cli-jaw 2.17.62 → 2.17.63

package/dist/src/code-mode/store.js

@@ -36,13 +36,17 @@ CREATE TABLE IF NOT EXISTS code_sessions (
     native_cursor TEXT, native_started INTEGER NOT NULL DEFAULT 0,
     native_policy_json TEXT, capabilities_json TEXT NOT NULL,
     epoch INTEGER NOT NULL DEFAULT 0, sequence INTEGER NOT NULL DEFAULT 0,
-    revision INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL, last_used_at INTEGER NOT NULL
+    revision INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL, last_used_at INTEGER NOT NULL,
+    last_turn_completed_at INTEGER, last_visited_at INTEGER, thinking INTEGER,
+    replay_floor_sequence INTEGER NOT NULL DEFAULT 0, history_generation INTEGER NOT NULL DEFAULT 0,
+    rollback_since INTEGER
 );
 CREATE TABLE IF NOT EXISTS code_turns (
     session_id TEXT NOT NULL, turn_id TEXT NOT NULL, client_turn_key TEXT NOT NULL,
     prompt_hash TEXT NOT NULL, status TEXT NOT NULL, accepted_sequence INTEGER NOT NULL,
     event_bytes INTEGER NOT NULL DEFAULT 0, control_event_bytes INTEGER NOT NULL DEFAULT 0,
     settlement_bytes INTEGER NOT NULL DEFAULT 0,
+    native_prompt_uuid TEXT, removed_generation INTEGER,
     PRIMARY KEY(session_id, turn_id), UNIQUE(session_id, client_turn_key)
 );
 CREATE TABLE IF NOT EXISTS code_events (
@@ -54,6 +58,13 @@ CREATE TABLE IF NOT EXISTS code_items (
     item_json TEXT NOT NULL, PRIMARY KEY(session_id, item_id)
 );
 CREATE INDEX IF NOT EXISTS idx_code_items_order ON code_items(session_id, first_sequence);
+CREATE TABLE IF NOT EXISTS code_steers (
+    session_id TEXT NOT NULL, turn_id TEXT NOT NULL, client_turn_key TEXT NOT NULL,
+    prompt_hash TEXT NOT NULL, status TEXT NOT NULL, accepted_sequence INTEGER, native_uuid TEXT,
+    PRIMARY KEY(session_id, client_turn_key)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_code_steers_one_per_turn ON code_steers(session_id, turn_id)
+    WHERE status IN ('reserved', 'committed', 'unknown');
 `;
 export class CodeStoreError extends Error {
     code;
@@ -65,11 +76,29 @@ export class CodeStoreError extends Error {
         this.name = 'CodeStoreError';
     }
 }
+/**
+ * The first kept user row whose turn still has a native prompt boundary, as a correlated
+ * subquery on `code_sessions.session_id`. User rows are admitted in turn order, so the earliest
+ * boundary turn (walked on idx_code_turns_boundary) that still has its row owns the minimum.
+ */
+const ROLLBACK_SINCE_SQL = `(SELECT i.first_sequence FROM code_turns t
+    JOIN code_items i ON i.session_id = t.session_id AND i.item_id = t.turn_id || ':user'
+    WHERE t.session_id = code_sessions.session_id AND t.native_prompt_uuid IS NOT NULL AND t.removed_generation IS NULL
+    ORDER BY t.accepted_sequence LIMIT 1)`;
+// `rollback_since` is stored: it is refreshed only where boundaries or user rows change, so a
+// session read on the streaming path never walks the session's turns.
 const SESSION_COLUMNS = `session_id, provider, cwd, title, model, effort, permission_mode,
     status, active_turn_id, archived_at, error_json, native_cursor, native_started,
-    native_policy_json, capabilities_json, epoch, sequence, revision, created_at, last_used_at`;
-const TURN_COLUMNS = 'turn_id, client_turn_key, prompt_hash, status, accepted_sequence';
-const isBusy = (status) => status === 'starting' || status === 'streaming' || status === 'stopping';
+    native_policy_json, capabilities_json, epoch, sequence, revision, created_at, last_used_at,
+    last_turn_completed_at, last_visited_at, thinking, replay_floor_sequence, history_generation, rollback_since`;
+const TURN_COLUMNS = 'turn_id, client_turn_key, prompt_hash, status, accepted_sequence, removed_generation';
+const STEER_COLUMNS = 'turn_id, client_turn_key, prompt_hash, status, accepted_sequence, native_uuid';
+const promptHash = (text) => createHash('sha256').update(text).digest('hex');
+function steerItem(turnId, clientTurnKey, text, at) {
+    return { itemId: `${turnId}:steer:${clientTurnKey}`, turnId, kind: 'user_message', status: 'done',
+        text, clientTurnKey, createdAt: at, updatedAt: at };
+}
+export const isBusy = (status) => status === 'starting' || status === 'streaming' || status === 'stopping';
 function mapCapabilities(value) {
     return {
         resume: value.resume, interrupt: value.interrupt, permissions: value.permissions,
@@ -144,14 +173,18 @@ export function toCodeSessionInfo(record) {
     const reason = record.archivedAt !== null ? 'archived'
         : !record.capabilities.resume ? 'unsupported'
             : record.nativeCursor ? null : record.nativeStarted ? 'resume_unavailable' : 'not_started';
+    const rollback = record.provider !== 'claude' ? 'unsupported' : reason ?? (record.rollbackSince === null ? 'no_boundary' : null);
     return {
         sessionId: record.sessionId, provider: record.provider, cwd: record.cwd, title: record.title,
         model: record.model, effort: record.effort, permissionMode: record.permissionMode,
         status: record.status, turnId: record.turnId, archivedAt: record.archivedAt,
         error: mapError(record.error), resume: { available: reason === null, reason },
+        rollback: { available: rollback === null, reason: rollback, sinceSequence: record.rollbackSince },
+        historyGeneration: record.historyGeneration,
         capabilities: mapCapabilities(record.capabilities), epoch: record.epoch,
         sequence: record.sequence, revision: record.revision, createdAt: record.createdAt,
-        lastUsedAt: record.lastUsedAt,
+        lastUsedAt: record.lastUsedAt, lastTurnCompletedAt: record.lastTurnCompletedAt,
+        lastVisitedAt: record.lastVisitedAt, thinking: record.thinking,
     };
 }
 function rowToRecord(row) {
@@ -165,11 +198,17 @@ function rowToRecord(row) {
         capabilities: JSON.parse(row.capabilities_json),
         epoch: row.epoch, sequence: row.sequence, revision: row.revision,
         createdAt: row.created_at, lastUsedAt: row.last_used_at,
+        lastTurnCompletedAt: row.last_turn_completed_at, lastVisitedAt: row.last_visited_at,
+        // Claude thinking defaults on, including rows written before the column existed.
+        thinking: row.provider === 'claude' ? row.thinking !== 0 : null,
+        replayFloorSequence: row.replay_floor_sequence, historyGeneration: row.history_generation,
+        rollbackSince: row.rollback_since,
     };
 }
+/** A turn a rollback removed is no longer current: its receipt reads cancelled. */
 function receipt(row) {
     return { turnId: row.turn_id, clientTurnKey: row.client_turn_key,
-        sequence: row.accepted_sequence, status: row.status };
+        sequence: row.accepted_sequence, status: row.removed_generation === null ? row.status : 'cancelled' };
 }
 function pageLimit(value, max) {
     if (value === undefined)
@@ -197,6 +236,8 @@ export class CodeStore {
         this.database.exec(CREATE_CODE_SCHEMA_SQL);
         this.ensureSessionListIndex();
         this.ensureBudgetColumns();
+        this.ensureActivityColumns();
+        this.ensureRollbackColumns();
     }
     /** Rebuild the list index only when it does not already match the page key. */
     ensureSessionListIndex() {
@@ -209,11 +250,63 @@ export class CodeStore {
             this.database.exec(`CREATE INDEX idx_code_sessions_list ON code_sessions(${SESSION_LIST_INDEX_COLUMNS})`);
         })();
     }
+    /** Adds the sidebar activity clocks and the thinking switch to databases created before them; all stay NULL. */
+    ensureActivityColumns() {
+        const names = new Set(this.database.prepare('PRAGMA table_info(code_sessions)').all()
+            .map(column => column.name));
+        if (names.has('last_turn_completed_at') && names.has('last_visited_at') && names.has('thinking'))
+            return;
+        this.database.transaction(() => {
+            if (!names.has('last_turn_completed_at'))
+                this.database.exec('ALTER TABLE code_sessions ADD COLUMN last_turn_completed_at INTEGER');
+            if (!names.has('last_visited_at'))
+                this.database.exec('ALTER TABLE code_sessions ADD COLUMN last_visited_at INTEGER');
+            if (!names.has('thinking'))
+                this.database.exec('ALTER TABLE code_sessions ADD COLUMN thinking INTEGER');
+        }).immediate();
+    }
+    /**
+     * Adds the rollback columns to databases created before them. Existing turns keep a
+     * NULL prompt boundary, so they are never rollback targets; floors and generations start at 0.
+     * A stored rollback start that did not exist yet is computed once for every session.
+     */
+    ensureRollbackColumns() {
+        const columns = (table) => new Set(this.database.prepare(`PRAGMA table_info(${table})`).all()
+            .map(column => column.name));
+        const sessions = columns('code_sessions'), turns = columns('code_turns');
+        const indexed = !!this.database.prepare("SELECT 1 FROM sqlite_master WHERE type = 'index' AND name = 'idx_code_turns_boundary'").get();
+        if (indexed && sessions.has('rollback_since') && sessions.has('replay_floor_sequence') && sessions.has('history_generation')
+            && turns.has('native_prompt_uuid') && turns.has('removed_generation'))
+            return;
+        this.database.transaction(() => {
+            if (!sessions.has('replay_floor_sequence'))
+                this.database.exec('ALTER TABLE code_sessions ADD COLUMN replay_floor_sequence INTEGER NOT NULL DEFAULT 0');
+            if (!sessions.has('history_generation'))
+                this.database.exec('ALTER TABLE code_sessions ADD COLUMN history_generation INTEGER NOT NULL DEFAULT 0');
+            if (!turns.has('native_prompt_uuid'))
+                this.database.exec('ALTER TABLE code_turns ADD COLUMN native_prompt_uuid TEXT');
+            if (!turns.has('removed_generation'))
+                this.database.exec('ALTER TABLE code_turns ADD COLUMN removed_generation INTEGER');
+            this.database.exec(`CREATE INDEX IF NOT EXISTS idx_code_turns_boundary ON code_turns(session_id, accepted_sequence)
+                WHERE native_prompt_uuid IS NOT NULL AND removed_generation IS NULL`);
+            if (!sessions.has('rollback_since')) {
+                this.database.exec('ALTER TABLE code_sessions ADD COLUMN rollback_since INTEGER');
+                this.database.exec(`UPDATE code_sessions SET rollback_since = ${ROLLBACK_SINCE_SQL}`);
+            }
+        }).immediate();
+    }
+    /** Adds the per-turn byte budgets; an up-to-date database returns before taking the write lock. */
     ensureBudgetColumns() {
+        const budgetColumns = ['event_bytes', 'control_event_bytes', 'settlement_bytes'];
+        const present = () => new Set(this.database.prepare('PRAGMA table_info(code_turns)').all()
+            .map(column => column.name));
+        const before = present();
+        if (budgetColumns.every(column => before.has(column)))
+            return;
         this.database.transaction(() => {
-            const columns = this.database.prepare('PRAGMA table_info(code_turns)').all();
-            const names = new Set(columns.map(column => column.name));
-            for (const column of ['event_bytes', 'control_event_bytes', 'settlement_bytes']) {
+            // Read again under the lock: another process may have migrated in between.
+            const names = present();
+            for (const column of budgetColumns) {
                 if (!names.has(column))
                     this.database.exec(`ALTER TABLE code_turns ADD COLUMN ${column} INTEGER NOT NULL DEFAULT 0`);
             }
@@ -252,6 +345,14 @@ export class CodeStore {
             throw new CodeStoreError('session_not_found', 'Code session not found', 404);
         return record;
     }
+    /**
+     * Refresh the stored rollback start after boundaries or user rows change, before the session
+     * event that saves it. Every writer of either calls this.
+     */
+    readRollbackSince(sessionId) {
+        return this.database.prepare(`SELECT ${ROLLBACK_SINCE_SQL} AS since FROM code_sessions WHERE session_id = ?`)
+            .get(sessionId)?.since ?? null;
+    }
     read(sessionId) {
         const record = this.readRecord(sessionId);
         return record ? toCodeSessionInfo(record) : null;
@@ -353,9 +454,13 @@ export class CodeStore {
         }
         const size = pageLimit(limit, CODE_EVENT_PAGE_MAX);
         return this.database.transaction(() => {
-            const throughSequence = this.requireRecord(sessionId).sequence;
+            const record = this.requireRecord(sessionId);
+            const throughSequence = record.sequence;
             if (afterSequence > throughSequence)
                 throw new CodeStoreError('invalid_sequence', 'Sequence exceeds session watermark', 409);
+            // Events before a rollback describe items it removed; only a new snapshot is consistent.
+            if (afterSequence < record.replayFloorSequence)
+                throw new CodeStoreError('invalid_sequence', 'Conversation was rolled back; take a new snapshot', 409);
             const events = [];
             let bytes = jsonBytes({ events, nextSequence: throughSequence, throughSequence, hasMore: false });
             if (bytes > this.limits.maxReplayPageBytes)
@@ -437,8 +542,10 @@ export class CodeStore {
     save(record) {
         this.database.prepare(`UPDATE code_sessions SET title = ?, model = ?, effort = ?, permission_mode = ?,
             status = ?, active_turn_id = ?, archived_at = ?, error_json = ?, native_cursor = ?, native_started = ?,
-            native_policy_json = ?, epoch = ?, sequence = ?, revision = ?, last_used_at = ? WHERE session_id = ?`)
-            .run(record.title, record.model, record.effort, record.permissionMode, record.status, record.turnId, record.archivedAt, record.error === null ? null : JSON.stringify(mapError(record.error)), record.nativeCursor, Number(record.nativeStarted), record.nativePolicy === null ? null : JSON.stringify(record.nativePolicy), record.epoch, record.sequence, record.revision, record.lastUsedAt, record.sessionId);
+            native_policy_json = ?, epoch = ?, sequence = ?, revision = ?, last_used_at = ?,
+            last_turn_completed_at = ?, last_visited_at = ?, thinking = ?, replay_floor_sequence = ?,
+            history_generation = ?, rollback_since = ? WHERE session_id = ?`)
+            .run(record.title, record.model, record.effort, record.permissionMode, record.status, record.turnId, record.archivedAt, record.error === null ? null : JSON.stringify(mapError(record.error)), record.nativeCursor, Number(record.nativeStarted), record.nativePolicy === null ? null : JSON.stringify(record.nativePolicy), record.epoch, record.sequence, record.revision, record.lastUsedAt, record.lastTurnCompletedAt, record.lastVisitedAt, record.thinking === null ? null : Number(record.thinking), record.replayFloorSequence, record.historyGeneration, record.rollbackSince, record.sessionId);
     }
     persistEvent(record, event, mode, settlementDelta = 0, budgetTurnId = record.turnId) {
         const encoded = JSON.stringify(event);
@@ -467,7 +574,8 @@ export class CodeStore {
         this.save(record);
         return event;
     }
-    event(record, item, mode = 'ordinary', budgetTurnId = record.turnId) {
+    /** `reserve` holds extra settlement bytes for a frame this item may need at settlement. */
+    event(record, item, mode = 'ordinary', budgetTurnId = record.turnId, reserve = 0) {
         record.sequence += 1;
         let retainedItem;
         let previousItem;
@@ -491,7 +599,7 @@ export class CodeStore {
             sequence: record.sequence, epoch: record.epoch,
             ...(update ? { update } : retainedItem ? { item: retainedItem } : { session: toCodeSessionInfo(record) }),
         };
-        this.persistEvent(record, event, mode, settlementCost(record.sessionId, retainedItem) - settlementCost(record.sessionId, previousItem), budgetTurnId);
+        this.persistEvent(record, event, mode, settlementCost(record.sessionId, retainedItem) - settlementCost(record.sessionId, previousItem) + reserve, budgetTurnId);
         if (item)
             this.database.prepare(`INSERT INTO code_items (session_id, item_id, first_sequence, item_json)
             VALUES (?, ?, ?, ?) ON CONFLICT(session_id, item_id) DO UPDATE SET item_json = excluded.item_json`)
@@ -504,8 +612,8 @@ export class CodeStore {
             const sessionId = input.sessionId ?? this.newId();
             this.database.prepare(`INSERT INTO code_sessions
                 (session_id, provider, cwd, title, model, effort, permission_mode, status,
-                 capabilities_json, created_at, last_used_at) VALUES (?, ?, ?, ?, ?, ?, ?, 'idle', ?, ?, ?)`)
-                .run(sessionId, input.provider, input.cwd, input.title ?? null, input.model, input.effort, input.permissionMode, JSON.stringify(mapCapabilities(input.capabilities)), now, now);
+                 capabilities_json, created_at, last_used_at, thinking) VALUES (?, ?, ?, ?, ?, ?, ?, 'idle', ?, ?, ?, ?)`)
+                .run(sessionId, input.provider, input.cwd, input.title ?? null, input.model, input.effort, input.permissionMode, JSON.stringify(mapCapabilities(input.capabilities)), now, now, input.thinking === undefined ? null : Number(input.thinking));
             const record = this.requireRecord(sessionId);
             const events = [this.event(record)];
             return { session: toCodeSessionInfo(record), events };
@@ -521,21 +629,139 @@ export class CodeStore {
     readTurn(sessionId, clientTurnKey) {
         const row = this.database.prepare(`SELECT ${TURN_COLUMNS} FROM code_turns WHERE session_id = ? AND client_turn_key = ?`)
             .get(sessionId, clientTurnKey);
+        if (!row)
+            this.refuseSteerKey(sessionId, clientTurnKey);
         return row ? receipt(row) : null;
     }
+    /** One client key names one message: a prompt key is never a follow-up key, or the reverse. */
+    refuseSteerKey(sessionId, clientTurnKey) {
+        if (this.database.prepare('SELECT 1 FROM code_steers WHERE session_id = ? AND client_turn_key = ?').get(sessionId, clientTurnKey)) {
+            throw new CodeStoreError('turn_key_conflict', 'Client turn key was used for a follow-up', 409);
+        }
+    }
+    steerRow(sessionId, clientTurnKey) {
+        return this.database.prepare(`SELECT ${STEER_COLUMNS} FROM code_steers WHERE session_id = ? AND client_turn_key = ?`)
+            .get(sessionId, clientTurnKey);
+    }
+    /** A follow-up receipt reports its owning turn as a prompt receipt does: a turn a rollback removed reads cancelled. */
+    turnStatus(sessionId, turnId) {
+        const turn = this.database.prepare('SELECT status, removed_generation FROM code_turns WHERE session_id = ? AND turn_id = ?')
+            .get(sessionId, turnId);
+        return turn.removed_generation === null ? turn.status : 'cancelled';
+    }
+    /** The follow-up key state machine; null means a new key that may be reserved. */
+    steerKey(sessionId, clientTurnKey, text) {
+        if (!text.trim() || !clientTurnKey.trim())
+            throw new CodeStoreError('invalid_prompt', 'Text and client turn key are required', 400);
+        this.requireRecord(sessionId);
+        if (this.database.prepare('SELECT 1 FROM code_turns WHERE session_id = ? AND client_turn_key = ?').get(sessionId, clientTurnKey)) {
+            throw new CodeStoreError('turn_key_conflict', 'Client turn key was used for a prompt', 409);
+        }
+        const row = this.steerRow(sessionId, clientTurnKey);
+        if (!row)
+            return null;
+        if (row.prompt_hash !== promptHash(text))
+            throw new CodeStoreError('turn_key_conflict', 'Client turn key was used for different content', 409);
+        if (row.status === 'reserved')
+            throw new CodeStoreError('steer_in_flight', 'This follow-up is still being delivered', 409);
+        if (row.status === 'rejected')
+            throw new CodeStoreError('steer_key_spent', 'This follow-up was refused; send it again as a new message', 409);
+        if (row.status === 'unknown')
+            throw new CodeStoreError('steer_outcome_unknown', 'Follow-up delivery could not be confirmed', 503);
+        return { turnId: row.turn_id, clientTurnKey, sequence: row.accepted_sequence, status: this.turnStatus(sessionId, row.turn_id) };
+    }
+    /** The committed receipt of a follow-up key, whatever its turn has become since. */
+    readSteer(sessionId, input) {
+        return this.database.transaction(() => this.steerKey(sessionId, input.clientTurnKey, input.text))();
+    }
+    /**
+     * Take the running turn's one follow-up slot before any native offer. No events: the
+     * message joins the transcript only through commitSteer, after the runtime accepted it.
+     */
+    reserveSteer(input) {
+        return this.write(() => {
+            const replay = this.steerKey(input.sessionId, input.clientTurnKey, input.text);
+            if (replay)
+                return { reservationId: input.clientTurnKey, receipt: replay };
+            const record = this.requireRecord(input.sessionId);
+            if (record.epoch !== input.epoch || record.turnId !== input.turnId) {
+                throw new CodeStoreError('stale_owner', 'Code turn ownership has changed', 409);
+            }
+            if (record.archivedAt !== null || record.status !== 'streaming' || record.turnId === null) {
+                throw new CodeStoreError('session_not_steerable', 'This turn does not take a follow-up right now', 409);
+            }
+            const turnId = record.turnId;
+            if (this.database.prepare(`SELECT 1 FROM code_steers WHERE session_id = ? AND turn_id = ?
+                AND status IN ('reserved', 'committed', 'unknown')`).get(input.sessionId, turnId)) {
+                throw new CodeStoreError('steer_queue_full', 'The running turn already has its follow-up', 409);
+            }
+            // Refuse before the native offer what commitSteer could not store, including the reserve for
+            // the settlement frame that may re-mark this item; digits a later sequence adds are covered.
+            const item = steerItem(turnId, input.clientTurnKey, input.text, this.now());
+            const bytes = jsonBytes({ topic: 'code', event: 'code_item', sessionId: record.sessionId, sequence: record.sequence + 1,
+                epoch: record.epoch, item: mapItem(item, record.sequence + 1) }) + 32;
+            const budget = this.database.prepare(`SELECT event_bytes, control_event_bytes, settlement_bytes FROM code_turns
+                WHERE session_id = ? AND turn_id = ?`).get(record.sessionId, turnId);
+            if (bytes > this.limits.maxEventBytes
+                || budget.event_bytes - budget.control_event_bytes + bytes > this.limits.maxTurnEventBytes
+                || budget.control_event_bytes + budget.settlement_bytes + settlementCost(record.sessionId, { ...item, status: 'pending' })
+                    + CODE_SETTLEMENT_TAIL_BYTES > CODE_TERMINAL_RESERVE_BYTES) {
+                throw new CodeStoreError('transcript_limit', 'Code turn event byte limit reached', 409);
+            }
+            this.database.prepare(`INSERT INTO code_steers (session_id, turn_id, client_turn_key, prompt_hash, status)
+                VALUES (?, ?, ?, ?, 'reserved')`).run(input.sessionId, turnId, input.clientTurnKey, promptHash(input.text));
+            return { reservationId: input.clientTurnKey, receipt: null };
+        });
+    }
+    /** The runtime accepted the follow-up: append it to the running turn and spend the reservation. */
+    commitSteer(sessionId, reservationId, text, nativeId) {
+        return this.write(() => {
+            const row = this.steerRow(sessionId, reservationId);
+            const record = this.requireRecord(sessionId);
+            if (!row || row.status !== 'reserved' || row.prompt_hash !== promptHash(text) || record.turnId !== row.turn_id
+                || record.archivedAt !== null || record.status !== 'streaming') {
+                throw new CodeStoreError('stale_owner', 'Follow-up reservation is no longer open', 409);
+            }
+            const item = steerItem(row.turn_id, reservationId, text, this.now());
+            const events = [this.event(record, item, 'ordinary', row.turn_id, settlementCost(sessionId, { ...item, status: 'pending' }))];
+            this.database.prepare(`UPDATE code_steers SET status = 'committed', accepted_sequence = ?, native_uuid = ?
+                WHERE session_id = ? AND client_turn_key = ?`).run(record.sequence, nativeId, sessionId, reservationId);
+            return { session: toCodeSessionInfo(record), events,
+                receipt: { turnId: row.turn_id, clientTurnKey: reservationId, sequence: record.sequence, status: this.turnStatus(sessionId, row.turn_id) } };
+        });
+    }
+    /**
+     * A definitive refusal before native acceptance: the key is spent, the turn's slot is free again.
+     * A turn that settled while the offer was in flight left the row `unknown`; the in-flight call
+     * that then learns the runtime refused the offer is the one owner that can make it definitive.
+     */
+    rejectSteer(sessionId, reservationId) {
+        this.write(() => {
+            this.database.prepare(`UPDATE code_steers SET status = 'rejected' WHERE session_id = ? AND client_turn_key = ?
+                AND status IN ('reserved', 'unknown')`).run(sessionId, reservationId);
+        });
+    }
+    /** Native input left the process without a durable record: the slot stays spent and the key answers unknown. */
+    markSteerUnknown(sessionId, reservationId) {
+        this.write(() => {
+            this.database.prepare(`UPDATE code_steers SET status = 'unknown' WHERE session_id = ? AND client_turn_key = ?
+                AND status <> 'committed'`).run(sessionId, reservationId);
+        });
+    }
     admitTurn(input) {
         return this.write(() => {
             if (!input.text.trim() || !input.clientTurnKey.trim())
                 throw new CodeStoreError('invalid_prompt', 'Text and client turn key are required', 400);
             const record = this.requireRecord(input.sessionId);
-            const promptHash = createHash('sha256').update(input.text).digest('hex');
+            const hash = promptHash(input.text);
             const previous = this.database.prepare(`SELECT ${TURN_COLUMNS} FROM code_turns WHERE session_id = ? AND client_turn_key = ?`)
                 .get(input.sessionId, input.clientTurnKey);
             if (previous) {
-                if (previous.prompt_hash !== promptHash)
+                if (previous.prompt_hash !== hash)
                     throw new CodeStoreError('turn_key_conflict', 'Client turn key was used for different content', 409);
-                return { session: toCodeSessionInfo(record), events: [], receipt: receipt(previous), duplicate: true };
+                return { session: toCodeSessionInfo(record), events: [], receipt: receipt(previous), duplicate: true, promptUuid: null };
             }
+            this.refuseSteerKey(input.sessionId, input.clientTurnKey);
             if (record.archivedAt !== null)
                 throw new CodeStoreError('session_archived', 'Code session is archived', 409);
             if (input.expectedRevision !== undefined && input.expectedRevision !== record.revision) {
@@ -556,17 +782,20 @@ export class CodeStore {
                 record.title = initialTitle(input.text) || null;
             record.nativePolicy = { model: record.model, effort: record.effort, permissionMode: record.permissionMode };
             const acceptedSequence = record.sequence + 3;
+            // The private native input identity; the provider sends the prompt under it.
+            const promptUuid = record.provider === 'claude' ? randomUUID() : null;
             this.database.prepare(`INSERT INTO code_turns
-                (session_id, turn_id, client_turn_key, prompt_hash, status, accepted_sequence)
-                VALUES (?, ?, ?, ?, 'accepted', ?)`)
-                .run(input.sessionId, turnId, input.clientTurnKey, promptHash, acceptedSequence);
+                (session_id, turn_id, client_turn_key, prompt_hash, status, accepted_sequence, native_prompt_uuid)
+                VALUES (?, ?, ?, ?, 'accepted', ?, ?)`)
+                .run(input.sessionId, turnId, input.clientTurnKey, hash, acceptedSequence, promptUuid);
             const events = [
                 this.event(record, { itemId: `${turnId}:user`, turnId, kind: 'user_message', status: 'done',
                     text: input.text, clientTurnKey: input.clientTurnKey, createdAt: now, updatedAt: now }),
                 this.event(record, { itemId: `${turnId}:started`, turnId, kind: 'turn_started', status: 'running', createdAt: now, updatedAt: now }),
-                this.event(record),
             ];
-            return { session: toCodeSessionInfo(record), events, duplicate: false,
+            record.rollbackSince = this.readRollbackSince(input.sessionId);
+            events.push(this.event(record));
+            return { session: toCodeSessionInfo(record), events, duplicate: false, promptUuid,
                 receipt: { turnId, clientTurnKey: input.clientTurnKey, sequence: acceptedSequence, status: 'accepted' } };
         });
     }
@@ -591,6 +820,15 @@ export class CodeStore {
             return { session: toCodeSessionInfo(record), events };
         });
     }
+    /** The Manager opened this session. A read receipt: the metadata revision does not move. */
+    markVisited(sessionId) {
+        return this.write(() => {
+            const record = this.requireRecord(sessionId);
+            record.lastVisitedAt = this.now();
+            const events = [this.event(record)];
+            return { session: toCodeSessionInfo(record), events };
+        });
+    }
     /** Reserve an explicit resume without inventing a prompt or consuming a client key. */
     beginAttach(sessionId, expectedRevision) {
         return this.write(() => {
@@ -642,14 +880,22 @@ export class CodeStore {
                 throw new CodeStoreError('stale_owner', 'Native cursor owner is no longer writable', 409);
             if (cursor !== null && !cursor.trim())
                 throw new CodeStoreError('invalid_cursor', 'Native cursor must be nonempty', 400);
+            // Boundaries belong to the native session that recorded them. A replaced identity
+            // retires them; the first identity, and the active turn now sent to it, keep theirs.
+            if (cursor !== null && record.nativeCursor !== null && cursor !== record.nativeCursor) {
+                this.database.prepare('UPDATE code_turns SET native_prompt_uuid = NULL WHERE session_id = ? AND turn_id IS NOT ?')
+                    .run(record.sessionId, record.turnId);
+            }
             record.nativeStarted = true;
             if (cursor !== null)
                 record.nativeCursor = cursor;
+            record.rollbackSince = this.readRollbackSince(record.sessionId);
             const events = [this.event(record)];
             return { session: toCodeSessionInfo(record), events };
         });
     }
-    finish(record, result) {
+    /** `lostRuntime`: a restart settles the turn, and nothing can confirm what its runtime consumed. */
+    finish(record, result, lostRuntime = false) {
         const turn = this.database.prepare(`SELECT ${TURN_COLUMNS} FROM code_turns WHERE session_id = ? AND turn_id = ?`)
             .get(record.sessionId, record.turnId);
         if (!turn)
@@ -684,16 +930,49 @@ export class CodeStore {
                 .run(status, now, record.sessionId, item.item_id);
             after = item.first_sequence;
         }
+        // A follow-up no native result consumed may never have reached Claude; say so on its item.
+        // After a restart every committed follow-up of the turn reads that way.
+        const undelivered = new Set(result.undeliveredFollowUps ?? []);
+        const steers = this.database.prepare(`SELECT client_turn_key, native_uuid FROM code_steers
+            WHERE session_id = ? AND turn_id = ? AND status = 'committed'`).all(record.sessionId, turnId);
+        for (const steer of steers) {
+            const itemId = `${turnId}:steer:${steer.client_turn_key}`;
+            const projected = this.database.prepare('SELECT first_sequence FROM code_items WHERE session_id = ? AND item_id = ?')
+                .get(record.sessionId, itemId);
+            const unconfirmed = lostRuntime || (steer.native_uuid !== null && undelivered.has(steer.native_uuid));
+            if (!unconfirmed || !projected)
+                continue;
+            record.sequence += 1;
+            events.push(this.persistEvent(record, {
+                topic: 'code', event: 'code_item_update', sessionId: record.sessionId, sequence: record.sequence, epoch: record.epoch,
+                update: { itemId, turnId, firstSequence: projected.first_sequence, phase: 'unknown', updatedAt: now },
+            }, 'settlement', -settlementCost(record.sessionId, { itemId, turnId, status: 'pending' }), turnId));
+            this.database.prepare(`UPDATE code_items SET item_json = json_set(item_json, '$.phase', 'unknown', '$.updatedAt', ?)
+                WHERE session_id = ? AND item_id = ?`).run(now, record.sessionId, itemId);
+        }
+        // A reservation still open here may already have been offered to the runtime: its key answers
+        // unknown (never "send it again"), and the turn's slot stays spent.
+        this.database.prepare(`UPDATE code_steers SET status = 'unknown' WHERE session_id = ? AND turn_id = ? AND status = 'reserved'`)
+            .run(record.sessionId, turnId);
         const kind = result.status === 'completed' ? 'turn_completed' : result.status === 'failed' ? 'turn_failed' : 'turn_cancelled';
         events.push(this.event(record, { itemId: `${record.turnId}:terminal`, turnId: record.turnId, kind,
             status: result.status === 'completed' ? 'done' : result.status === 'failed' ? 'error' : 'cancelled',
             ...(error ? { text: error.message } : {}), createdAt: now, updatedAt: now }, 'settlement', turnId));
         this.database.prepare('UPDATE code_turns SET status = ? WHERE session_id = ? AND turn_id = ?')
             .run(result.status, record.sessionId, record.turnId);
+        // A prompt that never reached the native runtime is absent from its history.
+        if (result.dispatched === false) {
+            this.database.prepare('UPDATE code_turns SET native_prompt_uuid = NULL WHERE session_id = ? AND turn_id = ?')
+                .run(record.sessionId, record.turnId);
+            record.rollbackSince = this.readRollbackSince(record.sessionId);
+        }
         record.turnId = null;
         record.status = result.status === 'failed' ? 'failed' : 'idle';
         record.error = error;
         record.lastUsedAt = now;
+        // The unread clock: a user-stopped turn is one they were watching, so it does not count.
+        if (result.status !== 'cancelled')
+            record.lastTurnCompletedAt = now;
         events.push(this.event(record, undefined, 'settlement', turnId));
         return { session: toCodeSessionInfo(record), events, receipt: { ...receipt(turn), status: result.status } };
     }
@@ -718,7 +997,8 @@ export class CodeStore {
             const record = this.requireRecord(sessionId);
             if (record.revision !== patch.expectedRevision)
                 throw new CodeStoreError('revision_conflict', 'Code metadata changed', 409);
-            const policyChange = patch.model !== undefined || patch.effort !== undefined || patch.permissionMode !== undefined;
+            const policyChange = patch.model !== undefined || patch.effort !== undefined || patch.permissionMode !== undefined
+                || patch.thinking !== undefined;
             if (isBusy(record.status) && (policyChange || patch.archived !== undefined)) {
                 throw new CodeStoreError('session_busy', 'Active Code sessions cannot change policy or archive', 409);
             }
@@ -730,6 +1010,8 @@ export class CodeStore {
                 record.effort = patch.effort;
             if (patch.permissionMode !== undefined)
                 record.permissionMode = patch.permissionMode;
+            if (patch.thinking !== undefined)
+                record.thinking = patch.thinking;
             if (patch.archived !== undefined)
                 record.archivedAt = patch.archived ? record.archivedAt ?? this.now() : null;
             // Invalidates idle runtime callbacks after reconfiguration or archive.
@@ -741,6 +1023,109 @@ export class CodeStore {
             return { session: toCodeSessionInfo(record), events };
         });
     }
+    /** Kept and later turns around a settled `${turnId}:user` target; removed turns are not part of the conversation. */
+    rollbackTurns(record, upToItemId) {
+        const item = this.database.prepare(`SELECT json_extract(item_json, '$.kind') AS kind, json_extract(item_json, '$.turnId') AS turn_id
+            FROM code_items WHERE session_id = ? AND item_id = ?`).get(record.sessionId, upToItemId);
+        const turnId = item?.turn_id;
+        if (!item || item.kind !== 'user_message' || typeof turnId !== 'string' || `${turnId}:user` !== upToItemId) {
+            throw new CodeStoreError('rollback_target_not_found', 'Rollback target is not a turn in this conversation', 404);
+        }
+        const turns = this.database.prepare(`SELECT turn_id, status, accepted_sequence, native_prompt_uuid FROM code_turns
+            WHERE session_id = ? AND removed_generation IS NULL ORDER BY accepted_sequence`).all(record.sessionId);
+        const index = turns.findIndex(turn => turn.turn_id === turnId);
+        const target = turns[index];
+        if (!target)
+            throw new CodeStoreError('rollback_target_not_found', 'Rollback target is not a turn in this conversation', 404);
+        if (target.status !== 'completed' && target.status !== 'failed' && target.status !== 'cancelled') {
+            throw new CodeStoreError('session_busy', 'The rollback target has not settled', 409);
+        }
+        return { kept: turns.slice(0, index + 1), later: turns.slice(index + 1) };
+    }
+    /**
+     * Validate a rollback to the item's turn without writing anything. The target must carry a
+     * boundary; later turns are passed as they are, boundary or not, and the provider proves
+     * where the fork ends (see `forkClaudeHistory`) before any fork.
+     */
+    readRollbackPlan(sessionId, upToItemId) {
+        return this.database.transaction(() => {
+            const record = this.requireRecord(sessionId);
+            if (record.archivedAt !== null)
+                throw new CodeStoreError('session_archived', 'Code session is archived', 409);
+            if (record.provider !== 'claude' || !record.nativeCursor)
+                throw new CodeStoreError('rollback_unavailable', 'Conversation history is unavailable', 409);
+            const { kept, later } = this.rollbackTurns(record, upToItemId);
+            const target = kept.at(-1);
+            if (!later.length)
+                throw new CodeStoreError('rollback_noop', 'The target is already the latest turn', 409);
+            if (target.native_prompt_uuid === null) {
+                throw new CodeStoreError('rollback_boundary_unavailable', 'This turn has no recorded conversation boundary', 409);
+            }
+            const turn = (row) => ({ turnId: row.turn_id, promptUuid: row.native_prompt_uuid });
+            return { target: { turnId: target.turn_id, promptUuid: target.native_prompt_uuid }, kept: kept.map(turn),
+                later: later.map(turn), revision: record.revision, epoch: record.epoch, nativeCursor: record.nativeCursor,
+                title: record.title };
+        })();
+    }
+    /**
+     * Commit a verified fork in one transaction, compare-and-swap on the revision, epoch and
+     * native cursor the plan was read at. Later items and their events leave; their turn rows
+     * stay so client keys keep answering, marked removed. Replay below the new floor fails with
+     * `invalid_sequence`, and the history generation tells live readers to take a snapshot.
+     * Follow-up rows (`code_steers`) stay as they are: their keys remain spent and their native
+     * ids are not remapped (only a running turn reads them). The follow-up items of removed turns
+     * leave with the other later items, and their receipts read cancelled like the turns'.
+     */
+    commitRollback(input) {
+        return this.write(() => {
+            const record = this.requireRecord(input.sessionId);
+            if (record.revision !== input.expectedRevision || record.epoch !== input.expectedEpoch
+                || record.nativeCursor !== input.expectedCursor || record.turnId !== null || isBusy(record.status)
+                || record.archivedAt !== null || record.provider !== 'claude') {
+                throw new CodeStoreError('revision_conflict', 'Code session changed during rollback', 409);
+            }
+            if (!input.forkCursor.trim() || input.forkCursor === input.expectedCursor) {
+                throw new CodeStoreError('invalid_cursor', 'Rollback fork must be a new native session', 400);
+            }
+            const { kept, later } = this.rollbackTurns(record, input.upToItemId);
+            if (!later.length)
+                throw new CodeStoreError('rollback_noop', 'The target is already the latest turn', 409);
+            const keptIds = new Set(kept.map(turn => turn.turn_id));
+            if (!input.remapped.every(turn => keptIds.has(turn.turnId) && !!turn.promptUuid.trim())
+                || !input.cleared.every(turnId => keptIds.has(turnId))) {
+                throw new CodeStoreError('rollback_unavailable', 'Rollback boundaries do not match the kept turns', 409);
+            }
+            const generation = record.historyGeneration + 1;
+            const after = kept.at(-1).accepted_sequence;
+            const cut = this.database.prepare(`SELECT MIN(first_sequence) AS cut FROM code_items WHERE session_id = ?
+                AND json_extract(item_json, '$.turnId') IN (SELECT turn_id FROM code_turns WHERE session_id = ?
+                    AND removed_generation IS NULL AND accepted_sequence > ?)`)
+                .get(record.sessionId, record.sessionId, after).cut;
+            if (cut !== null) {
+                this.database.prepare('DELETE FROM code_items WHERE session_id = ? AND first_sequence >= ?').run(record.sessionId, cut);
+                this.database.prepare('DELETE FROM code_events WHERE session_id = ? AND sequence >= ?').run(record.sessionId, cut);
+            }
+            this.database.prepare(`UPDATE code_turns SET removed_generation = ? WHERE session_id = ?
+                AND removed_generation IS NULL AND accepted_sequence > ?`).run(generation, record.sessionId, after);
+            // Every source boundary is retired; only the ones found again in the fork return.
+            this.database.prepare('UPDATE code_turns SET native_prompt_uuid = NULL WHERE session_id = ?').run(record.sessionId);
+            const remap = this.database.prepare('UPDATE code_turns SET native_prompt_uuid = ? WHERE session_id = ? AND turn_id = ?');
+            for (const turn of input.remapped)
+                remap.run(turn.promptUuid, record.sessionId, turn.turnId);
+            record.historyGeneration = generation;
+            record.nativeCursor = input.forkCursor;
+            record.nativeStarted = true;
+            record.revision += 1;
+            record.epoch += 1;
+            record.status = 'idle';
+            record.error = null;
+            record.lastUsedAt = this.now();
+            record.rollbackSince = this.readRollbackSince(record.sessionId);
+            record.replayFloorSequence = record.sequence + 1;
+            const events = [this.event(record)];
+            return { session: toCodeSessionInfo(record), events };
+        });
+    }
     /** Call once before the manager admits work. Never replays a native prompt. */
     recoverInterrupted() {
         return this.write(() => {
@@ -751,8 +1136,11 @@ export class CodeStore {
                 const record = rowToRecord(row);
                 record.epoch += 1;
                 const error = { code: 'orphaned_turn', message: 'Code turn interrupted by server restart', at: this.now(), recoverable: true };
-                if (record.turnId !== null)
-                    events.push(...this.finish(record, { status: 'failed', error }).events);
+                // A turn is marked streaming before its prompt is handed to the runtime, so one still
+                // starting never sent it: its boundary cannot be in native history.
+                if (record.turnId !== null) {
+                    events.push(...this.finish(record, { status: 'failed', error, ...(row.status === 'starting' ? { dispatched: false } : {}) }, true).events);
+                }
                 else {
                     record.status = 'failed';
                     record.error = error;