@vibedeckx/linux-x64 0.3.34 → 0.3.36

package/dist/bin.js

@@ -186887,7 +186887,8 @@ var mapLocalActivity = (row) => {
       parseActivityTimestamp(row.created_at) ?? 0
     ),
     lastUserMessageAt: row.last_user_message_at,
-    lastCompletedAt: row.last_completed_at
+    lastCompletedAt: row.last_completed_at,
+    favoritedAt: row.favorited_at
   };
 };
 var observeLocalActivity = (consumer, row) => {
@@ -186915,6 +186916,7 @@ var localActivityBase = (kdb, projectId) => {
     "s.updated_at",
     "s.last_user_message_at",
     "s.last_completed_at",
+    "s.favorited_at",
     "checkout.worktree_path",
     "checkout.deleted_at as checkout_deleted_at",
     "checkout.status as checkout_status",
@@ -187196,6 +187198,12 @@ var createAgentSessionRepos = (kdb, h) => ({
       await observeDanglingLocalScope(kdb, consumer, projectId);
       return rows.map(mapLocalActivity);
     },
+    listFavoritedActivityByProject: async (projectId, limit, consumer) => {
+      const rows = await localActivityBase(kdb, projectId).where(visibleLifecycleOf("s")).where("s.favorited_at", "is not", null).orderBy("s.favorited_at", "desc").orderBy("s.id", "desc").limit(limit).execute();
+      rows.forEach((row) => observeLocalActivity(consumer, row));
+      await observeDanglingLocalScope(kdb, consumer, projectId);
+      return rows.map(mapLocalActivity);
+    },
     countRunningByProject: async (projectId) => {
       const row = await kdb.selectFrom("agent_sessions").select(kdb.fn.countAll().as("count")).where("project_id", "=", projectId).where("status", "=", "running").where(visibleLifecycle).executeTakeFirstOrThrow();
       return Number(row.count);
@@ -187296,12 +187304,25 @@ var createAgentSessionRepos = (kdb, h) => ({
     getEntries: async (sessionId) => {
       return kdb.selectFrom("agent_session_entries").select(["entry_index", "data"]).where("session_id", "=", sessionId).orderBy("entry_index", "asc").execute();
     },
+    getEntriesBefore: async (sessionId, beforeIndex, limit) => {
+      let query = kdb.selectFrom("agent_session_entries").select(["entry_index", "data"]).where("session_id", "=", sessionId);
+      if (beforeIndex !== null) query = query.where("entry_index", "<", beforeIndex);
+      return query.orderBy("entry_index", "desc").limit(limit).execute();
+    },
     deleteEntries: async (sessionId) => {
       await kdb.deleteFrom("agent_session_entries").where("session_id", "=", sessionId).execute();
     },
     countEntries: async () => {
       return kdb.selectFrom("agent_session_entries").select("session_id").select(kdb.fn.countAll().as("cnt")).groupBy("session_id").execute();
     },
+    getEntryMetaAll: async () => {
+      const rows = await kdb.selectFrom("agent_session_entries").select("session_id").select(kdb.fn.countAll().as("cnt")).select(kdb.fn.max("entry_index").as("max_index")).groupBy("session_id").execute();
+      return rows.map((row) => ({
+        session_id: row.session_id,
+        cnt: Number(row.cnt),
+        max_index: row.max_index ?? -1
+      }));
+    },
     listRetentionCandidates: async ({ cutoff, limit, after }) => {
       let query = kdb.selectFrom("agent_sessions").select(["id", "project_id", "branch", "activity_at"]).where(retentionPredicate(cutoff));
       if (after) {
@@ -188166,7 +188187,8 @@ var mapRemoteActivity = (row) => {
     model: row.model,
     lastActiveAt: row.last_active_at,
     lastUserMessageAt: row.last_user_message_at,
-    lastCompletedAt: row.last_completed_at
+    lastCompletedAt: row.last_completed_at,
+    favoritedAt: row.favorited_at
   };
 };
 var observeRemoteActivity = (consumer, row) => {
@@ -188234,6 +188256,7 @@ var remoteActivityBase = (kdb, projectId) => remoteSessionScope(kdb, projectId).
   "c.model",
   "c.last_user_message_at",
   "c.last_completed_at",
+  "c.favorited_at",
   "checkout.worktree_path",
   "checkout.deleted_at as checkout_deleted_at",
   "checkout.status as checkout_status",
@@ -188269,6 +188292,12 @@ var createSearchCacheRepos = (kdb, _h) => ({
       await observeDanglingRemoteActivity(kdb, consumer, projectId);
       return rows.map(mapRemoteActivity);
     },
+    listRemoteSessionFavoritesByProject: async (projectId, limit, consumer) => {
+      const rows = await remoteActivityBase(kdb, projectId).where("c.favorited_at", "is not", null).orderBy("c.favorited_at", "desc").orderBy("c.local_session_id", "asc").limit(limit).execute();
+      rows.forEach((row) => observeRemoteActivity(consumer, row));
+      await observeDanglingRemoteActivity(kdb, consumer, projectId);
+      return rows.map(mapRemoteActivity);
+    },
     countRemoteSessionActivityByProject: async (projectId) => {
       const row = await remoteSessionScope(kdb, projectId).select([
         sql`coalesce(sum(case when c.status = 'running' then 1 else 0 end), 0)`.as("running")
@@ -188450,6 +188479,39 @@ var createSearchCacheRepos = (kdb, _h) => ({
     updateCachedSessionTitle: async (localSessionId, title) => {
       await kdb.updateTable("session_search_cache").set({ title, written_at: Date.now() }).where("local_session_id", "=", localSessionId).execute();
     },
+    // Star write-through. Unlike the title and delete write-throughs this one
+    // may CREATE the row: the remote favorite PATCH has already succeeded on
+    // the worker, so the session provably exists, and the path that lists a
+    // remote's sessions (where the star button lives) binds only a mapping —
+    // no cache row. Before that target's first catalog snapshot there would be
+    // nothing to update and the star would sit invisible, which is the exact
+    // latency this write-through exists to remove. Only starring creates a
+    // row; an unstar with no row has nothing to hide (see noteSessionDeleted).
+    updateCachedSessionFavorited: async (localSessionId, favoritedAt) => {
+      const now3 = Date.now();
+      const updated = await kdb.updateTable("session_search_cache").set({ favorited_at: favoritedAt, written_at: now3 }).where("local_session_id", "=", localSessionId).executeTakeFirst();
+      if (Number(updated?.numUpdatedRows ?? 0) > 0 || favoritedAt === null) return;
+      const mapping = await kdb.selectFrom("remote_session_mappings").select(["project_id", "remote_server_id", "branch"]).where("local_session_id", "=", localSessionId).executeTakeFirst();
+      if (!mapping || mapping.remote_server_id === "local") return;
+      await kdb.insertInto("session_search_cache").values({
+        local_session_id: localSessionId,
+        project_id: mapping.project_id,
+        target_id: mapping.remote_server_id,
+        branch: toDbBranch(mapping.branch),
+        title: null,
+        last_active_at: null,
+        favorited_at: favoritedAt,
+        entry_count: 0,
+        status: "unknown",
+        agent_type: null,
+        model: null,
+        last_user_message_at: null,
+        last_completed_at: null,
+        generation: 0,
+        deleted_at: null,
+        written_at: now3
+      }).onConflict((oc) => oc.column("local_session_id").doUpdateSet({ favorited_at: favoritedAt, written_at: now3 })).execute();
+    },
     // Create write-through: called where a remote session's creation transits
     // the server (UI create proxy, commander spawn, branch-from-history). The
     // written_at stamp keeps the row exempt from snapshot reconciliation until
@@ -208493,6 +208555,111 @@ var EntryTracker = class {
   }
 };
 
+// src/session-history-window.ts
+function historyHead(entries, historyEpoch) {
+  let latestEntryIndex = null;
+  let lastTurnEndEntryIndex = null;
+  for (let index = entries.length - 1; index >= 0; index--) {
+    const message = entries[index];
+    if (!message) continue;
+    latestEntryIndex ??= index;
+    if (lastTurnEndEntryIndex === null && message.type === "turn_end") {
+      lastTurnEndEntryIndex = index;
+    }
+    if (latestEntryIndex !== null && lastTurnEndEntryIndex !== null) break;
+  }
+  return { historyEpoch, latestEntryIndex, lastTurnEndEntryIndex };
+}
+function buildHistoryWindow(entries, historyEpoch, opts = {}) {
+  const head = historyHead(entries, historyEpoch);
+  const endExclusive = Math.max(0, Math.min(opts.before ?? entries.length, entries.length));
+  const requestedTurns = Math.max(1, Math.min(opts.turns ?? 5, 20));
+  const boundaries = [];
+  for (let index = endExclusive - 1; index >= 0; index--) {
+    if (entries[index]?.type === "turn_end") boundaries.push(index);
+    if (boundaries.length >= requestedTurns + 2) break;
+  }
+  const startIndex = boundaries.length > requestedTurns + 1 ? boundaries[requestedTurns + 1] + 1 : 0;
+  const dense = [];
+  for (let index = startIndex; index < endExclusive; index++) {
+    const message = entries[index];
+    if (message) dense.push({ entryIndex: index, message });
+  }
+  const hasMore = startIndex > 0;
+  return {
+    ...head,
+    entries: dense,
+    previousCursor: hasMore ? startIndex : null,
+    hasMore
+  };
+}
+
+// src/session-history-reader.ts
+var SessionHistoryReader = class {
+  storage;
+  constructor(storage2) {
+    this.storage = storage2;
+  }
+  /**
+   * The whole transcript as a SPARSE array indexed by entry index — the exact
+   * shape `MessageStore.entries` has, so callers can treat hot and cold
+   * sessions identically. Unparsable rows become holes, matching
+   * `rebuildStoreFromRows`.
+   */
+  async readAll(sessionId) {
+    const rows = await this.storage.agentSessions.getEntries(sessionId);
+    return parseRows(rows, sessionId);
+  }
+  /** `readAll` with holes dropped — the `getMessages` shape. */
+  async readDense(sessionId) {
+    return (await this.readAll(sessionId)).filter(Boolean);
+  }
+  /**
+   * Phase 1 reads the whole transcript and slices it in memory: correctness
+   * first, and the slicing logic stays the single implementation shared with
+   * hot sessions. Phase 2 replaces the body with paged `getEntriesBefore`
+   * queries plus one turn_end count — the signature is chosen to allow that
+   * without touching a single caller.
+   */
+  async readWindow(sessionId, historyEpoch, opts = {}) {
+    return buildHistoryWindow(await this.readAll(sessionId), historyEpoch, opts);
+  }
+  async readHead(sessionId, historyEpoch) {
+    return historyHead(await this.readAll(sessionId), historyEpoch);
+  }
+  /**
+   * One page of entries in descending index order, strictly before
+   * `beforeIndex` (null = the tail). The backward walk crash repair uses to
+   * find a turn boundary without reading the whole transcript.
+   */
+  async readBefore(sessionId, beforeIndex, limit) {
+    const rows = await this.storage.agentSessions.getEntriesBefore(sessionId, beforeIndex, limit);
+    return rows.map((row) => ({
+      entryIndex: row.entry_index,
+      message: parseRow(row.data)
+    }));
+  }
+};
+function parseRow(data) {
+  try {
+    return JSON.parse(data);
+  } catch {
+    return void 0;
+  }
+}
+function parseRows(rows, sessionIdForLog) {
+  const entries = [];
+  for (const row of rows) {
+    const message = parseRow(row.data);
+    if (message === void 0) {
+      console.error(`[SessionHistoryReader] Failed to parse entry ${row.entry_index} for session ${sessionIdForLog}`);
+      continue;
+    }
+    entries[row.entry_index] = message;
+  }
+  return entries;
+}
+
 // src/utils/worktree-paths.ts
 import path7 from "path";
 import { createHash } from "crypto";
@@ -230246,6 +230413,7 @@ ${details}`;
   return msg;
 }
 var SUMMARY_TEXT_CAP = 1500;
+var REPAIR_SCAN_BATCH = 64;
 function extractLastAssistantText(entries) {
   for (let i = entries.length - 1; i >= 0; i--) {
     const entry = entries[i];
@@ -230256,6 +230424,55 @@ function extractLastAssistantText(entries) {
   }
   return void 0;
 }
+var WS_OPEN = 1;
+function isSocketOpen(ws) {
+  return ws.readyState === void 0 || ws.readyState === WS_OPEN;
+}
+function replayPatchesFor(entries) {
+  const patches = [];
+  entries.forEach((message, index) => {
+    if (message !== void 0) patches.push(ConversationPatch.addEntry(index, message));
+  });
+  return patches;
+}
+function denseMessagesFromRows(rows) {
+  const messages = [];
+  for (const row of rows) {
+    try {
+      messages.push(JSON.parse(row.data));
+    } catch {
+    }
+  }
+  return messages;
+}
+function metaFromStore(store) {
+  let entryCount = 0;
+  let maxEntryIndex = -1;
+  store.entries.forEach((entry, index) => {
+    if (entry === void 0) return;
+    entryCount++;
+    if (index > maxEntryIndex) maxEntryIndex = index;
+  });
+  return { entryCount, maxEntryIndex };
+}
+function coldStore(maxEntryIndex) {
+  const indexProvider = new EntryIndexProvider(maxEntryIndex + 1);
+  return {
+    patches: [],
+    entries: [],
+    indexProvider,
+    toolTracker: new EntryTracker(indexProvider),
+    currentAssistantIndex: null
+  };
+}
+var SpawnSupersededError = class extends Error {
+  code = "spawn_superseded";
+  statusCode = 409;
+  constructor(sessionId) {
+    super(`Session ${sessionId} was restarted while its history was loading`);
+    this.name = "SpawnSupersededError";
+  }
+};
 var WorkspaceCheckoutUnavailableError = class extends Error {
   code = "workspace_checkout_unavailable";
   statusCode = 409;
@@ -230313,8 +230530,11 @@ var AgentSessionManager = class {
   /** Bound on a parked completion (injectable for tests). */
   parkTimeoutMs;
   workflowSuppressionCheck = null;
+  /** Every read of a cold session's transcript goes through here. */
+  reader;
   constructor(storage2, opts) {
     this.storage = storage2;
+    this.reader = new SessionHistoryReader(storage2);
     this.completionGraceMs = opts?.completionGraceMs ?? COMPLETION_GRACE_MS;
     this.parkTimeoutMs = opts?.parkTimeoutMs ?? PARK_TIMEOUT_MS;
   }
@@ -230471,6 +230691,154 @@ var AgentSessionManager = class {
     const session = this.sessions.get(sessionId);
     if (session) this.emitSessionTitle(session.projectId, session.branch, sessionId, title);
   }
+  // ============ History hydration (plan B §2) ============
+  /**
+   * Guard for the paths that may only run against an in-memory transcript:
+   * everything on the streaming write side (`stageEntry` and the stdout
+   * parsing chain behind it) plus the turn-boundary scans that read
+   * `store.entries` directly.
+   *
+   * They all sit behind invariant B1 — a session with a process is hot — so
+   * this should be unreachable. It throws rather than silently degrading
+   * because the failure mode it guards against is invisible: a cold session
+   * reads as a transcript of length zero, which would make a turn boundary
+   * resolve to a fabricated disposition instead of blowing up.
+   */
+  assertHot(session, operation) {
+    if (session.hot) return;
+    throw new Error(
+      `[AgentSession] ${operation} requires a hydrated session but ${session.id} is cold`
+    );
+  }
+  /**
+   * Load a cold session's transcript into memory ahead of spawning a process
+   * for it. The ONLY hydration path.
+   *
+   * @throws SpawnSupersededError if a restart overtook the caller's operation.
+   *   The caller must abort: not spawn, not append, not touch the session.
+   */
+  async hydrateForSpawn(session) {
+    const generation = session.clearGeneration;
+    if (!session.hot) {
+      if (!session.hydrating) {
+        session.hydrating = this.runOnHistoryChain(session, async () => {
+          if (session.hot) return;
+          const generationAtRead = session.clearGeneration;
+          const rows = await this.storage.agentSessions.getEntries(session.id);
+          if (session.clearGeneration !== generationAtRead || session.hot) return;
+          const store = this.rebuildStoreFromRows(rows, session.id);
+          session.store = store;
+          session.historyMeta = metaFromStore(store);
+          session.hot = true;
+        }).finally(() => {
+          session.hydrating = null;
+        });
+      }
+      await session.hydrating;
+    }
+    if (session.clearGeneration !== generation) throw new SpawnSupersededError(session.id);
+  }
+  /**
+   * Drop a session's transcript back to the database. Called at every point
+   * where a session stops owning a process — the four in plan §2.3 (process
+   * exit, Stop, hibernate, agent switch) plus `setModel` retiring an idle
+   * process. This is the whole of the memory-reclaim story: no sweeper and no
+   * idle threshold, because "does it have a process" is not a policy.
+   *
+   * A no-op for sessions that are already cold (a second Stop, a Stop on a
+   * session restored from disk) and for `skipDb` mirrors, which have no rows
+   * to read back.
+   */
+  unloadHistory(session, reason) {
+    if (!session.hot || session.skipDb) return;
+    if (session.chainPending > 0) {
+      this.enqueueSessionWork(
+        session,
+        async () => this.unloadHistoryNow(session, reason),
+        `unload:${reason}`
+      );
+      return;
+    }
+    this.unloadHistoryNow(session, reason);
+  }
+  unloadHistoryNow(session, reason) {
+    if (!session.hot || session.skipDb) return;
+    if (session.process !== null) {
+      console.warn(`[AgentSession] Refusing to unload ${session.id} (${reason}): process still attached`);
+      return;
+    }
+    if (session.processStartsInFlight > 0) {
+      return;
+    }
+    const meta3 = metaFromStore(session.store);
+    session.historyMeta = meta3;
+    session.store = coldStore(Math.max(meta3.maxEntryIndex, session.store.indexProvider.current() - 1));
+    session.hot = false;
+  }
+  /**
+   * Release the transcript when a spawn attempt ends without attaching a
+   * process — `ensureResidentCapacity` refusing at the cap, a checkout that
+   * vanished, a spawn that could not start.
+   *
+   * Without this, every rejected send on a dormant session loads a transcript
+   * that nothing will ever unload (the four unload points all hang off a
+   * process going away, and no process ever arrived). A user retrying against
+   * a full resident pool would walk the memory bound back up one session at a
+   * time — the exact failure this design exists to prevent.
+   *
+   * Must run AFTER the caller releases its `processStartsInFlight` claim: a
+   * second, still-committed start means the transcript has a new owner.
+   */
+  unloadIfSpawnAbandoned(session) {
+    if (session.process !== null || session.processStartsInFlight > 0) return;
+    this.unloadHistory(session, "spawn-abandoned");
+  }
+  /**
+   * Aggregate hydration counters for `memory-stats`. Aggregate-only and
+   * name-free by construction, like everything else on that endpoint.
+   *
+   * `hot_entries` is the number of transcript entries actually resident. It is
+   * the curve this whole design exists to flatten: before it, that number was
+   * every entry in the database; after it, it should track the number of live
+   * agent processes. No byte estimate is reported — measuring it means
+   * serializing the very heap we are trying not to touch, twelve times an hour.
+   */
+  hydrationStats() {
+    let hot = 0;
+    let hotEntries = 0;
+    for (const session of this.sessions.values()) {
+      if (!session.hot) continue;
+      hot++;
+      hotEntries += session.store.entries.filter(Boolean).length;
+    }
+    return { total: this.sessions.size, hot, cold: this.sessions.size - hot, hot_entries: hotEntries };
+  }
+  /** Dense messages (holes dropped), from memory when hot and storage when cold. */
+  async loadMessages(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) return [];
+    if (session.hot) return session.store.entries.filter(Boolean);
+    return this.reader.readDense(sessionId);
+  }
+  /** Sparse entries (holes preserved) — index space matches entry indices. */
+  async loadRawMessages(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) return [];
+    if (session.hot) return session.store.entries;
+    return this.reader.readAll(sessionId);
+  }
+  async loadHistoryWindow(sessionId, opts = {}) {
+    const session = this.sessions.get(sessionId);
+    if (!session) return null;
+    if (session.hot) return buildHistoryWindow(session.store.entries, session.historyEpoch, opts);
+    return this.reader.readWindow(sessionId, session.historyEpoch, opts);
+  }
+  async loadHistoryHead(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) return null;
+    if (session.hot) return historyHead(session.store.entries, session.historyEpoch);
+    return this.reader.readHead(sessionId, session.historyEpoch);
+  }
   isProcessAlive(session) {
     return !!session.process && session.process.exitCode === null && !session.dormant;
   }
@@ -230644,7 +231012,7 @@ var AgentSessionManager = class {
     }
     for (const session of this.sessions.values()) {
       if (session.projectId === projectId && session.branch === branch) {
-        console.log(`[findExisting] skipDb in-memory match: ${session.id} (entries=${session.store.entries.filter(Boolean).length})`);
+        console.log(`[findExisting] skipDb in-memory match: ${session.id} (entries=${this.historyEntryCount(session)})`);
         return this.reuseExistingSession(session, projectPath);
       }
     }
@@ -230838,6 +231206,11 @@ var AgentSessionManager = class {
       processStartsInFlight: 0,
       historyEpoch: stored?.history_epoch ?? 0,
       store,
+      // Born hot: a process is spawned for it a few lines below (B1).
+      hot: true,
+      historyMeta: metaFromStore(store),
+      hydrating: null,
+      clearGeneration: 0,
       subscribers: /* @__PURE__ */ new Set(),
       status: "running",
       buffer: "",
@@ -230851,6 +231224,8 @@ var AgentSessionManager = class {
       graceTimer: null,
       parkTimer: null,
       eventChain: Promise.resolve(),
+      chainPending: 0,
+      historyChain: Promise.resolve(),
       bgSpawnHintsThisTurn: 0,
       taskStartedThisTurn: 0,
       lastActiveAt: Date.now(),
@@ -230907,7 +231282,7 @@ var AgentSessionManager = class {
    * switch-mode route, which carries actual user intent.
    */
   async reuseExistingSession(session, projectPath) {
-    const entriesCount = session.store.entries.filter(Boolean).length;
+    const entriesCount = this.historyEntryCount(session);
     this.touchSession(session);
     if (session.dormant) {
       console.log(`[AgentSession] Returning dormant session ${session.id} (entries=${entriesCount})`);
@@ -230939,9 +231314,10 @@ var AgentSessionManager = class {
    * Uses negative PID to signal the process group (requires detached: true at spawn).
    */
   killProcess(proc, signal = "SIGTERM") {
-    if (!proc?.pid) return;
+    const pid = proc?.pid;
+    if (!proc || pid === void 0 || !Number.isSafeInteger(pid) || pid <= 1) return;
     try {
-      process.kill(-proc.pid, signal);
+      process.kill(-pid, signal);
     } catch {
       try {
         proc.kill(signal);
@@ -231073,6 +231449,7 @@ var AgentSessionManager = class {
         this.broadcastPatch(session.id, ConversationPatch.updateStatus(session.status));
         this.eventBus?.emit({ type: "session:status", projectId: session.projectId, branch: session.branch, sessionId: session.id, status: session.status });
         this.broadcastRaw(session.id, { finished: true });
+        this.unloadHistory(session, "process-exit");
       }, "process-close");
     });
     childProcess2.on("error", (error48) => {
@@ -231100,20 +231477,42 @@ var AgentSessionManager = class {
    * runs through here so steps never interleave across await points.
    */
   enqueueSessionWork(session, work, label) {
+    session.chainPending += 1;
     session.eventChain = session.eventChain.then(work).catch((err) => {
       console.error(`[AgentSession] Error in ${label} handler for ${session.id}:`, err);
+    }).then(() => {
+      session.chainPending -= 1;
     });
   }
+  /**
+   * Run `work` with exclusive access to the session's history, i.e. serialized
+   * against every other hydration and cold append for that session.
+   *
+   * Separate from `eventChain` on purpose — see `historyChain`'s declaration.
+   */
+  runOnHistoryChain(session, work) {
+    const result = session.historyChain.then(work);
+    session.historyChain = result.then(
+      () => void 0,
+      () => void 0
+    );
+    return result;
+  }
   /**
    * Same serial chain as `enqueueSessionWork`, for a caller that needs the
    * result back. The chain itself absorbs the outcome (success or failure) so
    * one queued step can never break the next; the caller gets the real promise.
    */
   runSerialForResult(session, work) {
+    session.chainPending += 1;
     const result = session.eventChain.then(work);
     session.eventChain = result.then(
-      () => void 0,
-      () => void 0
+      () => {
+        session.chainPending -= 1;
+      },
+      () => {
+        session.chainPending -= 1;
+      }
     );
     return result;
   }
@@ -231343,6 +231742,7 @@ var AgentSessionManager = class {
     }
     if (session.turnOpenSince === null && !outOfTurn && (event.type === "turn_started" || event.type === "text" || event.type === "thinking" || event.type === "tool_use" || event.type === "tool_result" || event.type === "approval_request")) {
       session.turnOpenSince = timestamp;
+      this.assertHot(session, "turn-open disposition");
       session.turnDisposition = resolveNotificationDisposition(findLatestUserEntry(session.store.entries));
     }
     if (session.status !== "running" && !outOfTurn && (event.type === "text" || event.type === "thinking" || event.type === "tool_use" || event.type === "tool_result" || event.type === "approval_request")) {
@@ -231606,15 +232006,40 @@ var AgentSessionManager = class {
    * the two persistence paths can't drift on index allocation or patch shape.
    */
   stageEntry(session, message) {
+    this.assertHot(session, "stageEntry");
     const index = session.store.indexProvider.next();
     session.store.entries[index] = message;
     const patch = ConversationPatch.addEntry(index, message);
     session.store.patches.push(patch);
     return { index, patch };
   }
+  /**
+   * Does this session have any transcript at all?
+   *
+   * Reads the store when hot and the metadata when cold, so it is correct in
+   * both states AND — the load-bearing half — never triggers a read. Retention
+   * and the discard compensator ask this of every candidate they consider; if
+   * the question could hydrate, one sweep would pull the whole database back
+   * into the heap that this design just emptied (§3.2).
+   *
+   * Deliberately NOT "historyMeta.entryCount > 0" in both states: keeping the
+   * counter exact through the streaming write paths (which allocate indices
+   * via `toolTracker.getOrCreate`, not only `stageEntry`) would be a new
+   * invariant spread across a dozen sites. While hot, the store is already the
+   * authority; `historyMeta` only has to be right at the moments it is read,
+   * which are all cold.
+   */
+  hasHistory(session) {
+    return session.hot ? session.store.entries.some((entry) => entry !== void 0) : session.historyMeta.entryCount > 0;
+  }
+  /** Entry count for logging — same hot/cold split as `hasHistory`, never reads. */
+  historyEntryCount(session) {
+    return session.hot ? session.store.entries.filter(Boolean).length : session.historyMeta.entryCount;
+  }
   async pushEntry(sessionId, message, broadcast = true, userId = "local", pushOpts) {
     const session = this.sessions.get(sessionId);
     if (!session) return -1;
+    if (!session.hot) return this.pushColdEntry(session, message, broadcast, userId, pushOpts);
     const { index, patch } = this.stageEntry(session, message);
     if (!session.skipDb && message.type !== "assistant") {
       await this.persistEntry(session, index, message, userId, { strict: pushOpts?.strictPersist });
@@ -231624,6 +232049,48 @@ var AgentSessionManager = class {
     }
     return index;
   }
+  /**
+   * Append to a session whose transcript is not in memory: allocate an index,
+   * write the row, advance the metadata, broadcast the patch. No store is
+   * built — a Stop note or an agent-switch note must not be a reason to pull a
+   * whole transcript into the heap.
+   *
+   * Callers do not choose this path; `pushEntry` picks it. That is what makes
+   * "stop a session restored from disk" and "switch the agent on a dormant
+   * session" work unchanged, which the previous design missed by giving only
+   * `switchAgentType` a bespoke cold-append helper.
+   *
+   * Runs on the session's history chain so it cannot interleave with a
+   * `hydrateForSpawn` and be dropped when that installs its snapshot (§3.3).
+   * It must NOT run on `eventChain`: an unload can land while a stdout chunk
+   * is mid-flight on that chain, so the chunk resumes against a session that
+   * went cold underneath it and appends from *inside* the chain. Queuing there
+   * would make that task wait for itself — the chain wedges, and because
+   * `hydrateForSpawn` used to queue on it too, the session could then never be
+   * woken again.
+   */
+  pushColdEntry(session, message, broadcast, userId, pushOpts) {
+    return this.runOnHistoryChain(session, async () => {
+      if (session.hot) {
+        const { index: index2, patch } = this.stageEntry(session, message);
+        if (!session.skipDb && message.type !== "assistant") {
+          await this.persistEntry(session, index2, message, userId, { strict: pushOpts?.strictPersist });
+        }
+        if (broadcast) this.broadcastPatch(session.id, patch);
+        return index2;
+      }
+      const index = session.store.indexProvider.next();
+      if (!session.skipDb && message.type !== "assistant") {
+        await this.persistEntry(session, index, message, userId, { strict: pushOpts?.strictPersist });
+      }
+      session.historyMeta = {
+        entryCount: session.historyMeta.entryCount + 1,
+        maxEntryIndex: Math.max(session.historyMeta.maxEntryIndex, index)
+      };
+      if (broadcast) this.broadcastPatch(session.id, ConversationPatch.addEntry(index, message));
+      return index;
+    });
+  }
   /**
    * Persist a `turn_end` together with the attention milestone it earns.
    *
@@ -231649,8 +232116,15 @@ var AgentSessionManager = class {
     if (entryIndexOverride !== void 0) {
       index = entryIndexOverride;
       patch = ConversationPatch.addEntry(index, message);
-    } else {
+    } else if (session.hot) {
       ({ index, patch } = this.stageEntry(session, message));
+    } else {
+      index = session.store.indexProvider.next();
+      session.historyMeta = {
+        entryCount: session.historyMeta.entryCount + 1,
+        maxEntryIndex: Math.max(session.historyMeta.maxEntryIndex, index)
+      };
+      patch = ConversationPatch.addEntry(index, message);
     }
     if (!session.skipDb) {
       const activityReader = this.storage.agentSessions.getActivityById;
@@ -231736,9 +232210,12 @@ var AgentSessionManager = class {
     if (session.turnOpenSince === null) return null;
     const endedAt = Date.now();
     const durationMs = endedAt - session.turnOpenSince;
-    const disposition = session.turnDisposition ?? resolveNotificationDisposition(
-      findTurnOpeningUserEntry(session.store.entries, session.store.entries.length)
-    );
+    let disposition = session.turnDisposition;
+    if (disposition === null) {
+      const entries = session.hot ? session.store.entries : await this.reader.readAll(session.id);
+      const beforeIndex = session.hot ? entries.length : session.historyMeta.maxEntryIndex + 1;
+      disposition = resolveNotificationDisposition(findTurnOpeningUserEntry(entries, beforeIndex));
+    }
     const index = await this.pushTurnEnd(session, outcome, disposition, endedAt, durationMs);
     session.turnOpenSince = null;
     session.turnDisposition = null;
@@ -231897,48 +232374,83 @@ var AgentSessionManager = class {
     }
   }
   /**
-   * Subscribe to session updates (WebSocket connection)
+   * Attach a client to a session's live stream and replay its history to it.
+   *
+   * Async since lazy hydration: a dormant session's transcript is read from
+   * storage here. The caller MUST register its `close` handler before
+   * awaiting — see `websocket-routes.ts` — or a user who closes the tab during
+   * that read leaves a dead socket in `subscribers` and a heartbeat running.
    */
-  subscribe(sessionId, ws, opts = {}) {
+  async subscribe(sessionId, ws, opts = {}) {
     const session = this.sessions.get(sessionId);
     if (!session) {
       return null;
     }
+    if (!isSocketOpen(ws)) return null;
     session.subscribers.add(ws);
-    const after = opts.historyEpoch === void 0 || opts.historyEpoch === session.historyEpoch ? opts.afterEntryIndex ?? -1 : -1;
-    ws.send(JSON.stringify({
-      HistorySync: {
-        historyEpoch: session.historyEpoch,
-        reset: opts.historyEpoch !== void 0 && opts.historyEpoch !== session.historyEpoch
-      }
-    }));
-    ws.send(JSON.stringify(this.backgroundTasksMessage(session)));
-    for (const patch of session.store.patches) {
-      const entryIndices = patch.flatMap((op) => {
-        const match2 = op.path.match(/^\/entries\/(\d+)$/);
-        return match2 ? [Number(match2[1])] : [];
-      });
-      if (entryIndices.length > 0 && entryIndices.every((index) => index <= after)) continue;
-      const msg = { JsonPatch: patch };
-      ws.send(JSON.stringify(msg));
-    }
-    ws.send(JSON.stringify({ Ready: true, historyEpoch: session.historyEpoch }));
-    const statusPatch = ConversationPatch.updateStatus(session.status);
-    ws.send(JSON.stringify({ JsonPatch: statusPatch }));
-    return () => {
+    const unsubscribe = () => {
       session.subscribers.delete(ws);
     };
+    for (let attempt = 0; ; attempt++) {
+      if (attempt >= 5) {
+        console.error(`[AgentSession] subscribe to ${sessionId} kept being invalidated; giving up`);
+        unsubscribe();
+        return null;
+      }
+      const generation = session.clearGeneration;
+      const after = opts.historyEpoch === void 0 || opts.historyEpoch === session.historyEpoch ? opts.afterEntryIndex ?? -1 : -1;
+      ws.send(JSON.stringify({
+        HistorySync: {
+          historyEpoch: session.historyEpoch,
+          reset: opts.historyEpoch !== void 0 && opts.historyEpoch !== session.historyEpoch
+        }
+      }));
+      ws.send(JSON.stringify(this.backgroundTasksMessage(session)));
+      const patches = session.hot ? session.store.patches : replayPatchesFor(await this.reader.readAll(sessionId));
+      if (!isSocketOpen(ws)) {
+        unsubscribe();
+        return null;
+      }
+      if (session.clearGeneration !== generation) continue;
+      for (const patch of patches) {
+        const entryIndices = patch.flatMap((op) => {
+          const match2 = op.path.match(/^\/entries\/(\d+)$/);
+          return match2 ? [Number(match2[1])] : [];
+        });
+        if (entryIndices.length > 0 && entryIndices.every((index) => index <= after)) continue;
+        const msg = { JsonPatch: patch };
+        ws.send(JSON.stringify(msg));
+      }
+      ws.send(JSON.stringify({ Ready: true, historyEpoch: session.historyEpoch }));
+      const statusPatch = ConversationPatch.updateStatus(session.status);
+      ws.send(JSON.stringify({ JsonPatch: statusPatch }));
+      return unsubscribe;
+    }
   }
   /**
-   * Get all messages for a session (reconstructed from patches)
+   * Get all messages for a session (reconstructed from patches).
+   *
+   * HOT SESSIONS ONLY — use `loadMessages` unless you know a process is
+   * attached. Throwing beats returning `[]` for a cold session: an empty
+   * transcript is a plausible-looking answer that would quietly corrupt
+   * whatever the caller does next.
    */
   getMessages(sessionId) {
     const session = this.sessions.get(sessionId);
-    return session?.store.entries.filter(Boolean) ?? [];
+    if (!session) return [];
+    this.assertHot(session, "getMessages");
+    return session.store.entries.filter(Boolean);
   }
-  /** Raw sparse entries (holes preserved) — index space matches entry indices. */
+  /**
+   * Raw sparse entries (holes preserved) — index space matches entry indices.
+   * Hot sessions only, same as `getMessages`; cold callers want
+   * `loadRawMessages`.
+   */
   getRawMessages(sessionId) {
-    return this.sessions.get(sessionId)?.store.entries ?? [];
+    const session = this.sessions.get(sessionId);
+    if (!session) return [];
+    this.assertHot(session, "getRawMessages");
+    return session.store.entries;
   }
   getHistoryEpoch(sessionId) {
     return this.sessions.get(sessionId)?.historyEpoch;
@@ -232043,6 +232555,7 @@ var AgentSessionManager = class {
           });
         }
       }
+      this.unloadHistory(session, "stop");
       return true;
     } catch (error48) {
       console.error(`[AgentSession] Failed to stop session:`, error48);
@@ -232113,6 +232626,7 @@ var AgentSessionManager = class {
         sessionId: session.id,
         status: "stopped"
       });
+      this.unloadHistory(session, "hibernate");
       return true;
     } catch (error48) {
       console.error(`[AgentSession] Failed to hibernate session:`, error48);
@@ -232202,7 +232716,7 @@ var AgentSessionManager = class {
     if (session?.skipDb) return retained("retained_skip_db");
     if ((this.userMessagesInFlight.get(sessionId) ?? 0) > 0) return retained("retained_in_flight");
     if (this.retentionDeleting.has(sessionId)) return retained("retained_deleting");
-    if (session?.store.entries.some((entry) => entry !== void 0)) return retained("retained_has_entries");
+    if (session && this.hasHistory(session)) return retained("retained_has_entries");
     this.retentionDeleting.add(sessionId);
     try {
       const deleted = await this.storage.agentSessions.deleteIfEmpty(sessionId);
@@ -232251,19 +232765,18 @@ var AgentSessionManager = class {
     this.killProcess(proc);
     this.emitProcessAlive(session, false);
     this.resetCompletion(session);
+    session.clearGeneration += 1;
+    session.store = coldStore(-1);
+    session.historyMeta = { entryCount: 0, maxEntryIndex: -1 };
+    session.hot = true;
+    session.buffer = "";
+    session.dormant = false;
     if (!session.skipDb) {
       await this.storage.agentSessions.deleteEntries(sessionId);
       session.historyEpoch = await this.storage.agentSessions.incrementHistoryEpoch(sessionId);
     } else {
       session.historyEpoch += 1;
     }
-    session.store.patches = [];
-    session.store.entries = [];
-    session.store.indexProvider.reset();
-    session.store.toolTracker.clear();
-    session.store.currentAssistantIndex = null;
-    session.buffer = "";
-    session.dormant = false;
     session.turnOpenSince = null;
     this.touchSession(session);
     this.broadcastRaw(sessionId, {
@@ -232304,8 +232817,7 @@ var AgentSessionManager = class {
     const session = this.sessions.get(sessionId);
     if (!session) return "not_found";
     if (session.agentType === agentType) return "ok";
-    const hasHistory = session.store.entries.some(Boolean);
-    if (session.status === "running" && hasHistory) return "busy";
+    if (session.status === "running" && this.hasHistory(session)) return "busy";
     console.log(`[AgentSession] Switching session ${sessionId} agent ${session.agentType} \u2192 ${agentType} (dormant, history preserved)`);
     const proc = session.process;
     session.process = null;
@@ -232337,6 +232849,7 @@ var AgentSessionManager = class {
       this.broadcastPatch(sessionId, ConversationPatch.updateStatus("stopped"));
       this.eventBus?.emit({ type: "session:status", projectId: session.projectId, branch: session.branch, sessionId: session.id, status: "stopped" });
     }
+    this.unloadHistory(session, "agent-switch");
     return "ok";
   }
   /**
@@ -232406,6 +232919,7 @@ var AgentSessionManager = class {
           this.broadcastPatch(sessionId, ConversationPatch.updateStatus("stopped"));
           this.eventBus?.emit({ type: "session:status", projectId: session.projectId, branch: session.branch, sessionId: session.id, status: "stopped" });
         }
+        this.unloadHistory(session, "model-change");
       }
       return "ok";
     });
@@ -232417,7 +232931,7 @@ var AgentSessionManager = class {
    * chip and the agent chip lock at different moments in the same header row.
    */
   isModelChangeTooLate(session) {
-    return session.status === "running" && session.store.entries.some(Boolean);
+    return session.status === "running" && this.hasHistory(session);
   }
   /**
    * Switch permission mode for a session (preserves conversation history)
@@ -232427,7 +232941,21 @@ var AgentSessionManager = class {
     if (!session) {
       return false;
     }
-    const absoluteWorktreePath = await this.resolveSessionWorktreePath(session, projectPath);
+    const release = this.beginProcessStart(session);
+    if (!release) {
+      console.log(`[AgentSession] Refusing to switch mode on ${sessionId}: retention is deleting it`);
+      return false;
+    }
+    try {
+      const absoluteWorktreePath = await this.resolveSessionWorktreePath(session, projectPath);
+      await this.hydrateForSpawn(session);
+      return await this.switchModeInner(session, sessionId, absoluteWorktreePath, newMode, initialMessage);
+    } finally {
+      release();
+      this.unloadIfSpawnAbandoned(session);
+    }
+  }
+  async switchModeInner(session, sessionId, absoluteWorktreePath, newMode, initialMessage) {
     console.log(`[AgentSession] Switching session ${sessionId} from ${session.permissionMode} to ${newMode}`);
     this.resetCompletion(session);
     const proc = session.process;
@@ -232561,10 +233089,12 @@ var AgentSessionManager = class {
       return true;
     } finally {
       release();
+      this.unloadIfSpawnAbandoned(session);
     }
   }
   async wakeDormantSessionInner(session, projectPath, userMessage, userId, origin, notificationDisposition) {
     const absoluteWorktreePath = await this.resolveSessionWorktreePath(session, projectPath);
+    await this.hydrateForSpawn(session);
     await this.ensureResidentCapacity(
       { projectId: session.projectId, branch: session.branch },
       { excludeSessionId: session.id }
@@ -232642,9 +233172,10 @@ var AgentSessionManager = class {
    * Crash repair (restore path): if the previous process died mid-turn, the
    * history has no closing turn_end — append one with outcome
    * "server_restart" and no duration (the crash time is unknown; the UI
-   * shows "interrupted" instead of a fabricated number). Runs BEFORE
-   * rebuildStoreFromRows so the store is built from the repaired rows.
-   * The other constructor of turn_end entries is endActiveTurn (live paths).
+   * shows "interrupted" instead of a fabricated number). Returns the session's
+   * updated history metadata, so restore accounts for the entry it wrote
+   * without re-reading. The other constructor of turn_end entries is
+   * endActiveTurn (live paths).
    *
    * Also records a turn_snapshots row at the repair index (mirrors
    * endActiveTurn's hook), capturing the worktree exactly as the crash left
@@ -232654,32 +233185,39 @@ var AgentSessionManager = class {
    * this runs on server boot for every restored session and must never
    * throw into the restore path.
    */
-  async repairInterruptedTurn(dbSession, rows) {
+  async repairInterruptedTurn(dbSession, meta3) {
     const sessionId = dbSession.id;
-    let landingType = null;
-    for (let i = rows.length - 1; i >= 0; i--) {
-      try {
-        const msg = JSON.parse(rows[i].data);
-        if (msg.type === "system") continue;
-        landingType = msg.type;
-      } catch {
-        landingType = "unparsable";
-      }
-      break;
-    }
-    if (landingType === null || landingType === "turn_end") return rows;
-    const maxIndex = rows.reduce((m2, r) => Math.max(m2, r.entry_index), -1);
-    const repairIndex = maxIndex + 1;
-    const entries = [];
-    for (const row of rows) {
-      try {
-        entries[row.entry_index] = JSON.parse(row.data);
-      } catch {
+    if (meta3.entryCount === 0) return meta3;
+    let landingType;
+    let opening;
+    let cursor = null;
+    let atBoundary = false;
+    while (!atBoundary) {
+      const batch = await this.reader.readBefore(sessionId, cursor, REPAIR_SCAN_BATCH);
+      if (batch.length === 0) break;
+      for (const { message } of batch) {
+        if (message === void 0) {
+          landingType ??= "unparsable";
+          continue;
+        }
+        if (landingType === void 0) {
+          if (message.type === "system") continue;
+          landingType = message.type;
+          if (landingType === "turn_end") return meta3;
+          if (message.type === "user") opening = message;
+          continue;
+        }
+        if (message.type === "turn_end") {
+          atBoundary = true;
+          break;
+        }
+        if (message.type === "user") opening = message;
       }
+      cursor = batch[batch.length - 1].entryIndex;
     }
-    const disposition = resolveNotificationDisposition(
-      findTurnOpeningUserEntry(entries, repairIndex)
-    );
+    if (landingType === void 0) return meta3;
+    const repairIndex = meta3.maxEntryIndex + 1;
+    const disposition = resolveNotificationDisposition(opening);
     const repair = {
       type: "turn_end",
       timestamp: Date.now(),
@@ -232719,27 +233257,42 @@ var AgentSessionManager = class {
     } catch (error48) {
       console.warn(`[AgentSession] Turn snapshot lookup failed for ${sessionId}@${repairIndex}:`, error48);
     }
-    return [...rows, { entry_index: repairIndex, data }];
+    return { entryCount: meta3.entryCount + 1, maxEntryIndex: repairIndex };
   }
   /**
    * Restore sessions from database on startup.
    * Creates dormant RunningSession objects with process=null for sessions that have entries.
+   *
+   * Restores IDENTITY AND METADATA ONLY — no transcripts. One aggregate query
+   * gives every session its entry count and highest index; the entries
+   * themselves stay in the database until something actually spawns a process
+   * for the session (`hydrateForSpawn`) or reads its history
+   * (`SessionHistoryReader`). That is what turns startup from O(all history)
+   * into O(session count): on the worker this plan was written for, 1385
+   * sessions were carrying 474 MiB of transcript that boot used to parse into
+   * the heap before the server would answer its first request.
    */
   async restoreSessionsFromDb() {
     const allSessions = await this.storage.agentSessions.getAll();
+    const entryMeta = new Map(
+      (await this.storage.agentSessions.getEntryMetaAll()).map((row) => [
+        row.session_id,
+        { entryCount: row.cnt, maxEntryIndex: row.max_index }
+      ])
+    );
     let restoredCount = 0;
     let zeroEntryRows = 0;
     for (const dbSession of allSessions) {
       if (this.sessions.has(dbSession.id)) continue;
-      let entries = await this.storage.agentSessions.getEntries(dbSession.id);
-      if (entries.length === 0) {
+      let meta3 = entryMeta.get(dbSession.id);
+      if (!meta3 || meta3.entryCount === 0) {
         zeroEntryRows++;
         continue;
       }
       if (dbSession.status === "running") {
-        entries = await this.repairInterruptedTurn(dbSession, entries);
+        meta3 = await this.repairInterruptedTurn(dbSession, meta3);
       }
-      const store = this.rebuildStoreFromRows(entries, dbSession.id);
+      const store = coldStore(meta3.maxEntryIndex);
       const permissionMode = dbSession.permission_mode === "plan" ? "plan" : "edit";
       const restoredCheckout = dbSession.workspace_checkout_id ? await this.storage.workspaceRegistry.getCheckoutById(dbSession.workspace_checkout_id) : void 0;
       const activityReader = this.storage.agentSessions.getActivityById;
@@ -232758,6 +233311,11 @@ var AgentSessionManager = class {
         processStartsInFlight: 0,
         historyEpoch: dbSession.history_epoch ?? 0,
         store,
+        // Restored cold: no process, so no transcript in memory (B1).
+        hot: false,
+        historyMeta: meta3,
+        hydrating: null,
+        clearGeneration: 0,
         subscribers: /* @__PURE__ */ new Set(),
         status: "stopped",
         buffer: "",
@@ -232771,6 +233329,8 @@ var AgentSessionManager = class {
         graceTimer: null,
         parkTimer: null,
         eventChain: Promise.resolve(),
+        chainPending: 0,
+        historyChain: Promise.resolve(),
         bgSpawnHintsThisTurn: 0,
         taskStartedThisTurn: 0,
         lastActiveAt: Date.now(),
@@ -232902,7 +233462,7 @@ var AgentSessionManager = class {
             existingRuntime.branchedFromEntryIndex = repairedEntryIndex;
           }
         }
-        return { ok: true, sessionId: newId };
+        return { ok: true, sessionId: newId, messages: denseMessagesFromRows(entryRows) };
       }
     }
     let inheritedCheckoutId = source?.workspaceCheckoutId ?? sourceRow?.workspace_checkout_id ?? void 0;
@@ -232952,7 +233512,11 @@ var AgentSessionManager = class {
     }
     await this.storage.agentSessions.updateTitle(newId, `Branch - ${baseTitle || "Conversation"}`);
     this.markTitleResolved(newId);
-    const store = this.rebuildStoreFromRows(entryRows, newId);
+    const branchedMeta = {
+      entryCount: entryRows.length,
+      maxEntryIndex: entryRows[entryRows.length - 1].entry_index
+    };
+    const store = coldStore(branchedMeta.maxEntryIndex);
     const branched = {
       id: newId,
       projectId,
@@ -232964,6 +233528,10 @@ var AgentSessionManager = class {
       processStartsInFlight: 0,
       historyEpoch: 0,
       store,
+      hot: false,
+      historyMeta: branchedMeta,
+      hydrating: null,
+      clearGeneration: 0,
       subscribers: /* @__PURE__ */ new Set(),
       status: "stopped",
       buffer: "",
@@ -232975,6 +233543,8 @@ var AgentSessionManager = class {
       graceTimer: null,
       parkTimer: null,
       eventChain: Promise.resolve(),
+      chainPending: 0,
+      historyChain: Promise.resolve(),
       bgSpawnHintsThisTurn: 0,
       taskStartedThisTurn: 0,
       lastActiveAt: Date.now(),
@@ -232988,7 +233558,7 @@ var AgentSessionManager = class {
     this.sessions.set(newId, branched);
     await this.emitDerivedBranchActivity(projectId, branch);
     console.log(`[AgentSession] branchSession: ${sourceSessionId} \u2192 ${newId} (entries=${entryRows.length}, agentType=${agentType})`);
-    return { ok: true, sessionId: newId };
+    return { ok: true, sessionId: newId, messages: denseMessagesFromRows(entryRows) };
   }
   /**
    * Kill all active session processes and clear state for graceful shutdown
@@ -235755,7 +236325,7 @@ var ChatSessionManager = class {
             agentSession = projectSessions.find((s3) => s3.status === "running") ?? projectSessions[0] ?? null;
           }
           if (agentSession) {
-            const allMessages = agentSessionManager.getMessages(agentSession.id);
+            const allMessages = await agentSessionManager.loadMessages(agentSession.id);
             const recent = allMessages.slice(-tailMessages);
             localResult = {
               sessionId: agentSession.id,
@@ -238231,7 +238801,7 @@ async function createProjectChatTools(options) {
             agentType: nullablePreview(local.agent_type, ENUM_CHAR_LIMIT),
             model: nullablePreview(local.model, MODEL_CHAR_LIMIT),
             processAlive: agentSessionManager.getSessionProcessAlive(local.id),
-            transcript: transcriptPreview(agentSessionManager.getMessages(local.id))
+            transcript: transcriptPreview(await agentSessionManager.loadMessages(local.id))
           };
           await touch("agent_session", local.id);
           return detail2;
@@ -240761,7 +241331,7 @@ var WorkflowEngine = class {
       if (sourceSession?.status === "running") {
         throw new WorkflowError("source-running", "source session \u6B63\u5728\u8FD0\u884C\uFF0C\u8BF7\u7B49\u5F85\u5F53\u524D turn \u5B8C\u6210\u540E\u518D\u53D1\u8D77 review");
       }
-      const entries = this.agentOps.getRawMessages(opts.sourceSessionId);
+      const entries = await this.agentOps.getRawMessages(opts.sourceSessionId);
       const turnEndIndex = opts.sourceTurnEndIndex ?? extractLatestTurnEndIndex(entries);
       if (turnEndIndex === null) {
         throw new WorkflowError("no-completed-turn", "source session \u8FD8\u6CA1\u6709\u5DF2\u5B8C\u6210\u7684 turn \u53EF\u4F9B review");
@@ -240945,7 +241515,7 @@ var WorkflowEngine = class {
     const pending = this.pendingActivations.get(runId) ?? parsePreparedContext(run2.prepared_context);
     let outcome;
     try {
-      const entries = pending ? null : this.agentOps.getRawMessages(run2.source_session_id);
+      const entries = pending ? null : await this.agentOps.getRawMessages(run2.source_session_id);
       const prompt = buildReviewerPrompt({
         taskContext: pending ? pending.taskContext : extractTaskContextBefore(entries, run2.source_turn_end_index),
         originalIntent: pending ? pending.originalIntent : extractFirstUserMessage(entries),
@@ -241002,7 +241572,7 @@ var WorkflowEngine = class {
     if (!p2 || p2.role !== "reviewer") return;
     const run2 = await this.storage.workflowRuns.getById(p2.runId);
     if (!run2 || run2.status !== "waiting_reviewer") return;
-    const entries = this.agentOps.getRawMessages(event.sessionId);
+    const entries = await this.agentOps.getRawMessages(event.sessionId);
     const boundary = event.turnEndEntryIndex ?? extractLatestTurnEndIndex(entries) ?? entries.length;
     const feedback = extractLastAssistantInTurn(entries, boundary) ?? "(reviewer \u6CA1\u6709\u8F93\u51FA\u53EF\u7528\u7684\u53CD\u9988\u6587\u672C)";
     let driftNote = null;
@@ -245234,7 +245804,8 @@ function collectMemoryStats(deps) {
       uptime_s: Math.round(process.uptime())
     },
     patch_cache: deps.remotePatchCache.stats(),
-    process_manager: deps.processManager.logBufferStats()
+    process_manager: deps.processManager.logBufferStats(),
+    ...deps.sessionHydration ? { agent_sessions: deps.sessionHydration.hydrationStats() } : {}
   };
 }
 var MemoryStatsReporter = class {
@@ -245617,7 +246188,7 @@ var sharedServices = async (fastify2, opts) => {
     sendUserMessage: (...args) => agentSessionManager.sendUserMessage(...args),
     setFinalSessionTitle: (sessionId, title) => agentSessionManager.setFinalSessionTitle(sessionId, title),
     switchMode: (sessionId, projectPath, mode) => agentSessionManager.switchMode(sessionId, projectPath, mode),
-    getRawMessages: (sessionId) => agentSessionManager.getRawMessages(sessionId),
+    getRawMessages: (sessionId) => agentSessionManager.loadRawMessages(sessionId),
     broadcastRawToSession: (sessionId, payload) => agentSessionManager.broadcastRawToSession(sessionId, payload)
   };
   const workflowEngine = new WorkflowEngine(opts.storage, reviewAgentOps);
@@ -245675,7 +246246,8 @@ var sharedServices = async (fastify2, opts) => {
   remoteNotificationSync.enqueue(() => remoteNotificationSync.syncAll({ includeExpired: true }));
   const memoryStatsReporter = new MemoryStatsReporter({
     remotePatchCache,
-    processManager
+    processManager,
+    sessionHydration: agentSessionManager
   });
   memoryStatsReporter.start();
   fastify2.addHook("onClose", async () => {
@@ -246267,7 +246839,8 @@ var routes4 = async (fastify2) => {
     if (!isOperatorRequest(request)) return reply.code(404).send({ error: "Not found" });
     return reply.send(collectMemoryStats({
       remotePatchCache: fastify2.remotePatchCache,
-      processManager: fastify2.processManager
+      processManager: fastify2.processManager,
+      sessionHydration: fastify2.agentSessionManager
     }));
   });
   fastify2.get("/api/admin/worker-version-stats", async (request, reply) => {
@@ -249401,48 +249974,9 @@ import { createHash as createHash7, randomUUID as randomUUID16 } from "crypto";
 // src/protocol/model-suggestions.ts
 var MODEL_SUGGESTIONS = {
   "claude-code": ["opus", "sonnet", "haiku", "fable"],
-  codex: ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5"]
+  codex: ["gpt-6-astra", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5"]
 };
 
-// src/session-history-window.ts
-function historyHead(entries, historyEpoch) {
-  let latestEntryIndex = null;
-  let lastTurnEndEntryIndex = null;
-  for (let index = entries.length - 1; index >= 0; index--) {
-    const message = entries[index];
-    if (!message) continue;
-    latestEntryIndex ??= index;
-    if (lastTurnEndEntryIndex === null && message.type === "turn_end") {
-      lastTurnEndEntryIndex = index;
-    }
-    if (latestEntryIndex !== null && lastTurnEndEntryIndex !== null) break;
-  }
-  return { historyEpoch, latestEntryIndex, lastTurnEndEntryIndex };
-}
-function buildHistoryWindow(entries, historyEpoch, opts = {}) {
-  const head = historyHead(entries, historyEpoch);
-  const endExclusive = Math.max(0, Math.min(opts.before ?? entries.length, entries.length));
-  const requestedTurns = Math.max(1, Math.min(opts.turns ?? 5, 20));
-  const boundaries = [];
-  for (let index = endExclusive - 1; index >= 0; index--) {
-    if (entries[index]?.type === "turn_end") boundaries.push(index);
-    if (boundaries.length >= requestedTurns + 2) break;
-  }
-  const startIndex = boundaries.length > requestedTurns + 1 ? boundaries[requestedTurns + 1] + 1 : 0;
-  const dense = [];
-  for (let index = startIndex; index < endExclusive; index++) {
-    const message = entries[index];
-    if (message) dense.push({ entryIndex: index, message });
-  }
-  const hasMore = startIndex > 0;
-  return {
-    ...head,
-    entries: dense,
-    previousCursor: hasMore ? startIndex : null,
-    hasMore
-  };
-}
-
 // src/routes/agent-session-routes.ts
 async function resolveProjectPath(projectId, storage2) {
   if (projectId.startsWith("path:")) {
@@ -249621,7 +250155,7 @@ var routes11 = async (fastify2) => {
     }
     const newSessionId = result.sessionId;
     const session = fastify2.agentSessionManager.getSession(newSessionId);
-    const messages = fastify2.agentSessionManager.getMessages(newSessionId);
+    const messages = result.messages;
     const dbRow = await fastify2.storage.agentSessions.getById(newSessionId);
     return {
       ok: true,
@@ -249698,9 +250232,10 @@ var routes11 = async (fastify2) => {
         return reply.code(200).send({ session: null, messages: [] });
       }
       const session = fastify2.agentSessionManager.getSession(sessionId);
-      const messages = fastify2.agentSessionManager.getMessages(sessionId);
       const epoch = fastify2.agentSessionManager.getHistoryEpoch(sessionId) ?? 0;
-      const historyWindow = historyTurns ? buildHistoryWindow(fastify2.agentSessionManager.getRawMessages(sessionId), epoch, { turns: historyTurns }) : void 0;
+      const rawMessages = await fastify2.agentSessionManager.loadRawMessages(sessionId);
+      const messages = rawMessages.filter(Boolean);
+      const historyWindow = historyTurns ? buildHistoryWindow(rawMessages, epoch, { turns: historyTurns }) : void 0;
       const projection = await fastify2.storage.agentSessions.getActivityById(sessionId, "session-detail");
       if (session?.workspaceCheckoutId && !projection) {
         return reply.code(409).send({
@@ -249866,7 +250401,7 @@ var routes11 = async (fastify2) => {
                 worktreePath: recovered?.checkoutPath ?? null,
                 processAlive: recovered ? fastify2.agentSessionManager.getSessionProcessAlive(recoveredSessionId) : false
               },
-              messages: fastify2.agentSessionManager.getMessages(recoveredSessionId)
+              messages: await fastify2.agentSessionManager.loadMessages(recoveredSessionId)
             });
           }
           return reply.code(200).send({
@@ -249883,7 +250418,7 @@ var routes11 = async (fastify2) => {
               processAlive: fastify2.agentSessionManager.getSessionProcessAlive(sessionId),
               ...sendBackFields(active)
             },
-            messages: fastify2.agentSessionManager.getMessages(sessionId)
+            messages: await fastify2.agentSessionManager.loadMessages(sessionId)
           });
         }
       }
@@ -250234,9 +250769,10 @@ var routes11 = async (fastify2) => {
         return reply.code(200).send({ session: null, messages: [] });
       }
       const session = fastify2.agentSessionManager.getSession(sessionId);
-      const messages = fastify2.agentSessionManager.getMessages(sessionId);
       const epoch = fastify2.agentSessionManager.getHistoryEpoch(sessionId) ?? 0;
-      const historyWindow = historyTurns ? buildHistoryWindow(fastify2.agentSessionManager.getRawMessages(sessionId), epoch, { turns: historyTurns }) : void 0;
+      const rawMessages = await fastify2.agentSessionManager.loadRawMessages(sessionId);
+      const messages = rawMessages.filter(Boolean);
+      const historyWindow = historyTurns ? buildHistoryWindow(rawMessages, epoch, { turns: historyTurns }) : void 0;
       const effectiveStatus = session?.status || "stopped";
       return reply.code(200).send({
         session: {
@@ -250420,7 +250956,7 @@ var routes11 = async (fastify2) => {
           error: "The workspace checkout binding for this session is unavailable"
         });
       }
-      const messages = fastify2.agentSessionManager.getMessages(req.params.sessionId);
+      const messages = await fastify2.agentSessionManager.loadMessages(req.params.sessionId);
       return reply.code(200).send({
         session: {
           id: session.id,
@@ -250492,9 +251028,10 @@ var routes11 = async (fastify2) => {
     }
     const session = fastify2.agentSessionManager.getSession(req.params.sessionId);
     if (!session) return reply.code(404).send({ error: "Session not found" });
-    const epoch = fastify2.agentSessionManager.getHistoryEpoch(req.params.sessionId) ?? 0;
+    const window2 = await fastify2.agentSessionManager.loadHistoryWindow(req.params.sessionId, { before, turns });
+    if (!window2) return reply.code(404).send({ error: "Session not found" });
     return reply.code(200).send({
-      ...buildHistoryWindow(fastify2.agentSessionManager.getRawMessages(req.params.sessionId), epoch, { before, turns }),
+      ...window2,
       status: session.status,
       session: {
         id: session.id,
@@ -250560,8 +251097,8 @@ var routes11 = async (fastify2) => {
       }
       const session = fastify2.agentSessionManager.getSession(req.params.sessionId);
       if (!session) return reply.code(404).send({ error: "Session not found" });
-      const epoch = fastify2.agentSessionManager.getHistoryEpoch(req.params.sessionId) ?? 0;
-      const head = buildHistoryWindow(fastify2.agentSessionManager.getRawMessages(req.params.sessionId), epoch, { turns: 1 });
+      const head = await fastify2.agentSessionManager.loadHistoryHead(req.params.sessionId);
+      if (!head) return reply.code(404).send({ error: "Session not found" });
       return reply.code(200).send({
         historyEpoch: head.historyEpoch,
         latestEntryIndex: head.latestEntryIndex,
@@ -250576,7 +251113,7 @@ var routes11 = async (fastify2) => {
       const session = fastify2.agentSessionManager.getSession(req.params.sessionId);
       if (!session) return reply.code(404).send({ error: "Session not found" });
       return reply.code(200).send({
-        messages: projectMessagesForBrief(fastify2.agentSessionManager.getMessages(req.params.sessionId))
+        messages: projectMessagesForBrief(await fastify2.agentSessionManager.loadMessages(req.params.sessionId))
       });
     }
   );
@@ -251385,6 +251922,16 @@ var routes11 = async (fastify2) => {
         `/api/agent-sessions/${remoteInfo.remoteSessionId}/favorite`,
         { favorited }
       );
+      if (result.ok) {
+        try {
+          await fastify2.storage.searchCache.updateCachedSessionFavorited(
+            req.params.sessionId,
+            favorited ? Date.now() : null
+          );
+        } catch (err) {
+          console.error("[API] searchCache.updateCachedSessionFavorited failed:", err);
+        }
+      }
       return reply.code(proxyStatus(result)).send(result.data);
     }
     const session = await fastify2.storage.agentSessions.getById(req.params.sessionId);
@@ -252467,17 +253014,19 @@ var RECENT_SESSION_LIMIT = 8;
 var RECENT_RUN_LIMIT = 5;
 var PRIORITY_TASK_LIMIT = 5;
 var ATTENTION_LIMIT = 10;
+var STARRED_LIMIT = 50;
 var parseDbTimestamp4 = (value) => {
   if (!value) return null;
   const explicitZone = /(?:Z|[+-]\d\d:\d\d)$/i.test(value);
   const parsed = Date.parse(explicitZone ? value : `${value.replace(" ", "T")}Z`);
   return Number.isNaN(parsed) ? null : parsed;
 };
-var mergeActivity = (local, remote, limit) => {
+var mergeBy = (local, remote, limit, rank) => {
   const byId = /* @__PURE__ */ new Map();
   for (const row of [...local, ...remote]) if (!byId.has(row.id)) byId.set(row.id, row);
-  return [...byId.values()].sort((left, right) => (right.lastActiveAt ?? 0) - (left.lastActiveAt ?? 0) || left.id.localeCompare(right.id)).slice(0, limit);
+  return [...byId.values()].sort((left, right) => rank(right) - rank(left) || left.id.localeCompare(right.id)).slice(0, limit);
 };
+var mergeActivity = (local, remote, limit) => mergeBy(local, remote, limit, (row) => row.lastActiveAt ?? 0);
 async function getProjectActivity(storage2, projectId, userId) {
   const [
     recentThreads,
@@ -252487,6 +253036,8 @@ async function getProjectActivity(storage2, projectId, userId) {
     priorityTasks,
     localAttentionSessions,
     remoteAttentionSessions,
+    localStarredSessions,
+    remoteStarredSessions,
     attentionRuns,
     runningSessions,
     runningRuns,
@@ -252500,6 +253051,8 @@ async function getProjectActivity(storage2, projectId, userId) {
     storage2.tasks.listPriorityByProject(projectId, PRIORITY_TASK_LIMIT),
     storage2.agentSessions.listAttentionActivityByProject(projectId, ATTENTION_LIMIT, "project-activity"),
     storage2.searchCache.listRemoteSessionAttentionByProject(projectId, ATTENTION_LIMIT, "project-activity"),
+    storage2.agentSessions.listFavoritedActivityByProject(projectId, STARRED_LIMIT + 1, "project-activity"),
+    storage2.searchCache.listRemoteSessionFavoritesByProject(projectId, STARRED_LIMIT + 1, "project-activity"),
     storage2.scheduledTaskRuns.getAttentionByProject(projectId, ATTENTION_LIMIT),
     storage2.agentSessions.countRunningActivityByProject(projectId),
     storage2.scheduledTaskRuns.countByProjectStatuses(projectId, ["starting", "running"]),
@@ -252516,6 +253069,14 @@ async function getProjectActivity(storage2, projectId, userId) {
     remoteAttentionSessions,
     ATTENTION_LIMIT
   );
+  const starredProbe = mergeBy(
+    localStarredSessions,
+    remoteStarredSessions,
+    STARRED_LIMIT + 1,
+    (row) => row.favoritedAt ?? 0
+  );
+  const starredHasMore = starredProbe.length > STARRED_LIMIT;
+  const starredSessions = starredProbe.slice(0, STARRED_LIMIT);
   const attention = [
     ...attentionSessions.map((session) => ({
       type: "agent_session",
@@ -252540,6 +253101,8 @@ async function getProjectActivity(storage2, projectId, userId) {
   return {
     recentThreads,
     recentAgentSessions,
+    starredSessions,
+    starredHasMore,
     recentScheduleRuns,
     priorityTasks,
     attention,
@@ -253113,7 +253676,7 @@ async function routes21(fastify2) {
         if (!historyResult.ok) return void 0;
         messages = historyResult.data.messages ?? [];
       } else {
-        messages = fastify2.agentSessionManager.getMessages(sourceSessionId);
+        messages = await fastify2.agentSessionManager.loadMessages(sourceSessionId);
       }
       return await generateIntentBrief(fastify2.storage, resolveUserId(userId), messages) ?? void 0;
     } catch (err) {
@@ -254854,14 +255417,12 @@ var routes24 = async (fastify2) => {
           });
           return;
         }
-        const unsubscribe = fastify2.agentSessionManager.subscribe(sessionId, socket, { afterEntryIndex, historyEpoch });
-        if (!unsubscribe) {
-          console.log(`[AgentWS] Session ${sessionId} not found`);
+        let unsubscribe = null;
+        socket.on("close", () => {
+          console.log(`[AgentWS] Client disconnected from session ${sessionId}`);
           stopHeartbeat();
-          socket.send(JSON.stringify({ error: "Session not found" }));
-          socket.close();
-          return;
-        }
+          unsubscribe?.();
+        });
         socket.on("message", (data) => {
           try {
             const message = JSON.parse(data.toString());
@@ -254874,11 +255435,21 @@ var routes24 = async (fastify2) => {
             console.error("[AgentWS] Failed to parse message:", error48);
           }
         });
-        socket.on("close", () => {
-          console.log(`[AgentWS] Client disconnected from session ${sessionId}`);
+        unsubscribe = await fastify2.agentSessionManager.subscribe(
+          sessionId,
+          socket,
+          { afterEntryIndex, historyEpoch }
+        );
+        if (!unsubscribe) {
+          console.log(`[AgentWS] Session ${sessionId} unavailable for subscribe`);
           stopHeartbeat();
-          unsubscribe?.();
-        });
+          try {
+            socket.send(JSON.stringify({ error: "Session not found" }));
+            socket.close();
+          } catch {
+          }
+          return;
+        }
       }
     );
     fastify2.get(