cctally 1.52.1 → 1.54.0

package/CHANGELOG.md

@@ -5,6 +5,53 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.54.0] - 2026-06-22
+
+### Added
+- **Dashboard conversation viewer — side-by-side session comparison.** A new **⟷ Compare with…** control in the reader head puts the conversation list into a pick-mode (a banner with Cancel/Esc; the anchor session's row greyed out) to choose a second session, then opens a side-by-side **prompt-sequence diff** of the two runs — built for comparing variations of the same or a similar task to see where they diverged and which run was cheaper / faster / cleaner. A metrics-delta strip heads the view with A→B Cost, Tokens, Prompts, Errors, Duration, and Files (an improvement arrow only on the lower-is-better cost / errors / duration), the two prompt spines are aligned by their normalized first lines with a ⚡ divergence marker on replaced regions and a hatched gap where one run has an extra prompt, and clicking any row lazily expands both runs' full prompt text inline (new `GET /api/conversation/<id>/prompts` route behind the same fail-closed transcript gate) with an "open in reader →" jump per side. The view is two-column on a wide viewport and a unified single column below ~1100px, divergence is conveyed by the ⚡ bar + ◆ markers + del/add styling (never color alone), and the comparison is shareable and cold-loadable via its `#/conversations/compare/<A>/<B>` URL with ⇄ swap / ✕ close. (#217)
+- **Dashboard conversation viewer — transcript export & per-card extraction.** The reader header gains an `Export ▾` menu with four Markdown scopes — Whole transcript, Prompts only, Chat only, and Replay recipe (a numbered list of your prompts) — each offering Copy (clipboard) and Download (`.md`); the export is computed server-side over the whole assembled session (new `GET /api/conversation/<id>/export` route behind the same fail-closed transcript gate), so it's complete even for a long transcript you've only partially paged in, and truncated tool data is marked `… [truncated]` rather than shown as complete. A diff card additionally offers a `.patch` download (a real `diff --git`/`@@` unified diff — Write yields an applyable add-patch, Edit/MultiEdit are snippet-relative best-effort), and a Bash card offers a `copy full` action (`$ cmd` + stdout + stderr, with a truncation marker when clipped). (#217)
+- **Dashboard conversation viewer — files-touched tab + tool-type/subagent focus filters.** The outline sidebar gains an `[Outline] [Files]` tab listing every file the session modified via an Edit/MultiEdit/Write call (in first-touch order) with a summed `+N −M` badge per path, expandable to per-touch jump rows that scroll the transcript to the change; a truncated edit with no computable stat is still listed (its badge side omitted), and `NotebookEdit`/read-only tools never appear. The focus control gains a `▾ More` menu adding three filters on the same single-select axis — Edits (Edit/MultiEdit/Write turns), Bash, and a Subagent submenu that isolates one top-level subagent thread (labelled by its agent kind, key fallback when no metadata) — that filter the reading column like the four primary modes; `v` keeps cycling only the four primary modes and returns to All from a More filter. (#217)
+- **Dashboard conversation viewer — git-context diff rendering + a task-completion summary.** An injected `Injected context` block that carries an unfenced git diff (e.g. `diff --git a/CLAUDE.md b/CLAUDE.md … @@ … @@`) now renders as a real red/green unified diff — per-file path header, a `+N −M` stat, and the same syntax-highlighted hunk rows as an Edit diff — with the surrounding prose left as Markdown; detection is conservative (a real `diff --git` marker, never a bare `-`/`+` bullet), so a Markdown list is never mistaken for a diff. And when a session's main-thread to-do checklist ends fully completed, the reader header shows a green `✓ Complete · N` chip (always visible regardless of scroll) that jumps to the final checklist, plus a `✓ Session complete (N tasks)` outline landmark — both gated on the final *main-thread* snapshot being entirely done, so a subagent's own checklist never triggers them. (#217)
+- **Dashboard conversation viewer — in-reader cost/token analytics.** Each assistant turn's cost footer gains a thin micro-bar whose width and intensity encode that turn's cost relative to the most-expensive turn loaded so far (the exact `$`/token text is unchanged; the bar is a relative cue with the precise cost in its tooltip); the reader header carries a cumulative-cost chip showing `$so-far / $total` plus a progress bar that tracks your scroll position, prefixed `~` when earlier pages aren't loaded yet (a lower bound) and hidden both on a costless session and until you've scrolled a turn into view (so it never flashes a transient `$0.00`); and the outline's cache-rebuild stat expands from a single count into a per-rebuild jump list — each row labelled with its turn, wasted tokens, and `~$` cost, worst-first, capped at three with a "+N more" expander, honoring the `dashboard.cache_failure_markers` opt-out. (#217)
+- **Dashboard conversation viewer — per-turn bookmarks & notes.** Each turn's action row gains a ★ bookmark toggle with an inline note editor (saved on Enter/blur, cancelled on Esc); bookmarks persist in your browser's local storage only — nothing leaves the machine — and surface as ★ landmarks in the outline (labelled with your note or the turn's heading, including bookmarks on subagent turns), with a ★ chip in the outline's "Jump to" cluster and reader keys `i` / `I` to step to the next / previous bookmark and `t` to toggle a bookmark on the current turn. (#217)
+- **Dashboard conversation viewer — inline PDF rendering.** A PDF attachment now offers a `view inline ▾` toggle that renders the PDF in the reading column at a capped, scrollable height (with a `collapse ▴` control); the viewer mounts — and the bytes fetch — only when expanded, is served behind the same privacy gate as every other transcript media request, and falls back to the `open ↗` link automatically in a browser without a built-in PDF viewer. (#217)
+
+### Changed
+- **Dashboard conversation search — the Files facet now matches a file-path substring instead of a path prefix.** Searching the Files facet for a bare basename (`package.json`) or a mid-path fragment (`cctally`) now returns the sessions that touched a matching path, instead of requiring a leading path prefix; the match is a case-insensitive substring over the (modest) touched-file table. (#223)
+- **Dashboard conversation find bar — regex matches are now underlined in the transcript.** In regex find mode the in-prose highlight is no longer suppressed: matches get a best-effort inline underline (per rendered text segment, case-toggle-aware), alongside the existing match count and jump-to-match. Invalid or pathological patterns degrade to no underline (the match count still drives navigation). (#223)
+
+### Fixed
+- **Dashboard conversation viewer — the reader-header `Export ▾` and focus `▾ More` menus are now fully keyboard-navigable.** Both popovers previously exposed a `role="menu"` with no arrow-key navigation; they now implement the full menu keyboard pattern — opening moves focus to the first item, `↑`/`↓` cycle through items (wrapping), `Home`/`End` jump to the ends, and `Esc` closes and restores focus to the trigger, with a single roving tab stop so `Tab` moves past the menu rather than through every item. In the focus `▾ More` menu, `→` opens the Subagent submenu (focusing its first entry) and `←` collapses back to the parent. (#224)
+- **Dashboard conversation viewer — git-context diff path parsing no longer over-captures a trailing word into the file path.** The `diff --git a/… b/…` path capture now stops at whitespace instead of greedily running to end-of-line, so a pathological marker line carrying trailing prose after the `b/` path can't bleed that text into the displayed new-path header; real injected diffs (whose paths are whitespace-free) are unaffected. (#224)
+- Conversation viewer: subagents dispatched without an explicit type (the default general-purpose case, e.g. SDD implementors/reviewers) now show their kind, description, and token/duration/tool usage in the card chip and outline — previously only explicitly-typed subagents (e.g. Explore) did (#225).
+- **Dashboard conversation viewer — jumping to a deeply-nested subagent no longer occasionally leaves that subagent's card collapsed.** When you jump to a target inside a subagent that was itself spawned by another subagent (a grandchild thread), the reader force-opens the whole ancestor chain; that expansion now latches each card's open-state in the same render that opens it instead of a beat later, so the brief reset that runs once the jump has scrolled into place can no longer race the parent's expansion and silently re-collapse the nested target. (#222)
+
+## [1.53.0] - 2026-06-21
+
+### Added
+- **Dashboard conversation outline — per-subagent cost, a resizable column, a nested-subagent tree, and a compaction landmark.** Each subagent thread in the outline now shows its cost beside its label (a display-only, summed-cost-once figure that covers every thread, including older ones with no captured spawn metadata). A thin resize divider between the reading column and the outline lets you drag the outline wider or narrower — keyboard-resizable too (`←`/`→` step, `Home`/`End` to the extremes, with a labeled `separator` accessibility surface) — and the width persists across reloads. When a subagent spawns its own sub-subagents, the outline nests those children indented beneath their parent thread (a session with no such nesting looks exactly as before). And a conversation compaction (the auto-summarize point) is now a navigable outline landmark with its own "Jump to" chip and `m`/`M` reader keys. The outline's "Jump to" chips also change: a primary click now jumps to the most-recent occurrence of that landmark family, while shift-click steps to the previous one.
+- **Dashboard conversation reader — opens at the bottom with two-way scrolling, remembers where you were reading, and jumps straight to the last prompt or error.** A long conversation now opens on its newest turns (single-request tail load, with live-tail already following) instead of at the top; a short conversation that fits one page still opens at the top so it reads from the start. The reader window pages in both directions — scrolling down loads newer turns and scrolling up prepends older ones, anchored so the turn you're reading stays put rather than jumping — and a backward (scroll-up) page never breaks the "follow the live session" state. Switching away from a conversation and returning later restores you to the turn you were last reading (anchored to the turn, so it survives a resized window or a grown transcript; a deep-link or jump target still wins, and a vanished turn falls back to the bottom). Two new reader keys jump directly to the most-recent occurrence: `a` to the last prompt and `L` to the last error. `Latest ↓` / `End` now reset to the newest page in a single request (instant even on a very long session) rather than paging all the way forward.
+- **`cctally doctor` — new conversation-rollup consistency check.** `doctor` (and the dashboard's doctor panel) now run a `data.conversation_sessions_rollup` check that compares the materialized `conversation_sessions` browse-rail rollup against the distinct session count in the conversation cache, warning only when they disagree in a quiescent cache — an in-flight sync, reingest, or backfill is detected (via a non-blocking cache-lock probe and the pending-flag set) and never warns — so a stale or half-built rollup that would skew the conversation list's filters and counts is surfaced instead of passing silently.
+- **Dashboard conversation reader — open-at-bottom and backward pagination on the reader API.** `GET /api/conversation/<id>` now pages with `before=<id>` (the page of turns immediately *before* a cursor) and `tail=1` (the last page in a single request, so a client can land on the newest turns without paging forward through the whole session) alongside the existing forward `after=<id>`; the three cursors are mutually exclusive (more than one is a `400`) and `limit` is clamped `1`–`1000` (default `500`). The `page` object gains additive `prev_before`/`has_prev` (older turns remain to page back to) beside `next_after`/`has_more`, each computed from the page's actual position so a short backward page at the head still reports more forward; a stale cursor yields an empty page rather than re-serving the head or tail. Existing no-cursor and `after` responses are byte-stable except for the two additive `page` keys (backend contract only — the frontend lights this up in a later session).
+- **Dashboard conversation search — `kind=title` title search and server-side filtered search.** `GET /api/conversation/search` adds a `kind=title` facet that searches the AI-generated session titles and returns one session-level hit per matching session (anchored to the session's first turn, with `match_kinds:["title"]` and the matched title as the snippet); its `total` counts only sessions with surviving turns, so the count never lies, and it falls back to a `LIKE` scan when the host lacks FTS5. The search route also now accepts the same browse filters as the conversation list (`date_from`/`date_to`/`projects`/`cost_min`/`cost_max`/`rebuild_min`), applied as a session-scope restriction across every kind, with the same brief project/cost/rebuild degradation (a `filter_degraded` flag, date-axis only) while the per-session rollup is still indexing; a no-filter request is byte-stable with the prior output. The cross-session-only `title` facet is rejected with a `400` (never a `500`) on the in-conversation `find` route. Backend contract only — surfaced in a later frontend session.
+- **Dashboard conversation search — `kind=files` file-path search.** `GET /api/conversation/search` adds a `kind=files` facet that searches the write-class file paths each session edited or created (files touched by an `Edit`/`MultiEdit`/`Write`/`NotebookEdit` tool call — read-only `Read` and shell `Bash` are excluded so the axis answers "which sessions modified this file"), returning one hit per distinct `(session, file path)` anchored to that path's most-recent touch (`match_kinds:["file"]`, snippet = the file path) and a `total` that is the distinct `(session, file path)` count; a query with no leading separator is treated as a case-insensitive path prefix that is genuinely index-assisted — it rides the `COLLATE NOCASE` path index as a key-range search (the index is `NOCASE` precisely because the default `LIKE` is case-insensitive and a binary-collated index can't serve it) — while a leading-separator query is a full substring scan over the modest touch table (a leading wildcard can never use an index), and the facet composes with the same browse filters as the other kinds and is rejected with a `400` on the in-conversation `find` route. The axis is backed by a re-derivable `conversation_file_touches` table (cache migration `019`) backfilled once on the first sync after upgrade. Backend contract only — surfaced in a later frontend session.
+- **Dashboard conversation reader — long Bash output collapses by default, and a key to search the conversation list from inside a reader.** A Bash tool card whose output runs long (more than 20 rendered lines) now opens collapsed with a `show N lines` hint so it no longer buries the next turn — short output stays open, and the `[`/`]` collapse-all and a per-card click still override either way. The new `f` key focuses the conversation-list search input even while a conversation is open, so you can look up another session without pressing `Esc` to leave the reader first (`/` stays reader-aware and opens the in-conversation find bar).
+- **Dashboard conversation find bar — `⌘F` / `Ctrl+F`, regex + case-sensitive search, a focus trap, and live results.** The in-conversation find bar now opens with `⌘F` / `Ctrl+F` as well as `/` (the browser's native find bar is suppressed only inside the Conversations workspace, and only when no modal or text input is up — it still works on the dashboard panels), and two toggles beside the input — `.*` (regular expression) and `Aa` (case-sensitive), both remembered across reloads — drive a real server-side match over the full transcript corpus (prose, tool commands/results/stderr, and thinking, the same content the search facets cover); an invalid regex shows an announced "invalid regex" hint rather than failing silently. The prose underline now honors the case toggle (and is suppressed in regex mode, where the match count and jump still work fully). The bar traps keyboard focus while open (`Tab`/`Shift+Tab` cycle its controls, `Esc` exits to the transcript), and its results now live-refresh as the open conversation grows — keeping your place by jumping back to the same match across the refresh, and resetting to the first match only when the one you were on disappeared.
+- **Dashboard conversation rail — sort the browse list, persist your filters + sort, and apply filters to search.** A new **Sort** control in the rail header orders the conversation list by Recent (default), Oldest, Cost (high→low), Messages (high→low), or Project (A→Z, with un-labeled sessions last); the chosen sort and the browse filters now persist across reloads instead of resetting every session. The Browse filters also apply to full-text **search** now — the same filter set is shared, so the Filters button stays enabled with a search needle active, the active-filter chips stay visible, and the chosen date/project/cost/rebuild axes narrow the search results (file-path and AI-title results included) rather than only the browse list. While a brand-new or `--no-sync` dashboard is still building its per-session rollup, the Cost/Project sorts briefly fall back to Recent order (and the rollup-only filter axes to date-only), each with a muted "while indexing" note, self-correcting after the first full sync. The `GET /api/conversations` route gains a `sort` param (`recent`/`oldest`/`cost`/`messages`/`project`, lenient on unknown values) and an additive `page.sort_degraded` flag.
+- **Dashboard conversation search — search across sessions by AI-title or file path, surfaced in the rail.** The cross-session search chip row gains two structural facets after a subtle separator — **Title** (searches the AI-generated session titles) and **Files** (searches the write-class file paths each session edited or created) — joining the existing All / Prompts / Assistant / Tools / Thinking content kinds; both stay available even while the search index is still backfilling (neither rides the split index). A Title hit shows the matched title and opens that session at its first turn; a Files hit leads with the file path (with the session title secondary) and opens the session at that path's most-recent touch, so you can jump from "which session modified `bin/cctally`" straight into the conversation. The new hits carry `title` / `file` match badges, and both facets narrow to your active browse filters like every other kind. (This lights up the `kind=title` / `kind=files` backend facets shipped earlier in the conversation viewer's search route.)
+
+### Changed
+- **Dashboard conversation viewer — backend performance and tech-debt hardening (no visible change).** The per-sync browse-rail rollup no longer runs a full transcript assembly for every touched session — the cache-rebuild count now comes from a dedicated lightweight query that shares the exact cache-failure rule with the reader — so the rollup maintenance that runs under the cache lock on every sync no longer does work proportional to sessions × full-assembly; the in-conversation find skips assembling a transcript entirely when a query matches nothing; cross-session search batches its badge and snippet lookups into a couple of bounded queries instead of issuing up to ~200 per-result round-trips; and a dead, always-empty `search_aux` column is removed via cache migration `016`. The rendered conversation output is byte-for-byte unchanged.
+
+### Fixed
+- **Dashboard conversation reader — a cluster of small reading and accessibility refinements.** The header `Errors` focus-mode badge now counts error *turns* (matching the "Jump to" error chip and exactly what clicking the filter steps between) rather than the raw total of error events, so it can no longer read higher than the number of places the filter lands. A WebSearch results-count chip no longer shows green when the search errored (it takes a neutral/error style, with the `· error` marker alongside). The browse list's "Load more" button disables and shows a loading label while a page is fetching, matching the search results list. The Find control uses an inline icon (matching the other reader controls), the `· N hidden ·` focus-mode marker carries a screen-reader label naming the hidden-turn count, the load-full affordance disables when there's no addressable session, the diff result disclosure names the snippet's line count instead of a fixed string, and the ExitPlanMode outcome badge no longer mis-reads a free-text user response that merely mentions "approve"/"reject" as an approval or rejection.
+- **Dashboard conversation viewer — a subagent whose result exceeds 16 KB no longer drops its nested subagent into a detached, unlinked card.** When a subagent returned more than ~16 KB of text, the `agentId:` trailer that links a nested (grandchild) subagent back to the thread that spawned it could fall past the point where the result is clipped for storage, so the grandchild rendered as a flat, top-level card disconnected from its parent. The link is now captured at ingest time from the full, pre-clip result (with the read-time parse kept as a fallback), so deeply-nested subagents render correctly regardless of result size; existing transcripts are re-derived once by a flag-only cache migration (`017_arm_nested_agent_reingest`), and because the cache is fully re-derivable there is nothing to do on upgrade.
+- **Dashboard conversation viewer — full-payload reads now bound and flag truncation honestly.** A tool input large enough to exceed the payload cap is now actually clipped to that cap rather than served over-cap with only a truncation flag set (the bound is measured in the same serialization the response uses, so it holds for non-ASCII text too), and a tool result whose `stderr` stream is itself truncated now carries an explicit `stderr_truncated` flag — so a consumer of the read-full-payload route can tell a clipped stream from a complete one. No change to the rendered transcript.
+- **Dashboard — the Recent Sessions table no longer spills past its panel card at narrow two-column widths (≈1100–1600px).** Its columns (Started · Dur · Model · Project · Cost) sum wider than the card at those widths, so the Cost column used to bleed past the card and the viewport edge; the table now scrolls horizontally inside the card instead, keeping every column full-width (no truncation) with the scrollbar shown only when the table can't fit. Wider layouts (≥~1300px, including the centered ≥1600px cap) are unchanged — the table fits with no scrollbar (#208).
+- **Dashboard — the Daily heatmap no longer clips the digits of larger costs at narrow widths.** A full three-digit cost such as `$212.83` overflowed the day cell's clip box and lost its leading/trailing glyphs (rendering as "212.8"); each cell now sizes its cost text to the cell's width given the value's length, so the whole amount (cents included) always fits — wide cells keep the original 16px size and only cells that would otherwise overflow shrink, fluidly, at any width (#208).
+- **`record-credit` — a week with an already-applied credit is now refused before the confirm prompt, not after it.** Re-running `record-credit` on a week that already has a fully-recorded credit is refused by default (exit 2, naming the recorded pre-credit value and pointing at `--force`). Previously, on an interactive terminal, the command printed the full preview and asked `Proceed? [y/N]` first, then refused only after you answered `y` — so you were prompted to confirm an action that was never going to apply. The refusal now fires before the prompt, so the "already recorded — pass `--force`" message appears immediately on both interactive and non-interactive reruns (#212).
+- **Dashboard conversation find bar — `Esc` from a find-bar button no longer closes the whole reader, and a Files search result no longer prints its path twice.** Pressing `Esc` while focus was on one of the find bar's buttons (Close, the `.*`/`Aa` toggles, or the prev/next arrows) closed the find bar *and* tore the entire reader down back to the conversation list — only `Esc` from the text input behaved correctly. `Esc` is now handled at the bar level, so it closes only the find bar from any of its controls and restores keyboard focus to the transcript (instead of dropping it to the page body). Separately, a `Files` search hit in the conversation rail showed the file path both as its prominent primary line and again, redundantly, in the snippet row beneath; the duplicate snippet row is now suppressed for file hits (every other result kind keeps its snippet).
+
 ## [1.52.1] - 2026-06-20
 
 ### Fixed

package/bin/_cctally_cache.py

@@ -185,8 +185,8 @@ _CONV_INSERT_SQL = (
     " timestamp_utc,entry_type,text,blocks_json,model,msg_id,"
     " req_id,cwd,git_branch,is_sidechain,source_tool_use_id,"
     " stop_reason,attribution_skill,attribution_plugin,"
-    " search_tool,search_thinking,search_aux)"
-    " VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)"
+    " search_tool,search_thinking)"
+    " VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)"
 )
 
 # #193: last non-null write wins (ai-title carries no timestamp; see spec S1). NO
@@ -206,19 +206,19 @@ def _conv_row_tuple(m, path_str):
     """Flatten a ``MessageRow`` into the ``_CONV_INSERT_SQL`` column order.
 
     The #177 enrichment fields (stop_reason / attribution_skill /
-    attribution_plugin / search_tool / search_thinking / search_aux) are
-    TAIL-APPENDED after source_tool_use_id — same order as the SQL column list —
-    so both ingest paths (fused per-file walk + backfill_conversation_messages)
-    carry them through this one tuple. #177 S6: ``search_aux`` is always written
-    as ``''`` (documented-dead); the split ``search_tool``/``search_thinking``
-    columns carry the non-prose index."""
+    attribution_plugin / search_tool / search_thinking) are TAIL-APPENDED after
+    source_tool_use_id — same order as the SQL column list — so both ingest paths
+    (fused per-file walk + backfill_conversation_messages) carry them through this
+    one tuple. #217 S1 / U7a: the documented-dead ``search_aux`` column is gone
+    from the live schema (dropped by migration 016); the split
+    ``search_tool``/``search_thinking`` columns carry the non-prose index."""
     return (
         m.session_id, m.uuid, m.parent_uuid, path_str, m.byte_offset,
         m.timestamp_utc, m.entry_type, m.text, m.blocks_json, m.model,
         m.msg_id, m.req_id, m.cwd, m.git_branch, m.is_sidechain,
         m.source_tool_use_id,
         m.stop_reason, m.attribution_skill, m.attribution_plugin,
-        m.search_tool, m.search_thinking, m.search_aux,
+        m.search_tool, m.search_thinking,
     )
 
 
@@ -595,6 +595,9 @@ _TARGETED_DECLINE_FLAGS = (
     "conversation_promote_command_args_pending",
     "conversation_sessions_backfill_pending",
     "conversation_queued_prompt_reingest_pending",   # migration 014
+    "conversation_reingest_nested_agent_pending",    # migration 017
+    "conversation_title_fts_backfill_pending",       # migration 018 (P1-2: HERE ONLY)
+    "conversation_reingest_file_touches_pending",    # migration 019 (P1-2: HERE ONLY)
 )
 
 
@@ -731,7 +734,20 @@ def sync_cache(
             # while-busy user prompts persisted as queued_command attachments); the
             # same offset-0 walk re-derives them through the current parser, so drop
             # that flag here too — MISSING this site re-arms the flag on every
-            # cache-sync --rebuild.
+            # cache-sync --rebuild. #217 S1 migration 017 sets the DISTINCT
+            # conversation_reingest_nested_agent_pending flag (to land the
+            # ingest-time structured agent_id stamp on >16 KB nested-subagent
+            # grandchildren); the same offset-0 walk re-derives it through the
+            # current parser, so drop that flag here as well. #217 S2 migrations
+            # 018/019 set conversation_title_fts_backfill_pending (title FTS) and
+            # conversation_reingest_file_touches_pending (+ its
+            # conversation_file_touches_cursor); the offset-0 walk re-derives both
+            # the title FTS and the file-touch axis, so drop them too (#219 S2.3).
+            # NOTE: unlike the flags above, dropping the 018/019 keys here is
+            # COSMETIC — their consumers run on the just-wiped (empty) tables and
+            # self-clear before the offset-0 walk repopulates, so leaving them
+            # caused no redundant expensive pass and no re-arming. We add them for
+            # consistency with the documented convention only.
             conn.execute(
                 "DELETE FROM cache_meta WHERE key IN "
                 "('conversation_reingest_pending',"
@@ -739,6 +755,10 @@ def sync_cache(
                 " 'conversation_reingest_enrichment_pending',"
                 " 'conversation_media_reingest_pending',"
                 " 'conversation_queued_prompt_reingest_pending',"
+                " 'conversation_reingest_nested_agent_pending',"
+                " 'conversation_title_fts_backfill_pending',"
+                " 'conversation_reingest_file_touches_pending',"
+                " 'conversation_file_touches_cursor',"
                 " 'conversation_reingest_cursor',"
                 " 'conversation_reingest_cursor_gen')")
             # #177 S6: a rebuild repopulates search_tool/search_thinking via the
@@ -885,9 +905,14 @@ def sync_cache(
             # for a distinct flag. Migration 014 uses ANOTHER distinct flag
             # ``conversation_queued_prompt_reingest_pending`` to land queued-while-
             # busy user prompts (queued_command attachments the parser now promotes
-            # to HUMAN); same offset-0 re-parse, same distinct-flag reason. We
-            # trigger the SAME clear + offset-0 backfill on ANY of these flags and
-            # clear them ALL atomically here under the held flock.
+            # to HUMAN); same offset-0 re-parse, same distinct-flag reason. #217 S1
+            # migration 017 uses ANOTHER distinct flag
+            # ``conversation_reingest_nested_agent_pending`` to land the ingest-time
+            # structured agent_id stamp on >16 KB nested-subagent grandchildren
+            # (whose agentId: trailer was clipped past the 16 KB cap); same offset-0
+            # re-parse, same distinct-flag reason. We trigger the SAME clear +
+            # offset-0 backfill on ANY of these flags and clear them ALL atomically
+            # here under the held flock.
             try:
                 _reingest = conn.execute(
                     "SELECT 1 FROM cache_meta WHERE key IN "
@@ -895,7 +920,8 @@ def sync_cache(
                     " 'conversation_source_tool_use_reingest_pending',"
                     " 'conversation_reingest_enrichment_pending',"
                     " 'conversation_media_reingest_pending',"
-                    " 'conversation_queued_prompt_reingest_pending')"
+                    " 'conversation_queued_prompt_reingest_pending',"
+                    " 'conversation_reingest_nested_agent_pending')"
                 ).fetchone() is not None
             except sqlite3.OperationalError:
                 _reingest = False
@@ -931,6 +957,21 @@ def sync_cache(
             # HUMAN(text=args); the split-FTS UPDATE triggers re-index the args.
             _consume_promote_command_args(conn)
 
+            # #217 S2 / E7: consume the migration-018 title-FTS backfill under the
+            # SAME held flock. An FTS5 'rebuild' re-derives the external-content
+            # title index from conversation_ai_titles (P1-7) — idempotent under
+            # the 012-then-018 both-pending ordering, and a cheap clear-only
+            # no-op on a no-FTS5 build (P1-6). Touches ONLY the title index, never
+            # conversation_messages (P1-2).
+            _consume_title_fts(conn)
+
+            # #217 S2 / I-3: consume the migration-019 file-touches backfill under
+            # the SAME held flock. Derives conversation_file_touches from existing
+            # blocks_json history (cursor-resumable; idempotent via INSERT OR
+            # IGNORE). Touches ONLY conversation_file_touches, never
+            # conversation_messages (P1-2).
+            _consume_file_touches(conn)
+
         if targeted:
             paths = [pathlib.Path(p) for p in only_paths if pathlib.Path(p).is_file()]
         else:
@@ -1293,6 +1334,16 @@ def sync_cache(
                 # (parallel to the cost path's lifecycle).
                 if conv_rows:
                     conn.executemany(_CONV_INSERT_SQL, conv_rows)
+                    # #217 S2 / I-3: derive this tick's file touches, scoped to the
+                    # just-ingested rows' PHYSICAL keys (cr[3]=source_path,
+                    # cr[4]=byte_offset per _conv_row_tuple). Cheap (proportional to
+                    # new bytes); decoupled from the INSERT OR IGNORE rowcount —
+                    # _fill_file_touches reads conversation_messages by physical key,
+                    # so an already-present (rowcount-0) row still gets its touches.
+                    # Lands in the SAME per-file write transaction as the message
+                    # rows, so they commit atomically.
+                    _fill_file_touches(
+                        conn, scope=[(cr[3], cr[4]) for cr in conv_rows])
                 # #193: ai-title upserts for this file, in file order (last wins).
                 # Committed atomically with the session_files cursor below.
                 if ai_rows:
@@ -1486,6 +1537,7 @@ _REINGEST_FLAG_KEYS = (
     "conversation_reingest_enrichment_pending",
     "conversation_media_reingest_pending",   # #177 S4 (migration 009)
     "conversation_queued_prompt_reingest_pending",   # migration 014
+    "conversation_reingest_nested_agent_pending",    # #217 S1 (migration 017)
 )
 
 
@@ -1550,10 +1602,25 @@ def _resumable_reingest_conversation_messages(conn):
             conn.commit()
             continue
         try:
+            # #217 S2 / I-3 (P1-4): conversation_file_touches is derived state
+            # keyed by conversation_messages.id, and this per-source reingest
+            # DELETEs + re-inserts the file's message rows (bumping autoincrement
+            # ids). Delete the file's touches BEFORE the message delete (resolving
+            # the ids while they still exist), then refill from the reinserted rows
+            # AFTER — all in this one atomic transaction, so a crash leaves no stale
+            # or duplicate anchors.
+            conn.execute(
+                "DELETE FROM conversation_file_touches WHERE message_id IN "
+                "(SELECT id FROM conversation_messages WHERE source_path=?)",
+                (path_str,))
             conn.execute("DELETE FROM conversation_messages WHERE source_path=?",
                          (path_str,))
             if rows:
                 conn.executemany(_CONV_INSERT_SQL, rows)
+                # Refill scoped to this file's just-reinserted physical keys
+                # (col 3=source_path, col 4=byte_offset per _conv_row_tuple).
+                _fill_file_touches(
+                    conn, scope=[(r[3], r[4]) for r in rows])
             _set_cache_meta(conn, "conversation_reingest_cursor", path_str)
             conn.commit()
         except BaseException:
@@ -1568,6 +1635,7 @@ def _resumable_reingest_conversation_messages(conn):
         " 'conversation_reingest_enrichment_pending',"
         " 'conversation_media_reingest_pending',"
         " 'conversation_queued_prompt_reingest_pending',"
+        " 'conversation_reingest_nested_agent_pending',"
         " 'conversation_reingest_cursor',"
         " 'conversation_reingest_cursor_gen')")
     conn.commit()
@@ -1669,9 +1737,10 @@ def _fill_conversation_sessions_filter_columns(conn, session_ids):
     _project_label / _session_cost_map the rail's per-page Python path used), so
     a filtered/displayed value equals what the live rail produced. cost is
     rounded to 6dp to match list_conversations' per-row rounding.
-    cache_rebuild_count is a per-session assemble via the query kernel's
-    single-source-of-truth helper (whole-session property — recompute, never
-    increment).
+    cache_rebuild_count is a per-session lightweight rebuild-count via the
+    query kernel's single-source-of-truth helper (no full assembly — U1; the
+    rule is shared with the reader path) — a whole-session property
+    (recompute, never increment).
 
     No-op when the columns are absent (a pre-migration-015 cache.db being
     re-derived before its 015 ALTER lands), so an early/partial sync never
@@ -1758,6 +1827,153 @@ def _consume_search_split(conn) -> None:
     conn.commit()
 
 
+def _consume_title_fts(conn) -> None:
+    """#217 S2 / E7: flock-held consumer for ``conversation_title_fts_backfill_pending``
+    (set by cache migration 018). Populates the external-content title FTS over
+    ``conversation_ai_titles`` from existing history.
+
+    Uses the FTS5 ``'rebuild'`` command (the established consumer idiom —
+    ``_apply_cache_schema``'s recovery rebuild + ``_consume_search_split`` —
+    NOT blind row inserts, P1-7): ``'rebuild'`` re-derives the whole index from
+    the content table and is IDEMPOTENT even if migration 012's
+    ``ai_titles_backfill_pending`` ran first and already populated the index via
+    the conv_title_fts_ai trigger (the 012-then-018 both-pending upgrade
+    ordering) — re-running yields the same rows, no duplicates or conflict.
+
+    FTS5-unavailable (``fts5_unavailable`` set, P1-6): there is no usable vtable
+    to rebuild and a ``'rebuild'`` would error on the absent fts5 module, so just
+    clear the flag — ``kind=title`` degrades to a LIKE scan over
+    conversation_ai_titles. Touches ONLY the title index (never
+    conversation_messages — P1-2: this is NOT a message reingest); the flag is
+    dropped LAST so a crash mid-rebuild re-runs cleanly on the next sync. A fresh
+    install never sets the flag, so this is a cheap no-op there."""
+    if conn.execute(
+        "SELECT 1 FROM cache_meta "
+        "WHERE key='conversation_title_fts_backfill_pending'"
+    ).fetchone() is None:
+        return
+    fts_off = conn.execute(
+        "SELECT 1 FROM cache_meta WHERE key='fts5_unavailable'"
+    ).fetchone() is not None
+    if not fts_off:
+        # The title FTS may not exist YET even on an FTS5-capable build: a pre-S6
+        # install whose conversation_fts is still the legacy (text) shape makes
+        # _apply_cache_schema early-return at its legacy_present guard BEFORE it
+        # creates conversation_title_fts. When migrations 010 + 018 are both
+        # pending in that open, _consume_search_split swaps only the MESSAGE FTS
+        # (never the title FTS), so a blind 'rebuild' here would raise
+        # "no such table: conversation_title_fts" — fts5_unavailable is NOT set
+        # (FTS5 IS available), so the fts_off guard above does not protect it.
+        # Swallow that OperationalError and RETURN before the flag-clear so the
+        # flag survives: the NEXT open (message FTS now split → legacy_present
+        # False → _apply_cache_schema creates the title FTS) re-runs this consumer
+        # and completes the backfill. Match the message-FTS path's resilience.
+        try:
+            conn.execute(
+                "INSERT INTO conversation_title_fts(conversation_title_fts) "
+                "VALUES('rebuild')")
+        except sqlite3.OperationalError:
+            return   # title FTS not yet created (legacy-shape pre-swap); leave
+                     # the flag set, retry on the next open
+    conn.execute(
+        "DELETE FROM cache_meta WHERE key='conversation_title_fts_backfill_pending'")
+    conn.commit()
+
+
+_FILE_TOUCH_INSERT_SQL = (
+    "INSERT OR IGNORE INTO conversation_file_touches"
+    "(message_id, session_id, uuid, file_path, tool) VALUES(?,?,?,?,?)")
+
+
+def _fill_file_touches(conn, scope=None) -> None:
+    """#217 S2 / I-3: derive ``conversation_file_touches`` rows from
+    ``conversation_messages.blocks_json`` for the in-scope message rows.
+
+    ``scope`` is an iterable of ``(source_path, byte_offset)`` physical keys, or
+    ``None`` for ALL rows (the backfill). We read FROM ``conversation_messages``
+    (the source of truth) and resolve ``message_id`` from the row's own ``id``.
+
+    P1-3 (load-bearing): scope by the PHYSICAL key ``(source_path, byte_offset)``,
+    NEVER by ``uuid``. ``conversation_messages.uuid`` is NOT unique (only
+    ``(source_path, byte_offset)`` is; the uuid index is ``(session_id, uuid)``),
+    and resume/replay rows legitimately share a ``(session_id, uuid)`` — a
+    ``WHERE uuid=?`` fill would touch unrelated physical rows.
+
+    Decoupled from the message-insert rowcount ("dedup must not gate side
+    effects"): a no-op INSERT OR IGNORE of an already-present message row (rowcount
+    0) still has its touches derived here, because we read the row by physical key
+    rather than from the insert's lastrowid/rowcount.
+
+    Cheap at steady state: scoped to the rows ingested this tick (proportional to
+    new bytes), never re-parsing the whole session per tick. ``INSERT OR IGNORE``
+    on ``UNIQUE(message_id, file_path, tool)`` makes it idempotent, and a row's
+    ``blocks_json`` is immutable, so accumulate-via-IGNORE needs no per-tick DELETE.
+    The caller owns the commit (this helper never commits)."""
+    def _emit(rows):
+        for mid, sid, uuid_, bj in rows:
+            if not sid:
+                continue   # a touch row's session_id is NOT NULL; skip null-session rows
+            try:
+                blocks = json.loads(bj) if bj else []
+            except (TypeError, ValueError):
+                blocks = []
+            for fp, tool in _lib_conversation._derive_file_touches(blocks):
+                conn.execute(_FILE_TOUCH_INSERT_SQL, (mid, sid, uuid_, fp, tool))
+
+    if scope is None:
+        # Backfill: cursor-resumable 500-row batches keyed on the message rowid.
+        # Resume from the stored cursor so an interrupt skips already-derived
+        # batches (the fill is also idempotent via INSERT OR IGNORE, so a restart
+        # from 0 would be correct but redundant).
+        row = conn.execute(
+            "SELECT value FROM cache_meta "
+            "WHERE key='conversation_file_touches_cursor'").fetchone()
+        last_id = int(row[0]) if row and row[0] is not None else 0
+        while True:
+            batch = conn.execute(
+                "SELECT id, session_id, uuid, blocks_json FROM conversation_messages "
+                "WHERE id > ? ORDER BY id LIMIT 500",
+                (last_id,)).fetchall()
+            if not batch:
+                break
+            _emit(batch)
+            last_id = batch[-1][0]
+            _cctally_db_sib._set_cache_meta(
+                conn, "conversation_file_touches_cursor", str(last_id))
+            conn.commit()
+        return
+    for sp, off in scope:
+        rows = conn.execute(
+            "SELECT id, session_id, uuid, blocks_json FROM conversation_messages "
+            "WHERE source_path=? AND byte_offset=?", (sp, off)).fetchall()
+        _emit(rows)
+
+
+def _consume_file_touches(conn) -> None:
+    """#217 S2 / I-3: flock-held consumer for
+    ``conversation_reingest_file_touches_pending`` (set by cache migration 019).
+    Derives ``conversation_file_touches`` from ALL existing ``blocks_json`` history
+    via ``_fill_file_touches(conn, scope=None)`` (cursor-resumable, 500-row
+    batches), then clears the flag + cursor.
+
+    Touches ONLY ``conversation_file_touches`` (never ``conversation_messages`` —
+    P1-2: this is NOT a message reingest). The fill is idempotent (INSERT OR
+    IGNORE on the UNIQUE key), so an interrupted backfill resumes cleanly on the
+    next locked sync. A fresh install never sets the flag, so this is a cheap
+    no-op there."""
+    if conn.execute(
+        "SELECT 1 FROM cache_meta "
+        "WHERE key='conversation_reingest_file_touches_pending'"
+    ).fetchone() is None:
+        return
+    _fill_file_touches(conn, scope=None)
+    conn.execute(
+        "DELETE FROM cache_meta WHERE key IN "
+        "('conversation_reingest_file_touches_pending',"
+        " 'conversation_file_touches_cursor')")
+    conn.commit()
+
+
 def _consume_promote_command_args(conn) -> None:
     """#188 bug 4: flock-held consumer for ``conversation_promote_command_args_pending``
     (set by cache migration 011). Cursor-resumable walk of