@vellumai/assistant 0.12.3-staging.2 → 0.12.4-staging.1

package/src/daemon/handlers/conversations.ts

@@ -10,9 +10,11 @@ import { resolveConversationId } from "../../persistence/conversation-key-store.
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { resolveCapabilities } from "../../runtime/capabilities.js";
 import * as pendingInteractions from "../../runtime/pending-interactions.js";
+import { resolvePendingQuestion } from "../../runtime/question-resolution.js";
 import { getSubagentManager } from "../../subagent/index.js";
 import { createAbortReason } from "../../util/abort-reasons.js";
 import { UserError } from "../../util/errors.js";
+import type { Conversation } from "../conversation.js";
 import { touchConversation } from "../conversation-evictor.js";
 import { forceClearStaleProcessing } from "../conversation-lifecycle.js";
 import {
@@ -24,7 +26,7 @@ import {
   conversationEntries,
   findConversation,
 } from "../conversation-registry.js";
-import { resolveSlash } from "../conversation-slash.js";
+import { classifySlash, resolveSlash } from "../conversation-slash.js";
 import {
   clearAllActiveConversations,
   getOrCreateConversation,
@@ -328,23 +330,36 @@ export function deleteQueuedMessage(
     );
     return { removed: false, reason: "forbidden" };
   }
-  conversation.removeQueuedMessage(requestId);
-  // Queue events come in pairs, so an entry that never produced a
-  // `message_queued` ack (a suppressed daemon-injected send, or a hidden
-  // machine send) must not produce a delete either: clients have no row to
-  // retire and an unpaired event would decrement a counter that was never
-  // incremented.
+  consumeQueuedMessage(conversation, conversationId, queued);
+  return { removed: true };
+}
+
+/**
+ * Drop a queued message from the queue and close out the client row it
+ * created, so a message that will never run leaves no pending indicator
+ * behind.
+ *
+ * Queue events come in pairs, so an entry that never produced a
+ * `message_queued` ack (a suppressed daemon-injected send, or a hidden machine
+ * send) must not produce a delete either: clients have no row to retire and an
+ * unpaired event would decrement a counter that was never incremented.
+ */
+function consumeQueuedMessage(
+  conversation: Conversation,
+  conversationId: string,
+  queued: QueuedMessage,
+): void {
+  conversation.removeQueuedMessage(queued.requestId);
   if (!isSuppressedQueuedMessage(queued.metadata)) {
     queued.onEvent({
       type: "message_queued_deleted",
       conversationId,
-      requestId,
+      requestId: queued.requestId,
       ...(queued.clientMessageId
         ? { clientMessageId: queued.clientMessageId }
         : {}),
     });
   }
-  return { removed: true };
 }
 
 /**
@@ -458,6 +473,92 @@ export function steerToMessage(
   return { steered: true };
 }
 
+/**
+ * Answer an open `ask_question` prompt with a message the user typed into the
+ * chat while the card was up.
+ *
+ * Typing an answer instead of using the card is the same act as typing it into
+ * the card's free-text field, so it resolves the prompt rather than cancelling
+ * it: the parked turn keeps running and the model reads the answer in the tool
+ * result. Channel replies already work this way (the bare-text branch of
+ * `runtime/guardian-reply-router.ts`); this is the app path saying the same
+ * thing through the same `resolvePendingQuestion` core.
+ *
+ * The message is consumed, not run as a turn of its own: it reaches the model
+ * once, through the tool result, and the answered card carries the user's own
+ * words in the transcript. Consuming it retires the client's queued row the
+ * same way a queue delete does.
+ *
+ * Deliberately narrow. Anything the free-text field of a card could not have
+ * carried, or that a single answer cannot honestly stand in for, falls through
+ * to {@link steerOnEnqueuedMessageIfQuestionParked} and supersedes as before:
+ *  - more than one parked question, so which prompt the text answers is a guess
+ *  - a message no longer on the queue, which cannot be consumed
+ *  - attachments, which the tool result has no way to carry
+ *  - a send that is not a person typing: automated, non-interactive, or
+ *    echo-suppressed machine signals
+ *  - empty text, which answers nothing
+ *  - a slash command, which is an instruction to the assistant rather than prose
+ *
+ * Returns `true` when a parked question was answered and the message consumed.
+ */
+export function answerParkedQuestionWithEnqueuedMessage(
+  conversationId: string,
+  enqueuedRequestId: string,
+): boolean {
+  const conversation = findConversation(conversationId);
+  if (!conversation) {
+    return false;
+  }
+
+  const parked = pendingInteractions
+    .getByConversation(conversationId)
+    .filter((interaction) => interaction.kind === "question");
+  if (parked.length !== 1) {
+    return false;
+  }
+
+  const queued = conversation.queue.findByRequestId(enqueuedRequestId);
+  if (!queued || queued.attachments.length > 0) {
+    return false;
+  }
+  if (
+    queued.isInteractive === false ||
+    queued.metadata?.automated === true ||
+    isSuppressedQueuedMessage(queued.metadata)
+  ) {
+    return false;
+  }
+
+  const text = queued.content.trim();
+  if (text.length === 0 || classifySlash(text) !== "passthrough") {
+    return false;
+  }
+
+  const outcome = resolvePendingQuestion(parked[0].requestId, {
+    kind: "chat_reply",
+    text,
+  });
+  if (outcome.status !== "resolved") {
+    log.warn(
+      {
+        conversationId,
+        requestId: parked[0].requestId,
+        outcome: outcome.status,
+      },
+      "Parked question did not resolve from the enqueued message",
+    );
+    return false;
+  }
+
+  consumeQueuedMessage(conversation, conversationId, queued);
+  log.info(
+    { conversationId, requestId: parked[0].requestId, enqueuedRequestId },
+    "Enqueued message answered a parked question",
+  );
+  return true;
+}
+
 /**
  * Supersede an open `ask_question` prompt when a new chat message is enqueued
  * for the same conversation.
@@ -495,7 +596,9 @@ export function steerOnEnqueuedMessageIfQuestionParked(
  *     gateway request-status sync *before* clearing the prompter-owned
  *     confirmations, so a later guardian reply can't match a stale "pending"
  *     record and fail with `pending_interaction_not_found`.
- *  2. Supersede a parked ask_question by steering to the enqueued message.
+ *  2. Answer a parked ask_question with the enqueued message when the message
+ *     reads as an answer ({@link answerParkedQuestionWithEnqueuedMessage}), and
+ *     otherwise supersede it by steering to the enqueued message.
  *
  * Order matters: the steer aborts the turn, which denies the prompter's
  * confirmations as a side effect, so the status/notification sync must be
@@ -508,6 +611,11 @@ export function supersedePendingInteractionsOnEnqueue(
   enqueuedRequestId: string,
 ): void {
   denyPendingConfirmationsOnSupersession(conversationId);
+  if (
+    answerParkedQuestionWithEnqueuedMessage(conversationId, enqueuedRequestId)
+  ) {
+    return;
+  }
   steerOnEnqueuedMessageIfQuestionParked(conversationId, enqueuedRequestId);
 }
 

package/src/desktop/desktop-browser-endpoint.ts

@@ -134,6 +134,7 @@ export function desktopChromeArguments(
     `--class=${DESKTOP_CHROME_WINDOW_CLASS}`,
     "--force-renderer-accessibility",
     "--disable-dev-shm-usage",
+    "--disable-features=Prerender2",
     ...(shouldRestoreDesktopChromeSession(profileDir)
       ? ["--restore-last-session", "--hide-crash-restore-bubble"]
       : []),

package/src/ipc/routes/__tests__/conversation-sync-ipc-routes.test.ts

@@ -16,6 +16,7 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 const recordCalls: Array<[string, number]> = [];
 const publishCalls: string[] = [];
+const listPublishCalls: Array<[string, string | string[]]> = [];
 
 mock.module("../../../persistence/conversation-crud.js", () => ({
   recordConversationPersistedSeq: (id: string, seq: number) => {
@@ -27,6 +28,12 @@ mock.module("../../../runtime/sync/resource-sync-events.js", () => ({
   publishConversationMessagesChanged: (id: string) => {
     publishCalls.push(id);
   },
+  publishConversationListAndMetadataChanged: (
+    reason: string,
+    ids: string | string[],
+  ) => {
+    listPublishCalls.push([reason, ids]);
+  },
 }));
 
 import type { AssistantEventEnvelope } from "../../../api/index.js";
@@ -40,9 +47,13 @@ import {
   _resetStreamStateForTesting,
   stampAndBuffer,
 } from "../../../runtime/assistant-stream-state.js";
-import { NOTIFY_CONVERSATION_PERSISTED_IPC_METHOD } from "../../../runtime/sync/worker-daemon-notify.js";
+import {
+  NOTIFY_CONVERSATION_LIST_CHANGED_IPC_METHOD,
+  NOTIFY_CONVERSATION_PERSISTED_IPC_METHOD,
+} from "../../../runtime/sync/worker-daemon-notify.js";
 import {
   CONVERSATION_SYNC_IPC_METHODS,
+  handleNotifyConversationListChanged,
   handleNotifyConversationPersisted,
 } from "../conversation-sync-ipc-routes.js";
 
@@ -176,3 +187,40 @@ describe("conversation-sync IPC route", () => {
     ).toBe(false);
   });
 });
+
+describe("conversation-list-changed IPC route", () => {
+  beforeEach(() => {
+    listPublishCalls.length = 0;
+  });
+
+  test("republishes the worker's list invalidation on the daemon's hub", () => {
+    const result = handleNotifyConversationListChanged({
+      body: { reason: "reordered", conversationIds: ["conv-1"] },
+    });
+
+    expect(result).toEqual({ ok: true });
+    expect(listPublishCalls).toEqual([["reordered", ["conv-1"]]]);
+  });
+
+  test("rejects an unknown reason and an empty id list", () => {
+    expect(() =>
+      handleNotifyConversationListChanged({
+        body: { reason: "resurfaced", conversationIds: ["conv-1"] },
+      }),
+    ).toThrow();
+    expect(() =>
+      handleNotifyConversationListChanged({
+        body: { reason: "reordered", conversationIds: [] },
+      }),
+    ).toThrow();
+    expect(listPublishCalls).toEqual([]);
+  });
+
+  test("is reachable on the IPC surface under the shared method name", () => {
+    expect(
+      typeof CONVERSATION_SYNC_IPC_METHODS[
+        NOTIFY_CONVERSATION_LIST_CHANGED_IPC_METHOD
+      ],
+    ).toBe("function");
+  });
+});

package/src/ipc/routes/conversation-sync-ipc-routes.ts

@@ -29,13 +29,30 @@ import { getInflightFlushedContentSeq } from "../../daemon/inflight-turn-registr
 import { recordConversationPersistedSeq } from "../../persistence/conversation-crud.js";
 import { getCurrentSeq } from "../../runtime/assistant-stream-state.js";
 import type { RouteHandlerArgs } from "../../runtime/routes/types.js";
-import { publishConversationMessagesChanged } from "../../runtime/sync/resource-sync-events.js";
-import { NOTIFY_CONVERSATION_PERSISTED_IPC_METHOD } from "../../runtime/sync/worker-daemon-notify.js";
+import {
+  publishConversationListAndMetadataChanged,
+  publishConversationMessagesChanged,
+} from "../../runtime/sync/resource-sync-events.js";
+import {
+  NOTIFY_CONVERSATION_LIST_CHANGED_IPC_METHOD,
+  NOTIFY_CONVERSATION_PERSISTED_IPC_METHOD,
+} from "../../runtime/sync/worker-daemon-notify.js";
 
 const NotifyConversationPersistedParamsSchema = z.object({
   conversationId: z.string().min(1),
 });
 
+const NotifyConversationListChangedParamsSchema = z.object({
+  reason: z.enum([
+    "created",
+    "renamed",
+    "deleted",
+    "reordered",
+    "seen_changed",
+  ]),
+  conversationIds: z.array(z.string().min(1)).min(1),
+});
+
 /**
  * Record the daemon-issued snapshot anchor for a worker-persisted turn and
  * republish its messages-changed invalidation to the daemon's subscribers.
@@ -61,6 +78,23 @@ export function handleNotifyConversationPersisted({
   return { ok: true };
 }
 
+/**
+ * Republish a worker's conversation-list-and-metadata invalidation on the
+ * daemon's hub, where the SSE subscribers live.
+ *
+ * A worker turn that changes which rows belong in the list (clearing
+ * `archived_at` on a Done conversation it woke) has to reach connected
+ * sidebars, and a publish in the worker reaches none of them.
+ */
+export function handleNotifyConversationListChanged({
+  body = {},
+}: RouteHandlerArgs) {
+  const { reason, conversationIds } =
+    NotifyConversationListChangedParamsSchema.parse(body);
+  publishConversationListAndMetadataChanged(reason, conversationIds);
+  return { ok: true };
+}
+
 /**
  * IPC-only conversation-sync methods, keyed by operationId. Registered directly
  * on the assistant IPC server (see `assistant-server.ts`).
@@ -70,4 +104,6 @@ export const CONVERSATION_SYNC_IPC_METHODS: Record<
   (args: RouteHandlerArgs) => unknown
 > = {
   [NOTIFY_CONVERSATION_PERSISTED_IPC_METHOD]: handleNotifyConversationPersisted,
+  [NOTIFY_CONVERSATION_LIST_CHANGED_IPC_METHOD]:
+    handleNotifyConversationListChanged,
 };

package/src/permissions/question-prompter.ts

@@ -58,6 +58,14 @@ export interface QuestionPromptEntryResult {
 export interface QuestionPromptResult {
   entries: QuestionPromptEntryResult[];
   overall: "completed" | "closed" | "timed_out" | "aborted";
+  /**
+   * True when the answer arrived as a message typed into the chat while the
+   * card was still open, rather than through the card itself. Only the first
+   * question carries the typed text; the rest stay `skipped`. The
+   * `ask_question` tool says so in the model-facing result, so the model can
+   * map the reply onto the questions itself.
+   */
+  answeredInChat?: boolean;
 }
 
 /**
@@ -178,10 +186,12 @@ export interface QuestionBatchMetadata {
  *
  * The idle timeout is a backstop (`getConfig().timeouts.questionResponseTimeoutSec`,
  * default 30 min), not the primary way a prompt is dismissed. An interactive
- * user who moves on instead of answering enqueues another message, which
- * supersedes the open prompt at the enqueue handler (see conversation-routes.ts);
- * a non-interactive turn resolves immediately at the tool. The backstop only
- * fires when a prompt is left open with no response and no follow-up message.
+ * user who types into the chat instead of using the card settles the prompt at
+ * the enqueue handler: the typed text answers it, or, when it cannot stand in
+ * for an answer, supersedes it (see
+ * `daemon/handlers/conversations.ts`). A non-interactive turn resolves
+ * immediately at the tool. The backstop only fires when a prompt is left open
+ * with no response and no follow-up message.
  */
 export class QuestionPrompter {
   async prompt(params: QuestionPromptParams): Promise<QuestionPromptOutcome> {

package/src/persistence/conversation-crud.ts

@@ -32,6 +32,7 @@ import type { ChannelId, InterfaceId } from "../channels/types.js";
 import { parseChannelId, parseInterfaceId } from "../channels/types.js";
 import { CHANNEL_IDS, isChannelId } from "../channels/types.js";
 import { getConfig } from "../config/loader.js";
+import { isSidebarDoneEnabled } from "../config/sidebar-done-gate.js";
 import { findDisplayTurnEndIndex } from "../conversations/message-consolidation.js";
 import { findConversation } from "../daemon/conversation-registry.js";
 import { conversationMetadataSyncTag } from "../daemon/message-types/sync.js";
@@ -48,6 +49,7 @@ import { indexMessageNow } from "../plugins/defaults/memory/indexer.js";
 import { runHook } from "../plugins/pipeline.js";
 import type { ContentBlock } from "../providers/types.js";
 import { getCurrentSeq } from "../runtime/assistant-stream-state.js";
+import { publishConversationListAndMetadataChanged } from "../runtime/sync/resource-sync-events.js";
 import { publishSyncInvalidation } from "../runtime/sync/sync-publisher.js";
 import { UserError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
@@ -100,6 +102,7 @@ import {
   computerUseScreenshotAttachmentIdsFromMetadata,
   type ConversationCreateType,
   type ConversationOrigin,
+  isEchoSuppressedUserMessage,
   isHiddenMessageMetadata,
   isNoResponseMetadata,
   isReactionMessageMetadata,
@@ -942,6 +945,11 @@ interface InsertMessageCoreParams {
   /** Answered synchronously at the top of every insert attempt. See
    *  {@link AddMessageOptions.insertPrecondition}. */
   insertPrecondition?: () => boolean;
+  /** The row is a reservation booked ahead of the content that will fill it
+   *  ({@link reserveMessage}), so it carries nothing to read yet. */
+  reserved?: boolean;
+  /** See {@link AddMessageOptions.skipResurface}. */
+  skipResurface?: boolean;
 }
 
 /**
@@ -1029,6 +1037,8 @@ async function insertMessageCore(
     clientMessageId,
     id,
     insertPrecondition,
+    reserved,
+    skipResurface,
   } = params;
   warnOnModelInvisibleContent(content, conversationId);
   const db = getDb();
@@ -1054,7 +1064,7 @@ async function insertMessageCore(
 
   // The timestamp is recomputed each attempt so a late retry doesn't persist a
   // stale `updatedAt`.
-  return withSqliteRetry(
+  const inserted = await withSqliteRetry(
     (): InsertedMessage => {
       // Asked at the top of EVERY attempt, and synchronously, because that is
       // the scope the answer holds for. Contention retries this function after
@@ -1179,6 +1189,32 @@ async function insertMessageCore(
     },
     { op: "insertMessageCore", context: { conversationId } },
   );
+
+  // A message the user reads brings a Done conversation back to the list.
+  // Four kinds of insert are not that: the echo-suppressed set, which never
+  // renders in the transcript; the empty row `reserveMessage` books for an LLM
+  // call that has not run yet, whose content arrives at the finalize seam and
+  // resurfaces from there; a row whose producer declared it bookkeeping ABOUT
+  // the conversation rather than activity in it (`skipResurface`); and a
+  // deduplicated insert, which wrote no row at all. Best-effort: a failure
+  // here must not escalate into a failed persist.
+  if (
+    !inserted.deduplicated &&
+    !reserved &&
+    !skipResurface &&
+    !isEchoSuppressedUserMessage(metadata)
+  ) {
+    try {
+      resurfaceArchivedConversation(conversationId, inserted.createdAt);
+    } catch (err) {
+      log.warn(
+        { err, conversationId, messageId: inserted.id },
+        "Failed to resurface Done conversation after message insert",
+      );
+    }
+  }
+
+  return inserted;
 }
 
 /**
@@ -2653,6 +2689,17 @@ export interface AddMessageOptions {
    * during that sleep.
    */
   insertPrecondition?: () => boolean;
+  /**
+   * The row is the assistant's bookkeeping ABOUT this conversation rather than
+   * activity in it, so it must not bring the conversation back from Done (see
+   * {@link resurfaceArchivedConversation}). The producer declares this, because
+   * only the producer knows which of the two a row is.
+   *
+   * The retrospective skill card is the case: a pass runs once a conversation
+   * has gone idle, which is exactly when the user has just marked it done, so
+   * a card that resurfaced would bounce fresh done chats back into the sidebar.
+   */
+  skipResurface?: boolean;
 }
 
 /**
@@ -2666,8 +2713,14 @@ export async function addMessage(
   content: string,
   options?: AddMessageOptions,
 ) {
-  const { metadata, skipIndexing, clientMessageId, id, insertPrecondition } =
-    options ?? {};
+  const {
+    metadata,
+    skipIndexing,
+    clientMessageId,
+    id,
+    insertPrecondition,
+    skipResurface,
+  } = options ?? {};
   const inserted = await insertMessageCore({
     conversationId,
     role,
@@ -2676,6 +2729,7 @@ export async function addMessage(
     clientMessageId,
     id,
     ...(insertPrecondition ? { insertPrecondition } : {}),
+    ...(skipResurface ? { skipResurface } : {}),
   });
 
   if (inserted.deduplicated) {
@@ -3521,6 +3575,62 @@ export function unarchiveConversation(id: string): boolean {
   return true;
 }
 
+/**
+ * Bring a Done conversation back to the list because a message the user reads
+ * landed in it at `activityAt`.
+ *
+ * Under the `sidebar-done` gate "Done" is a completion mark, not a deletion:
+ * the conversation keeps its schedules and its channel threads, so anything
+ * the user would read arriving in it has to be reachable again. Two seams call
+ * this, which between them cover every ingest path without a per-provider
+ * hook: {@link insertMessageCore}, where each durable append lands (channel
+ * inbound, web and CLI sends, wake tail messages, assistant-initiated
+ * notification bodies), and the turn's finalize effect, where a streamed
+ * assistant reply becomes readable content.
+ *
+ * Rows the user never reads resurface nothing. `insertMessageCore` excludes
+ * the echo-suppressed set (hidden signals, subagent and ACP notifications, and
+ * the `<background_event>` trigger each wake persists); the empty row an LLM
+ * call reserves before it runs, so a call rejected before producing anything
+ * leaves the conversation Done; and any row whose producer passed
+ * {@link AddMessageOptions.skipResurface}. Retrospectives and memory
+ * consolidation are excluded by construction: they append to a fork or to a
+ * conversation of their own, never to the conversation under review.
+ *
+ * The clear is conditional on `archived_at <= activityAt` in one statement, so
+ * a Done mark the user makes after this activity (while a turn's deferred tail
+ * is still settling, or from the daemon while a worker runs the turn) wins
+ * instead of being erased by it.
+ *
+ * No-ops when the gate is off, which is the shipped behavior: nothing but the
+ * unarchive route clears `archived_at`.
+ */
+export function resurfaceArchivedConversation(
+  conversationId: string,
+  activityAt: number,
+): boolean {
+  if (!isSidebarDoneEnabled(getConfig())) {
+    return false;
+  }
+  const now = Date.now();
+  const changed = rawRun(
+    "conversation:resurface",
+    "UPDATE conversations SET archived_at = NULL, updated_at = ? WHERE id = ? AND archived_at IS NOT NULL AND archived_at <= ?",
+    now,
+    conversationId,
+    activityAt,
+  );
+  if (changed === 0) {
+    return false;
+  }
+  publishConversationListAndMetadataChanged("reordered", conversationId);
+  log.info(
+    { conversationId },
+    "Resurfaced Done conversation on user-visible activity",
+  );
+  return true;
+}
+
 /**
  * Persist the processing-start timestamp for a conversation. Called by
  * `Conversation.setProcessing(true)` so out-of-process callers can detect
@@ -4530,6 +4640,7 @@ export async function reserveMessage(
     content: inflightRef ? JSON.stringify({ ref: inflightRef }) : "[]",
     ...(inflightRef ? { finalized: 0 as const } : {}),
     metadata,
+    reserved: true,
   });
 }
 

package/src/persistence/conversation-queries.ts

@@ -116,6 +116,16 @@ export function hasLexicalTokens(text: string): boolean {
  */
 export type ArchiveStatusFilter = "active" | "archived" | "all";
 
+/**
+ * Which bucket a listing covers.
+ *
+ * The persisted {@link ConversationType} values plus `"all"`, a read-side
+ * union that exists only here: no row carries it, and nothing writes it. It
+ * lets one paginated request span a user's whole history, which is what a
+ * full-history view needs and what three interleaved cursors cannot give it.
+ */
+export type ConversationListTypeFilter = ConversationType | "all";
+
 function archiveStatusClause(status: ArchiveStatusFilter) {
   switch (status) {
     case "active":
@@ -196,6 +206,25 @@ function surfacedVisibilitySql(alias = "conversations"): string {
   );
 }
 
+/**
+ * Raw SQL predicate for the background **umbrella**: background and scheduled
+ * rows together, matched on `conversation_type` or on the system group the
+ * producer filed them in, with subagent runs excluded so the sidebar never
+ * surfaces them.
+ *
+ * Shared by the `"background"` bucket of {@link conversationTypeClause} and by
+ * the `"all"` bucket, which is the union of that one with the standard
+ * listing, so the combined read can never admit a row either bucket alone
+ * would have withheld.
+ */
+function backgroundUmbrellaSql(alias = "conversations"): string {
+  return (
+    `((${alias}.conversation_type IN ('background', 'scheduled')` +
+    ` OR COALESCE(${alias}.group_id, 'system:all') IN ('system:background', 'system:scheduled'))` +
+    ` AND (${alias}.source IS NULL OR ${alias}.source != 'subagent'))`
+  );
+}
+
 /**
  * Raw SQL predicate for "not an automated background/scheduled row".
  *
@@ -289,6 +318,11 @@ function ungroupedSql(alias = "conversations"): string {
  *   Background and Scheduled sidebar sections from one request.
  * - `"scheduled"` — scheduled rows only, so the Scheduled section can load
  *   independently of the broader background backlog without over-fetching it.
+ * - `"all"`: the union of `"standard"` and `"background"`, so one paginated
+ *   request covers a user's whole history instead of interleaving three. Not
+ *   a bypass of the visibility rules: it is exactly those two predicates
+ *   OR-ed, with the legacy `private` type excluded on top, so nothing reaches
+ *   it that neither bucket would have returned.
  *
  * `group_id` is matched alongside `conversationType` so conversations routed to
  * `system:background` / `system:scheduled` (heartbeat, reminders, schedule-job
@@ -296,7 +330,7 @@ function ungroupedSql(alias = "conversations"): string {
  * correct bucket. Subagent runs are excluded from the background/scheduled
  * buckets so the sidebar never surfaces them.
  */
-function conversationTypeClause(type: ConversationType) {
+function conversationTypeClause(type: ConversationListTypeFilter) {
   const notSubagent = sql`(${conversations.source} IS NULL OR ${conversations.source} != 'subagent')`;
   switch (type) {
     case "standard":
@@ -305,9 +339,20 @@ function conversationTypeClause(type: ConversationType) {
       // standardListingVisibilitySql for the full predicate semantics.
       return sql.raw(standardListingVisibilitySql());
     case "background":
-      return sql`(${conversations.conversationType} IN ('background', 'scheduled') OR group_id IN ('system:background', 'system:scheduled')) AND ${notSubagent}`;
+      return sql.raw(backgroundUmbrellaSql());
     case "scheduled":
       return sql`(${conversations.conversationType} = 'scheduled' OR group_id = 'system:scheduled') AND ${notSubagent}`;
+    case "all":
+      /* `private` is excluded explicitly rather than left to the two arms.
+         The standard arm already drops it everywhere, but the umbrella
+         matches on the system group as well as on the type, so a legacy
+         private row filed in `system:background` would otherwise arrive
+         through it. Those rows exist transiently after an in-place snapshot
+         restore, before migration cleanup deletes them. */
+      return sql.raw(
+        `((${standardListingVisibilitySql()} OR ${backgroundUmbrellaSql()})` +
+          ` AND conversations.conversation_type != 'private')`,
+      );
   }
 }
 
@@ -321,7 +366,7 @@ function conversationTypeClause(type: ConversationType) {
  * transposition waiting to happen.
  */
 export interface ConversationListFilter {
-  conversationType?: ConversationType;
+  conversationType?: ConversationListTypeFilter;
   archiveStatus?: ArchiveStatusFilter;
   originChannel?: string;
   /**