commandmate 0.33.1 → 0.33.3

package/dist/server/src/lib/hooks/sources/antigravity/history.js

@@ -47,6 +47,25 @@
  * module reads only the former — see {@link ANTIGRAVITY_CLI_HOME_SEGMENTS} — and
  * the conversation ids are uuids in any case.
  *
+ * ## Saving and finishing are two questions (Issue #2443)
+ *
+ * agy writes no record that closes a turn, so "may this be saved" has to be
+ * answered from the shape of its last words — and an interim report has the
+ * same shape as a conclusion. #2438 made the row that follows repairable. #2443
+ * separates the *second* consequence of the same evidence: whether the body may
+ * be handed onward as the answer. Two states, and the reader reports which one
+ * the newest turn is in:
+ *
+ *  - **provisional** — History holds the turn, the scraper stands down, the row
+ *    keeps being re-read and grown, and `broadcastMessage('message_updated', …)`
+ *    refreshes what a browser is showing. Nothing leaves the server.
+ *  - **settled** — agy's own `Stop` arrived at or after the turn's newest
+ *    record, so the body is the one it finished on. The gate announces the
+ *    completion edge exactly once for that body.
+ *
+ * `docs/design/antigravity-turn-completion-2443.md` is the argument, including
+ * what happens when the evidence never arrives.
+ *
  * ## Nothing here throws
  *
  * Same contract as the other three readers, for the same reason: this runs
@@ -91,8 +110,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ANTIGRAVITY_CLI_HOME_SEGMENTS = exports.ANTIGRAVITY_TRANSCRIPT_TAIL_BYTES = void 0;
+exports.ANTIGRAVITY_TURN_RECHECK_LIMIT = exports.ANTIGRAVITY_UNSETTLED_TURN_LIMIT = exports.ANTIGRAVITY_CLI_HOME_SEGMENTS = exports.ANTIGRAVITY_TRANSCRIPT_TAIL_BYTES = void 0;
 exports.resetAntigravityTranscriptConversations = resetAntigravityTranscriptConversations;
+exports.resetAntigravityUnsettledTurns = resetAntigravityUnsettledTurns;
 exports.resolveAntigravityConversationId = resolveAntigravityConversationId;
 exports.resolveAntigravityHome = resolveAntigravityHome;
 exports.antigravityBrainRoot = antigravityBrainRoot;
@@ -106,6 +126,7 @@ const path_1 = require("path");
 const auto_yes_state_1 = require("../../../../lib/auto-yes-state");
 const transcript_tail_1 = require("../../../../lib/history/transcript-tail");
 const user_turn_recorder_1 = require("../../../../lib/history/user-turn-recorder");
+const assistant_response_saver_1 = require("../../../../lib/assistant-response-saver");
 const logger_1 = require("../../../../lib/logger");
 const agent_transcript_1 = require("../../../../types/agent-transcript");
 const transcript_1 = require("./transcript");
@@ -158,12 +179,153 @@ const ANTIGRAVITY_CONVERSATION_ID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9
  * did not would otherwise blank the pointer mid-session.
  */
 const conversationPointers = (globalThis.__antigravityTranscriptConversations ??= new Map());
+/**
+ * How many written-but-unconfirmed turns one instance may be following (#2443).
+ *
+ * The bound on the answer to "a saved row must be able to catch up with its
+ * conclusion even once three later turns have been written". Sixteen and not
+ * "however many are in the window", because the list is walked on **every**
+ * poll: each entry costs one indexed `findMessageByRequestId` and, only when
+ * that finds a row, one render of a turn that is already parsed. Sixteen turns
+ * is more than a working session accumulates without a single `Stop` arriving,
+ * and it is a fixed ceiling on a per-instance map rather than a function of a
+ * file somebody else appends to.
+ *
+ * Eviction is oldest-first and is a real loss of coverage, which is why it is
+ * logged (`antigravity-transcript-unsettled-evicted`) rather than silent. What
+ * is left is #2438's behaviour for that row: the newest
+ * {@link ANTIGRAVITY_TURN_RECHECK_LIMIT} turns are re-read regardless of this
+ * list, so an evicted entry loses the *extra* reach and not the ordinary one.
+ */
+exports.ANTIGRAVITY_UNSETTLED_TURN_LIMIT = 16;
+/**
+ * Which written turns are still waiting for agy to vouch for them (#2443).
+ *
+ * On `globalThis` for the reason {@link conversationPointers} is: under `next
+ * dev` the poller's bundle and the hook receiver's bundle each get their own
+ * copy of a module-scoped map, and a list only one of the two writers can see is
+ * not a list.
+ *
+ * In memory and not in SQLite, deliberately. The entry describes a turn this
+ * *process* wrote provisionally and has not seen confirmed; a restart loses it,
+ * and what remains is exactly {@link ANTIGRAVITY_TURN_RECHECK_LIMIT} — the same
+ * coverage #2438 shipped. Persisting it would make a row's repair depend on a
+ * table that outlives the transcript window it can only be repaired from.
+ */
+const unsettledTurns = (globalThis.__antigravityUnsettledTurns ??= new Map());
 function keyOf(target) {
     return (0, auto_yes_state_1.buildCompositeKey)(target.worktreeId, target.cliToolId, target.instanceId);
 }
-/** Forget every instance's pointer. Test seam. */
+/**
+ * Forget every instance's pointer and every unconfirmed row it was following.
+ *
+ * Test seam. Both maps, because they are two halves of one per-instance state:
+ * a suite that reset the pointer and kept the follow list would carry one test's
+ * `step_index` values into the next one's conversation.
+ */
 function resetAntigravityTranscriptConversations() {
     conversationPointers.clear();
+    unsettledTurns.clear();
+}
+/** Forget the unconfirmed rows alone. Test seam. */
+function resetAntigravityUnsettledTurns() {
+    unsettledTurns.clear();
+}
+/**
+ * The steps this instance is following in `conversationId`, oldest first.
+ *
+ * A conversation that is not the one the list was built for answers empty and
+ * drops the list: `/clear` mints a new conversation id, and following the old
+ * one's `step_index` values into it would re-check turns that are not the same
+ * turns. This is the leak test #2443 asks for, expressed as the read path
+ * rather than as a promise.
+ */
+function unsettledStepsFor(key, conversationId) {
+    const entry = unsettledTurns.get(key);
+    if (!entry)
+        return [];
+    if (entry.conversationId !== conversationId) {
+        unsettledTurns.delete(key);
+        return [];
+    }
+    return entry.steps;
+}
+/**
+ * Start, or stop, following one written turn (Issue #2443).
+ *
+ * `confirmed` is {@link AntigravityTurnCompletion.confirmed}: a turn agy has
+ * vouched for cannot grow again without a later record, and a later record takes
+ * the confirmation away and re-adds it here on the very next pass. So the list
+ * holds exactly the rows whose body is still provisional.
+ *
+ * @returns The step that was evicted to make room, or null
+ */
+function noteAntigravityTurnCompletion(key, conversationId, stepIndex, confirmed) {
+    const entry = unsettledTurns.get(key);
+    if (entry && entry.conversationId !== conversationId)
+        unsettledTurns.delete(key);
+    if (confirmed) {
+        const current = unsettledTurns.get(key);
+        if (!current)
+            return null;
+        current.steps = current.steps.filter((step) => step !== stepIndex);
+        if (current.steps.length === 0)
+            unsettledTurns.delete(key);
+        return null;
+    }
+    const current = unsettledTurns.get(key) ?? { conversationId, steps: [] };
+    unsettledTurns.set(key, current);
+    if (current.steps.includes(stepIndex))
+        return null;
+    current.steps.push(stepIndex);
+    if (current.steps.length <= exports.ANTIGRAVITY_UNSETTLED_TURN_LIMIT)
+        return null;
+    return current.steps.shift() ?? null;
+}
+/** Stop following steps the current read window no longer contains. */
+function forgetAntigravityTurnsOutsideWindow(key, conversationId, present) {
+    const entry = unsettledTurns.get(key);
+    if (!entry || entry.conversationId !== conversationId)
+        return [];
+    const dropped = entry.steps.filter((step) => !present.has(step));
+    if (dropped.length === 0)
+        return [];
+    entry.steps = entry.steps.filter((step) => present.has(step));
+    if (entry.steps.length === 0)
+        unsettledTurns.delete(key);
+    return dropped;
+}
+/**
+ * When this instance last reported that its loop stopped, or null (#2443).
+ *
+ * The one piece of evidence {@link resolveAntigravityTurnCompletion} is asked to
+ * judge against, read the way {@link resolveAntigravityConversationId} reads its
+ * own: dynamically, so `agent-event-state`'s module graph is not a static
+ * dependency of the poller, and defensively, so a state module that cannot be
+ * reached — or a build in which this reader is newer than its neighbour — is one
+ * that knows of no stop rather than one that throws inside the save path.
+ *
+ * `recordAgentStopEvent` runs **before** the Stop receiver asks for a capture
+ * (`lib/hooks/agent-event-service`), so the value is already there on the read
+ * that stop itself triggers. That ordering is what lets one seam serve both
+ * triggers instead of the receiver having to hand a flag down through the gate.
+ */
+async function resolveAntigravityStopAt(target) {
+    try {
+        const state = await Promise.resolve().then(() => __importStar(require('../../../../lib/session/agent-event-state')));
+        const read = state.getLastStopEventAt;
+        if (typeof read !== 'function')
+            return null;
+        return read(target.worktreeId, target.cliToolId, target.instanceId) ?? null;
+    }
+    catch (error) {
+        logger.debug('antigravity-transcript-stop-lookup-failed', {
+            worktreeId: target.worktreeId,
+            instanceId: target.instanceId ?? target.cliToolId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
 }
 /**
  * The conversation id this instance's transcript is under, or null.
@@ -288,11 +450,43 @@ function acceptAntigravityTranscriptPath(agyHome, candidate) {
  *
  * Never throws.
  *
+ * **A row this reader wrote is not final (Issue #2438).** Before anything is
+ * written, the newest already-written turns — at most
+ * {@link ANTIGRAVITY_TURN_RECHECK_LIMIT} of them — are re-rendered and compared
+ * against the rows they produced, and a row whose turn now renders *strictly
+ * longer* is replaced in place. agy has no record that closes a turn, so an
+ * interim report reads as a finished answer (`isAntigravityTurnClosingRecord`)
+ * and used to freeze a half-written reply into History forever. That is a
+ * repair and not a second verdict: growing an older row changes neither the
+ * return value nor `report`, both of which are about the **newest** turn.
+ *
+ * Since Issue #2436 the false can explain itself: pass a
+ * `StructuredHistoryCaptureReport` and `outcome` is set to `'not_yet_closed'`
+ * when the newest turn is one the agent has not finished writing — the case the
+ * `-turn-open` line below reports, and the one where the caller's scraped copy
+ * is worth holding rather than saving. Every other false leaves it unset, which
+ * the gate reads as `'unavailable'`.
+ *
+ * **A saved turn is not a finished turn (Issue #2443).** #2438 made the frozen
+ * row repairable and left the other half of the damage in place: the same
+ * `true` that tells the poller to drop its scrape also told the relay that the
+ * turn was over, so an interim report was **delivered** to whoever had asked
+ * agy a question, and no later `message_updated` could take that back. So the
+ * `true` now carries a second word. `report.completion` is `'settled'` only
+ * when {@link resolveAntigravityTurnCompletion} can show, from agy's own `Stop`
+ * event, that the body in hand is the one it finished on; otherwise it is
+ * `'provisional'` — History still holds the row, the repair still runs on every
+ * later read, and nothing is announced to a relay. Rows written provisionally
+ * are followed by `step_index` (see {@link ANTIGRAVITY_UNSETTLED_TURN_LIMIT}),
+ * so the conclusion is still picked up once the turn has fallen out of
+ * {@link ANTIGRAVITY_TURN_RECHECK_LIMIT}'s window.
+ *
  * @param target - The instance whose turn just ended
  * @param capture - See {@link AntigravityTranscriptCapture}
+ * @param report - Optional out-parameter; see `StructuredHistoryCaptureReport`
  * @returns Whether History now holds this turn as the agent's own Markdown
  */
-async function captureAntigravityTranscriptTurn(target, capture = {}) {
+async function captureAntigravityTranscriptTurn(target, capture = {}, report) {
     const instanceId = target.instanceId ?? target.cliToolId;
     try {
         const agyHome = capture.antigravityHome ?? resolveAntigravityHome();
@@ -347,13 +541,55 @@ async function captureAntigravityTranscriptTurn(target, capture = {}) {
                 preludeRecords: built.preludeRecords,
             });
         }
+        // Issue #2443: one read of the evidence, applied to every turn in the
+        // window. `stopAt` is agy's own account of when its loop ended; see
+        // {@link resolveAntigravityTurnCompletion} for why an ordering against the
+        // turn's newest record — rather than a word, a silence or a `status` — is
+        // what the promotion to "final" rests on.
+        const instanceKey = keyOf(target);
+        const stopAt = await resolveAntigravityStopAt(target);
+        const completions = new Map();
+        for (const turn of built.turns) {
+            completions.set(turn.stepIndex, (0, transcript_1.resolveAntigravityTurnCompletion)(turn, stopAt));
+        }
+        const newestTurn = built.turns[built.turns.length - 1];
+        const newestCompletion = completions.get(newestTurn.stepIndex) ??
+            (0, transcript_1.resolveAntigravityTurnCompletion)(newestTurn, stopAt);
+        // A step this read can no longer see is a step no later read can repair:
+        // the 4 MiB tail slid past it, its `USER_INPUT` is outside the window, or
+        // the file was replaced. Logged rather than dropped in silence, because it
+        // is the boundary of what #2443 promises.
+        const forgotten = forgetAntigravityTurnsOutsideWindow(instanceKey, conversationId, new Set(built.turns.map((turn) => turn.stepIndex)));
+        if (forgotten.length > 0) {
+            logger.info('antigravity-transcript-unsettled-out-of-window', {
+                worktreeId: target.worktreeId,
+                instanceId,
+                conversationId,
+                steps: forgotten,
+                turnsInWindow: built.turns.length,
+            });
+        }
         const pending = await selectUnwrittenAntigravityTurns(target, built.turns);
+        const writtenTurns = built.turns.slice(0, built.turns.length - pending.turns.length);
+        // Before anything is written: the rows that are already there (#2438). This
+        // is deliberately ahead of the early return below, because "the newest turn
+        // is already a row" is exactly the state the frozen row the Issue measured
+        // was stuck in — agy said "waiting for the worker", the writer saved that,
+        // and every later read answered true and did nothing while the conclusion
+        // sat in the transcript beside it. Written turns are re-checked whether or
+        // not anything is pending, so an old turn can be repaired in the same pass
+        // that writes a new one.
+        await refreshAntigravityTurnRows(target, selectAntigravityRecheckCandidates(writtenTurns, unsettledStepsFor(instanceKey, conversationId)), path, { instanceKey, conversationId, completions });
         if (pending.turns.length === 0) {
             logger.debug('antigravity-transcript-turns-already-saved', {
                 worktreeId: target.worktreeId,
                 instanceId,
                 turnsInWindow: built.turns.length,
             });
+            // Issue #2437: this turn is already History's Markdown, so the pane rows
+            // behind it must stop being "unsaved output" the pre-send flush can pick up.
+            await (0, assistant_response_saver_1.advanceCapturedLineForTranscriptTurn)(target);
+            reportAntigravityCompletion(report, newestTurn, newestCompletion);
             return true;
         }
         if (pending.turns.length > 1) {
@@ -380,7 +616,22 @@ async function captureAntigravityTranscriptTurn(target, capture = {}) {
         let captured = false;
         for (let index = 0; index < pending.turns.length; index += 1) {
             const turn = pending.turns[index];
-            captured = await writeAntigravityTurn(target, turn, (0, transcript_1.renderAntigravityTurn)(turn), resolveAssistantTimestampMs(turn, userRows[index], lastAntigravityRecordAt(turn), nextTurnOpensAt(pending.turns, userRows, index)), path);
+            captured = await writeAntigravityTurn(target, turn, (0, transcript_1.renderAntigravityTurn)(turn), resolveAssistantTimestampMs(turn, userRows[index], (0, transcript_1.antigravityTurnLastRecordAt)(turn), nextTurnOpensAt(pending.turns, userRows, index)), path, report);
+            // Issue #2443: a row now exists for this turn, and whether it is the body
+            // agy finished on is a separate question from whether it could be saved.
+            // An unconfirmed one joins the follow list so that its conclusion is still
+            // picked up once three later turns have pushed it out of #2438's window.
+            if (captured) {
+                noteUnsettledAntigravityTurn(target, instanceKey, turn, completions.get(turn.stepIndex) ?? (0, transcript_1.resolveAntigravityTurnCompletion)(turn, stopAt));
+            }
+        }
+        if (captured) {
+            // Issue #2437: History now holds this turn as the agent's own Markdown.
+            // Park the pre-send flush's cursor past the pane rows it covers, or a
+            // `/send` arriving before the next poll tick saves the whole finished turn
+            // a second time.
+            await (0, assistant_response_saver_1.advanceCapturedLineForTranscriptTurn)(target);
+            reportAntigravityCompletion(report, newestTurn, newestCompletion);
         }
         return captured;
     }
@@ -545,23 +796,6 @@ function resolveAssistantTimestampMs(turn, userRow, lastRecordAt = 0, nextTurnOp
     const latest = nextTurnOpensAt === null ? Number.POSITIVE_INFINITY : nextTurnOpensAt - 1;
     return Math.max(earliest, Math.min(lastRecordAt, latest));
 }
-/**
- * When the last record agy wrote for this turn was made (Issue #2273).
- *
- * The maximum rather than `records.at(-1)`: `created_at` is agy's own field and
- * a record that carries none reads as null, so the last record in file order is
- * not always the last one with a clock on it.
- *
- * @returns Epoch ms, or 0 when the turn has no timestamped record
- */
-function lastAntigravityRecordAt(turn) {
-    let at = 0;
-    for (const record of turn.records) {
-        if (record.timestampMs !== null && record.timestampMs > at)
-            at = record.timestampMs;
-    }
-    return at;
-}
 /**
  * The instant the next pending turn's prompt row carries, or null (Issue #2273).
  *
@@ -577,6 +811,218 @@ function nextTurnOpensAt(turns, userRows, index) {
         return null;
     return userRows[index + 1]?.timestampMs ?? next.startedAt;
 }
+/**
+ * How many already-written turns are re-rendered and compared (Issue #2438).
+ *
+ * The repair half of #2438 has to look at rows this reader has **already**
+ * written, which is the one thing the anchor rule of
+ * {@link selectUnwrittenAntigravityTurns} deliberately does not do — so it is
+ * bounded here rather than by the read window. Three, the number claude and
+ * command-code settled on in #2264 and for the same arithmetic: the poller runs
+ * every couple of seconds, re-rendering the whole window on every tick would
+ * make a repair the most expensive thing the poll does, and a turn that is going
+ * to grow grows within seconds of being written.
+ *
+ * The cost of the bound is paid by rows a session has already moved three turns
+ * past: those keep whatever they were written with. The measured case — one
+ * conversation whose only turn was `#0` — is inside it by a wide margin.
+ */
+exports.ANTIGRAVITY_TURN_RECHECK_LIMIT = 3;
+/**
+ * Replace a saved row whose body has since grown (Issue #2438).
+ *
+ * The defect this exists for is not that the wrong body was written; it is that
+ * the row was written **early**. `isAntigravityTurnClosingRecord` reads prose
+ * with no `tool_calls` as agy finishing, and an interim report — "waiting for
+ * the worker" — has exactly that shape. The row is keyed
+ * `antigravity-turn:<conversationId>#<stepIndex>`, so once it exists every later
+ * read finds it, answers "already saved", and the gate suppresses the scrape
+ * that could have carried the conclusion instead. Nothing else in the system
+ * ever revisits that row.
+ *
+ * **Strictly longer, never merely different.** Equality is the ordinary case and
+ * must cost nothing, and a body that got *shorter* between two reads is not a
+ * turn that grew — it is a window that slid, or a truncation marker, and
+ * overwriting a full reply with a shorter one is the one outcome worse than the
+ * bug. Longer implies different, so one comparison covers both.
+ *
+ * Only `content` moves. The row's `id`, `request_id`, `timestamp`, worktree,
+ * tool and instance are what History sorts and pairs on, and a repair that
+ * disturbed any of them would move an old answer to the bottom of the
+ * conversation.
+ *
+ * `message_updated`, never `message`: the row already existed and was already
+ * delivered when it was created, so a client that appended instead of replacing
+ * would show the reply twice.
+ *
+ * @param existing - The row `findMessageByRequestId` answered with
+ * @returns Whether the row was replaced
+ */
+async function growAntigravityTurnRow(target, existing, rendered, path) {
+    const instanceId = target.instanceId ?? target.cliToolId;
+    // The stored body is the only evidence of what History holds, so a row that
+    // carries none is not evidence that anything grew. Same answer as "not
+    // longer": leave it alone. This runs inside the poller's save path, where the
+    // module contract is that nothing throws.
+    const previous = existing.content;
+    if (typeof previous !== 'string')
+        return false;
+    const previousLength = previous.length;
+    if (rendered.body.length <= previousLength)
+        return false;
+    const [{ getDbInstance }, { updateMessageContent }, { broadcastMessage }] = await Promise.all([
+        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
+        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
+        Promise.resolve().then(() => __importStar(require('../../../../lib/ws-server'))),
+    ]);
+    updateMessageContent(getDbInstance(), existing.id, rendered.body);
+    broadcastMessage('message_updated', {
+        worktreeId: target.worktreeId,
+        message: { ...existing, content: rendered.body },
+    });
+    logger.info('antigravity-transcript-turn-updated', {
+        worktreeId: target.worktreeId,
+        instanceId,
+        conversationId: rendered.conversationId,
+        stepIndex: rendered.stepIndex,
+        requestId: existing.requestId,
+        path,
+        previousLength,
+        bodyLength: rendered.body.length,
+        textBlocks: rendered.textBlocks,
+        toolBlocks: rendered.toolBlocks,
+    });
+    return true;
+}
+/**
+ * Re-read the newest already-written turns and grow the short ones (#2438).
+ *
+ * Runs before the pending turns are written and independently of whether there
+ * are any — the case it exists for is precisely the one
+ * {@link captureAntigravityTranscriptTurn} used to return `true` from without
+ * doing anything: the newest turn already has a row, and that row stopped at
+ * agy's interim report.
+ *
+ * Turns that are open again are skipped rather than compared. A turn whose last
+ * record is a `tool_calls` is one agy is still working through, its body is by
+ * definition not the final one, and a repair that raced the agent would rewrite
+ * the row on every poll of a long turn. **This is not a second chance to write
+ * a turn**: a candidate with no row is left alone, because the anchor rule
+ * already decided it is not this pass's to create.
+ *
+ * The database is asked before the turn is rendered, so a candidate with no row
+ * — every candidate, in a session this reader has never written to — costs one
+ * indexed lookup and no Markdown.
+ *
+ * Serialisation is the gate's, per instance: this adds no loop and no timer of
+ * its own, it is one more thing the poll's existing pass does.
+ *
+ * @param candidates - Already-written turns, oldest first, at most
+ *   {@link ANTIGRAVITY_TURN_RECHECK_LIMIT}
+ * @returns How many rows were replaced
+ */
+async function refreshAntigravityTurnRows(target, candidates, path, follow) {
+    if (candidates.length === 0)
+        return 0;
+    const [{ getDbInstance }, { findMessageByRequestId }] = await Promise.all([
+        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
+        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
+    ]);
+    const db = getDbInstance();
+    let updated = 0;
+    for (const turn of candidates) {
+        // Issue #2443: the row lookup moved ahead of the writable check, because
+        // the follow list is a statement about ROWS. A turn that is open again has a
+        // row whose body is provisional by definition and must stay followed, and a
+        // candidate whose row has gone — History cleared, the key rewritten — is one
+        // nothing can repair and is dropped here rather than re-queried forever.
+        const existing = findMessageByRequestId(db, target.worktreeId, (0, agent_transcript_1.antigravityTurnRequestId)(turn.conversationId, turn.stepIndex));
+        if (!existing) {
+            noteAntigravityTurnCompletion(follow.instanceKey, follow.conversationId, turn.stepIndex, true);
+            continue;
+        }
+        noteUnsettledAntigravityTurn(target, follow.instanceKey, turn, follow.completions.get(turn.stepIndex) ?? (0, transcript_1.resolveAntigravityTurnCompletion)(turn, null));
+        if (!(0, transcript_1.isAntigravityTurnWritable)(turn))
+            continue;
+        if (await growAntigravityTurnRow(target, existing, (0, transcript_1.renderAntigravityTurn)(turn), path)) {
+            updated += 1;
+        }
+    }
+    return updated;
+}
+/**
+ * The written turns to re-read on this pass (Issue #2443).
+ *
+ * Two sources, concatenated oldest-first and de-duplicated:
+ *
+ *  - **the newest {@link ANTIGRAVITY_TURN_RECHECK_LIMIT}**, which is #2438's
+ *    window exactly and is what covers the ordinary case — a row saved at an
+ *    interim report and concluded seconds later, while the session has not moved
+ *    on. It is kept as a floor rather than replaced, so a cold process (one that
+ *    restarted, or one whose follow list was evicted) still has #2438's reach.
+ *  - **the followed steps**, which are the rows this process wrote from a body
+ *    agy had not vouched for. They are the ones the limit above loses: four
+ *    prompts queued back to back push the first turn out of the window in
+ *    seconds, and nothing else in the system ever revisits it.
+ *
+ * The result is bounded by `ANTIGRAVITY_TURN_RECHECK_LIMIT +
+ * {@link ANTIGRAVITY_UNSETTLED_TURN_LIMIT}` — a fixed 19 — whatever the window
+ * holds, so a long transcript cannot make a poll's cost grow with it.
+ *
+ * @param writtenTurns - Turns in the window that already have rows, oldest first
+ * @param followed - `step_index` values from the follow list
+ */
+function selectAntigravityRecheckCandidates(writtenTurns, followed) {
+    const recent = writtenTurns.slice(-exports.ANTIGRAVITY_TURN_RECHECK_LIMIT);
+    if (followed.length === 0)
+        return recent;
+    const inRecent = new Set(recent.map((turn) => turn.stepIndex));
+    const followedSteps = new Set(followed);
+    const older = writtenTurns.filter((turn) => followedSteps.has(turn.stepIndex) && !inRecent.has(turn.stepIndex));
+    return older.length === 0 ? recent : [...older, ...recent];
+}
+/**
+ * Follow this row, or stop following it, and say so once (Issue #2443).
+ *
+ * The log line is the only place an operator can see why a repair did or did not
+ * keep happening, so it carries the reason word rather than the boolean:
+ * `no-stop-event` and `stop-before-last-record` are very different sessions.
+ */
+function noteUnsettledAntigravityTurn(target, instanceKey, turn, completion) {
+    const evicted = noteAntigravityTurnCompletion(instanceKey, turn.conversationId, turn.stepIndex, completion.confirmed);
+    if (evicted === null)
+        return;
+    logger.info('antigravity-transcript-unsettled-evicted', {
+        worktreeId: target.worktreeId,
+        instanceId: target.instanceId ?? target.cliToolId,
+        conversationId: turn.conversationId,
+        step: evicted,
+        limit: exports.ANTIGRAVITY_UNSETTLED_TURN_LIMIT,
+    });
+}
+/**
+ * Tell the caller whether the turn it was handed is final (Issue #2443).
+ *
+ * `completion` is what the gate reads to decide whether a relay may be told the
+ * turn ended; `completionKey` is what stops it being told twice about one body.
+ * The key names the turn **and** the instant of its newest record, so a turn
+ * that grows after being confirmed is a new state and is announced again once
+ * the new state is itself confirmed — which is exactly the `Stop`-then-`continue`
+ * case `./source` warns about, handled without a second rule.
+ *
+ * Left entirely alone when the body is not confirmed, apart from the word
+ * `provisional`: the gate defaults an absent `completion` to `settled`, so this
+ * is the one place antigravity opts out of the pre-#2443 announcement.
+ */
+function reportAntigravityCompletion(report, turn, completion) {
+    if (!report)
+        return;
+    report.completion = completion.confirmed ? 'settled' : 'provisional';
+    report.completionKey = completion.confirmed
+        ? `${(0, agent_transcript_1.antigravityTurnRequestId)(turn.conversationId, turn.stepIndex)}@${completion.lastRecordAt}`
+        : undefined;
+    report.completionReason = completion.reason;
+}
 /**
  * Write one rendered turn, unless it is already there.
  *
@@ -587,20 +1033,36 @@ function nextTurnOpensAt(turns, userRows, index) {
  * Answering **true** for a turn that was already saved is deliberate. It means
  * "History holds this turn as Markdown", which is what the poller needs to know
  * — a second poll of the same finished turn must not save the pane's copy on top
- * of the row this path wrote.
+ * of the row this path wrote. Since #2438 that row is no longer left as it was
+ * found: it is the same comparison {@link growAntigravityTurnRow} makes for the
+ * turns the recheck window covers, made here where both the row and the turn
+ * are already in hand.
  *
  * @returns Whether History holds this turn as the agent's own Markdown
  */
-async function writeAntigravityTurn(target, turn, rendered, timestampMs, path) {
+async function writeAntigravityTurn(target, turn, rendered, timestampMs, path, report) {
     const instanceId = target.instanceId ?? target.cliToolId;
+    // Issue #2436: the caller's report is about the turn THIS call is deciding.
+    // The loop above walks oldest-first, so a verdict left by an earlier turn has
+    // to be cleared before this one's is written.
+    if (report)
+        report.outcome = undefined;
     if (!(0, transcript_1.isAntigravityTurnWritable)(turn)) {
         // agy has not finished this answer and no later prompt has taken over, so
         // what is in the file is a turn in progress. Writing it would put a reply
-        // with its last paragraph missing into History permanently — the row is
-        // keyed on `(conversationId, step_index)`, so every later read finds it and
-        // answers "already saved". That is Issue #2264, reported against claude and
+        // with its last paragraph missing into History — the row is keyed on
+        // `(conversationId, step_index)`, so every later read finds it and answers
+        // "already saved". That is Issue #2264, reported against claude and
         // structurally identical here: a turn cut off after its `tool_calls` renders
         // a *non-empty* body, so the emptiness guard below cannot see it.
+        //
+        // #2438 made such a row repairable rather than making it acceptable: a
+        // short row only grows while its turn is still among the newest
+        // {@link ANTIGRAVITY_TURN_RECHECK_LIMIT}, and nothing at all rewinds what a
+        // relay already delivered from it. Not writing it in the first place is
+        // still the fix; the repair is the second line.
+        if (report)
+            report.outcome = 'not_yet_closed';
         logger.info('antigravity-transcript-turn-open', {
             worktreeId: target.worktreeId,
             instanceId,
@@ -654,12 +1116,20 @@ async function writeAntigravityTurn(target, turn, rendered, timestampMs, path) {
         Promise.resolve().then(() => __importStar(require('../../../../lib/ws-server'))),
     ]);
     const db = getDbInstance();
-    if (findMessageByRequestId(db, target.worktreeId, requestId)) {
+    const existing = findMessageByRequestId(db, target.worktreeId, requestId);
+    if (existing) {
         logger.debug('antigravity-transcript-turn-already-saved', {
             worktreeId: target.worktreeId,
             instanceId,
             requestId,
         });
+        // The row may be one of the ones #2438 was reported for — saved at agy's
+        // interim report — and this is the one place that holds both the row and
+        // the turn. The comparison and the notification are not repeated here; see
+        // {@link growAntigravityTurnRow}. The verdict is unchanged: History holds
+        // this turn either way, and `report.outcome` is about this turn's
+        // completeness rather than about an edit.
+        await growAntigravityTurnRow(target, existing, rendered, path);
         return true;
     }
     const message = createMessage(db, {