePaths: () => undefined,

package/src/__tests__/helpers/verification-sessions-ipc-sim.ts

@@ -22,6 +22,8 @@
 import { randomBytes, randomUUID } from "node:crypto";
 
 import {
+  bindsSameIdentity,
+  boundIdentity,
   hashVerificationSecret,
   VERIFICATION_SESSIONS_IPC_METHODS,
   type VerificationSessionWire,
@@ -64,30 +66,11 @@ function isInterceptable(s: VerificationSessionWire): boolean {
 
 const OUTBOUND_LIVE_STATUSES = ["pending_bootstrap", "awaiting_response"];
 
-/**
- * The identity a session redeems on, in `checkIdentityMatch`'s precedence
- * order. Null when the session carries none, which is a bootstrap session.
- */
-function boundIdentity(session: {
-  expectedExternalUserId?: string | null;
-  expectedChatId?: string | null;
-  expectedPhoneE164?: string | null;
-}): string | null {
-  if (session.expectedExternalUserId) {
-    return `user:${session.expectedExternalUserId}`;
-  }
-  if (session.expectedPhoneE164) {
-    return `phone:${session.expectedPhoneE164}`;
-  }
-  if (session.expectedChatId) {
-    return `chat:${session.expectedChatId}`;
-  }
-  return null;
-}
-
 /**
  * Mirrors the gateway store: an outbound mint supersedes only sessions bound
  * to the same identity, leaving other actors and inbound challenges alone.
+ * The identity rule itself comes from the shared contract, so this cannot
+ * drift from what the gateway does.
  */
 function revokeSameActorOutbound(
   channel: string,
@@ -102,7 +85,7 @@ function revokeSameActorOutbound(
     if (
       s.channel === channel &&
       OUTBOUND_LIVE_STATUSES.includes(s.status) &&
-      boundIdentity(s) === identity
+      bindsSameIdentity(boundIdentity(s), identity)
     ) {
       s.status = "revoked";
       s.updatedAt = now;
@@ -522,50 +505,24 @@ function recordInvalidAttempt(key: string): void {
   rateLimits.set(key, entry);
 }
 
+/**
+ * Mirrors the gateway consume path. Both sides read the shared
+ * `boundIdentity`, so the sim cannot accept a code the real service would
+ * refuse. A session bound to no identity, or not yet finally bound
+ * (`pending_bootstrap`), bypasses the check as it does at the gateway.
+ */
 function checkIdentityMatch(
   session: VerificationSessionWire,
   actorExternalUserId: string,
   actorChatId: string,
 ): boolean {
-  const hasExpectedIdentity =
-    session.expectedExternalUserId != null ||
-    session.expectedChatId != null ||
-    session.expectedPhoneE164 != null;
-  // pending_bootstrap (and unbound inbound) sessions bypass the check.
-  if (!hasExpectedIdentity || session.identityBindingStatus !== "bound") {
-    return true;
-  }
-
-  if (
-    session.expectedPhoneE164 != null &&
-    (actorExternalUserId === session.expectedPhoneE164 ||
-      actorExternalUserId === session.expectedExternalUserId)
-  ) {
-    return true;
-  }
-
-  // Shared-chatId caveat: when both expected fields are set, require the
-  // externalUserId match — chat IDs can be shared.
-  if (session.expectedChatId != null) {
-    if (session.expectedExternalUserId != null) {
-      if (actorExternalUserId === session.expectedExternalUserId) {
-        return true;
-      }
-    } else if (actorChatId === session.expectedChatId) {
-      return true;
-    }
-  }
-
-  if (
-    session.expectedPhoneE164 == null &&
-    session.expectedChatId == null &&
-    session.expectedExternalUserId != null &&
-    actorExternalUserId === session.expectedExternalUserId
-  ) {
+  const identity = boundIdentity(session);
+  if (identity === null || session.identityBindingStatus !== "bound") {
     return true;
   }
-
-  return false;
+  return identity.field === "chatId"
+    ? actorChatId === identity.value
+    : actorExternalUserId === identity.value;
 }
 
 export function validateAndConsumeVerification(

package/src/__tests__/http-conversation-lineage.test.ts

@@ -13,7 +13,7 @@ mock.module("../config/env.js", () => ({
 }));
 
 import {
-  batchSetDisplayOrders,
+  batchSetConversationPlacement,
   createConversation,
   updateConversationTitle,
 } from "../persistence/conversation-crud.js";
@@ -100,9 +100,7 @@ describe("conversation lineage in HTTP reads", () => {
 
   test("GET /v1/conversations/:id includes pin metadata when present", async () => {
     const conversation = createConversation("Pinned conversation");
-    batchSetDisplayOrders([
-      { id: conversation.id, displayOrder: 7, isPinned: true },
-    ]);
+    batchSetConversationPlacement([{ id: conversation.id, isPinned: true }]);
     await startServer();
 
     const response = await fetch(url(`/conversations/${conversation.id}`));
@@ -115,7 +113,6 @@ describe("conversation lineage in HTTP reads", () => {
     expect(body.conversation).toMatchObject({
       id: conversation.id,
       title: conversation.title ?? "Untitled",
-      displayOrder: 7,
       isPinned: true,
     });
   });

package/src/persistence/conversation-crud.ts

@@ -4209,13 +4209,19 @@ export function getConversationRecentProvenanceTrustClass(
 }
 
 // ---------------------------------------------------------------------------
-// CRUD functions for display_order and is_pinned
+// Conversation placement (group + pin) and display metadata
 // ---------------------------------------------------------------------------
 
-export function batchSetDisplayOrders(
+/**
+ * Move conversations between sections: set the group, and the pin state
+ * derived from it.
+ *
+ * Writes no ordering. Every list is ordered by recency, so a conversation's
+ * placement is which section holds it, not where it sits inside one.
+ */
+export function batchSetConversationPlacement(
   updates: Array<{
     id: string;
-    displayOrder: number | null;
     isPinned?: boolean;
     groupId?: string | null;
   }>,
@@ -4236,7 +4242,7 @@ export function batchSetDisplayOrders(
           safeGroupId = UNGROUPED_GROUP_ID;
         } else if (
           !rawGet<{ id: string }>(
-            "conversation:batchSetDisplayOrders:groupCheck",
+            "conversation:batchSetConversationPlacement:groupCheck",
             "SELECT id FROM conversation_groups WHERE id = ?",
             safeGroupId,
           )
@@ -4270,13 +4276,8 @@ export function batchSetDisplayOrders(
           safeGroupId !== UNGROUPED_GROUP_ID &&
           (safeGroupId === PINNED_GROUP_ID ||
             !safeGroupId.startsWith("system:"));
-        const setClauses = [
-          "display_order = ?",
-          "is_pinned = ?",
-          "group_id = ?",
-        ];
+        const setClauses = ["is_pinned = ?", "group_id = ?"];
         const params: Array<string | number | null> = [
-          update.displayOrder,
           safeGroupId === PINNED_GROUP_ID ? 1 : 0,
           safeGroupId,
         ];
@@ -4291,31 +4292,22 @@ export function batchSetDisplayOrders(
         }
         params.push(update.id);
         rawRun(
-          "conversation:batchSetDisplayOrders:group",
+          "conversation:batchSetConversationPlacement:group",
           `UPDATE conversations SET ${setClauses.join(", ")} WHERE id = ?`,
           ...params,
         );
-      } else if (update.isPinned === undefined) {
-        // Only displayOrder provided — preserve existing pin state and group.
-        rawRun(
-          "conversation:batchSetDisplayOrders:orderOnly",
-          "UPDATE conversations SET display_order = ? WHERE id = ?",
-          update.displayOrder,
-          update.id,
-        );
-      } else if (update.isPinned) {
+      } else if (update.isPinned === true) {
         rawRun(
-          "conversation:batchSetDisplayOrders:pin",
-          "UPDATE conversations SET display_order = ?, is_pinned = 1, group_id = 'system:pinned' WHERE id = ?",
-          update.displayOrder,
+          "conversation:batchSetConversationPlacement:pin",
+          "UPDATE conversations SET is_pinned = 1, group_id = 'system:pinned' WHERE id = ?",
           update.id,
         );
-      } else {
+      } else if (update.isPinned === false) {
         // Restore system group from source/conversationType when unpinning,
         // instead of clearing to NULL (which would lose provenance).
         rawRun(
-          "conversation:batchSetDisplayOrders:unpin",
-          `UPDATE conversations SET display_order = ?, is_pinned = 0,
+          "conversation:batchSetConversationPlacement:unpin",
+          `UPDATE conversations SET is_pinned = 0,
            group_id = CASE WHEN group_id = 'system:pinned' THEN
              CASE
                WHEN source IN ('schedule', 'reminder') THEN 'system:scheduled'
@@ -4325,7 +4317,6 @@ export function batchSetDisplayOrders(
              END
            ELSE group_id END
            WHERE id = ?`,
-          update.displayOrder,
           update.id,
         );
       }

package/src/persistence/conversation-group-migration.ts

@@ -36,7 +36,7 @@ export function _resetGroupMigrationForTests(): void {
  * for the first time inside a Drizzle db.transaction() block — SQLite
  * does not support nested transactions. In practice this is safe because
  * the migration is triggered by early startup queries (listConversations,
- * batchSetDisplayOrders) before any transaction-wrapped paths run, and
+ * batchSetConversationPlacement) before any transaction-wrapped paths run, and
  * the `migrated` flag makes subsequent calls no-ops.
  */
 export function ensureGroupMigration(): void {

package/src/runtime/routes/conversation-management-routes.ts

@@ -46,7 +46,7 @@ import { normalizeConversationType } from "../../daemon/message-types/shared.js"
 import { stripConversationIds } from "../../home/feed-writer.js";
 import {
   archiveConversation,
-  batchSetDisplayOrders,
+  batchSetConversationPlacement,
   countConversationsByScheduleJobId,
   deleteConversation,
   forkConversation as forkConversationInStore,
@@ -845,7 +845,6 @@ function handleReorderConversations({ body = {}, headers }: RouteHandlerArgs) {
   const updates = body.updates as
     | Array<{
         conversationId: string;
-        displayOrder?: number;
         isPinned?: boolean;
         groupId?: string | null;
       }>
@@ -853,10 +852,9 @@ function handleReorderConversations({ body = {}, headers }: RouteHandlerArgs) {
   if (!Array.isArray(updates)) {
     throw new BadRequestError("Missing updates array");
   }
-  batchSetDisplayOrders(
+  batchSetConversationPlacement(
     updates.map((u) => ({
       id: u.conversationId,
-      displayOrder: u.displayOrder ?? null,
       isPinned: u.isPinned,
       groupId: u.groupId,
     })),
@@ -1304,14 +1302,15 @@ export const ROUTES: RouteDefinition[] = [
       requiredScopes: ["chat.write"],
       allowedPrincipalTypes: ACTOR_PRINCIPALS,
     },
-    summary: "Reorder conversations",
-    description: "Batch-update display order and pin state for conversations.",
+    summary: "Move conversations between sections",
+    description:
+      "Batch-update which group holds each conversation, and its pin state. " +
+      "Lists are ordered by recency, so this sets placement, not order.",
     tags: ["conversations"],
     requestBody: z.object({
       updates: z.array(
         z.object({
           conversationId: z.string(),
-          displayOrder: z.number().optional(),
           isPinned: z.boolean().optional(),
           groupId: z.string().nullable().optional(),
         }),

package/src/runtime/verification-outbound-actions.ts

@@ -920,14 +920,15 @@ export async function resendOutbound(
     };
   }
 
-  const resendDestination =
+  const destination =
     session.destinationAddress ??
     session.expectedPhoneE164 ??
     session.expectedChatId;
-  if (resendDestination) {
+
+  if (destination) {
     const recentDestSends = await countRecentSendsToDestination(
       channel,
-      resendDestination,
+      destination,
       DESTINATION_RATE_WINDOW_MS,
     );
     if (recentDestSends >= MAX_SENDS_PER_DESTINATION_WINDOW) {
@@ -941,10 +942,6 @@ export async function resendOutbound(
     }
   }
 
-  const destination =
-    session.destinationAddress ??
-    session.expectedPhoneE164 ??
-    session.expectedChatId;
   if (!destination) {
     return {
       success: false,

package/src/tools/conversation-groups/move_to_group.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 
 import {
-  batchSetDisplayOrders,
+  batchSetConversationPlacement,
   getConversation,
   getDisplayMetaForConversations,
 } from "../../persistence/conversation-crud.js";
@@ -73,15 +73,7 @@ export async function executeConversationMoveToGroup(
     };
   }
 
-  // Preserve the conversation's manual sort slot across the move; only the
-  // group assignment changes.
-  batchSetDisplayOrders([
-    {
-      id: conversationId,
-      displayOrder: meta?.displayOrder ?? null,
-      groupId: group.id,
-    },
-  ]);
+  batchSetConversationPlacement([{ id: conversationId, groupId: group.id }]);
   publishConversationListAndMetadataChanged("reordered", [conversationId]);
 
   const notes: string[] = [];