gestalt-mobile 0.17.2 → 0.18.0

package/dist/server/server/platform/codex/session-runtime.js

@@ -8,9 +8,11 @@ import { randomUUID } from 'node:crypto';
 import { createPlanMeasurementSnapshot, } from '../../features/plans/application/measurement-snapshot.js';
 import { canRebindMissingRollout, rebindMissingRollout, } from '../../features/sessions/restore-session/use-case.js';
 import { gestaltQuizDynamicTool } from '../../../shared/contracts/quiz.js';
+import { gestaltOrgPlanAttentionDynamicTool } from '../../../shared/contracts/org-plan-attention.js';
 import { threadPlanName } from './thread-plan-name.js';
 import { WriterAcquisitionError, } from '../../features/sessions/application/writer-acquisition.js';
 import { isCodexThreadWriterBusy, isMissingCodexThreadRollout } from './json-rpc-client.js';
+import { resolvedServerRequestId } from './server-request.js';
 /** One private owner for every resource acquired for a live Codex child. */
 class SessionResource {
     sessionId;
@@ -38,7 +40,6 @@ class SessionResource {
             return false;
         this.disposed = true;
         for (const pending of this.pendingRequests.values()) {
-            clearTimeout(pending.timer);
             pending.reject(new Error('CODEX_SERVER_REQUEST_CANCELLED'));
         }
         this.pendingRequests.clear();
@@ -65,13 +66,14 @@ export class CodexSessionRuntime {
     planStatusSource;
     onPlanStatus;
     planMeasurementBaseUrl;
-    requestTimeoutMs;
     maxPendingRequests;
     readerCwd;
     constructor(launch, 
     // Kept as an ignored compatibility slot while callers migrate from the old
     // correlated-map constructor shape.  Live ownership is `sessions` only.
-    _legacyProcesses = undefined, onNotification, onServerRequest, onProcessExit, resolveSkills, planStatusSource, onPlanStatus, planMeasurementBaseUrl, requestTimeoutMs = 30_000, maxPendingRequests = 64, readerCwd) {
+    _legacyProcesses = undefined, onNotification, onServerRequest, onProcessExit, resolveSkills, planStatusSource, onPlanStatus, planMeasurementBaseUrl, 
+    // Compatibility slot: blocking app-server requests wait for explicit input.
+    _legacyRequestTimeoutMs = undefined, maxPendingRequests = 64, readerCwd) {
         this.launch = launch;
         this.onNotification = onNotification;
         this.onServerRequest = onServerRequest;
@@ -80,10 +82,10 @@ export class CodexSessionRuntime {
         this.planStatusSource = planStatusSource;
         this.onPlanStatus = onPlanStatus;
         this.planMeasurementBaseUrl = planMeasurementBaseUrl;
-        this.requestTimeoutMs = requestTimeoutMs;
         this.maxPendingRequests = maxPendingRequests;
         this.readerCwd = readerCwd;
         void _legacyProcesses;
+        void _legacyRequestTimeoutMs;
     }
     sessions = new Map();
     historyReads = new Map();
@@ -99,7 +101,9 @@ export class CodexSessionRuntime {
             resource.threadId = startedThreadId;
             this.sessions.set(session.id, resource);
             await this.writePendingThreadName(session.id);
-            return RelaySession.rehydrate(session).bindThread(startedThreadId, now).snapshot;
+            return RelaySession.rehydrate(session)
+                .bindThread(startedThreadId, now)
+                .supportsAttentionTool(now).snapshot;
         }
         catch (error) {
             resource.dispose();
@@ -138,10 +142,16 @@ export class CodexSessionRuntime {
         if (!resource || !pending)
             return false;
         resource.pendingRequests.delete(requestId);
-        clearTimeout(pending.timer);
         pending.resolve(result);
         return true;
     }
+    /** Distinguishes an offline relay writer from a live writer that cleared a request. */
+    attentionWriterState(sessionId, requestId) {
+        const resource = this.sessions.get(sessionId);
+        if (!resource || !resource.active)
+            return 'unavailable';
+        return resource.pendingRequests.has(requestId) ? 'available' : 'cleared';
+    }
     async startTurn(session, text, clientUserMessageId, now) {
         const resource = this.sessions.get(session.id);
         if (!resource || !session.threadId)
@@ -229,6 +239,67 @@ export class CodexSessionRuntime {
                 this.historyReads.delete(session.id);
         }
     }
+    /** Bounded reconciliation port for direct spawned children only. */
+    async listDirectChildren(session) {
+        if (!session.threadId)
+            throw new Error('CODEX_THREAD_ID_MISSING');
+        const owned = this.sessions.get(session.id);
+        if (!owned)
+            return [];
+        const children = [];
+        const cursors = new Set();
+        let cursor;
+        for (let page = 0; page < 4 && children.length < 64; page += 1) {
+            const result = await owned.process.rpc.request('thread/list', {
+                parentThreadId: session.threadId,
+                ...(cursor ? { cursor } : {}),
+            });
+            const response = result && typeof result === 'object' ? result : null;
+            const data = response && Array.isArray(response.data) ? response.data : [];
+            children.push(...data.flatMap((candidate) => {
+                if (!candidate || typeof candidate !== 'object')
+                    return [];
+                const value = candidate;
+                if (typeof value.id !== 'string' || value.id.length === 0 || value.id.length > 256)
+                    return [];
+                const rawStatus = value.status && typeof value.status === 'object'
+                    ? value.status.type
+                    : undefined;
+                // `thread/list` is our bounded child-authority read. A row without
+                // one of its documented statuses cannot prove a child is healthy.
+                const status = rawStatus === 'active' ||
+                    rawStatus === 'idle' ||
+                    rawStatus === 'notLoaded' ||
+                    rawStatus === 'systemError'
+                    ? rawStatus
+                    : undefined;
+                return [
+                    {
+                        id: value.id,
+                        ...(status ? { status } : { status: 'notLoaded', qualified: false }),
+                        ...(typeof value.agentNickname === 'string' && value.agentNickname.length <= 128
+                            ? { nickname: value.agentNickname }
+                            : {}),
+                        ...(typeof value.agentRole === 'string' && value.agentRole.length <= 128
+                            ? { role: value.agentRole }
+                            : {}),
+                    },
+                ];
+            }));
+            const next = typeof response?.nextCursor === 'string' && response.nextCursor.length <= 256
+                ? response.nextCursor
+                : undefined;
+            if (!next)
+                return children;
+            if (cursors.has(next) || children.length >= 64)
+                throw new Error('CODEX_CHILD_LIST_UNSUPPORTED');
+            cursors.add(next);
+            cursor = next;
+        }
+        if (cursor)
+            throw new Error('CODEX_CHILD_LIST_UNSUPPORTED');
+        return children;
+    }
     async readDetachedHistory(session) {
         // A reader is intentionally not a SessionResource: it owns no subscriptions,
         // runtime registration, plan lease, or writer state and is closed on every path.
@@ -278,10 +349,10 @@ export class CodexSessionRuntime {
                 await resource.process.rpc.request('thread/resume', {
                     threadId: session.threadId,
                     cwd: session.workspacePath,
-                    dynamicTools: [gestaltQuizDynamicTool],
+                    dynamicTools: [gestaltQuizDynamicTool, gestaltOrgPlanAttentionDynamicTool],
                 });
                 result = {
-                    session: RelaySession.rehydrate(session).restore(now).snapshot,
+                    session: RelaySession.rehydrate(session).restore(now).supportsAttentionTool(now).snapshot,
                     historyUnavailable: false,
                     replacementCreated: false,
                 };
@@ -337,18 +408,17 @@ export class CodexSessionRuntime {
         }
     }
     holdServerRequest(resource, request) {
-        if (!resource.active || !this.onServerRequest?.(resource.sessionId, request)) {
-            return Promise.reject(new Error('CODEX_SERVER_REQUEST_UNSUPPORTED'));
-        }
+        if (!resource.active)
+            return Promise.reject(new Error('CODEX_SERVER_REQUEST_CANCELLED'));
         if (resource.pendingRequests.size >= this.maxPendingRequests)
             return Promise.reject(new Error('CODEX_SERVER_REQUEST_LIMIT'));
         const requestId = String(request.id);
+        if (resource.pendingRequests.has(requestId))
+            return Promise.reject(new Error('CODEX_SERVER_REQUEST_DUPLICATE'));
+        if (!this.onServerRequest?.(resource.sessionId, request))
+            return Promise.reject(new Error('CODEX_SERVER_REQUEST_UNSUPPORTED'));
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                if (resource.pendingRequests.delete(requestId))
-                    reject(new Error('CODEX_SERVER_REQUEST_TIMEOUT'));
-            }, this.requestTimeoutMs);
-            resource.pendingRequests.set(requestId, { resolve, reject, timer });
+            resource.pendingRequests.set(requestId, { resolve, reject });
         });
     }
     async startThread(process, session, settings = {}) {
@@ -358,7 +428,7 @@ export class CodexSessionRuntime {
         return {
             cwd: session.workspacePath,
             approvalPolicy: settings.approvalPolicy ?? 'on-request',
-            dynamicTools: [gestaltQuizDynamicTool],
+            dynamicTools: [gestaltQuizDynamicTool, gestaltOrgPlanAttentionDynamicTool],
             ...(settings.model ? { model: settings.model } : {}),
             ...(settings.sandbox ? { sandbox: settings.sandbox } : {}),
         };
@@ -393,15 +463,37 @@ export class CodexSessionRuntime {
                 if (this.sessions.get(session.id) === resource)
                     this.sessions.delete(session.id);
             });
-            const notificationUnsubscribe = process.rpc.onNotification((notification) => {
-                if (resource.active)
-                    this.onNotification?.(session.id, notification);
-            });
-            const requestUnsubscribe = process.rpc.onServerRequest((request) => this.holdServerRequest(resource, request));
+            // Own process exit before resume/initialization can make this resource appear healthy.
+            // A short-lived child could otherwise leave a durable ready session without a writer.
             const exitUnsubscribe = process.onExit?.(() => {
                 if (resource.dispose())
                     this.onProcessExit?.(session.id);
             }) ?? (() => { });
+            resource.attach([exitUnsubscribe]);
+            if (!resource.active) {
+                exitUnsubscribe();
+                throw new Error('CODEX_SESSION_PROCESS_EXITED');
+            }
+            const notificationUnsubscribe = process.rpc.onNotification((notification) => {
+                if (!resource.active)
+                    return;
+                const resolvedRequestId = resolvedServerRequestId(notification);
+                if (resolvedRequestId) {
+                    const pending = resource.pendingRequests.get(resolvedRequestId);
+                    resource.pendingRequests.delete(resolvedRequestId);
+                    // App-server has already cleared the request, so settle the local handler too.
+                    // The late JSON-RPC error response is harmless and prevents an orphaned promise.
+                    // The notification callback reconciles the durable interaction record.
+                    pending?.reject(new Error('CODEX_SERVER_REQUEST_CLEARED'));
+                }
+                this.onNotification?.(session.id, notification);
+            });
+            const requestUnsubscribe = process.rpc.onServerRequest((request) => this.holdServerRequest(resource, request));
+            if (!resource.active) {
+                notificationUnsubscribe();
+                requestUnsubscribe();
+                throw new Error('CODEX_SESSION_PROCESS_EXITED');
+            }
             // The resource's private unsubscribe list is populated before it is published.
             resource.attach([notificationUnsubscribe, requestUnsubscribe, exitUnsubscribe]);
             return resource;

package/dist/server/server/platform/persistence/migrate.js

@@ -3,9 +3,10 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-const schema = `CREATE TABLE IF NOT EXISTS relay_sessions (id TEXT PRIMARY KEY, workspace_id TEXT NOT NULL, workspace_path TEXT NOT NULL, profile TEXT NOT NULL, model TEXT, branch TEXT, thread_id TEXT, state TEXT NOT NULL, desired_state TEXT NOT NULL, active_turn_id TEXT, protocol_version TEXT, failure_count INTEGER NOT NULL DEFAULT 0, effective_skill_selection_json TEXT, last_org_plan_json TEXT, next_sequence INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL); CREATE TABLE IF NOT EXISTS pending_interactions (session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, request_id TEXT NOT NULL, kind TEXT NOT NULL, payload_json TEXT NOT NULL, turn_id TEXT, requested_at TEXT, resolved_at TEXT, outcome TEXT, PRIMARY KEY (session_id, request_id)); CREATE TABLE IF NOT EXISTS session_events (session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, sequence INTEGER NOT NULL, occurred_at TEXT NOT NULL, type TEXT NOT NULL, payload_json TEXT NOT NULL, PRIMARY KEY (session_id, sequence)); CREATE TABLE IF NOT EXISTS idempotency_results (scope TEXT NOT NULL, key TEXT NOT NULL, status_code INTEGER NOT NULL, body_json TEXT NOT NULL, PRIMARY KEY (scope, key));`;
+const schema = `CREATE TABLE IF NOT EXISTS relay_sessions (id TEXT PRIMARY KEY, workspace_id TEXT NOT NULL, workspace_path TEXT NOT NULL, profile TEXT NOT NULL, model TEXT, branch TEXT, thread_id TEXT, state TEXT NOT NULL, desired_state TEXT NOT NULL, active_turn_id TEXT, protocol_version TEXT, failure_count INTEGER NOT NULL DEFAULT 0, effective_skill_selection_json TEXT, last_org_plan_json TEXT, next_sequence INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL); CREATE TABLE IF NOT EXISTS pending_interactions (session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, request_id TEXT NOT NULL, kind TEXT NOT NULL, payload_json TEXT NOT NULL, turn_id TEXT, requested_at TEXT, resolved_at TEXT, outcome TEXT, operation_key TEXT, resolution_state TEXT NOT NULL DEFAULT 'active', PRIMARY KEY (session_id, request_id)); CREATE TABLE IF NOT EXISTS session_events (session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, sequence INTEGER NOT NULL, occurred_at TEXT NOT NULL, type TEXT NOT NULL, payload_json TEXT NOT NULL, autopilot_outbox_id INTEGER, PRIMARY KEY (session_id, sequence), UNIQUE(session_id, autopilot_outbox_id)); CREATE TABLE IF NOT EXISTS idempotency_results (scope TEXT NOT NULL, key TEXT NOT NULL, status_code INTEGER NOT NULL, body_json TEXT NOT NULL, PRIMARY KEY (scope, key)); CREATE TABLE IF NOT EXISTS autopilot_sessions (session_id TEXT PRIMARY KEY REFERENCES relay_sessions(id) ON DELETE CASCADE, state TEXT NOT NULL, requested_enabled INTEGER NOT NULL, plan_identity TEXT, plan_fingerprint TEXT, generation INTEGER NOT NULL, no_progress_count INTEGER NOT NULL, next_evaluation_at TEXT, last_control_id TEXT, stop_reason TEXT, updated_at TEXT NOT NULL); CREATE TABLE IF NOT EXISTS autopilot_controls (session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, control_id TEXT NOT NULL, status TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, failure_code TEXT, turn_id TEXT, PRIMARY KEY (session_id, control_id)); CREATE TABLE IF NOT EXISTS autopilot_outbox (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, type TEXT NOT NULL, payload_json TEXT NOT NULL, occurred_at TEXT NOT NULL);`;
 export function migrate(database) {
     database.exec(schema);
+    database.exec("CREATE INDEX IF NOT EXISTS session_events_autopilot_audit_tail_v2 ON session_events(session_id, type, sequence DESC) WHERE type IN ('autopilot.continuation-scheduled','autopilot.control-issued','autopilot.turn-started','autopilot.turn-failed','autopilot.progress-reset','autopilot.updated','org-plan.attention-required','org-plan.attention-resolved')");
     const columns = database.prepare('PRAGMA table_info(relay_sessions)').all();
     if (!columns.some((column) => column.name === 'effective_skill_selection_json'))
         database.exec('ALTER TABLE relay_sessions ADD COLUMN effective_skill_selection_json TEXT');
@@ -15,6 +16,8 @@ export function migrate(database) {
         database.exec('ALTER TABLE relay_sessions ADD COLUMN model TEXT');
     if (!columns.some((column) => column.name === 'branch'))
         database.exec('ALTER TABLE relay_sessions ADD COLUMN branch TEXT');
+    if (!columns.some((column) => column.name === 'attention_tool_capability'))
+        database.exec('ALTER TABLE relay_sessions ADD COLUMN attention_tool_capability TEXT');
     const interactionColumns = database
         .prepare('PRAGMA table_info(pending_interactions)')
         .all();
@@ -24,4 +27,16 @@ export function migrate(database) {
         database.exec('ALTER TABLE pending_interactions ADD COLUMN requested_at TEXT');
     if (!interactionColumns.some((column) => column.name === 'outcome'))
         database.exec('ALTER TABLE pending_interactions ADD COLUMN outcome TEXT');
+    if (!interactionColumns.some((column) => column.name === 'operation_key'))
+        database.exec('ALTER TABLE pending_interactions ADD COLUMN operation_key TEXT');
+    if (!interactionColumns.some((column) => column.name === 'resolution_state'))
+        database.exec("ALTER TABLE pending_interactions ADD COLUMN resolution_state TEXT NOT NULL DEFAULT 'active'");
+    const eventColumns = database.prepare('PRAGMA table_info(session_events)').all();
+    if (!eventColumns.some((column) => column.name === 'autopilot_outbox_id')) {
+        database.exec('ALTER TABLE session_events ADD COLUMN autopilot_outbox_id INTEGER');
+        database.exec('CREATE UNIQUE INDEX IF NOT EXISTS session_events_autopilot_outbox ON session_events(session_id, autopilot_outbox_id)');
+    }
+    const controlColumns = database.prepare('PRAGMA table_info(autopilot_controls)').all();
+    if (!controlColumns.some((column) => column.name === 'turn_id'))
+        database.exec('ALTER TABLE autopilot_controls ADD COLUMN turn_id TEXT');
 }

package/dist/server/server/platform/persistence/sqlite-autopilot-store.js

@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+export class SqliteAutopilotStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    find(sessionId) {
+        const row = this.db
+            .prepare('SELECT * FROM autopilot_sessions WHERE session_id = ?')
+            .get(sessionId);
+        if (!row)
+            return null;
+        if (!['disabled', 'monitoring', 'backoff', 'attentionRequired', 'completed'].includes(String(row.state)) ||
+            ![
+                'manualDisabled',
+                'planRequired',
+                'planComplete',
+                'sessionUnavailable',
+                'attentionRequired',
+                'noPlanProgress',
+                'reconcileFailed',
+                'planRemoved',
+                'planReplaced',
+                'sessionEnded',
+                'null',
+            ].includes(String(row.stop_reason)) ||
+            !Number.isSafeInteger(Number(row.generation)) ||
+            Number(row.generation) < 0 ||
+            !Number.isSafeInteger(Number(row.no_progress_count)) ||
+            Number(row.no_progress_count) < 0 ||
+            ![0, 1].includes(Number(row.requested_enabled)))
+            return null;
+        return {
+            sessionId: String(row.session_id),
+            state: row.state,
+            requestedEnabled: Number(row.requested_enabled) === 1,
+            planIdentity: row.plan_identity === null ? null : String(row.plan_identity),
+            planFingerprint: row.plan_fingerprint === null ? null : String(row.plan_fingerprint),
+            generation: Number(row.generation),
+            consecutiveNoProgress: Number(row.no_progress_count),
+            nextEvaluationAt: row.next_evaluation_at === null ? null : String(row.next_evaluation_at),
+            lastControlId: row.last_control_id === null ? null : String(row.last_control_id),
+            stopReason: row.stop_reason,
+            updatedAt: String(row.updated_at),
+        };
+    }
+    save(state) {
+        this.db
+            .prepare('INSERT INTO autopilot_sessions (session_id,state,requested_enabled,plan_identity,plan_fingerprint,generation,no_progress_count,next_evaluation_at,last_control_id,stop_reason,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(session_id) DO UPDATE SET state=excluded.state,requested_enabled=excluded.requested_enabled,plan_identity=excluded.plan_identity,plan_fingerprint=excluded.plan_fingerprint,generation=excluded.generation,no_progress_count=excluded.no_progress_count,next_evaluation_at=excluded.next_evaluation_at,last_control_id=excluded.last_control_id,stop_reason=excluded.stop_reason,updated_at=excluded.updated_at')
+            .run(state.sessionId, state.state, state.requestedEnabled ? 1 : 0, state.planIdentity, state.planFingerprint, state.generation, state.consecutiveNoProgress, state.nextEvaluationAt, state.lastControlId, state.stopReason, state.updatedAt);
+    }
+    findControl(sessionId, controlId) {
+        const row = this.db
+            .prepare('SELECT * FROM autopilot_controls WHERE session_id = ? AND control_id = ?')
+            .get(sessionId, controlId);
+        if (!row || !['scheduled', 'issued', 'started', 'failed'].includes(String(row.status)))
+            return null;
+        const failureCode = row.failure_code === null ? null : String(row.failure_code);
+        if (failureCode !== null && !['START_FAILED', 'START_UNAVAILABLE'].includes(failureCode))
+            return null;
+        return {
+            sessionId: String(row.session_id),
+            controlId: String(row.control_id),
+            status: row.status,
+            createdAt: String(row.created_at),
+            updatedAt: String(row.updated_at),
+            failureCode: failureCode,
+            turnId: row.turn_id === null ? null : String(row.turn_id),
+        };
+    }
+    saveControl(control) {
+        this.db
+            .prepare("INSERT INTO autopilot_controls (session_id,control_id,status,created_at,updated_at,failure_code,turn_id) VALUES (?,?,?,?,?,?,?) ON CONFLICT(session_id,control_id) DO UPDATE SET status=excluded.status,updated_at=excluded.updated_at,failure_code=excluded.failure_code,turn_id=COALESCE(excluded.turn_id,autopilot_controls.turn_id) WHERE CASE autopilot_controls.status WHEN 'scheduled' THEN 0 WHEN 'issued' THEN 1 WHEN 'started' THEN 2 WHEN 'failed' THEN 2 END <= CASE excluded.status WHEN 'scheduled' THEN 0 WHEN 'issued' THEN 1 WHEN 'started' THEN 2 WHEN 'failed' THEN 2 END")
+            .run(control.sessionId, control.controlId, control.status, control.createdAt, control.updatedAt, control.failureCode, control.turnId ?? null);
+    }
+    commit(input) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            if (input.state)
+                this.save(input.state);
+            if (input.control)
+                this.saveControl(input.control);
+            this.appendOutbox(input.events);
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    claimControlIssued(sessionId, controlId, updatedAt, state, events = []) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const result = this.db
+                .prepare("UPDATE autopilot_controls SET status = 'issued', updated_at = ? WHERE session_id = ? AND control_id = ? AND status = 'scheduled'")
+                .run(updatedAt, sessionId, controlId);
+            if (result.changes !== 1) {
+                this.db.exec('ROLLBACK');
+                return null;
+            }
+            const control = this.findControl(sessionId, controlId);
+            if (!control)
+                throw new Error('AUTOPILOT_CONTROL_MISSING_AFTER_CLAIM');
+            if (state)
+                this.save(state);
+            this.appendOutbox(events);
+            this.db.exec('COMMIT');
+            return control;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    drainOutbox(sessionId) {
+        return this.db
+            .prepare('SELECT id,session_id,type,payload_json,occurred_at FROM autopilot_outbox WHERE session_id = ? ORDER BY id')
+            .all(sessionId).map((row) => ({
+            id: row.id,
+            sessionId: row.session_id,
+            type: row.type,
+            payload: JSON.parse(row.payload_json),
+            occurredAt: row.occurred_at,
+        }));
+    }
+    acknowledgeOutbox(id) {
+        this.db.prepare('DELETE FROM autopilot_outbox WHERE id = ?').run(id);
+    }
+    appendOutbox(events) {
+        const statement = this.db.prepare('INSERT INTO autopilot_outbox (session_id,type,payload_json,occurred_at) VALUES (?,?,?,?)');
+        for (const event of events)
+            statement.run(event.sessionId, event.type, JSON.stringify(event.payload), event.occurredAt);
+    }
+    acceptedControlTurns(sessionId) {
+        return new Map(this.db
+            .prepare("SELECT turn_id,control_id FROM autopilot_controls WHERE session_id = ? AND status = 'started' AND turn_id IS NOT NULL")
+            .all(sessionId).map((row) => [row.turn_id, row.control_id]));
+    }
+    controlIds(sessionId) {
+        return new Set(this.db
+            .prepare('SELECT control_id FROM autopilot_controls WHERE session_id = ?')
+            .all(sessionId).map((row) => row.control_id));
+    }
+    remove(sessionId) {
+        this.db.prepare('DELETE FROM autopilot_sessions WHERE session_id = ?').run(sessionId);
+    }
+}

package/dist/server/server/platform/persistence/sqlite-event-journal.js

@@ -3,6 +3,31 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
+export const autopilotAuditEventTypes = [
+    'autopilot.continuation-scheduled',
+    'autopilot.control-issued',
+    'autopilot.turn-started',
+    'autopilot.turn-failed',
+    'autopilot.progress-reset',
+    'autopilot.updated',
+    'org-plan.attention-required',
+    'org-plan.attention-resolved',
+];
+/**
+ * Not every coordinator state publication is useful as a timeline record.
+ * Keep this predicate in SQL so a burst of routine `monitoring` updates cannot
+ * consume the bounded, user-visible audit tail.
+ */
+const renderableAutopilotAuditWhere = `
+  type IN (${autopilotAuditEventTypes.map(() => '?').join(',')})
+  AND (
+    type <> 'autopilot.updated'
+    OR json_extract(payload_json, '$.state') IN ('backoff', 'attentionRequired', 'completed')
+    OR (
+      json_extract(payload_json, '$.state') = 'disabled'
+      AND json_extract(payload_json, '$.reason') = 'planRequired'
+    )
+  )`;
 export class SqliteEventJournal {
     db;
     retain;
@@ -10,7 +35,7 @@ export class SqliteEventJournal {
         this.db = db;
         this.retain = retain;
     }
-    append(sessionId, type, payload, occurredAt) {
+    append(sessionId, type, payload, occurredAt, autopilotOutboxId) {
         this.db.exec('BEGIN IMMEDIATE');
         try {
             const row = this.db
@@ -18,9 +43,24 @@ export class SqliteEventJournal {
                 .get(sessionId);
             if (!row)
                 throw new Error('SESSION_NOT_FOUND');
-            this.db
-                .prepare('INSERT INTO session_events (session_id,sequence,occurred_at,type,payload_json) VALUES (?,?,?,?,?)')
-                .run(sessionId, row.sequence, occurredAt, type, JSON.stringify(payload));
+            const inserted = this.db
+                .prepare('INSERT OR IGNORE INTO session_events (session_id,sequence,occurred_at,type,payload_json,autopilot_outbox_id) VALUES (?,?,?,?,?,?)')
+                .run(sessionId, row.sequence, occurredAt, type, JSON.stringify(payload), autopilotOutboxId ?? null);
+            if (inserted.changes === 0 && autopilotOutboxId !== undefined) {
+                const existing = this.db
+                    .prepare('SELECT sequence,type,occurred_at,payload_json FROM session_events WHERE session_id = ? AND autopilot_outbox_id = ?')
+                    .get(sessionId, autopilotOutboxId);
+                if (existing) {
+                    this.db.exec('COMMIT');
+                    return {
+                        sessionId,
+                        sequence: existing.sequence,
+                        type: existing.type,
+                        occurredAt: existing.occurred_at,
+                        payload: JSON.parse(existing.payload_json),
+                    };
+                }
+            }
             this.db
                 .prepare('UPDATE relay_sessions SET next_sequence = next_sequence + 1 WHERE id = ?')
                 .run(sessionId);
@@ -47,4 +87,52 @@ export class SqliteEventJournal {
             payload: JSON.parse(row.payload_json),
         }));
     }
+    /** Bounded chronological tail for redacted timeline projections. */
+    tail(sessionId, limit) {
+        const safeLimit = Math.max(1, Math.min(limit, 200));
+        return this.db
+            .prepare('SELECT sequence,type,occurred_at,payload_json FROM session_events WHERE session_id = ? ORDER BY sequence DESC LIMIT ?')
+            .all(sessionId, safeLimit)
+            .reverse()
+            .map((row) => ({
+            sessionId,
+            sequence: row.sequence,
+            type: row.type,
+            occurredAt: row.occurred_at,
+            payload: JSON.parse(row.payload_json),
+        }));
+    }
+    tailWithTruncation(sessionId, limit) {
+        const safeLimit = Math.max(1, Math.min(limit, 200));
+        const events = this.tail(sessionId, safeLimit);
+        const oldest = events.at(0)?.sequence;
+        const truncated = oldest !== undefined &&
+            Boolean(this.db
+                .prepare('SELECT 1 AS present FROM session_events WHERE session_id = ? AND sequence < ? LIMIT 1')
+                .get(sessionId, oldest));
+        return { events, truncated };
+    }
+    /**
+     * Reads only audit-bearing rows. A generic journal tail can otherwise be
+     * filled with chat deltas and incorrectly report an empty audit history.
+     */
+    autopilotAuditTail(sessionId, limit) {
+        const safeLimit = Math.max(1, Math.min(limit, 200));
+        const rows = this.db
+            .prepare(`SELECT sequence,type,occurred_at,payload_json FROM session_events WHERE session_id = ? AND ${renderableAutopilotAuditWhere} ORDER BY sequence DESC LIMIT ?`)
+            .all(sessionId, ...autopilotAuditEventTypes, safeLimit);
+        const events = rows.reverse().map((row) => ({
+            sessionId,
+            sequence: row.sequence,
+            type: row.type,
+            occurredAt: row.occurred_at,
+            payload: JSON.parse(row.payload_json),
+        }));
+        const oldest = events.at(0)?.sequence;
+        const truncated = oldest !== undefined &&
+            Boolean(this.db
+                .prepare(`SELECT 1 AS present FROM session_events WHERE session_id = ? AND sequence < ? AND ${renderableAutopilotAuditWhere} LIMIT 1`)
+                .get(sessionId, oldest, ...autopilotAuditEventTypes));
+        return { events, truncated };
+    }
 }

package/dist/server/server/platform/persistence/sqlite-pending-interaction-store.js

@@ -4,7 +4,13 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 function safeInteractionOutcome(value) {
-    return value === 'approved' || value === 'denied' || value === 'answered' ? value : 'answered';
+    return value === 'approved' ||
+        value === 'denied' ||
+        value === 'answered' ||
+        value === 'dismissed' ||
+        value === 'failed'
+        ? value
+        : 'answered';
 }
 export class SqlitePendingInteractionStore {
     db;
@@ -13,7 +19,13 @@ export class SqlitePendingInteractionStore {
     }
     add(sessionId, interaction) {
         this.db
-            .prepare('INSERT INTO pending_interactions (session_id,request_id,kind,payload_json,turn_id,requested_at) VALUES (?,?,?,?,?,?)')
+            .prepare(`INSERT INTO pending_interactions (session_id,request_id,kind,payload_json,turn_id,requested_at)
+         VALUES (?,?,?,?,?,?)
+         ON CONFLICT(session_id,request_id) DO UPDATE SET
+           kind = excluded.kind, payload_json = excluded.payload_json, turn_id = excluded.turn_id,
+           requested_at = excluded.requested_at, resolved_at = NULL, outcome = NULL, operation_key = NULL,
+           resolution_state = 'active'
+         WHERE pending_interactions.kind != 'orgPlanAttention'`)
             .run(sessionId, interaction.requestId, interaction.kind, JSON.stringify(interaction.payload), interaction.turnId ?? null, interaction.requestedAt ?? null);
     }
     resolve(sessionId, requestId, resolvedAt, outcome = 'answered') {
@@ -21,6 +33,44 @@ export class SqlitePendingInteractionStore {
             .prepare('UPDATE pending_interactions SET resolved_at = ?, outcome = ? WHERE session_id = ? AND request_id = ? AND resolved_at IS NULL')
             .run(resolvedAt, outcome, sessionId, requestId).changes === 1);
     }
+    /**
+     * The operation key is claimed before a writer is touched.  A matching retry
+     * keeps that claim, whereas another key is permanently stale.
+     */
+    claimOperation(sessionId, requestId, operationKey) {
+        const row = this.db
+            .prepare('SELECT resolved_at,operation_key FROM pending_interactions WHERE session_id = ? AND request_id = ?')
+            .get(sessionId, requestId);
+        if (!row)
+            return 'missing';
+        if (row.resolved_at)
+            return row.operation_key === operationKey ? 'resolved' : 'stale';
+        if (row.operation_key)
+            return row.operation_key === operationKey ? 'same' : 'stale';
+        return this.db
+            .prepare('UPDATE pending_interactions SET operation_key = ? WHERE session_id = ? AND request_id = ? AND operation_key IS NULL AND resolved_at IS NULL')
+            .run(operationKey, sessionId, requestId).changes === 1
+            ? 'claimed'
+            : 'stale';
+    }
+    /** Persist the in-flight delivery boundary before the app-server is notified. */
+    beginDelivery(sessionId, requestId, operationKey) {
+        return (this.db
+            .prepare("UPDATE pending_interactions SET resolution_state = 'delivering' WHERE session_id = ? AND request_id = ? AND operation_key = ? AND resolved_at IS NULL AND resolution_state IN ('active','delivering')")
+            .run(sessionId, requestId, operationKey).changes === 1);
+    }
+    /** A local writer outage is retryable only by the already-claimed key. */
+    retryDelivery(sessionId, requestId, operationKey) {
+        return (this.db
+            .prepare("UPDATE pending_interactions SET resolution_state = 'active' WHERE session_id = ? AND request_id = ? AND operation_key = ? AND resolved_at IS NULL AND resolution_state = 'delivering'")
+            .run(sessionId, requestId, operationKey).changes === 1);
+    }
+    /** Terminal state is durable before publishing a success/failure event. */
+    settleOperation(sessionId, requestId, operationKey, resolvedAt, outcome) {
+        return (this.db
+            .prepare("UPDATE pending_interactions SET resolved_at = ?, outcome = ?, resolution_state = ? WHERE session_id = ? AND request_id = ? AND operation_key = ? AND resolved_at IS NULL AND resolution_state = 'delivering'")
+            .run(resolvedAt, outcome, outcome === 'failed' ? 'failed' : 'resolved', sessionId, requestId, operationKey).changes === 1);
+    }
     list(sessionId) {
         return this.db
             .prepare('SELECT request_id,kind,payload_json,turn_id,requested_at FROM pending_interactions WHERE session_id = ? AND resolved_at IS NULL ORDER BY rowid')
@@ -37,7 +87,7 @@ export class SqlitePendingInteractionStore {
     }
     resolved(sessionId, requestId) {
         const row = this.db
-            .prepare('SELECT resolved_at,outcome FROM pending_interactions WHERE session_id = ? AND request_id = ? AND resolved_at IS NOT NULL')
+            .prepare('SELECT resolved_at,outcome,operation_key FROM pending_interactions WHERE session_id = ? AND request_id = ? AND resolved_at IS NOT NULL')
             .get(sessionId, requestId);
         return row
             ? {
@@ -46,6 +96,15 @@ export class SqlitePendingInteractionStore {
             }
             : null;
     }
+    terminalOperation(sessionId, requestId) {
+        const resolved = this.resolved(sessionId, requestId);
+        if (!resolved)
+            return null;
+        const row = this.db
+            .prepare('SELECT operation_key FROM pending_interactions WHERE session_id = ? AND request_id = ?')
+            .get(sessionId, requestId);
+        return row ? { ...resolved, operationKey: row.operation_key } : null;
+    }
     snapshot(sessionId) {
         return this.db
             .prepare('SELECT request_id,kind,payload_json,turn_id,requested_at,resolved_at,outcome FROM pending_interactions WHERE session_id = ? ORDER BY CASE WHEN resolved_at IS NULL THEN 0 ELSE 1 END, requested_at, rowid')