@volter/supercode-teams 0.3.150 → 0.3.152

package/mail/sqlite.mjs

@@ -0,0 +1,353 @@
+// The machine daemon's mail database. Only its owner opens a writable handle;
+// clients use the machine socket. This module contains no harness or delivery IO.
+import { EventEmitter } from 'node:events';
+import { createRequire } from 'node:module';
+import { chmodSync, closeSync, mkdirSync, openSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+export const MAIL_SCHEMA_VERSION = 2;
+export const MAIL_RETENTION = Object.freeze({
+  bodyDays: 30,
+  maxReadHeaders: 1_000_000,
+  maxCarrierRows: 10_000,
+  maxTerminalLogRows: 10_000,
+});
+export const RETAINED_BODY = `[this message's body was let go after ${MAIL_RETENTION.bodyDays} days (mail retention); its header and thread are kept]`;
+
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS mail_metadata (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+) STRICT;
+CREATE TABLE IF NOT EXISTS mailboxes (
+  address TEXT PRIMARY KEY,
+  folder TEXT NOT NULL UNIQUE
+) STRICT;
+CREATE TABLE IF NOT EXISTS messages (
+  mailbox TEXT NOT NULL REFERENCES mailboxes(address),
+  id TEXT NOT NULL,
+  thread TEXT NOT NULL,
+  sender TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  subject TEXT,
+  created_at_ms INTEGER NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('new', 'claimed', 'cur')),
+  header TEXT NOT NULL CHECK (json_valid(header)),
+  body TEXT,
+  first_line TEXT NOT NULL,
+  body_expired_at_ms INTEGER,
+  read_at_ms INTEGER,
+  claim_pid INTEGER,
+  claim_token TEXT,
+  PRIMARY KEY (mailbox, id),
+  CHECK ((state = 'claimed') = (claim_pid IS NOT NULL AND claim_token IS NOT NULL))
+) STRICT;
+CREATE INDEX IF NOT EXISTS messages_inbox ON messages(mailbox, state, created_at_ms, id);
+CREATE INDEX IF NOT EXISTS messages_mailbox_time ON messages(mailbox, created_at_ms, id);
+CREATE INDEX IF NOT EXISTS messages_mailbox_kind_time ON messages(mailbox, kind, created_at_ms, id);
+CREATE INDEX IF NOT EXISTS messages_mailbox_thread_time ON messages(mailbox, thread, created_at_ms, id);
+CREATE INDEX IF NOT EXISTS messages_id ON messages(id, mailbox);
+CREATE INDEX IF NOT EXISTS messages_thread ON messages(thread, created_at_ms, id);
+CREATE INDEX IF NOT EXISTS messages_parent ON messages(json_extract(header, '$.in_reply_to'), id, mailbox);
+CREATE INDEX IF NOT EXISTS messages_sender ON messages(sender, created_at_ms, id);
+CREATE INDEX IF NOT EXISTS messages_created ON messages(created_at_ms, sender, kind, id);
+CREATE INDEX IF NOT EXISTS messages_retention ON messages(state, created_at_ms);
+CREATE TABLE IF NOT EXISTS claims (
+  mailbox TEXT NOT NULL,
+  message TEXT NOT NULL,
+  record TEXT NOT NULL CHECK (json_valid(record)),
+  PRIMARY KEY (mailbox, message),
+  FOREIGN KEY (mailbox, message) REFERENCES messages(mailbox, id) ON DELETE CASCADE
+) STRICT;
+CREATE TABLE IF NOT EXISTS deliveries (
+  mailbox TEXT NOT NULL,
+  message TEXT NOT NULL,
+  due_at_ms INTEGER NOT NULL,
+  attempts INTEGER NOT NULL,
+  record TEXT NOT NULL CHECK (json_valid(record)),
+  PRIMARY KEY (mailbox, message),
+  FOREIGN KEY (mailbox, message) REFERENCES messages(mailbox, id) ON DELETE CASCADE
+) STRICT;
+CREATE INDEX IF NOT EXISTS deliveries_due ON deliveries(due_at_ms, mailbox, message);
+CREATE TABLE IF NOT EXISTS subscriptions (
+  mailbox TEXT NOT NULL,
+  message TEXT NOT NULL,
+  record TEXT NOT NULL CHECK (json_valid(record)),
+  PRIMARY KEY (mailbox, message),
+  FOREIGN KEY (mailbox, message) REFERENCES messages(mailbox, id) ON DELETE CASCADE
+) STRICT;
+CREATE TABLE IF NOT EXISTS mail_records (
+  collection TEXT NOT NULL,
+  key TEXT NOT NULL,
+  record TEXT NOT NULL CHECK (json_valid(record)),
+  updated_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (collection, key)
+) STRICT;
+CREATE INDEX IF NOT EXISTS mail_thread_holder
+  ON mail_records(json_extract(record, '$.holder')) WHERE collection = 'threads';
+CREATE INDEX IF NOT EXISTS mail_thread_agent
+  ON mail_records(json_extract(record, '$.agent')) WHERE collection = 'threads';
+CREATE TABLE IF NOT EXISTS thread_markers (
+  collection TEXT NOT NULL DEFAULT 'threads' CHECK (collection = 'threads'),
+  thread TEXT NOT NULL,
+  marker TEXT NOT NULL,
+  message TEXT NOT NULL CHECK (json_valid(message)),
+  PRIMARY KEY (thread, marker),
+  FOREIGN KEY (collection, thread) REFERENCES mail_records(collection, key) ON DELETE CASCADE
+) STRICT;
+CREATE INDEX IF NOT EXISTS thread_marker_lookup ON thread_markers(marker, thread);
+CREATE TABLE IF NOT EXISTS sent_messages (
+  sender_key TEXT NOT NULL,
+  id TEXT NOT NULL,
+  recipient TEXT NOT NULL,
+  thread TEXT,
+  at_ms INTEGER NOT NULL,
+  record TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(record) AND json_type(record) = 'object'),
+  PRIMARY KEY (sender_key, id, recipient)
+) STRICT;
+CREATE INDEX IF NOT EXISTS sent_messages_id ON sent_messages(id);
+CREATE TABLE IF NOT EXISTS carrier_log (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  at_ms INTEGER NOT NULL,
+  record TEXT NOT NULL CHECK (json_valid(record))
+) STRICT;
+CREATE TABLE IF NOT EXISTS terminal_log (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  recipient TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  record TEXT NOT NULL CHECK (json_valid(record))
+) STRICT;
+CREATE INDEX IF NOT EXISTS terminal_log_recipient ON terminal_log(recipient, sequence);
+CREATE TABLE IF NOT EXISTS mail_import_errors (
+  source TEXT PRIMARY KEY,
+  mailbox TEXT,
+  detail TEXT NOT NULL,
+  critical INTEGER NOT NULL DEFAULT 0 CHECK (critical IN (0, 1))
+) STRICT;
+CREATE TABLE IF NOT EXISTS mail_import_sources (
+  source TEXT PRIMARY KEY,
+  sha256 TEXT NOT NULL,
+  purged INTEGER NOT NULL DEFAULT 0 CHECK (purged IN (0, 1))
+) STRICT;
+`;
+
+function sqlite() {
+  const [major, minor] = process.versions.node.split('.').map(Number);
+  if (major < 22 || (major === 22 && minor < 13)) throw new Error(`the machine daemon's mail needs Node 22.13.0 or later; this is ${process.version}`);
+  return createRequire(import.meta.url)('node:sqlite');
+}
+
+/** A separate exclusive SQLite transaction is held for the owner's lifetime.
+ * The filesystem releases it on process exit. No PID-file deletion or stale
+ * PID guess can admit two writable mail handles for the same home. */
+export class MailOwner {
+  constructor(path) {
+    const { DatabaseSync } = sqlite();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    closeSync(openSync(path, 'a', 0o600));
+    chmodSync(path, 0o600);
+    this.connection = new DatabaseSync(path);
+    try {
+      this.connection.exec('PRAGMA journal_mode = DELETE; PRAGMA busy_timeout = 0; BEGIN EXCLUSIVE;');
+    } catch (error) {
+      this.connection.close();
+      throw new Error(`mail at ${dirname(path)} already has an owner or cannot acquire its filesystem lock: ${error.message}`);
+    }
+  }
+  close() { this.connection.close(); }
+}
+
+/** A synchronous transaction cannot encompass a native-door await. Persist its
+ * intent, commit, await the door, then persist the observed result separately. */
+export class MailDatabase extends EventEmitter {
+  constructor(path, { retention = MAIL_RETENTION } = {}) {
+    super();
+    this.path = path;
+    this.retention = { ...MAIL_RETENTION, ...retention };
+    for (const [name, value] of Object.entries(this.retention)) {
+      if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`mail retention ${name} must be a positive integer`);
+    }
+    // Resolve only when the daemon opens mail. Other CLI doors can still report
+    // their own requirements without failing at module import on an older Node.
+    const { DatabaseSync } = sqlite();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    closeSync(openSync(path, 'a', 0o600));
+    chmodSync(path, 0o600);
+    this.connection = new DatabaseSync(path);
+    this.statements = new Map();
+    this.depth = 0;
+    this.pending = [];
+    try {
+      let storedVersion = null;
+      const tables = this.connection.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all();
+      if (tables.some(({ name }) => name === 'mail_metadata')) {
+        const stored = this.connection.prepare('SELECT value FROM mail_metadata WHERE key = ?').get('schema_version');
+        storedVersion = stored ? JSON.parse(stored.value) : null;
+        if (storedVersion !== 1 && storedVersion !== MAIL_SCHEMA_VERSION) throw new Error(`mail schema ${storedVersion} is not supported by this release`);
+      } else if (tables.length) throw new Error(`the database at ${path} has no mail schema receipt; its schema has not been changed`);
+      const mode = this.connection.prepare('PRAGMA journal_mode = WAL').get();
+      if (String(mode.journal_mode).toLowerCase() !== 'wal') throw new Error(`mail database cannot use WAL at ${path}`);
+      this.connection.exec('PRAGMA synchronous = FULL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 2000;');
+      this.transaction(() => {
+        this.connection.exec(SCHEMA);
+        // The private first candidate stored only the four legacy send fields.
+        // Add the complete record before publishing the upgraded schema receipt.
+        if (storedVersion === 1 && !this.connection.prepare('PRAGMA table_info(sent_messages)').all().some(({ name }) => name === 'record')) {
+          this.connection.exec("ALTER TABLE sent_messages ADD COLUMN record TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(record) AND json_type(record) = 'object');");
+        }
+        this.setMetadata('schema_version', MAIL_SCHEMA_VERSION);
+      });
+    } catch (error) {
+      this.connection.close();
+      throw error;
+    }
+  }
+
+  statement(sql) {
+    if (this.closed) throw new Error('the mail database is closed; no write or native action is resumed');
+    if (!this.statements.has(sql)) this.statements.set(sql, this.connection.prepare(sql));
+    return this.statements.get(sql);
+  }
+
+  transaction(operation) {
+    if (this.closed) throw new Error('the mail database is closed');
+    const depth = this.depth;
+    const pending = this.pending.length;
+    this.connection.exec(depth ? `SAVEPOINT mail_${depth}` : 'BEGIN IMMEDIATE');
+    this.depth++;
+    let value;
+    try {
+      value = operation();
+      if (value?.then instanceof Function) throw new Error('mail database transactions must be synchronous');
+      this.connection.exec(depth ? `RELEASE mail_${depth}` : 'COMMIT');
+    } catch (error) {
+      this.pending.length = pending;
+      this.connection.exec(depth ? `ROLLBACK TO mail_${depth}; RELEASE mail_${depth}` : 'ROLLBACK');
+      throw error;
+    } finally {
+      this.depth--;
+    }
+    if (!depth) {
+      const events = this.pending.splice(0);
+      for (const event of events) this.#notify(event.topic, event.key);
+    }
+    return value;
+  }
+
+  changed(topic, key) {
+    if (!this.listenerCount(topic)) return;
+    if (this.depth) this.pending.push({ topic, key });
+    else this.#notify(topic, key);
+  }
+
+  #notify(topic, key) {
+    // A caller may set the delivery's grace deadline immediately after creating
+    // its wake. Notify after that write, as the former filesystem event did.
+    setImmediate(() => { if (!this.closed) this.emit(topic, key); });
+  }
+
+  metadata(key) {
+    const found = this.statement('SELECT value FROM mail_metadata WHERE key = ?').get(key);
+    return found ? JSON.parse(found.value) : null;
+  }
+
+  setMetadata(key, value) {
+    this.statement('INSERT INTO mail_metadata(key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(key, JSON.stringify(value));
+  }
+
+  record(collection, key) {
+    const row = this.statement('SELECT record FROM mail_records WHERE collection = ? AND key = ?').get(collection, key);
+    return row ? JSON.parse(row.record) : null;
+  }
+
+  records(collection) {
+    return this.statement('SELECT key, record, updated_at_ms FROM mail_records WHERE collection = ? ORDER BY key').all(collection)
+      .map((row) => ({ key: row.key, value: JSON.parse(row.record), updated_at_ms: row.updated_at_ms }));
+  }
+
+  putRecord(collection, key, value, { create = false, at = Date.now() } = {}) {
+    const sql = create
+      ? 'INSERT INTO mail_records(collection, key, record, updated_at_ms) VALUES (?, ?, ?, ?) ON CONFLICT(collection, key) DO NOTHING'
+      : 'INSERT INTO mail_records(collection, key, record, updated_at_ms) VALUES (?, ?, ?, ?) ON CONFLICT(collection, key) DO UPDATE SET record = excluded.record, updated_at_ms = excluded.updated_at_ms';
+    return this.transaction(() => {
+      const changed = this.statement(sql).run(collection, key, JSON.stringify(value), at).changes > 0;
+      if (changed && collection === 'threads') {
+        this.statement('DELETE FROM thread_markers WHERE thread = ?').run(key);
+        const add = this.statement('INSERT INTO thread_markers(thread, marker, message) VALUES (?, ?, ?)');
+        for (const [marker, message] of Object.entries(value.markers ?? {})) add.run(key, marker, JSON.stringify(message));
+      }
+      if (changed) this.changed('record', { collection, key });
+      return changed;
+    });
+  }
+
+  removeRecord(collection, key) {
+    const changed = this.statement('DELETE FROM mail_records WHERE collection = ? AND key = ?').run(collection, key).changes > 0;
+    if (changed) this.changed('record', { collection, key });
+    return changed;
+  }
+
+  appendCarrier(record) {
+    return this.transaction(() => {
+      this.statement('INSERT INTO carrier_log(at_ms, record) VALUES (?, ?)').run(Date.now(), JSON.stringify(record));
+      this.statement('DELETE FROM carrier_log WHERE sequence <= (SELECT sequence FROM carrier_log ORDER BY sequence DESC LIMIT 1 OFFSET ?)').run(this.retention.maxCarrierRows);
+    });
+  }
+
+  /** Only settled read mail is eligible. Pending deliveries, subscriptions and
+   * claim holders protect their originals; an unresolved message never loses its body. */
+  retain(now = Date.now()) {
+    const cutoff = now - this.retention.bodyDays * 86_400_000;
+    return this.transaction(() => {
+      const expired = this.statement(`UPDATE messages SET body = NULL, first_line = '', body_expired_at_ms = ?
+        WHERE state = 'cur' AND created_at_ms < ? AND body IS NOT NULL
+        AND NOT EXISTS (SELECT 1 FROM deliveries d WHERE d.mailbox = messages.mailbox AND d.message = messages.id)
+        AND NOT EXISTS (SELECT 1 FROM subscriptions s WHERE s.mailbox = messages.mailbox AND s.message = messages.id)`)
+        .run(now, cutoff).changes;
+      // Completed native questions duplicate an envelope and its answer input.
+      // Keep the claim/binding/header so a repeat cannot submit another answer,
+      // but let go of those text copies after the mailbox copies have expired.
+      const questions = this.statement(`UPDATE mail_records AS r SET record = json_set(
+        json_remove(record, '$.native', '$.answers'), '$.envelope.body', ?, '$.body_expired_at_ms', ?)
+        WHERE collection = 'native_questions' AND json_type(record, '$.envelope') = 'object'
+        AND json_type(record, '$.body_expired_at_ms') IS NULL
+        AND json_extract(record, '$.envelope.created_at_ms') < ?
+        AND EXISTS (SELECT 1 FROM mail_records d WHERE d.collection = 'native_questions'
+          AND d.key = substr(r.key, 1, instr(r.key, '.') - 1) || '.delivered' AND CAST(d.record AS INTEGER) < ?)
+        AND NOT EXISTS (SELECT 1 FROM mail_records w WHERE w.collection = 'native_questions'
+          AND w.key = substr(r.key, 1, instr(r.key, '.') - 1) || '.waiting')
+        AND NOT EXISTS (SELECT 1 FROM messages m WHERE m.id = json_extract(r.record, '$.envelope.id') AND m.body IS NOT NULL)`)
+        .run(RETAINED_BODY, now, cutoff, cutoff).changes;
+      const relayRecords = this.statement(`DELETE FROM mail_records AS r WHERE collection = 'relays'
+        AND (key LIKE '%/turn.txt' OR key LIKE '%/receipt.json') AND updated_at_ms < ?
+        AND NOT EXISTS (SELECT 1 FROM mail_records q WHERE q.collection = 'relays'
+          AND q.key = substr(r.key, 1, instr(r.key, '/')) || 'queue.json')`).run(cutoff).changes;
+      const launchInputs = this.statement(`UPDATE mail_records SET record = json_set(
+        json_remove(record, '$.initialInput', '$.claudeInput.text'), '$.input_body_expired_at_ms', ?)
+        WHERE collection = 'native_launches' AND json_type(record, '$.input_body_expired_at_ms') IS NULL
+        AND json_type(record, '$.input_settled_at_ms') = 'integer'
+        AND json_extract(record, '$.input_settled_at_ms') < ?
+        AND (json_type(record, '$.initialInput') = 'text' OR json_type(record, '$.claudeInput.text') = 'text')`)
+        .run(now, cutoff).changes;
+      const removed = this.statement(`DELETE FROM messages WHERE (mailbox, id) IN (
+        SELECT mailbox, id FROM messages m WHERE state = 'cur' AND body_expired_at_ms IS NOT NULL
+        AND NOT EXISTS (SELECT 1 FROM deliveries d WHERE d.mailbox = m.mailbox AND d.message = m.id)
+        AND NOT EXISTS (SELECT 1 FROM subscriptions s WHERE s.mailbox = m.mailbox AND s.message = m.id)
+        ORDER BY created_at_ms DESC, id DESC LIMIT -1 OFFSET ?)`)
+        .run(this.retention.maxReadHeaders).changes;
+      const result = { at_ms: now, expired_bodies: expired, expired_question_records: questions,
+        removed_relay_text_records: relayRecords, expired_launch_inputs: launchInputs, removed_headers: removed, policy: this.retention };
+      this.setMetadata('retention', result);
+      if (expired || questions || relayRecords || launchInputs || removed) this.changed('retention', result);
+      return result;
+    });
+  }
+
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.removeAllListeners();
+    this.statements.clear();
+    this.connection.close();
+  }
+}

package/mail/transcript.mjs

@@ -2,7 +2,7 @@
 // lines its own user typed, the lines it took from its harness's own channels, its answers, and when each filed message
 // first reached the model. The mailbox records a message as sent; only the transcript records it delivered. A transcript
 // is read only when a call names the message or the session it is about (one named read, never a sweep).
-import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { readdirSync, statSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { blake3Hex } from './envelope.mjs';
@@ -234,10 +234,10 @@ export async function readCodex(path) {
 }
 
 /** The transcript of the session at `address` on this machine, when its harness's records are read here. */
-export function transcriptPath(address, { claudeProjects, mailRoot }) {
+export function transcriptPath(address, { claudeProjects, store }) {
   const [, , harness, sessionId] = String(address).split(':');
   if (harness === 'codex') {
-    try { return JSON.parse(readFileSync(join(mailRoot, 'native-questions', `binding-${blake3Hex(address)}.json`), 'utf8')).transcript_path ?? null; }
+    try { return store.record('native_questions', `binding-${blake3Hex(address)}.json`)?.transcript_path ?? null; }
     catch { return null; }
   }
   if (harness !== 'claude-code') return null;

package/mail/upkeep.mjs

@@ -9,32 +9,32 @@
 // The first and the last follow the live map's changes; the copying passes every TYPED_EVERY_MS while any agent is
 // declared, reading only a transcript written since its cursor.
 import { spawn } from 'node:child_process';
-import { readFileSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { statSync } from 'node:fs';
 import { blake3Hex } from './envelope.mjs';
 import { envelope as makeEnvelope, makeAddress } from './compose.mjs';
 import { TYPED_ID_PREFIX, readClaude, transcriptPath, typedLineId } from './transcript.mjs';
-import { writeAtomically } from './agents.mjs';
 
 const SESSION_THREAD_PREFIX = 's-';
 const TYPED_EVERY_MS = 10_000;
+const MAX_COPY_BATCH = 256;
+const yieldTurn = () => new Promise((resolve) => setImmediate(resolve));
 
 export class AgentUpkeep {
   /** `agents` the agents' records; `live` the live-session map; `lastMessageAt(address)` when a session last spoke (its
    *  index row); `program` the supercode a session is ended with. */
   constructor({ machine, mailRoot, store, agents, live, claudeProjects, lastMessageAt, program, env, log = () => {} }) {
     Object.assign(this, { machine, mailRoot, store, agents, live, claudeProjects, lastMessageAt, program, env, log });
-    this.typedDir = join(mailRoot, 'agents', 'typed');
+    this.stopped = false;
     this.running = new Set();
   }
 
   start() {
-    let pending = null;
-    this.live.on('changed', () => {
-      if (pending) return;
-      pending = setTimeout(() => { pending = null; void this.#once('sessions', () => this.registerFolderSessions().then(() => this.closeIdleThreads())); }, 1000);
-      pending.unref?.();
-    });
+    this.onLive = () => {
+      if (this.stopped || this.pending) return;
+      this.pending = setTimeout(() => { this.pending = null; void this.#once('sessions', () => this.registerFolderSessions().then(() => this.closeIdleThreads())); }, 1000);
+      this.pending.unref?.();
+    };
+    this.live.on('changed', this.onLive);
     this.timer = setInterval(() => void this.#once('typed', () => this.copyTypedLines()), TYPED_EVERY_MS);
     this.timer.unref?.();
     // an idle thread's bound passes with no change to the map: checked once a minute as well
@@ -43,10 +43,10 @@ export class AgentUpkeep {
     return this;
   }
 
-  stop() { clearInterval(this.timer); clearInterval(this.idleTimer); }
+  stop() { this.stopped = true; this.live.off('changed', this.onLive); clearTimeout(this.pending); clearInterval(this.timer); clearInterval(this.idleTimer); }
 
   async #once(key, work) {
-    if (this.running.has(key)) return;
+    if (this.stopped || this.running.has(key)) return;
     this.running.add(key);
     try { await work(); } catch (error) { this.log(`agent upkeep: ${key}: ${error.message}`); } finally { this.running.delete(key); }
   }
@@ -58,6 +58,7 @@ export class AgentUpkeep {
     if (!agents.length) return;
     const holders = new Set(this.agents.threads().map((thread) => thread.holder));
     for (const session of this.live.sessions()) {
+      if (this.stopped) return;
       if (!session.cwd) continue;
       const agent = agents.find((item) => item.folder === session.cwd && item.main_session !== session.address);
       if (!agent || holders.has(session.address)) continue;
@@ -69,7 +70,7 @@ export class AgentUpkeep {
     }
   }
 
-  #cursorPath(address) { return join(this.typedDir, blake3Hex(address).slice(0, 24)); }
+  #cursorKey(address) { return blake3Hex(address).slice(0, 24); }
 
   /** Each line typed into an agent's session since the last pass, copied to who is CC on it; a session seen the first
    *  time starts from now, so its history is not copied. */
@@ -82,39 +83,58 @@ export class AgentUpkeep {
     for (const thread of threads) if (!sessions.some(([address]) => address === thread.holder)) sessions.push([thread.holder, thread.agent]);
     const now = Date.now();
     for (const [session, agentName] of sessions) {
-      const cursorPath = this.#cursorPath(session);
-      let cursor = null;
-      try { cursor = Number(readFileSync(cursorPath, 'utf8').trim()); } catch { /* first seen */ }
-      if (!Number.isFinite(cursor)) { writeAtomically(cursorPath, String(now)); continue; }
+      if (this.stopped) return;
+      const cursorKey = this.#cursorKey(session);
+      const previous = this.store.record('agent_typed', cursorKey);
+      const cursor = previous == null ? null : Number(previous);
+      if (!Number.isFinite(cursor)) { this.store.putRecord('agent_typed', cursorKey, String(now)); continue; }
       // a transcript not written since the last pass has no new line
-      const path = transcriptPath(session, { claudeProjects: this.claudeProjects(), mailRoot: this.mailRoot });
+      const path = transcriptPath(session, { claudeProjects: this.claudeProjects(), store: this.store });
       if (path) { try { if (statSync(path).mtimeMs <= cursor) continue; } catch { /* not there: nothing new */ } }
       // a Claude session's lines are read from its transcript; a Codex session's were filed in its mailbox by its hook
       let lines;
       if (session.split(':')[2] === 'codex') {
-        lines = this.store.inventory(session).stored
-          .filter((item) => item.envelope.kind === 'user' && item.envelope.id.startsWith(TYPED_ID_PREFIX) && item.envelope.created_at_ms > cursor)
+        lines = this.store.typedSince(session, cursor, TYPED_ID_PREFIX)
           .map((item) => { const whole = this.store.body(item); return [item.envelope.created_at_ms, whole?.body ?? '']; });
       } else {
         if (!path) continue;
         const mail = await readClaude(path).catch(() => null);
+        if (this.stopped) return;
         if (!mail) continue;
         lines = mail.typed.filter((line) => !line.withdrawn && line.sent_at_ms > cursor).map((line) => [line.sent_at_ms, line.text]);
       }
       if (!lines.length) continue;
-      const newest = Math.max(...lines.map(([at]) => at));
+      let newest = cursor;
+      for (const [at] of lines) newest = Math.max(newest, at);
       // the newest thread this session holds as a delegate (its agent's main session is another: mail_agent.rs `delegated`)
       const held = [...threads].reverse().find((thread) => thread.holder === session && this.agents.load(thread.agent)?.main_session !== thread.holder);
       const receivers = held ? held.participants.filter((p) => p.role === 'cc' && p.address !== session).map((p) => p.address) : [];
       if (accountManager && agentName !== accountManager.name && !receivers.includes(accountManager.main_session)) receivers.push(accountManager.main_session);
       const from = makeAddress(session.split(':')[1], 'operator', 'typed');
+      let copies = [];
+      const flush = (complete = false) => {
+        this.store.transaction(() => {
+          for (const [receiver, copy] of copies) this.store.deliver(receiver, copy);
+          // Partial batches retain the old cursor. Stable ids make their
+          // committed copies harmless to repeat after a failed later batch.
+          if (complete) this.store.putRecord('agent_typed', cursorKey, String(newest));
+        });
+        copies = [];
+      };
       for (const [sentAt, text] of lines) {
+        if (this.stopped) return;
         const copy = makeEnvelope({ id: typedLineId(session, sentAt, text), created_at_ms: sentAt, from, from_name: `typed into ${session} (unattributed)`,
           kind: 'typed', reply_via: { mode: 'none' }, thread: held?.id ?? null, body: text });
-        // a copy that cannot be filed is said, never dropped in silence
-        for (const receiver of receivers) { try { this.store.deliver(receiver, copy); } catch (error) { this.log(`agent upkeep: the line typed into ${session} was not copied to ${receiver}: ${error.message}`); } }
+        for (const receiver of receivers) {
+          copies.push([receiver, copy]);
+          if (copies.length === MAX_COPY_BATCH) {
+            flush();
+            await yieldTurn();
+            if (this.stopped) return;
+          }
+        }
       }
-      writeAtomically(cursorPath, String(newest));
+      flush(true);
     }
   }
 
@@ -127,12 +147,12 @@ export class AgentUpkeep {
     const live = this.live.sessions();
     const now = Date.now();
     for (const [thread, minutes] of launched) {
+      if (this.stopped) return;
       const session = live.find((row) => row.address === thread.holder);
       if (!session || session.status !== 'idle') continue;
       const last = this.lastMessageAt(thread.holder);
       if (!Number.isFinite(last)) continue;
-      let resumed = 0;
-      try { resumed = Number(readFileSync(join(this.mailRoot, 'agents', 'resumed', blake3Hex(thread.holder).slice(0, 24)), 'utf8').trim()) || 0; } catch { /* never resumed */ }
+      const resumed = Number(this.store.record('agent_resumed', blake3Hex(thread.holder).slice(0, 24))) || 0;
       if (now - Math.max(last, resumed) < minutes * 60_000) continue;
       await new Promise((done) => {
         const child = spawn(this.program, ['close', thread.holder], { env: this.env, stdio: 'ignore' });

package/mail/verbs.mjs

@@ -1,8 +1,8 @@
 // An agent's verbs (docs/architecture/overview.md, "The mail operations", 3b-2): reading a conversation (`message
 // thread`), listing an agent's threads (`message threads`), handing a root to a new session of the agent (`message
 // delegate`), and declaring or showing an agent (`supercode agent declare|show`), answered by the daemon as
-// crates/cli/src/message.rs answered them, their texts kept. Each read answers from the header index; a body is read from
-// its one file when its message is shown.
+// crates/cli/src/message.rs answered them, their texts kept. Each read answers from indexed headers; a body is read from
+// its database row when its message is shown.
 import { spawn } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import { realpathSync } from 'node:fs';
@@ -33,42 +33,15 @@ export class AgentVerbs {
    * Answers `{ code, rows, rendered }` or `{ code, text }`.
    */
   thread(id) {
-    const all = new Map(); // id → { address, stored }
-    for (const address of this.store.addresses()) {
-      for (const stored of this.store.inventory(address).stored) if (!all.has(stored.envelope.id)) all.set(stored.envelope.id, { address, stored });
-    }
-    const matches = [...all.keys()].filter((key) => key.startsWith(id));
-    if (matches.length !== 1) return { code: EXIT_UNKNOWN, text: `${id} names ${matches.length} messages here; give one message's id.` };
-    // up to the root: the oldest ancestor filed here
-    let root = matches[0];
-    const seen = new Set();
-    for (;;) {
-      const parent = all.get(root)?.stored.envelope.in_reply_to;
-      if (!parent || !all.has(parent) || seen.has(parent)) break;
-      seen.add(parent); root = parent;
-    }
-    const threadOfRoot = threadOf(all.get(root).stored.envelope);
-    // down from the root: every reply, and every message naming the same thread
-    const children = new Map();
-    for (const [key, { stored }] of all) {
-      const parent = stored.envelope.in_reply_to;
-      if (parent) children.set(parent, [...(children.get(parent) ?? []), key]);
-    }
-    const members = new Set();
-    const queue = [root, ...[...all].filter(([, { stored }]) => stored.envelope.thread === threadOfRoot).map(([key]) => key)];
-    while (queue.length) {
-      const next = queue.pop();
-      if (members.has(next)) continue;
-      members.add(next);
-      queue.push(...(children.get(next) ?? []));
-    }
-    const conversation = [...members].map((key) => all.get(key)).map(({ address, stored }) => ({ address, stored: this.#whole(stored) })).filter((item) => item.stored)
+    const { matches, messages } = this.store.conversation(id);
+    if (matches !== 1) return { code: EXIT_UNKNOWN, text: `${id} names ${matches} messages here; give one message's id.` };
+    const conversation = messages.map(({ address, stored }) => ({ address, stored: this.#whole(stored) })).filter((item) => item.stored)
       .sort((a, b) => a.stored.envelope.created_at_ms - b.stored.envelope.created_at_ms);
     const deliveries = new Map();
     return {
       code: 0,
-      rows: conversation.map(({ address, stored }) => messageRow(address, stored, deliveries, this.mailRoot)),
-      rendered: conversation.map(({ address, stored }) => `To ${address}:\n${listed(stored.envelope, deliveries, this.mailRoot)}\n`),
+      rows: conversation.map(({ address, stored }) => messageRow(address, stored, deliveries, this.store)),
+      rendered: conversation.map(({ address, stored }) => `To ${address}:\n${listed(stored.envelope, deliveries, this.store)}\n`),
     };
   }
 
@@ -104,6 +77,7 @@ export class AgentVerbs {
    * found in the live-session map by the pane it opened in, within a minute.
    */
   async openSession(program, directory, key, input, ready) {
+    if (this.stopped) throw new Error('the daemon is stopping; no agent session was opened');
     const stem = String(program).split(/[\\/]/).pop().replace(/\.[^.]*$/, '');
     const claude = stem === 'claude' || stem === 'claude-code';
     let known = null;
@@ -117,6 +91,7 @@ export class AgentVerbs {
       extra.push('--', '--session-id', id);
       await ready(known);
     }
+    if (this.stopped) throw new Error('the daemon is stopping; no agent session was opened');
     const run = await new Promise((resolve) => {
       const child = spawn(this.supercodeBin, ['--cwd', directory, 'open', '--new', program, '--key', key, '--input', input, '--detach', ...extra], { stdio: ['ignore', 'pipe', 'pipe'], env: this.env });
       let out = '', err = '';
@@ -136,18 +111,22 @@ export class AgentVerbs {
     try {
       const started = Date.now();
       while (Date.now() - started < 60_000) {
+        if (this.stopped) throw new Error(`the daemon stopped while opening pane ${pane}; its launch is unconfirmed`);
         const session = this.live.sessions().find((row) => this.paneOf(row) === pane);
         if (session) { await ready(session.address); return session.address; }
         await sleep(500);
       }
       throw new Error(`${program} started in pane ${pane}, but no session appeared there within a minute; its pane is closed`);
     } catch (error) {
+      if (this.stopped) throw error;
       if (reused) { error.message = error.message.replace('; its pane is closed', `; its pane ${pane} was opened before, and is left open`); throw error; }
       try { await this.closePane(pane); } catch (closing) { error.message += ` (its pane ${pane} could not be closed: ${closing.message})`; }
       throw error;
     }
   }
 
+  stop() { this.stopped = true; }
+
   /**
    * Hand a root the caller received as an agent's main session to a new session of the agent (message.rs `delegate`):
    * it opens in a pane with the root, holds the thread (every reply wakes it), and main stays CC. Answers `{ code, text }`.
@@ -170,8 +149,7 @@ export class AgentVerbs {
     const input = `You are a session of agent ${agent.name}, holding its thread ${shownRoot}. Read it: supercode message thread ${shownRoot}. Answer in it with supercode message reply <id>; what you send stays in this thread, and ${agent.name}'s main session is CC on it.`;
     // the new session holds the thread and has its messages before it starts, so its first turn finds its root
     const handOver = async (holder) => {
-      for (const line of this.store.inventory(caller).stored) {
-        if (threadOf(line.envelope) !== thread.id) continue;
+      for (const line of this.store.threadIn(caller, thread.id)) {
         const whole = this.#whole(line);
         if (!whole) continue;
         // a line typed into main's terminal reaches the holder as one typed in another session (`typed`, ADR 0008)