cc-viewer 1.7.1 → 1.7.3

package/server/lib/v2/live-feed.js

@@ -22,12 +22,15 @@
 // through log-watcher's processWatchedEntry pipeline — the same enrichment,
 // reconstruction and side-events the v1 tail produced.
 
-import { watch, existsSync, readdirSync, statSync, openSync, readSync, closeSync } from 'node:fs';
+import { watch, existsSync, readdirSync, readFileSync, statSync, openSync, readSync, closeSync } from 'node:fs';
 import { join } from 'node:path';
 import { reportSwallowed } from '../error-report.js';
 import { createIncrementalReconstructor } from '../delta-reconstructor.js';
 import { processWatchedEntry, sendEventToClients, sendEventRawToClients } from '../log-watcher.js';
 import { SessionSynthesizer } from './adapter.js';
+import { isDiscardableSession } from './session-select.js';
+import { isForeignLiveOwned } from './session-owner.js';
+import { isConvertRunning } from './convert-manager.js';
 import { computeCacheLoss } from './meta-rows.js';
 import { classifyRequest } from '../../../src/utils/requestType.js';
 
@@ -37,12 +40,33 @@ const DEFER_MS = 3000;          // synthesizer park deadline (lagging lines)
 const ATTACH_RECENT_MS = 5 * 60 * 1000; // pre-existing dirs considered "live"
 const TICK_RETRY_MS = 250;      // in-process tick raced the first queue drain
 const TICK_RETRY_MAX = 8;
+// Idle cursor eviction: a followed dir whose journal hasn't moved for this
+// long is detached, freeing its synthesizer/reconstructor state (a migration
+// can promote hundreds of dirs at once — holding all of them pins ~the whole
+// project in heap). Re-attach self-heals via the safety poll's mtime-bump
+// scan or the leader's tick() (both suppress history on a seen dir).
+const IDLE_EVICT_MS = 10 * 60 * 1000;
 
-/** Read newly appended complete lines from a file cursor {path, offset,
- *  pending}. Returns an array of raw line strings (possibly empty). A file
+const READ_CHUNK_BYTES = 8 * 1024 * 1024;
+// Node's max string length (~512MiB) — a longer line can never be decoded.
+const MAX_LINE_BYTES = 0x1fffffe8;
+
+/** Read newly appended complete lines from a file cursor {path, offset}
+ *  (partial-line carry lives on lazily-initialized _pendBufs/_pendBytes/
+ *  _skipLine cursor fields). Returns an array of raw line strings (possibly
+ *  empty). A file
  *  that shrank (should never happen — v2 files are append-only) returns null
- *  so the caller can rebuild the cursor. */
-function readNewLines(cursor) {
+ *  so the caller can rebuild the cursor.
+ *
+ *  Chunked + byte-level newline split (issue #129 twin): the first attach to
+ *  a session seeds from offset 0, so one whole-file read + decode would throw
+ *  ERR_STRING_TOO_LONG on an oversized journal and crash-loop the boot path
+ *  exactly like the cold-scan crash the streaming reader fixed. The partial
+ *  tail line is carried on the cursor as Buffer fragments (never decoded
+ *  until its newline lands); a single line past the string cap is skipped
+ *  with a report instead of thrown. Exported for tests (chunkBytes seam).
+ */
+export function readNewLines(cursor, chunkBytes = READ_CHUNK_BYTES, maxLineBytes = MAX_LINE_BYTES) {
   let size;
   try {
     size = statSync(cursor.path).size;
@@ -51,23 +75,74 @@ function readNewLines(cursor) {
   }
   if (size < cursor.offset) return null;
   if (size === cursor.offset) return [];
-  const toRead = size - cursor.offset;
-  const buf = Buffer.alloc(toRead);
+  if (cursor._pendBufs === undefined) {
+    cursor._pendBufs = [];
+    cursor._pendBytes = 0;
+    cursor._skipLine = false;
+  }
+  const out = [];
   let fd;
   try {
     fd = openSync(cursor.path, 'r');
-    readSync(fd, buf, 0, toRead, cursor.offset);
+    const chunk = Buffer.alloc(Math.min(chunkBytes, size - cursor.offset));
+    while (cursor.offset < size) {
+      const toRead = Math.min(chunk.length, size - cursor.offset);
+      const n = readSync(fd, chunk, 0, toRead, cursor.offset);
+      if (n === 0) break;
+      cursor.offset += n;
+      const view = chunk.subarray(0, n);
+      let from = 0;
+      while (from < n) {
+        const nl = view.indexOf(10, from);
+        if (nl === -1) {
+          if (!cursor._skipLine) {
+            const restLen = n - from;
+            if (cursor._pendBytes + restLen > maxLineBytes) {
+              cursor._skipLine = true;
+              cursor._pendBufs = [];
+              cursor._pendBytes = 0;
+              reportSwallowed('v2-live.read-line-too-long', new Error(`${cursor.path}: line exceeds ${maxLineBytes} bytes — skipped`));
+            } else {
+              // chunk is reused next readSync — the carried slice must own its bytes
+              cursor._pendBufs.push(Buffer.from(view.subarray(from)));
+              cursor._pendBytes += restLen;
+            }
+          }
+          break;
+        }
+        if (cursor._skipLine) {
+          cursor._skipLine = false; // the oversized line ends at this newline
+        } else {
+          const seg = view.subarray(from, nl);
+          let text = null;
+          try {
+            if (cursor._pendBufs.length > 0) {
+              cursor._pendBufs.push(seg);
+              text = Buffer.concat(cursor._pendBufs).toString('utf-8');
+            } else {
+              text = seg.toString('utf-8');
+            }
+          } catch (err) {
+            reportSwallowed('v2-live.read-line-too-long', err);
+          }
+          cursor._pendBufs = [];
+          cursor._pendBytes = 0;
+          if (text !== null) {
+            const t = text.trim();
+            if (t) out.push(t);
+          }
+        }
+        from = nl + 1;
+      }
+    }
   } catch (err) {
+    // Deliver what was already parsed; offset only advanced past read bytes,
+    // so the next poll resumes from the failure point.
     reportSwallowed('v2-live.read', err);
-    return [];
   } finally {
     if (fd !== undefined) { try { closeSync(fd); } catch { /* already closed */ } }
   }
-  cursor.offset = size;
-  const chunk = cursor.pending + buf.toString('utf-8');
-  const parts = chunk.split('\n');
-  cursor.pending = parts.pop() || '';
-  return parts.map((l) => l.trim()).filter(Boolean);
+  return out;
 }
 
 export class V2LiveFeed {
@@ -82,7 +157,11 @@ export class V2LiveFeed {
    * @param {number} [opts.safetyPollMs] - 0 disables the timer (tests drive
    *   _safetyTick manually)
    * @param {number} [opts.deferMs]
+   * @param {number} [opts.idleEvictMs] - 0 disables idle cursor eviction (tests)
    * @param {Function} [opts.now]
+   * @param {Function} [opts.isConvertRunningFn] - injection seam (tests)
+   * @param {Function} [opts.isForeignLiveOwnedFn] - injection seam (tests):
+   *   (dir) => boolean, defaults to session-owner's isForeignLiveOwned
    */
   constructor(opts = {}) {
     this._clients = opts.clients || [];
@@ -92,13 +171,21 @@ export class V2LiveFeed {
     this._watchImpl = opts.watchImpl || watch;
     this._safetyPollMs = typeof opts.safetyPollMs === 'number' ? opts.safetyPollMs : SAFETY_POLL_MS;
     this._deferMs = typeof opts.deferMs === 'number' ? opts.deferMs : DEFER_MS;
+    this._idleEvictMs = typeof opts.idleEvictMs === 'number' ? opts.idleEvictMs : IDLE_EVICT_MS;
     this._now = opts.now || Date.now;
+    this._isConvertRunning = opts.isConvertRunningFn || isConvertRunning;
+    // Claim owners are compared against THIS process's pid: the feed must
+    // co-reside with its V2Writer in one process (worker_threads would still
+    // share the pid; moving the feed into a forked CHILD process would make
+    // every own dir look foreign and break single-window live-follow).
+    this._isForeignLiveOwned = opts.isForeignLiveOwnedFn || isForeignLiveOwned;
     // Wire v3 (V3.S2): when on, every emitted item ALSO broadcasts a metadata
     // row (v2_requests_delta). Explicit ctor param — this module has no access
     // to the server deps object.
     this._wireV3 = !!opts.wireV3;
     this._sessions = new Map(); // dir → cursor bundle
     this._seenDirs = new Map(); // dir → last observed journal mtimeMs (attached or not)
+    this._discardGated = new Set(); // dirs refused by the discard gate — first real attach must NOT suppress history
     this._sessionsRoot = null;
     this._rootWatcher = null;
     this._safetyTimer = null;
@@ -126,6 +213,7 @@ export class V2LiveFeed {
     for (const cur of this._sessions.values()) this._closeCursor(cur);
     this._sessions.clear();
     this._seenDirs.clear();
+    this._discardGated.clear();
     this._sessionsRoot = null;
   }
 
@@ -138,7 +226,12 @@ export class V2LiveFeed {
     if (!this._active || !sessionDir) return;
     let cur = this._sessions.get(sessionDir);
     if (!cur) {
-      cur = this._attach(sessionDir, { suppressExisting: false });
+      // A dir we have ALREADY seen re-attaching through tick() is an idle
+      // eviction (or a watcher loss) resuming — its backlog is history and
+      // must be seeded suppressed, or the re-attach replays the whole session
+      // through the broadcast path (the exact OOM this module was fixed for).
+      // Only a genuinely never-seen dir emits from byte 0.
+      cur = this._attach(sessionDir, { suppressExisting: this._seenDirs.has(sessionDir) });
       if (!cur) {
         if (_retries < TICK_RETRY_MAX) {
           setTimeout(() => this.tick(sessionDir, _retries + 1), TICK_RETRY_MS);
@@ -246,6 +339,59 @@ export class V2LiveFeed {
   _attach(dir, { suppressExisting }) {
     if (this._sessions.has(dir)) return this._sessions.get(dir);
     if (!existsSync(join(dir, 'journal.jsonl'))) return null;
+    // Multi-window isolation: a dir exclusively claimed by ANOTHER live ccv
+    // window (owner.lock, pid-liveness validity) never enters this feed — its
+    // traffic belongs to that window. Checked BEFORE the discard gate so a
+    // foreign dir never lands in _discardGated (whose delete side-effect would
+    // flip suppressExisting to false on a later attach and flood clients with
+    // the whole foreign history). Re-evaluated on every attach attempt — no
+    // persistent gate set — so a dead owner's claim stops mattering the
+    // moment its pid dies. Own dirs (tick path) and unclaimed teammate/IM
+    // dirs pass through untouched.
+    if (this._isForeignLiveOwned(dir)) return null;
+    // Discardable sessions (quota-probe orphans — no main/teammate req, no
+    // meta.leader) are never followed: single choke point, every attach path
+    // (_initialScan / _maybeAttachNew / tick / _safetyTick / _rebuildCursor)
+    // funnels here and handles null. Self-healing when a dir later gains its
+    // first main: the leader's own dir re-attaches via tick's retry chain
+    // (sub-second); cross-process dirs via the 5s safety poll's mtime-bump
+    // scan (_seenDirs bookkeeping stays in the callers, so the bump fires).
+    if (isDiscardableSession(dir)) {
+      this._discardGated.add(dir);
+      return null;
+    }
+    // A dir previously refused by the discard gate is attaching for the FIRST
+    // time — its first renderable turn was never broadcast, so the safety
+    // poll's suppressExisting:true (meant for "old stale dir resumed") must
+    // not swallow it: cross-process producers (IM worker, second ccv) have no
+    // cold-load fallback for a connected client.
+    if (this._discardGated.delete(dir)) suppressExisting = false;
+    // Migration output is dead history: converted sessions (meta origin:
+    // 'convert') have no producer and never append again, yet a promote
+    // renames dozens of them into sessions/ at once with fresh birthtimes —
+    // full-history seeding synthesized + JSON-round-tripped every entry of
+    // every promoted session inside the safety-poll/debounce timers (the
+    // 4GB main-thread OOM). Seek their cursors to EOF instead: nothing is
+    // read, cloned, or broadcast; the cold-load channel owns their history.
+    let convertOrigin = false;
+    try {
+      const meta = JSON.parse(readFileSync(join(dir, 'meta.json'), 'utf-8'));
+      convertOrigin = !!meta && meta.origin === 'convert';
+    } catch (err) {
+      // meta.json is written synchronously BEFORE the journal's first async
+      // drain (ensureSessionDirSync), so journal-present + meta-ABSENT is
+      // abnormal. Never fall through to a broadcast replay: mid-conversion
+      // (same-process check — the converter worker runs inside the server
+      // process) the dir is almost certainly a promote in flight — treat as
+      // convert output; a truly missing meta otherwise seeds suppressed (cold
+      // load covers the history). Any OTHER errno is a transient lock on an
+      // EXISTING meta (Windows AV/EBUSY) — keep the caller's suppress verdict:
+      // flipping a fresh live session to suppressed would silently drop its
+      // first turn (review finding).
+      reportSwallowed('v2-live.meta-read', err);
+      if (this._isConvertRunning()) convertOrigin = true;
+      else if (err && err.code === 'ENOENT') suppressExisting = true;
+    }
     const cur = {
       dir,
       synth: new SessionSynthesizer(dir, { deferMs: this._deferMs, now: this._now }),
@@ -254,32 +400,100 @@ export class V2LiveFeed {
       // rebase each other's accumulated baseline — v1's tail followed exactly
       // one file, so a single shared reconstructor was a new interleave surface.
       reconstructor: createIncrementalReconstructor(),
-      journal: { path: join(dir, 'journal.jsonl'), offset: 0, pending: '' },
-      responses: { path: join(dir, 'responses.jsonl'), offset: 0, pending: '' },
-      convFiles: new Map(), // path → {key, offset, pending}
+      journal: { path: join(dir, 'journal.jsonl'), offset: 0 },
+      responses: { path: join(dir, 'responses.jsonl'), offset: 0 },
+      convFiles: new Map(), // path → {key, offset} (+ lazy _pendBufs carry)
       watcher: null,
       debounce: null,
       reading: false,
       dirty: false,
       suppress: !!suppressExisting,
+      convertOrigin,
+      // Journal req seqs with no done yet. The journal is only touched at
+      // request start and completion, so a single >10min request would look
+      // "idle" to the mtime-based eviction and get detached mid-flight — its
+      // completion would then re-attach suppressed and never resolve the
+      // already-broadcast placeholder (review finding). Eviction skips
+      // cursors with an open request. A crash orphan (req, no done ever)
+      // pins its one session un-evicted — acceptable: eviction is a memory
+      // optimization, a stuck live card is a correctness bug.
+      openReqs: new Set(),
     };
     this._sessions.set(dir, cur);
     this._seenDirs.set(dir, this._journalMtime(dir));
-    try {
-      cur.watcher = this._watchImpl(dir, () => this._scheduleRead(cur));
-      cur.watcher.on('error', (err) => {
+    if (!convertOrigin) {
+      try {
+        cur.watcher = this._watchImpl(dir, () => this._scheduleRead(cur));
+        cur.watcher.on('error', (err) => {
+          reportSwallowed('v2-live.session-watch', err);
+          try { cur.watcher.close(); } catch { /* already closed */ }
+          cur.watcher = null; // safety poll keeps the cursor alive
+        });
+      } catch (err) {
         reportSwallowed('v2-live.session-watch', err);
-        try { cur.watcher.close(); } catch { /* already closed */ }
-        cur.watcher = null; // safety poll keeps the cursor alive
-      });
-    } catch (err) {
-      reportSwallowed('v2-live.session-watch', err);
+      }
+      this._readCursor(cur); // seed (suppressed history or brand-new content)
+    } else {
+      // No per-dir watcher either: a promote can bring hundreds of dead dirs
+      // at once and each fs.watch costs an fd. The safety poll's unconditional
+      // _readCursor still picks up any (theoretical) append past the seeked
+      // offsets until idle eviction reclaims the cursor.
+      this._seekCursorsToEof(cur);
     }
-    this._readCursor(cur); // seed (suppressed history or brand-new content)
     cur.suppress = false;
     return cur;
   }
 
+  /** Position every cursor of a session at the current end of its file —
+   *  attach without reading: nothing existing is synthesized or emitted, only
+   *  bytes appended AFTER this point would flow. Enumerates ALL conv epoch
+   *  files up front so pre-existing epochs can't be replayed from 0 later. */
+  _seekCursorsToEof(cur) {
+    const sizeOf = (p) => {
+      try { return statSync(p).size; } catch (err) {
+        if (err && err.code === 'ENOENT') return 0; // missing file: offset 0 IS its EOF
+        // Any other stat failure must never seed offset 0 — that re-arms the
+        // full replay this seek exists to prevent. Park the cursor past any
+        // real size; a later successful read sees size < offset and rebuilds.
+        reportSwallowed('v2-live.seek-stat', err);
+        return Number.MAX_SAFE_INTEGER;
+      }
+    };
+    cur.journal.offset = sizeOf(cur.journal.path);
+    cur.responses.offset = sizeOf(cur.responses.path);
+    for (const { key, path } of this._enumerateConvFiles(cur.dir)) {
+      cur.convFiles.set(path, { key, path, offset: sizeOf(path) });
+    }
+  }
+
+  /** Enumerate a session's conversation epoch files as [{key, path}], epochs
+   *  numerically ordered within each conv key — the single home of the
+   *  two-level conversations/<key>/e<N>.jsonl walk (shared by the EOF-seek
+   *  attach and the incremental reader; review dedup). NB: file order is NOT
+   *  guaranteed to be globally seq-ordered (a pre-fix writer restart appended
+   *  newer seqs into an older epoch file) — the synthesizer's ingestConvLine
+   *  keeps its event window seq-sorted on insert, so consumers only need a
+   *  stable feed order. */
+  _enumerateConvFiles(dir) {
+    const convRoot = join(dir, 'conversations');
+    const out = [];
+    let keys = [];
+    try {
+      keys = readdirSync(convRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    } catch {
+      return out; // no conversations dir yet
+    }
+    for (const key of keys) {
+      let files = [];
+      try {
+        files = readdirSync(join(convRoot, key)).filter((f) => /^e\d+\.jsonl$/.test(f));
+      } catch { continue; }
+      files.sort((a, b) => Number(a.match(/\d+/)[0]) - Number(b.match(/\d+/)[0]));
+      for (const f of files) out.push({ key, path: join(convRoot, key, f) });
+    }
+    return out;
+  }
+
   _closeCursor(cur) {
     if (cur.debounce) { clearTimeout(cur.debounce); cur.debounce = null; }
     if (cur.watcher) { try { cur.watcher.close(); } catch { /* already closed */ } cur.watcher = null; }
@@ -319,7 +533,11 @@ export class V2LiveFeed {
           try { line = JSON.parse(raw); } catch (err) {
             reportSwallowed('v2-live.journal-parse', new Error(`${cur.dir}: ${err.message}`));
           }
-          if (line) cur.synth.ingestJournalLine(line);
+          if (line) {
+            if (line.ph === 'req') cur.openReqs.add(line.seq);
+            else if (line.ph === 'done') cur.openReqs.delete(line.seq);
+            cur.synth.ingestJournalLine(line);
+          }
         }
         this._emitDrained(cur);
       } while (cur.dirty);
@@ -329,44 +547,22 @@ export class V2LiveFeed {
   }
 
   _feedConvFiles(cur) {
-    const convRoot = join(cur.dir, 'conversations');
-    if (!existsSync(convRoot)) return;
-    let keys = [];
-    try {
-      keys = readdirSync(convRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
-    } catch {
-      return;
-    }
-    for (const key of keys) {
-      let files = [];
-      try {
-        files = readdirSync(join(convRoot, key)).filter((f) => /^e\d+\.jsonl$/.test(f));
-      } catch {
-        continue;
+    for (const { key, path } of this._enumerateConvFiles(cur.dir)) {
+      let fc = cur.convFiles.get(path);
+      if (!fc) {
+        fc = { key, path, offset: 0 };
+        cur.convFiles.set(path, fc);
       }
-      // Numeric epoch order. NB: file order is NOT guaranteed to be globally
-      // seq-ordered (a pre-fix writer restart appended newer seqs into an
-      // older epoch file) — the synthesizer's ingestConvLine keeps its event
-      // window seq-sorted on insert, so feed order only needs to be stable.
-      files.sort((a, b) => Number(a.match(/\d+/)[0]) - Number(b.match(/\d+/)[0]));
-      for (const f of files) {
-        const p = join(convRoot, key, f);
-        let fc = cur.convFiles.get(p);
-        if (!fc) {
-          fc = { key, path: p, offset: 0, pending: '' };
-          cur.convFiles.set(p, fc);
+      const lines = readNewLines(fc);
+      if (lines === null) { this._rebuildCursor(cur); return; }
+      for (const raw of lines) {
+        let ev = null;
+        try { ev = JSON.parse(raw); } catch (err) {
+          reportSwallowed('v2-live.conv-parse', new Error(`${cur.dir}/${key}: ${err.message}`));
         }
-        const lines = readNewLines(fc);
-        if (lines === null) { this._rebuildCursor(cur); return; }
-        for (const raw of lines) {
-          let ev = null;
-          try { ev = JSON.parse(raw); } catch (err) {
-            reportSwallowed('v2-live.conv-parse', new Error(`${cur.dir}/${key}: ${err.message}`));
-          }
-          if (ev) {
-            cur.synth.ingestConvLine(key, ev);
-            if (this._wireV3 && !cur.suppress) this._forwardNative(cur, 'conv', key, raw);
-          }
+        if (ev) {
+          cur.synth.ingestConvLine(key, ev);
+          if (this._wireV3 && !cur.suppress) this._forwardNative(cur, 'conv', key, raw);
         }
       }
     }
@@ -471,8 +667,17 @@ export class V2LiveFeed {
       timestamp: parsed.timestamp || '',
       url: parsed.url || '',
       method: parsed.method || 'POST',
-      kind: item.isMain ? 'main' : (parsed.teammate ? 'teammate' : 'sub'),
-      mainAgent: parsed.mainAgent === true,
+      // conv/evt/kind/mainAgent mirror the cold fold (meta-rows.js foldDir) —
+      // journal truth, NOT re-derivation. conv is load-bearing: the client
+      // assembler's buildEntry is `if (row.conv)`-gated, so a conv-less live
+      // row rebuilt every entry with EMPTY messages (chat vanished at stream
+      // end). mainAgent must be kind-derived like cold: parsed.mainAgent
+      // re-derives from the body and mis-tags countTokens (main system/tools
+      // aboard) as true, which would merge its turn into the chat live-only.
+      conv: item.conv,
+      evt: item.evt,
+      kind: item.kind || (item.isMain ? 'main' : (parsed.teammate ? 'teammate' : 'sub')),
+      mainAgent: item.isMain === true,
       teammate: parsed.teammate || undefined,
       model: parsed.body?.model,
       proxyUrl: parsed.proxyUrl || undefined,
@@ -527,7 +732,38 @@ export class V2LiveFeed {
     if (!this._active) return;
     this._armRootWatcher(); // re-arm after errors / late directory creation
     // Attached sessions: unconditional slow re-read (fs.watch is lossy).
+    // Idle eviction first: a cursor whose journal has not moved for
+    // _idleEvictMs is detached, releasing its synthesizer/reconstructor/
+    // _v3PrevMain retained state (post-migration this is ~the whole project).
+    // _seenDirs keeps the mtime, so the existing mtime-bump scan below (or the
+    // leader's tick(), now suppress-on-seen) re-attaches on real new activity.
     for (const cur of [...this._sessions.values()]) {
+      // Multi-window isolation: an ATTACHED dir can turn foreign-owned after
+      // the fact — an unowned (dead-owner) dir followed since startup gets
+      // adopted by another window's `ccv -c`. The attach-time gate can't see
+      // that, so re-check here and detach before the unconditional re-read
+      // would stream the adopter's traffic into this window (bounded to one
+      // safety-poll period). _seenDirs keeps the current mtime so a later
+      // ownership release (owner exits) plus new activity re-attaches through
+      // the normal mtime-bump path below.
+      if (this._isForeignLiveOwned(cur.dir)) {
+        this._closeCursor(cur);
+        this._sessions.delete(cur.dir);
+        this._seenDirs.set(cur.dir, this._journalMtime(cur.dir));
+        continue;
+      }
+      // openReqs guard: never evict mid-flight — a long request keeps the
+      // journal mtime frozen between its req and done lines, and evicting
+      // then would strand its already-broadcast placeholder (see openReqs).
+      if (this._idleEvictMs > 0 && cur.openReqs.size === 0) {
+        const mtime = this._journalMtime(cur.dir);
+        if (mtime > 0 && this._now() - mtime > this._idleEvictMs) {
+          this._closeCursor(cur);
+          this._sessions.delete(cur.dir);
+          this._seenDirs.set(cur.dir, mtime);
+          continue;
+        }
+      }
       this._readCursor(cur);
     }
     // Unattached dirs: attach brand-new ones (missed root events) and

package/server/lib/v2/meta-rows.js

@@ -18,6 +18,7 @@
 import { readFileSync, readdirSync } from 'node:fs';
 import { join, basename } from 'node:path';
 import { readJsonlTolerant } from './replay.js';
+import { iterateJsonlLines } from './jsonl-read.js';
 import { iterateV2Items, findTeammateSessionDirs } from './adapter.js';
 import { SingleFlight } from './singleflight.js';
 import { reportSwallowed } from '../error-report.js';
@@ -246,13 +247,11 @@ export async function readV2NativeCold(sessionDir, rows) {
       try { files = readdirSync(join(convRoot, key)).filter((f) => /^e\d+\.jsonl$/.test(f)).sort((a, b) => Number(a.match(/\d+/)[0]) - Number(b.match(/\d+/)[0])); } catch { continue; }
       const raws = [];
       for (const f of files) {
-        let text = '';
-        try { text = readFileSync(join(convRoot, key, f), 'utf-8'); } catch { continue; }
-        for (const line of text.split('\n')) {
-          const trimmed = line.trim();
-          if (trimmed) raws.push(trimmed);
-        }
-        await yieldLoop(); // one yield per conv file read
+        // streamed line-by-line (issue #129): a conv epoch past Node's string
+        // cap must degrade to skipped lines, not lose the whole file silently
+        try { for (const trimmed of iterateJsonlLines(join(convRoot, key, f))) raws.push(trimmed); }
+        catch (err) { reportSwallowed('v2-native.conv-read-failed', err); }
+        await yieldLoop(); // one yield per conv file read (error path included)
       }
       // last snapshot at-or-before the window start for this session
       let start = 0;
@@ -271,17 +270,15 @@ export async function readV2NativeCold(sessionDir, rows) {
       // boundaries: the browser paints and the byte meter ticks between them.
       pushChunked(convPayloads, windowRaws, (linesJson) => `{"sessionId":${JSON.stringify(sessionId)},"channel":${JSON.stringify(key)},"lines":[${linesJson}]}`);
     }
-    // responses: exactly the window member seqs
-    let respText = '';
-    try { respText = readFileSync(join(dir, 'responses.jsonl'), 'utf-8'); } catch { /* none yet */ }
-    await yieldLoop();
+    // responses: exactly the window member seqs — streamed (issue #129)
     const respRaws = [];
-    for (const line of respText.split('\n')) {
-      const trimmed = line.trim();
-      if (!trimmed) continue;
-      const m = /"seq":\s*(\d+)/.exec(trimmed);
-      if (m && memberSeqs && memberSeqs.has(Number(m[1]))) respRaws.push(trimmed);
-    }
+    try {
+      for (const trimmed of iterateJsonlLines(join(dir, 'responses.jsonl'))) {
+        const m = /"seq":\s*(\d+)/.exec(trimmed);
+        if (m && memberSeqs && memberSeqs.has(Number(m[1]))) respRaws.push(trimmed);
+      }
+    } catch (err) { reportSwallowed('v2-native.responses-read-failed', err); }
+    await yieldLoop();
     pushChunked(respPayloads, respRaws, (linesJson) => `{"sessionId":${JSON.stringify(sessionId)},"lines":[${linesJson}]}`);
   }
   return { convPayloads, respPayloads };
@@ -315,7 +312,7 @@ function pushChunked(out, raws, wrap) {
 async function attachBodyFields(sessionDir, rows) {
   const rowByKey = new Map(rows.map((r) => [itemKey(r.sessionId, r.seq), r]));
   const materialize = (sessionId, seq) => rowByKey.has(itemKey(sessionId, seq));
-  let pending = null;      // { row, entry } awaiting its nextReq for classify
+  let pending = null;      // { row, entry, isMain } awaiting its nextReq for classify
   let prevMainFull = null; // previous mainAgent full-body entry (cacheLoss)
   let n = 0;
   const finish = (slot, nextEntry) => {
@@ -329,8 +326,12 @@ async function attachBodyFields(sessionDir, rows) {
       reportSwallowed('v2-meta.row-classify', err);
       row.typeTag = null; // journal-derived kind still renders
     }
-    // authoritative synthesis-level markers (parity with the legacy list)
-    row.mainAgent = entry.mainAgent === true;
+    // Authoritative synthesis-level markers. mainAgent stays KIND-derived
+    // (item.isMain = journal kind==='main' && !leader) like foldDir and the
+    // live rows — entry.mainAgent re-derives from the blob-backfilled body
+    // and mis-tags a main-shaped countTokens probe as true, which would merge
+    // its turn into the chat after a cold reload (2026-07-16 review P1).
+    row.mainAgent = slot.isMain === true;
     if (entry.teammate) row.teammate = entry.teammate;
     if (entry.body && entry.body.model) row.model = entry.body.model;
     if (row.mainAgent) {
@@ -353,7 +354,7 @@ async function attachBodyFields(sessionDir, rows) {
       entry = { ...entry, body: { ...entry.body, messages: item.stateRef } };
     }
     if (pending) finish(pending, entry);
-    pending = { row, entry };
+    pending = { row, entry, isMain: item.isMain };
     if (++n % 20 === 0) await new Promise((resolve) => setImmediate(resolve));
   }
   if (pending) finish(pending, null);

package/server/lib/v2/replay.js

@@ -14,14 +14,14 @@ import { join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { messageFingerprint, normalizeMsgForEquality } from '../session-boundary.js';
 import { isSupportedWireFormat } from './layout.js';
+import { iterateJsonlLines } from './jsonl-read.js';
 
-/** Parse a JSONL file tolerating a truncated tail line (spec §14). */
+/** Parse a JSONL file tolerating a truncated tail line (spec §14). Streams
+ *  line-by-line (issue #129): a file past Node's ~512MiB string cap must not
+ *  throw ERR_STRING_TOO_LONG out of the whole read path. */
 export function readJsonlTolerant(path) {
-  if (!existsSync(path)) return [];
   const out = [];
-  for (const line of readFileSync(path, 'utf-8').split('\n')) {
-    const t = line.trim();
-    if (!t) continue;
+  for (const t of iterateJsonlLines(path)) {
     try { out.push(JSON.parse(t)); } catch { /* truncated tail — drop */ }
   }
   return out;