maka-agent 0.2.0-dev.9.20260831 → 0.2.1-dev.82.20261014

package/node_modules/@maka/storage/dist/sqlite-session-metadata-store.js

@@ -16,12 +16,15 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { SessionMetadataConflictError, SessionMetadataVersionConflictError, } from './session-store-contract.js';
+export { SessionMetadataConflictError, SessionMetadataVersionConflictError, } from './session-store-contract.js';
 import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
 import { dirname, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { existsSync, mkdirSync } from 'node:fs';
 import { isDeepStrictEqual } from 'node:util';
+import { isCanonicalReadOnlyPermissionProfile } from '@maka/core/permission-profile';
 import { AGENT_GRAPH_CLIENT_PROJECTION_SCHEMA_VERSION, AgentGraphClientProjectionConflictError, AgentGraphClientTerminalCursorError, } from '@maka/core/agent-graph-client-projection';
 import { assessSandboxBoundaryExpansion, assertExecutionBoundaryCapacity, decodeExecutionBoundary, createGenesisExecutionBoundary, SANDBOX_BOUNDARY_CLOSURE_REASONS, SANDBOX_BOUNDARY_HOST_RESTART_CLOSURE_REASON, validateSandboxBoundaryExpansion, } from '@maka/core/sandbox-boundary';
 import { AGENT_GRAPH_EPOCH_SCHEMA_VERSION, AgentGraphEpochConflictError, assertAdvanceAgentGraphEpochRequest, assertResolveAgentGraphEpochRequest, decodeAgentGraphEpochBinding, } from '@maka/core/agent-graph-epoch';
@@ -31,23 +34,33 @@ import { assertAgentGraphIntentClaimRequest, decodeAgentGraphIntentClaim, } from
 import { isSubagentSessionParent, isSubagentSessionRuntime, isSubagentSessionSpawn, WORKHUB_COORDINATION_SESSION_ID, WORKHUB_COORDINATION_SESSION_ROLE, decodeCanonicalMessage, decodeStoredMessage as decodePersistedStoredMessage, } from '@maka/core/session';
 import { markPersisted } from '@maka/core/persisted-value';
 import { normalizePendingMessageAdmission, normalizeProvenRootMessageHandoff, normalizeProvenSteeringMessageHandoff, samePendingMessageAdmission, } from './message-admission-store.js';
+import { rootTurnSourceMessagePayloadsEqual } from './agent-run-store-contract.js';
 import { normalizeSubmittedTurnIntent } from './submitted-turn-intent.js';
 import { messageContentDigest, messageContentsEqual, normalizeMessageContent, } from '@maka/core/events';
 import { AGENT_GRAPH_SUPERVISOR_WAKE_SCHEMA_VERSION, } from '@maka/core/agent-graph-supervisor-wake';
-import { assertSafeSessionId, decodePersistedSessionHeader, normalizeSessionHeader, SessionNotFoundError, } from './session-store.js';
+import { assertSafeSessionId, SessionNotFoundError, } from './session-store-contract.js';
+import { decodePersistedSessionHeader, normalizeSessionHeader } from './session-store.js';
 import { isDiscardableConversationCopy, isValidConversationCopyTransition, } from './session-conversation-copy.js';
-import { catalogPreviewForUserMessage } from './session-message-projection.js';
+import { projectSessionCatalogMessages } from './session-message-projection.js';
 import { configureSqliteSessionMetadataDatabase, migrateSqliteSessionMetadataDatabase, readSqliteSessionMetadataSchemaVersion, SQLITE_AGENT_GRAPH_CONTROL_TABLES, SQLITE_SESSION_MESSAGE_CHUNK_BYTES, SQLITE_SESSION_MESSAGE_CHUNK_MARKER, } from './sqlite-session-metadata-schema.js';
-import { buildSqliteSessionCatalogPageQuery, } from './sqlite-session-catalog-query.js';
+import { assertFoldedSearchTerm, recallFoldedMatchClause, registerRecallFoldFunction, } from './recall-fold.js';
+import { buildSqliteSessionCatalogPageQuery, sqliteArchivedTaskRowPredicate, } from './sqlite-session-catalog-query.js';
 import { sqliteOrdinarySessionRolePredicate, sqliteRecoverableSessionRolePredicate, } from './sqlite-session-role-scope.js';
 export { SQLITE_SESSION_METADATA_SCHEMA_VERSION } from './sqlite-session-metadata-schema.js';
 const SQLITE_TRANSCRIPT_MESSAGE_LOOKUP_BATCH_SIZE = 256;
-const SQLITE_TURN_CONTRIBUTION_MAX_SOURCE_MESSAGES = 1_024;
-const SQLITE_TURN_CONTRIBUTION_MAX_SOURCE_BYTES = 4 * 1024 * 1024;
-const SQLITE_TURN_LANDMARK_LEGACY_NEIGHBOR_MESSAGES = 32;
+// Each target Session binds three parameters in the linkage query. Stay well
+// inside SQLite's bound-parameter limit.
+const WORKHUB_TARGET_LINKAGE_MAX_SESSIONS = 256;
 function decodeStoredMessage(value) {
     return decodePersistedStoredMessage(markPersisted(value));
 }
+/**
+ * Message types that carry user-visible content. Coordination records are
+ * excluded here so a candidate scan never reads them, matching the projection
+ * the recall predicate applies afterwards.
+ */
+const SEARCHABLE_MESSAGE_TYPES = ['user', 'assistant', 'tool_call', 'tool_result'];
+const SEARCHABLE_MESSAGE_TYPE_PLACEHOLDERS = SEARCHABLE_MESSAGE_TYPES.map(() => '?').join(', ');
 const require = createRequire(import.meta.url);
 const AGENT_GRAPH_CONTROL_DELETE_TABLES = SQLITE_AGENT_GRAPH_CONTROL_TABLES.filter((table) => table !== 'agent_graph_epochs').reverse();
 function loadSqliteModule() {
@@ -72,6 +85,7 @@ function decodeMessageAdmissionRow(sessionId, row) {
         typeof row.run_id !== 'string' ||
         typeof row.message_id !== 'string' ||
         typeof row.content_json !== 'string' ||
+        typeof row.skill_invocation_json !== 'string' ||
         typeof row.submitted_content_digest !== 'string' ||
         (row.submitted_placement !== 'current_turn' && row.submitted_placement !== 'next_turn') ||
         (row.placement !== 'current_turn' && row.placement !== 'next_turn') ||
@@ -95,6 +109,7 @@ function decodeMessageAdmissionRow(sessionId, row) {
         ...(typeof row.submitted_intent_json === 'string'
             ? { submittedIntent: normalizeSubmittedTurnIntent(JSON.parse(row.submitted_intent_json)) }
             : {}),
+        skillInvocation: JSON.parse(row.skill_invocation_json),
         admittedAt: row.admitted_at,
     });
 }
@@ -115,9 +130,6 @@ function uniqueVersionedSessionIdentities(sessions) {
     }
     return [...unique.values()].sort((left, right) => left.sessionId.localeCompare(right.sessionId));
 }
-export class SessionMetadataConflictError extends Error {
-    name = 'SessionMetadataConflictError';
-}
 export class StoredSessionMessageIncompatibleError extends Error {
     sessionId;
     sequence;
@@ -129,24 +141,9 @@ export class StoredSessionMessageIncompatibleError extends Error {
         this.sequence = sequence;
     }
 }
-export class SessionMetadataVersionConflictError extends SessionMetadataConflictError {
-    sessionId;
-    expectedVersion;
-    actualVersion;
-    name = 'SessionMetadataVersionConflictError';
-    constructor(sessionId, expectedVersion, actualVersion) {
-        super(`Session metadata version conflict for ${sessionId}: expected ${expectedVersion}, found ${actualVersion}`);
-        this.sessionId = sessionId;
-        this.expectedVersion = expectedVersion;
-        this.actualVersion = actualVersion;
-    }
-}
-export class AgentGraphIntentClaimConflictError extends SessionMetadataConflictError {
-    name = 'AgentGraphIntentClaimConflictError';
-}
-export class AgentGraphScheduleUpdateConflictError extends SessionMetadataConflictError {
-    name = 'AgentGraphScheduleUpdateConflictError';
-}
+import { AgentGraphIntentClaimConflictError, AgentGraphScheduleUpdateConflictError, } from './session-store-contract.js';
+export { AgentGraphIntentClaimConflictError, AgentGraphScheduleUpdateConflictError, } from './session-store-contract.js';
+import { assertGraphLookupIdentity, assertAgentGraphSupervisorWakeClaim, assertAgentGraphSupervisorWakeAttempt, assertAgentGraphSupervisorWakeCompletion, assertAgentGraphClientProjectionRequest, encodeProjectionPayload, assertGraphEventTime, assertGraphIntentId, } from './graph-control-values.js';
 export function createSqliteSessionMetadataStore(path, options = {}) {
     return new SqliteSessionMetadataStore(path, options);
 }
@@ -165,6 +162,7 @@ export class SqliteSessionMetadataStore {
         if (options.databaseLease) {
             this.databaseLease = options.databaseLease;
             this.db = options.databaseLease.database;
+            registerRecallFoldFunction(this.db);
             this.now = options.now ?? Date.now;
             return;
         }
@@ -173,6 +171,7 @@ export class SqliteSessionMetadataStore {
         try {
             configureSqliteSessionMetadataDatabase(database);
             migrateSqliteSessionMetadataDatabase(database);
+            registerRecallFoldFunction(database);
         }
         catch (error) {
             database.close();
@@ -346,6 +345,32 @@ export class SqliteSessionMetadataStore {
             return rows.map(decodeSandboxBoundaryRequestRow);
         });
     }
+    async hasExplicitSandboxBoundaryDenial(identities) {
+        this.assertOpen();
+        const query = this.db.prepare(`
+      SELECT
+        MAX(CASE WHEN outcome_reason = 'client_denied' THEN 1 ELSE 0 END) AS explicit,
+        MAX(CASE WHEN outcome_reason IN ('client_denied', 'turn_stopped', 'turn_terminal', 'host_restarted')
+          THEN 0 ELSE 1 END) AS ambiguous
+      FROM sandbox_boundary_log
+      WHERE session_id = ? AND run_id = ? AND turn_id = ?
+        AND entry_kind = 'expansion_request' AND status = 'denied'
+    `);
+        let denied = false;
+        for (const identity of identities) {
+            assertSafeSessionId(identity.sessionId);
+            assertSandboxBoundaryProvenanceId(identity.runId, 'run id');
+            assertSandboxBoundaryProvenanceId(identity.turnId, 'turn id');
+            const evidence = query.get(identity.sessionId, identity.runId, identity.turnId);
+            // Legacy NULL also meant internal cleanup. Do not invent a user decision
+            // or erase a possible denial; ambiguous provenance blocks this continuation.
+            if (evidence.ambiguous === 1) {
+                throw new Error('Historical sandbox denial cannot be attributed safely; start a new user Turn.');
+            }
+            denied ||= evidence.explicit === 1;
+        }
+        return denied;
+    }
     async settleSandboxBoundaryRequest(input) {
         this.assertOpen();
         assertSafeSessionId(input.sessionId);
@@ -373,7 +398,7 @@ export class SqliteSessionMetadataStore {
                     sessionId: input.sessionId,
                     requestId: input.requestId,
                     status: 'denied',
-                    ...(input.closureReason ? { outcomeReason: input.closureReason } : {}),
+                    outcomeReason: input.closureReason ?? 'client_denied',
                     settledAt,
                 });
                 return {
@@ -702,10 +727,12 @@ export class SqliteSessionMetadataStore {
             throw new SessionNotFoundError(sessionId);
         return record;
     }
-    async readCatalogRecord(sessionId) {
+    async readCatalogRecord(sessionId, roleScope = 'ordinary') {
         this.assertOpen();
         assertSafeSessionId(sessionId);
-        const role = sqliteOrdinarySessionRolePredicate();
+        const role = roleScope === 'recoverable'
+            ? sqliteRecoverableSessionRolePredicate()
+            : sqliteOrdinarySessionRolePredicate();
         const row = this.db
             .prepare(`
         SELECT
@@ -713,6 +740,7 @@ export class SqliteSessionMetadataStore {
           metadata.payload_json,
           metadata.metadata_version,
           metadata.committed_at,
+          metadata.archived_at,
           projection.activity_at,
           projection.last_message_preview
         FROM session_catalog_projection projection
@@ -780,6 +808,95 @@ export class SqliteSessionMetadataStore {
                 .all(sessionId);
         return rows.map((row) => row.sessionId);
     }
+    /**
+     * Archive-retention candidates, oldest archive first: the rows Settings ›
+     * Archived tasks shows (the catalog's own archived-row predicate), less
+     * Agent Graph operators, which retire only with their root, and less any
+     * family a pinned member keeps. A row that no longer decodes is returned as
+     * such, so a sweep can count it and move past it.
+     */
+    async listArchiveRetentionCandidates(query) {
+        this.assertOpen();
+        if (!Number.isSafeInteger(query.limit) || query.limit < 1 || query.limit > 256) {
+            throw new Error('Archive retention candidate limit must be between 1 and 256');
+        }
+        const candidate = archiveRetentionCandidatePredicate();
+        const where = [candidate.sql];
+        const parameters = [...candidate.parameters];
+        if (query.archivedBefore !== undefined) {
+            where.push('(metadata.archived_at IS NULL OR metadata.archived_at < ?)');
+            parameters.push(query.archivedBefore);
+        }
+        if (query.after) {
+            assertSafeSessionId(query.after.sessionId);
+            where.push('(COALESCE(metadata.archived_at, -1), metadata.session_id) > (?, ?)');
+            parameters.push(query.after.archivedAt ?? -1, query.after.sessionId);
+        }
+        const rows = this.db
+            .prepare(`
+        SELECT
+          metadata.session_id,
+          metadata.payload_json,
+          metadata.metadata_version,
+          metadata.committed_at,
+          metadata.archived_at
+        FROM session_metadata metadata
+        JOIN session_catalog_projection projection
+          ON projection.session_id = metadata.session_id
+        WHERE ${where.join(' AND ')}
+        ORDER BY COALESCE(metadata.archived_at, -1), metadata.session_id
+        LIMIT ?
+      `)
+            .all(...parameters, query.limit);
+        return rows.map((row) => {
+            const position = typeof row.archived_at === 'number' ? { archivedAt: row.archived_at } : {};
+            try {
+                const archivedAt = decodeCatalogArchivedAt(row.archived_at, row.session_id);
+                return { ...decodeRecord(row), ...(archivedAt === undefined ? {} : { archivedAt }) };
+            }
+            catch {
+                return { undecodable: true, sessionId: row.session_id, ...position };
+            }
+        });
+    }
+    /**
+     * How many families `listArchiveRetentionCandidates` would offer, and the
+     * earliest clock start among them under a policy enabled at `enabledAt`: a
+     * family starts when its most recently archived member did, and never before
+     * enablement.
+     */
+    async countArchiveRetentionCandidates(enabledAt) {
+        this.assertOpen();
+        const candidate = archiveRetentionCandidatePredicate();
+        const row = this.db
+            .prepare(`
+        SELECT COUNT(*) AS families, MIN(start) AS first_start
+        FROM (
+          SELECT MAX(MAX(COALESCE(metadata.archived_at, ?), ?)) AS start
+          FROM session_metadata metadata
+          JOIN session_catalog_projection projection
+            ON projection.session_id = metadata.session_id
+          WHERE ${candidate.sql}
+          GROUP BY COALESCE(metadata.revision_root_session_id, metadata.session_id)
+        )
+      `)
+            .get(enabledAt, enabledAt, ...candidate.parameters);
+        return {
+            families: row.families,
+            ...(typeof row.first_start === 'number' ? { firstStart: row.first_start } : {}),
+        };
+    }
+    async readLatestSessionMetadataTime() {
+        this.assertOpen();
+        const row = this.db
+            .prepare(`
+        SELECT MAX(committed_at) AS committed_at, MAX(archived_at) AS archived_at
+        FROM session_metadata
+      `)
+            .get();
+        const times = [row?.committed_at, row?.archived_at].filter((value) => typeof value === 'number' && Number.isFinite(value));
+        return times.length === 0 ? undefined : Math.max(...times);
+    }
     async reconcileOrphanedAgentGraphRetirements() {
         this.assertOpen();
         return this.transaction(() => {
@@ -903,6 +1020,10 @@ export class SqliteSessionMetadataStore {
                 .run(sessionId);
         });
     }
+    /**
+     * Session records in catalog order, each carrying the projection the Session
+     * list shows.
+     */
     async list(filter, roleScope) {
         this.assertOpen();
         const { where, parameters } = buildSessionListPredicate(filter ?? {});
@@ -918,17 +1039,22 @@ export class SqliteSessionMetadataStore {
         }
         const rows = this.db
             .prepare(`
-        SELECT session_id, payload_json, metadata_version, committed_at
+        SELECT
+          metadata.session_id,
+          metadata.payload_json,
+          metadata.metadata_version,
+          metadata.committed_at,
+          metadata.archived_at,
+          COALESCE(projection.activity_at, 0) AS activity_at,
+          projection.last_message_preview
         FROM session_metadata metadata
+        LEFT JOIN session_catalog_projection projection
+          ON projection.session_id = metadata.session_id
         ${where.length > 0 ? `WHERE ${where.join(' AND ')}` : ''}
-        ORDER BY (
-          SELECT activity_at
-          FROM session_catalog_projection projection
-          WHERE projection.session_id = metadata.session_id
-        ) DESC, session_id ASC
+        ORDER BY activity_at DESC, metadata.session_id ASC
       `)
             .all(...parameters);
-        return rows.map(decodeRecord);
+        return rows.map(decodeCatalogRecord);
     }
     async listCatalogPage(filter, cursor, limit) {
         this.assertOpen();
@@ -1114,7 +1240,7 @@ export class SqliteSessionMetadataStore {
             .prepare(`
         SELECT turn_id, run_id, message_id, content_json, submitted_content_digest,
           submitted_placement, placement, disposition, queue_order, admitted_at,
-          submitted_intent_json
+          submitted_intent_json, skill_invocation_json
         FROM message_admissions
         WHERE session_id = ? AND message_id = ?
       `)
@@ -1143,14 +1269,20 @@ export class SqliteSessionMetadataStore {
           INSERT INTO message_admissions(
             session_id, turn_id, run_id, message_id, content_json, submitted_content_digest,
             submitted_placement, placement, disposition, queue_order, admitted_at,
-            submitted_intent_json
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            submitted_intent_json, skill_invocation_json
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         `)
-            .run(stored.sessionId, stored.turnId, stored.runId, stored.messageId, JSON.stringify(stored.content), stored.submittedContentDigest, stored.submittedPlacement, stored.placement, stored.disposition, orderRow.next_order, stored.admittedAt, stored.submittedIntent ? JSON.stringify(stored.submittedIntent) : null);
+            .run(stored.sessionId, stored.turnId, stored.runId, stored.messageId, JSON.stringify(stored.content), stored.submittedContentDigest, stored.submittedPlacement, stored.placement, stored.disposition, orderRow.next_order, stored.admittedAt, stored.submittedIntent ? JSON.stringify(stored.submittedIntent) : null, JSON.stringify(stored.skillInvocation));
     }
     async assignWorkHubMessage(request) {
         const assignmentJson = JSON.stringify(request.assignment);
         const assignment = decodeCanonicalMessage(JSON.parse(assignmentJson));
+        const supersessionJson = request.supersession
+            ? JSON.stringify(request.supersession)
+            : undefined;
+        const supersession = supersessionJson
+            ? decodeCanonicalMessage(JSON.parse(supersessionJson))
+            : undefined;
         const admission = normalizePendingMessageAdmission(request.admission);
         const suffix = createHash('sha256')
             .update(request.assignment.actionId)
@@ -1164,13 +1296,37 @@ export class SqliteSessionMetadataStore {
             assignment.id !== `wha_${suffix}` ||
             assignment.targetMessageId !== `whm_${suffix}` ||
             assignment.delegationId !== `whd_${suffix}` ||
-            !messageContentsEqual(admission.content, normalizeMessageContent({ text: assignment.userText })) ||
+            !workHubAssignmentAttachmentsMatchTarget(assignment) ||
+            !messageContentsEqual(admission.content, normalizeMessageContent({
+                text: assignment.delegationText ?? assignment.userText,
+                ...(assignment.targetAttachments ? { attachments: assignment.targetAttachments } : {}),
+            })) ||
             admission.submittedContentDigest !== messageContentDigest(admission.content) ||
             admission.submittedPlacement !== 'current_turn' ||
             admission.placement !== 'current_turn' ||
             admission.disposition !== 'steering') {
             throw new SessionMetadataConflictError('Invalid WorkHub assignment identity');
         }
+        if ((assignment.replacesActionId === undefined) !==
+            (assignment.replacesDelegationId === undefined) ||
+            (assignment.replacesDelegationId === undefined) !== (supersession === undefined) ||
+            (supersession !== undefined &&
+                (supersession.type !== 'workhub_coordination' ||
+                    supersession.kind !== 'delegation_superseded' ||
+                    supersession.actionId !== assignment.actionId ||
+                    supersession.actionFingerprint !== assignment.actionFingerprint ||
+                    supersession.coordinationTurnId !== assignment.coordinationTurnId ||
+                    supersession.turnId !== assignment.coordinationTurnId ||
+                    supersession.supersededActionId !== assignment.replacesActionId ||
+                    supersession.supersededDelegationId !== assignment.replacesDelegationId ||
+                    supersession.replacementDelegationId !== assignment.delegationId ||
+                    supersession.id !==
+                        `whx_${createHash('sha256')
+                            .update(supersession.supersededDelegationId)
+                            .digest('hex')
+                            .slice(0, 48)}`))) {
+            throw new SessionMetadataConflictError('Invalid WorkHub supersession identity');
+        }
         const create = request.create
             ? {
                 header: normalizeSessionHeader(request.create.header),
@@ -1207,6 +1363,39 @@ export class SqliteSessionMetadataStore {
                     assignment: existingAssignment,
                 };
             }
+            if (supersession && assignment.replacesActionId && assignment.replacesDelegationId) {
+                const replacedSuffix = createHash('sha256')
+                    .update(assignment.replacesActionId)
+                    .digest('hex')
+                    .slice(0, 48);
+                const replaced = this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, `wha_${replacedSuffix}`);
+                if (replaced?.type !== 'workhub_coordination' ||
+                    replaced.kind !== 'delegation_assigned' ||
+                    replaced.delegationId !== assignment.replacesDelegationId) {
+                    throw new SessionMetadataConflictError('WorkHub supersession source is unavailable');
+                }
+                const abortSuffix = createHash('sha256')
+                    .update(assignment.replacesDelegationId)
+                    .digest('hex')
+                    .slice(0, 48);
+                const stopRequest = this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, `whq_${abortSuffix}`);
+                if (stopRequest) {
+                    const stopResolution = this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, `whz_${abortSuffix}`);
+                    if (stopResolution?.type !== 'workhub_coordination' ||
+                        stopResolution.kind !== 'delegation_stop_resolved' ||
+                        stopResolution.outcome !== 'not_owned') {
+                        throw new SessionMetadataConflictError('WorkHub delegation already has a stop claim');
+                    }
+                }
+                const existingAbort = this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, `whb_${abortSuffix}`);
+                if (existingAbort) {
+                    throw new SessionMetadataConflictError('WorkHub delegation replacement is aborted');
+                }
+                const existingSupersession = this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, supersession.id);
+                if (existingSupersession) {
+                    throw new SessionMetadataConflictError('WorkHub delegation is already superseded');
+                }
+            }
             let targetCreated = false;
             if (create) {
                 const probe = this.probeStableSessionCreateSync(create.header.id, create.requestFingerprint);
@@ -1232,8 +1421,19 @@ export class SqliteSessionMetadataStore {
             if (target.header.status === 'waiting_for_user') {
                 throw new SessionMetadataConflictError('WorkHub target Session is waiting for user input');
             }
+            let committedAssignment = assignment;
+            let committedAssignmentJson = assignmentJson;
             if (target.header.name !== assignment.targetSessionName) {
-                throw new SessionMetadataConflictError('WorkHub target display identity changed');
+                if (assignment.disposition !== 'delegate_existing' ||
+                    assignment.replacesDelegationId === undefined) {
+                    throw new SessionMetadataConflictError('WorkHub target display identity changed');
+                }
+                // A durable replacement owns the target Session id before retiring the
+                // source. Canonicalize its display-only name at the same transaction
+                // boundary that validates the target so a concurrent rename cannot
+                // strand the already-retired delegation.
+                committedAssignment = { ...assignment, targetSessionName: target.header.name };
+                committedAssignmentJson = JSON.stringify(committedAssignment);
             }
             if (this.readMessageAdmissionSync(admission.sessionId, admission.messageId)) {
                 throw new SessionMetadataConflictError('WorkHub target Message identity belongs to another admission');
@@ -1247,9 +1447,14 @@ export class SqliteSessionMetadataStore {
                 sequenceRow.last_sequence < -1) {
                 throw new SessionMetadataConflictError('Invalid WorkHub transcript sequence');
             }
-            this.insertSessionMessagesSync(WORKHUB_COORDINATION_SESSION_ID, sequenceRow.last_sequence + 1, [{ message: assignment, json: assignmentJson }]);
+            this.insertSessionMessagesSync(WORKHUB_COORDINATION_SESSION_ID, sequenceRow.last_sequence + 1, [
+                { message: committedAssignment, json: committedAssignmentJson },
+                ...(supersession && supersessionJson
+                    ? [{ message: supersession, json: supersessionJson }]
+                    : []),
+            ]);
             this.updateCatalogProjectionSync(WORKHUB_COORDINATION_SESSION_ID, request.projection, false);
-            return { kind: 'assigned', targetCreated, assignment };
+            return { kind: 'assigned', targetCreated, assignment: committedAssignment };
         });
     }
     async readMessageAdmission(sessionId, messageId) {
@@ -1261,7 +1466,7 @@ export class SqliteSessionMetadataStore {
                 .prepare(`
           SELECT turn_id, run_id, message_id, content_json, submitted_content_digest,
             submitted_placement, placement, disposition, queue_order, admitted_at,
-            submitted_intent_json
+            submitted_intent_json, skill_invocation_json
           FROM message_admissions
           WHERE session_id = ? AND message_id = ?
         `)
@@ -1280,6 +1485,106 @@ export class SqliteSessionMetadataStore {
             return row !== undefined;
         });
     }
+    /**
+     * Binds one WorkHub action identity to one exact operation, for good.
+     *
+     * Every other durable WorkHub record is keyed by what it is about, so none of
+     * them can see an action id that moved to a second delegation or a second
+     * disposition. This row is the global owner that rejects both, and it is
+     * written before the action's effect so a rejected or recovering attempt can
+     * never leak its identity into a different operation.
+     */
+    async claimWorkHubAction(claim) {
+        this.assertOpen();
+        assertSafeSessionId(claim.actionId);
+        assertSafeSessionId(claim.subject);
+        if (!/^sha256:[a-f0-9]{64}$/u.test(claim.actionFingerprint)) {
+            throw new SessionMetadataConflictError('Invalid WorkHub action fingerprint');
+        }
+        return this.transaction(() => {
+            const existing = this.readWorkHubActionClaimSync(claim.actionId);
+            if (existing) {
+                return existing.operation === claim.operation &&
+                    existing.actionFingerprint === claim.actionFingerprint &&
+                    existing.subject === claim.subject
+                    ? 'same_claim'
+                    : 'conflict';
+            }
+            this.db
+                .prepare(`
+          INSERT INTO workhub_action_claims(
+            action_id, operation, action_fingerprint, subject, claimed_at
+          ) VALUES (?, ?, ?, ?, ?)
+        `)
+                .run(claim.actionId, claim.operation, claim.actionFingerprint, claim.subject, this.now());
+            return 'claimed';
+        });
+    }
+    async readWorkHubActionClaim(actionId) {
+        this.assertOpen();
+        assertSafeSessionId(actionId);
+        return this.readTransaction(() => this.readWorkHubActionClaimSync(actionId));
+    }
+    readWorkHubActionClaimSync(actionId) {
+        const row = this.db
+            .prepare('SELECT operation, action_fingerprint, subject FROM workhub_action_claims WHERE action_id = ?')
+            .get(actionId);
+        if (!row)
+            return undefined;
+        if (!isWorkHubActionOperation(row.operation) ||
+            typeof row.action_fingerprint !== 'string' ||
+            !/^sha256:[a-f0-9]{64}$/u.test(row.action_fingerprint) ||
+            typeof row.subject !== 'string') {
+            throw new SessionMetadataConflictError('Invalid WorkHub action claim row');
+        }
+        return {
+            actionId,
+            operation: row.operation,
+            actionFingerprint: row.action_fingerprint,
+            subject: row.subject,
+        };
+    }
+    async claimMessageAdmissionCancellation(sessionId, messageId, claimId) {
+        this.assertOpen();
+        assertSafeSessionId(sessionId);
+        assertSafeSessionId(messageId);
+        assertSafeSessionId(claimId);
+        return this.transaction(() => {
+            const cancelled = this.db
+                .prepare('SELECT cancellation_claim_id FROM cancelled_message_admissions WHERE session_id = ? AND message_id = ?')
+                .get(sessionId, messageId);
+            if (cancelled) {
+                return cancelled.cancellation_claim_id === claimId ? 'same_claim' : 'already_cancelled';
+            }
+            const admission = this.db
+                .prepare(`
+          SELECT submitted_content_digest, submitted_placement
+          FROM message_admissions
+          WHERE session_id = ? AND message_id = ?
+        `)
+                .get(sessionId, messageId);
+            if (typeof admission?.submitted_content_digest !== 'string' ||
+                (admission.submitted_placement !== 'current_turn' &&
+                    admission.submitted_placement !== 'next_turn')) {
+                throw new SessionMetadataConflictError('Message admission cancellation identity conflict');
+            }
+            this.db
+                .prepare(`
+          INSERT INTO cancelled_message_admissions(
+            session_id, message_id, submitted_content_digest, submitted_placement,
+            cancellation_claim_id
+          ) VALUES (?, ?, ?, ?, ?)
+        `)
+                .run(sessionId, messageId, admission.submitted_content_digest, admission.submitted_placement, claimId);
+            const deleted = this.db
+                .prepare('DELETE FROM message_admissions WHERE session_id = ? AND message_id = ?')
+                .run(sessionId, messageId);
+            if (deleted.changes !== 1) {
+                throw new SessionMetadataConflictError('Message admission cancellation identity conflict');
+            }
+            return 'cancelled_by_claim';
+        });
+    }
     async listMessageAdmissions(sessionId) {
         this.assertOpen();
         assertSafeSessionId(sessionId);
@@ -1288,7 +1593,7 @@ export class SqliteSessionMetadataStore {
                 .prepare(`
           SELECT turn_id, run_id, message_id, content_json, submitted_content_digest,
             submitted_placement, placement, disposition, queue_order, admitted_at,
-            submitted_intent_json
+            submitted_intent_json, skill_invocation_json
           FROM message_admissions
           WHERE session_id = ?
           ORDER BY queue_order, sequence
@@ -1297,6 +1602,111 @@ export class SqliteSessionMetadataStore {
             return rows.map((row) => decodeMessageAdmissionRow(sessionId, row));
         });
     }
+    async readActiveWorkHubAssignmentsByTarget(targetSessionIds, maxAssignmentsPerTarget, includeStopped) {
+        this.assertOpen();
+        for (const sessionId of targetSessionIds)
+            assertSafeSessionId(sessionId);
+        if (targetSessionIds.length > WORKHUB_TARGET_LINKAGE_MAX_SESSIONS) {
+            throw new Error('Invalid WorkHub target Session count');
+        }
+        if (maxAssignmentsPerTarget !== undefined &&
+            (!Number.isSafeInteger(maxAssignmentsPerTarget) ||
+                maxAssignmentsPerTarget < 1 ||
+                maxAssignmentsPerTarget > 256)) {
+            throw new Error('Invalid WorkHub target Message limit');
+        }
+        const targets = [...new Set(targetSessionIds)];
+        if (targets.length === 0)
+            return [];
+        return this.readTransaction(() => {
+            const list = targets.map(() => '?').join(', ');
+            // One Message moves between these lifecycle tables — pending, admitted
+            // into a Turn, cancelled. Combine every target's identities once, then
+            // resolve activity from the canonical Coordination ledger in this same
+            // read transaction. That avoids rebuilding the target set once per page
+            // or once per candidate, without introducing another durable
+            // representation.
+            const rows = this.db
+                .prepare(`
+          WITH target_messages(session_id, message_id) AS (
+            SELECT session_id, message_id
+            FROM message_admissions
+            WHERE session_id IN (${list})
+              AND message_id GLOB 'whm_*'
+              AND length(message_id) = 52
+            UNION
+            SELECT session_id, message_id
+            FROM core_root_source_message_proofs
+            WHERE session_id IN (${list})
+              AND message_id GLOB 'whm_*'
+              AND length(message_id) = 52
+            UNION
+            SELECT session_id, message_id
+            FROM cancelled_message_admissions
+            WHERE session_id IN (${list})
+              AND message_id GLOB 'whm_*'
+              AND length(message_id) = 52
+          )
+          SELECT target.session_id, target.message_id
+          FROM target_messages AS target
+          CROSS JOIN session_messages AS assignment INDEXED BY session_messages_by_identity
+          WHERE assignment.session_id = ?
+            AND assignment.message_id = 'wha_' || substr(target.message_id, 5)
+          ORDER BY assignment.sequence DESC
+        `)
+                .iterate(...targets, ...targets, ...targets, WORKHUB_COORDINATION_SESSION_ID);
+            const assignments = [];
+            const acceptedPerTarget = new Map();
+            for (const row of rows) {
+                if (typeof row.message_id !== 'string' || typeof row.session_id !== 'string') {
+                    throw new SessionMetadataConflictError('Invalid WorkHub target Message identity');
+                }
+                const targetSessionId = row.session_id;
+                if (maxAssignmentsPerTarget !== undefined &&
+                    (acceptedPerTarget.get(targetSessionId) ?? 0) >= maxAssignmentsPerTarget) {
+                    continue;
+                }
+                const assignment = this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, `wha_${row.message_id.slice('whm_'.length)}`);
+                if (assignment?.type !== 'workhub_coordination' ||
+                    assignment.kind !== 'delegation_assigned' ||
+                    assignment.targetSessionId !== targetSessionId ||
+                    assignment.targetMessageId !== row.message_id) {
+                    continue;
+                }
+                const terminalSuffix = createHash('sha256')
+                    .update(assignment.delegationId, 'utf8')
+                    .digest('hex')
+                    .slice(0, 48);
+                const supersession = this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, `whx_${terminalSuffix}`);
+                if (supersession?.type === 'workhub_coordination' &&
+                    supersession.kind === 'delegation_superseded') {
+                    continue;
+                }
+                const replacementAbort = this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, `whb_${terminalSuffix}`);
+                if (replacementAbort?.type === 'workhub_coordination' &&
+                    replacementAbort.kind === 'delegation_replacement_aborted') {
+                    continue;
+                }
+                const stopResolution = this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, `whzt_${terminalSuffix}`) ??
+                    this.readMessageByIdSync(WORKHUB_COORDINATION_SESSION_ID, `whz_${terminalSuffix}`);
+                if (!includeStopped &&
+                    stopResolution?.type === 'workhub_coordination' &&
+                    stopResolution.kind === 'delegation_stop_resolved' &&
+                    stopResolution.outcome !== 'not_owned') {
+                    continue;
+                }
+                assignments.push(assignment);
+                acceptedPerTarget.set(targetSessionId, (acceptedPerTarget.get(targetSessionId) ?? 0) + 1);
+            }
+            return assignments;
+        });
+    }
+    async readMessageById(sessionId, messageId) {
+        this.assertOpen();
+        assertSafeSessionId(sessionId);
+        assertSafeSessionId(messageId);
+        return this.readTransaction(() => this.readMessageByIdSync(sessionId, messageId));
+    }
     async markMessagesHandedOff(input) {
         this.assertOpen();
         assertSafeSessionId(input.sessionId);
@@ -1331,19 +1741,6 @@ export class SqliteSessionMetadataStore {
             provenSteeringMessages.set(normalized.messageId, normalized);
         }
         this.transaction(() => {
-            const lastSequenceRow = this.db
-                .prepare('SELECT COALESCE(MAX(sequence), -1) AS last_sequence FROM session_messages WHERE session_id = ?')
-                .get(input.sessionId);
-            if (typeof lastSequenceRow.last_sequence !== 'number' ||
-                !Number.isSafeInteger(lastSequenceRow.last_sequence) ||
-                lastSequenceRow.last_sequence < -1) {
-                throw new SessionMetadataConflictError('Invalid Session message sequence');
-            }
-            const lastSequence = lastSequenceRow.last_sequence;
-            const historicalMissingMessages = new Map();
-            const ordinaryMissingMessages = new Map();
-            const historicalMessageIdSet = new Set();
-            const existingSequences = new Map();
             for (const messageId of unique) {
                 const fallback = provenRootMessages.get(messageId);
                 const steeringProof = provenSteeringMessages.get(messageId);
@@ -1351,7 +1748,7 @@ export class SqliteSessionMetadataStore {
                     .prepare(`
             SELECT turn_id, run_id, message_id, content_json, submitted_content_digest,
               submitted_placement, placement, disposition, queue_order, admitted_at,
-            submitted_intent_json
+            submitted_intent_json, skill_invocation_json
             FROM message_admissions
             WHERE session_id = ? AND message_id = ?
           `)
@@ -1366,83 +1763,35 @@ export class SqliteSessionMetadataStore {
                     admission.runId === steeringProof.admissionRunId &&
                     admission.admittedAt === steeringProof.admittedAt &&
                     messageContentsEqual(admission.content, steeringProof.content);
+                // Root admission commits before this mutable queue projection is retired. A crash
+                // between those writes can therefore leave the same Message looking like steering
+                // for its predecessor even though the successor Root already owns it.
+                const provenSuccessorRootHandoff = admission !== undefined &&
+                    fallback !== undefined &&
+                    rootTurnSourceMessagePayloadsEqual(admission, fallback);
                 if (admission !== undefined && steeringProof !== undefined && !provenCrossTurnSteering) {
                     throw new SessionMetadataConflictError('Proven steering admission identity conflict');
                 }
+                if (admission !== undefined &&
+                    fallback !== undefined &&
+                    !rootTurnSourceMessagePayloadsEqual(admission, fallback)) {
+                    throw new SessionMetadataConflictError('Message admission fallback payload conflict');
+                }
                 if (admission !== undefined &&
                     admission.turnId !== input.turnId &&
                     admission.disposition !== 'followup' &&
-                    !provenCrossTurnSteering) {
+                    !provenCrossTurnSteering &&
+                    !provenSuccessorRootHandoff) {
                     throw new SessionMetadataConflictError('Message admission Turn conflict');
                 }
-                if (admission !== undefined &&
-                    fallback !== undefined &&
-                    !messageContentsEqual(admission.content, fallback.content)) {
-                    throw new SessionMetadataConflictError('Message admission fallback content conflict');
-                }
-                if (admission === undefined && fallback !== undefined) {
-                    historicalMessageIdSet.add(messageId);
-                }
                 if (!admission &&
                     this.db
                         .prepare('SELECT 1 AS present FROM cancelled_message_admissions WHERE session_id = ? AND message_id = ?')
                         .get(input.sessionId, messageId)) {
                     throw new SessionMetadataConflictError('Message admission is already cancelled');
                 }
-                const rows = this.db
-                    .prepare(`
-            SELECT message.sequence, message.record_json, payload.record_bytes, payload.sha256
-            FROM session_messages AS message
-            LEFT JOIN session_message_payloads AS payload
-              ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-            WHERE message.session_id = ? AND message.message_id = ?
-          `)
-                    .all(input.sessionId, messageId);
-                if (rows.length > 1) {
-                    throw new SessionMetadataConflictError('Message admission transcript identity is ambiguous');
-                }
-                if (rows.length === 0) {
-                    const source = admission ?? fallback;
-                    if (!source)
-                        throw new SessionMetadataConflictError('Message admission does not exist');
-                    const message = decodeCanonicalMessage({
-                        type: 'user',
-                        id: messageId,
-                        turnId: input.turnId,
-                        ts: steeringProof?.eventTs ?? source.admittedAt,
-                        ...source.content,
-                        steeringEventId: steeringProof?.eventId ?? messageId,
-                    });
-                    const json = JSON.stringify(message);
-                    (historicalMessageIdSet.has(messageId)
-                        ? historicalMissingMessages
-                        : ordinaryMissingMessages).set(messageId, { message, json });
-                }
-                else {
-                    const sequence = rows[0]?.sequence;
-                    if (typeof sequence !== 'number' || !Number.isSafeInteger(sequence)) {
-                        throw new SessionMetadataConflictError('Invalid Message transcript sequence');
-                    }
-                    const row = rows[0];
-                    const recordJson = readStoredMessageRecordJson(this.db, input.sessionId, sequence, row);
-                    const message = decodeStoredMessage(JSON.parse(recordJson));
-                    const expectedSource = admission ?? fallback ?? steeringProof;
-                    if (message.type !== 'user' ||
-                        message.id !== messageId ||
-                        (expectedSource !== undefined &&
-                            !messageContentsEqual(normalizeMessageContent(message), expectedSource.content))) {
-                        throw new SessionMetadataConflictError('Message admission transcript identity conflict');
-                    }
-                    if (message.turnId !== input.turnId) {
-                        throw new SessionMetadataConflictError('Message admission transcript Turn conflict');
-                    }
-                    if (steeringProof !== undefined &&
-                        (message.ts !== steeringProof.eventTs ||
-                            message.turnId !== steeringProof.executionTurnId ||
-                            message.steeringEventId !== steeringProof.eventId)) {
-                        throw new SessionMetadataConflictError('Proven steering transcript identity conflict');
-                    }
-                    existingSequences.set(messageId, sequence);
+                if (admission === undefined && fallback === undefined && steeringProof === undefined) {
+                    throw new SessionMetadataConflictError('Message admission does not exist');
                 }
                 if (admission) {
                     const deleted = this.db
@@ -1453,94 +1802,21 @@ export class SqliteSessionMetadataStore {
                     }
                 }
             }
-            let tailLatest;
-            if (historicalMessageIdSet.size > 0) {
-                const transcript = this.readSessionMessageOrderingSync(input.sessionId);
-                let previousExistingSequence = -1;
-                const historicalMessageIds = unique.filter((messageId) => historicalMessageIdSet.has(messageId));
-                for (const messageId of historicalMessageIds) {
-                    const sequence = existingSequences.get(messageId);
-                    if (sequence === undefined)
-                        continue;
-                    const admittedAt = provenRootMessages.get(messageId).admittedAt;
-                    const blockingRow = transcript.find(({ sequence: candidateSequence, message }) => candidateSequence > previousExistingSequence &&
-                        candidateSequence < sequence &&
-                        !historicalMessageIdSet.has(message.id) &&
-                        (message.turnId === input.turnId || message.ts >= admittedAt));
-                    if (sequence <= previousExistingSequence || blockingRow !== undefined) {
-                        throw new SessionMetadataConflictError('Message admission transcript source order conflict');
-                    }
-                    previousExistingSequence = sequence;
-                }
-                const insertionGroups = [];
-                let pending = [];
-                let previousAnchor = -1;
-                for (const messageId of historicalMessageIds) {
-                    const missing = historicalMissingMessages.get(messageId);
-                    if (missing) {
-                        pending.push(missing);
-                        continue;
-                    }
-                    const boundary = existingSequences.get(messageId);
-                    if (pending.length > 0 && boundary !== undefined) {
-                        const admittedAt = Math.min(...pending.map(({ message }) => message.ts));
-                        const earlierBoundary = transcript.find(({ sequence, message }) => sequence > previousAnchor &&
-                            sequence < boundary &&
-                            !historicalMessageIdSet.has(message.id) &&
-                            (message.turnId === input.turnId || message.ts >= admittedAt));
-                        if (earlierBoundary) {
-                            throw new SessionMetadataConflictError('Message admission transcript source order conflict');
-                        }
-                        insertionGroups.push({ boundary, entries: pending });
-                        pending = [];
-                    }
-                    if (boundary !== undefined)
-                        previousAnchor = boundary;
-                }
-                if (pending.length > 0) {
-                    const admittedAt = Math.min(...pending.map(({ message }) => message.ts));
-                    const repairBoundary = transcript.find(({ sequence, message }) => sequence > previousAnchor &&
-                        !historicalMessageIdSet.has(message.id) &&
-                        (message.turnId === input.turnId || message.ts >= admittedAt))?.sequence;
-                    insertionGroups.push({
-                        boundary: repairBoundary ?? lastSequence + 1,
-                        entries: pending,
-                    });
-                }
-                for (const group of insertionGroups.reverse()) {
-                    this.shiftSessionMessageSuffixSync(input.sessionId, group.boundary, group.entries.length);
-                    this.insertSessionMessagesSync(input.sessionId, group.boundary, group.entries);
-                    if (group.boundary === lastSequence + 1) {
-                        tailLatest = group.entries.at(-1)?.message;
-                    }
-                }
-            }
-            if (ordinaryMissingMessages.size > 0) {
-                const ordinaryEntries = unique.flatMap((messageId) => {
-                    const entry = ordinaryMissingMessages.get(messageId);
-                    return entry ? [entry] : [];
-                });
-                const currentLastSequenceRow = this.db
-                    .prepare('SELECT COALESCE(MAX(sequence), -1) AS last_sequence FROM session_messages WHERE session_id = ?')
-                    .get(input.sessionId);
-                const currentLastSequence = currentLastSequenceRow.last_sequence;
-                if (typeof currentLastSequence !== 'number' ||
-                    !Number.isSafeInteger(currentLastSequence) ||
-                    currentLastSequence < -1) {
-                    throw new SessionMetadataConflictError('Invalid Session message sequence');
-                }
-                this.insertSessionMessagesSync(input.sessionId, currentLastSequence + 1, ordinaryEntries);
-                tailLatest = ordinaryEntries.at(-1)?.message;
-            }
-            if (tailLatest?.type === 'user') {
-                this.updateCatalogProjectionSync(input.sessionId, {
-                    lastMessageAt: tailLatest.ts,
-                    lastMessagePreview: catalogPreviewForUserMessage(tailLatest),
-                }, false, true);
-            }
-            else if (historicalMissingMessages.size > 0 || ordinaryMissingMessages.size > 0) {
-                this.updateCatalogProjectionSync(input.sessionId, {}, false, true);
-            }
+        });
+    }
+    /**
+     * The catalog facts a durable message carries, committed without a transcript
+     * row to carry them: the Session list's preview line, its time, and the
+     * connection lock a Session takes on its first user message.
+     */
+    async commitMessageCatalogProjection(sessionId, message) {
+        this.assertOpen();
+        assertSafeSessionId(sessionId);
+        this.transaction(() => {
+            const record = this.readRecordSync(sessionId);
+            if (!record)
+                throw new SessionNotFoundError(sessionId);
+            this.updateCatalogProjectionSync(sessionId, projectSessionCatalogMessages([message]), false, message.type === 'user' && !record.header.connectionLocked);
         });
     }
     async updateMessageAdmission(admission) {
@@ -1551,7 +1827,7 @@ export class SqliteSessionMetadataStore {
                 .prepare(`
           SELECT turn_id, run_id, message_id, content_json, submitted_content_digest,
             submitted_placement, placement, disposition, queue_order, admitted_at,
-            submitted_intent_json
+            submitted_intent_json, skill_invocation_json
           FROM message_admissions
           WHERE session_id = ? AND message_id = ?
         `)
@@ -1568,10 +1844,11 @@ export class SqliteSessionMetadataStore {
             this.db
                 .prepare(`
           UPDATE message_admissions
-          SET content_json = ?, submitted_content_digest = ?, placement = ?, disposition = ?
+          SET content_json = ?, submitted_content_digest = ?, placement = ?, disposition = ?,
+            skill_invocation_json = ?
           WHERE session_id = ? AND message_id = ?
         `)
-                .run(JSON.stringify(stored.content), stored.submittedContentDigest, stored.placement, stored.disposition, stored.sessionId, stored.messageId);
+                .run(JSON.stringify(stored.content), stored.submittedContentDigest, stored.placement, stored.disposition, JSON.stringify(stored.skillInvocation), stored.sessionId, stored.messageId);
         });
     }
     async cancelMessageAdmissions(sessionId, messageIds) {
@@ -1619,7 +1896,7 @@ export class SqliteSessionMetadataStore {
             }
         });
     }
-    async reorderMessageAdmissions(sessionId, messageIds) {
+    async reorderMessageAdmissions(sessionId, messageIds, disposition = 'followup') {
         this.assertOpen();
         assertSafeSessionId(sessionId);
         const unique = [...new Set(messageIds)];
@@ -1633,13 +1910,13 @@ export class SqliteSessionMetadataStore {
                 .prepare(`
           SELECT message_id
           FROM message_admissions
-          WHERE session_id = ? AND disposition = 'followup'
+          WHERE session_id = ? AND disposition = ?
           ORDER BY queue_order, sequence
         `)
-                .all(sessionId);
+                .all(sessionId, disposition);
             const current = rows.map((row) => row.message_id);
             const currentIds = new Set(current);
-            if (current.length !== unique.length ||
+            if ((disposition === 'followup' && current.length !== unique.length) ||
                 unique.some((messageId) => !currentIds.has(messageId))) {
                 throw new SessionMetadataConflictError('Message admission reorder identity conflict');
             }
@@ -1648,576 +1925,333 @@ export class SqliteSessionMetadataStore {
         SET queue_order = ?
         WHERE session_id = ? AND message_id = ?
       `);
-            unique.forEach((messageId, index) => update.run(index, sessionId, messageId));
+            // Older steering may already be in flight. Keep those entries in their
+            // slots so recovery never interleaves them with a newly reordered batch.
+            const selected = new Set(unique);
+            let next = 0;
+            current.forEach((messageId, index) => {
+                const orderedId = selected.has(messageId) ? unique[next++] : messageId;
+                update.run(index, sessionId, orderedId);
+            });
+        });
+    }
+    async readCoordinationTranscriptIndexState() {
+        this.assertOpen();
+        return this.db
+            .prepare(`SELECT (SELECT MAX(sequence) FROM coordination_transcript_index) AS highWater,
+      (SELECT MAX(source_sequence) FROM coordination_transcript_index WHERE source = 'legacy') AS legacy,
+      (SELECT MAX(source_sequence) FROM coordination_transcript_index WHERE source = 'runtime') AS runtime`)
+            .get();
+    }
+    async appendCoordinationTranscriptIndex(records) {
+        this.assertOpen();
+        if (records.length > 64)
+            throw new Error('Coordination transcript index batch exceeds limit');
+        this.transaction(() => {
+            let sequence = this.db
+                .prepare('SELECT MAX(sequence) AS value FROM coordination_transcript_index')
+                .get().value ?? -1;
+            const insert = this.db.prepare(`INSERT INTO coordination_transcript_index
+        (sequence, source, source_sequence) VALUES (?, ?, ?)
+        ON CONFLICT(source, source_sequence) DO NOTHING`);
+            for (const record of records) {
+                if (!Number.isSafeInteger(record.sourceSequence) || record.sourceSequence < 0)
+                    throw new Error('Invalid Coordination source sequence');
+                const result = insert.run(sequence + 1, record.source, record.sourceSequence);
+                if (result.changes)
+                    sequence++;
+            }
         });
     }
+    async readCoordinationTranscriptIndex(request) {
+        this.assertOpen();
+        if (!Number.isSafeInteger(request.limit) || request.limit < 1 || request.limit > 64)
+            throw new Error('Invalid Coordination transcript index limit');
+        const older = request.direction === 'older';
+        return this.db
+            .prepare(`SELECT sequence, source, source_sequence AS sourceSequence
+      FROM coordination_transcript_index WHERE sequence <= ? AND sequence ${older ? '<=' : '>='} ?
+      ORDER BY sequence ${older ? 'DESC' : 'ASC'} LIMIT ?`)
+            .all(request.throughSequence, request.position, request.limit);
+    }
     async readMessages(sessionId) {
         return this.readMessagesWith(sessionId, decodeStoredMessage);
     }
-    async readTranscriptPage(sessionId, request) {
+    /**
+     * Narrows recall to the pre-ledger Sessions whose transcript rows contain
+     * one of the folded terms. The answer is a superset of the true matches,
+     * never an answer: the caller projects each candidate Session and re-runs the
+     * real predicate on the projected, redacted text.
+     *
+     * Only Sessions the ledger does not yet own are scanned here. A Session with
+     * `transcriptLedgerVersion` 1 is projected from `runtime_events`, and its
+     * rows in these tables are a frozen copy of what the conversion read, so the
+     * ledger scan already covers it. Sessions still awaiting conversion, and
+     * imports still being prepared, keep their transcript here.
+     *
+     * Folding is ASCII `lower()` in SQL plus an unconditional match on every
+     * record that fold cannot reproduce — see `recall-fold.ts`. Terms must arrive
+     * folded; a raw term is rejected rather than quietly mismatched.
+     *
+     * Two scans rather than one condition, because the two storage forms need
+     * different reads. An inline record is matched directly; a record above the
+     * chunk threshold keeps only a marker in `record_json` and has to be
+     * reassembled from its chunks first. SQLite concatenates chunk blobs
+     * byte-wise, which restores characters a chunk boundary split in half.
+     *
+     * Returns `undefined` when a chunked record cannot be reassembled, which
+     * declines the fast path rather than answering with fewer candidates.
+     */
+    async listLegacyTranscriptCandidateSessions(sessionIds, terms) {
         this.assertOpen();
-        assertSafeSessionId(sessionId);
-        assertTranscriptPageRequest(request);
+        if (sessionIds.length === 0 || terms.length === 0)
+            return [];
+        for (const sessionId of sessionIds)
+            assertSafeSessionId(sessionId);
+        for (const term of terms)
+            assertFoldedSearchTerm(term);
+        const sessions = sessionIds.map(() => '?').join(', ');
+        const inlineMatch = recallFoldedMatchClause('message.record_json', terms.length);
+        const chunkedMatch = recallFoldedMatchClause('chunked.body', terms.length);
         return this.readTransaction(() => {
-            if (!this.readRecordSync(sessionId))
-                throw new SessionNotFoundError(sessionId);
-            const highWaterRow = this.db
-                .prepare('SELECT MAX(sequence) AS high_water FROM session_messages WHERE session_id = ?')
-                .get(sessionId);
-            const actualHighWater = nullableStoredMessageSequence(highWaterRow.high_water, sessionId);
-            const throughSequence = request.throughSequence === undefined ? actualHighWater : request.throughSequence;
-            if (throughSequence === null) {
-                return {
-                    throughSequence: null,
-                    fragments: [],
-                    rawBytes: 0,
-                    next: null,
-                };
-            }
-            if (actualHighWater === null || throughSequence > actualHighWater) {
-                throw new Error(`Session transcript watermark is ahead of durable storage: ${sessionId}`);
-            }
-            const position = request.position ?? (request.direction === 'older' ? throughSequence : 0);
-            const comparison = request.direction === 'older' ? '<=' : '>=';
-            const order = request.direction === 'older' ? 'DESC' : 'ASC';
+            // A payload row whose chunks do not reassemble to the bytes it recorded
+            // would be matched on a body shorter than the record, which is the one
+            // way this scan could return less than a superset: the term could sit in
+            // the part that is missing. A short body is as unusable as no body at
+            // all, so both decline the fast path rather than quietly answering with
+            // fewer candidates.
+            const unreadable = this.db
+                .prepare(`
+          SELECT count(*) AS total
+          FROM session_message_payloads AS payload
+          WHERE payload.session_id IN (${sessions})
+            AND COALESCE(
+                  octet_length((SELECT group_concat(CAST(chunk.data AS TEXT), '' ORDER BY chunk.chunk_index)
+                                  FROM session_message_chunks AS chunk
+                                 WHERE chunk.session_id = payload.session_id
+                                   AND chunk.sequence = payload.sequence)),
+                  -1
+                ) <> payload.record_bytes
+        `)
+                .get(...sessionIds);
+            if (typeof unreadable?.total === 'number' && unreadable.total > 0)
+                return undefined;
             const rows = this.db
                 .prepare(`
-          SELECT message.sequence,
-            coalesce(payload.record_bytes, length(CAST(message.record_json AS BLOB))) AS total_bytes,
-            payload.record_bytes IS NOT NULL AS chunked,
-            payload.sha256 AS payload_sha256
+          WITH legacy AS (
+            SELECT metadata.session_id
+            FROM session_metadata AS metadata
+            WHERE metadata.session_id IN (${sessions})
+              AND COALESCE(json_extract(metadata.payload_json, '$.transcriptLedgerVersion'), -1) <> 1
+          ),
+          chunked AS (
+            SELECT payload.session_id, payload.sequence,
+                   (SELECT group_concat(CAST(chunk.data AS TEXT), '' ORDER BY chunk.chunk_index)
+                      FROM session_message_chunks AS chunk
+                     WHERE chunk.session_id = payload.session_id
+                       AND chunk.sequence = payload.sequence) AS body
+              FROM session_message_payloads AS payload
+             WHERE payload.session_id IN (SELECT session_id FROM legacy)
+          )
+          SELECT DISTINCT message.session_id
           FROM session_messages AS message
           LEFT JOIN session_message_payloads AS payload
             ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-          WHERE message.session_id = ?
-            AND message.sequence <= ?
-            AND message.sequence ${comparison} ?
-          ORDER BY message.sequence ${order}
-          LIMIT ?
+          WHERE message.session_id IN (SELECT session_id FROM legacy)
+            AND message.message_type IN (${SEARCHABLE_MESSAGE_TYPE_PLACEHOLDERS})
+            AND payload.sequence IS NULL
+            AND (${inlineMatch})
+          UNION
+          SELECT DISTINCT message.session_id
+          FROM session_messages AS message
+          JOIN chunked
+            ON chunked.session_id = message.session_id AND chunked.sequence = message.sequence
+          WHERE message.message_type IN (${SEARCHABLE_MESSAGE_TYPE_PLACEHOLDERS})
+            AND chunked.body IS NOT NULL
+            AND (${chunkedMatch})
         `)
-                .all(sessionId, throughSequence, position, request.maxMessages + 1);
-            const slices = [];
-            let rawBytes = 0;
-            let next = null;
-            for (const row of rows) {
-                if (slices.length >= request.maxMessages || rawBytes >= request.maxBytes)
-                    break;
-                const sequence = requireStoredMessageSequence(row.sequence, sessionId);
-                const totalBytes = requireTranscriptRecordByteLength(row.total_bytes, sessionId, sequence);
-                const chunked = row.chunked === 1;
-                const payloadDigest = chunked
-                    ? requireTranscriptPayloadDigest(row.payload_sha256, sessionId, sequence)
-                    : null;
-                const continued = sequence === position && request.byteOffset !== undefined;
-                const edge = continued
-                    ? request.byteOffset
-                    : request.direction === 'older'
-                        ? totalBytes
-                        : 0;
-                if ((request.direction === 'older' && (edge < 1 || edge > totalBytes)) ||
-                    (request.direction === 'newer' && (edge < 0 || edge >= totalBytes))) {
-                    throw new StoredSessionMessageIncompatibleError(sessionId, sequence);
-                }
-                const available = request.maxBytes - rawBytes;
-                const byteOffset = request.direction === 'older' ? Math.max(0, edge - available) : edge;
-                const byteLength = request.direction === 'older'
-                    ? edge - byteOffset
-                    : Math.min(totalBytes - edge, available);
-                const complete = request.direction === 'older' ? byteOffset === 0 : byteOffset + byteLength === totalBytes;
-                slices.push({
-                    sequence,
-                    byteOffset,
-                    totalBytes,
-                    byteLength,
-                    chunked,
-                    payloadDigest,
-                });
-                rawBytes += byteLength;
-                if (!complete) {
-                    next = {
-                        position: sequence,
-                        byteOffset: request.direction === 'older' ? byteOffset : byteOffset + byteLength,
-                    };
-                    break;
+                .all(...sessionIds, ...SEARCHABLE_MESSAGE_TYPES, ...terms, ...SEARCHABLE_MESSAGE_TYPES, ...terms);
+            return rows.map((row) => {
+                if (typeof row.session_id !== 'string') {
+                    throw new Error('Session search candidate is missing its Session');
                 }
-            }
-            if (next === null && slices.length > 0 && slices.length < rows.length) {
-                const sequence = slices.at(-1).sequence;
-                next = {
-                    position: sequence + (request.direction === 'older' ? -1 : 1),
-                    byteOffset: null,
-                };
-            }
-            const dataBySequence = readTranscriptSlices(this.db, sessionId, slices);
-            const fragments = slices.map(({ sequence, byteOffset, totalBytes, byteLength, payloadDigest }) => {
-                const data = dataBySequence.get(sequence);
-                if (!data || data.byteLength !== byteLength) {
-                    throw new StoredSessionMessageIncompatibleError(sessionId, sequence);
-                }
-                if (byteOffset === 0 && byteLength === totalBytes) {
-                    validateTranscriptRecord(data, sessionId, sequence);
-                }
-                return { sequence, byteOffset, totalBytes, payloadDigest, data };
+                return row.session_id;
             });
-            return { throughSequence, fragments, rawBytes, next };
         });
     }
-    async readTranscriptMessages(sessionId, request) {
+    /**
+     * How many pre-ledger transcript rows could project to a searchable message,
+     * for recall's idf term. Counted by message type rather than by projecting,
+     * so it is cheap and identical whichever path recall takes to find its hits;
+     * Sessions the ledger owns are counted from `runtime_events` instead.
+     */
+    async countLegacyTranscriptMessages(sessionIds) {
         this.assertOpen();
-        assertSafeSessionId(sessionId);
-        if (request.messageIds.some((messageId) => typeof messageId !== 'string')) {
-            throw new Error('Invalid Session transcript message identity set');
-        }
-        if (request.throughSequence !== null &&
-            (!Number.isSafeInteger(request.throughSequence) || request.throughSequence < 0)) {
-            throw new Error('Invalid Session transcript watermark');
-        }
-        if (!Number.isSafeInteger(request.maxBytes) || request.maxBytes < 1) {
-            throw new Error('Invalid Session transcript message byte limit');
-        }
-        if (!Number.isSafeInteger(request.maxMessages) || request.maxMessages < 1) {
-            throw new Error('Invalid Session transcript message count limit');
-        }
-        const messageIds = [...new Set(request.messageIds)];
+        if (sessionIds.length === 0)
+            return 0;
+        for (const sessionId of sessionIds)
+            assertSafeSessionId(sessionId);
+        const sessions = sessionIds.map(() => '?').join(', ');
         return this.readTransaction(() => {
-            if (!this.readRecordSync(sessionId))
-                throw new SessionNotFoundError(sessionId);
-            if (messageIds.length === 0 || request.throughSequence === null)
-                return [];
-            const selected = [];
-            let selectedBytes = 0;
-            for (let offset = 0; offset < messageIds.length; offset += SQLITE_TRANSCRIPT_MESSAGE_LOOKUP_BATCH_SIZE) {
-                const batch = messageIds.slice(offset, offset + SQLITE_TRANSCRIPT_MESSAGE_LOOKUP_BATCH_SIZE);
-                const placeholders = batch.map(() => '?').join(', ');
-                const remainingMessages = request.maxMessages - selected.length;
-                const rows = this.db
-                    .prepare(`
-              SELECT message.sequence,
-                coalesce(payload.record_bytes, length(CAST(message.record_json AS BLOB)))
-                  AS stored_bytes
-              FROM session_messages AS message
-              LEFT JOIN session_message_payloads AS payload
-                ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-              WHERE message.session_id = ? AND message.sequence <= ?
-                AND message.message_id IN (${placeholders})
-              ORDER BY message.sequence ASC
-              LIMIT ?
-            `)
-                    .all(sessionId, request.throughSequence, ...batch, remainingMessages + 1);
-                if (rows.length > remainingMessages) {
-                    throw new Error('Session transcript message lookup exceeds its message limit');
-                }
-                for (const row of rows) {
-                    if (typeof row.sequence !== 'number' ||
-                        !Number.isSafeInteger(row.sequence) ||
-                        row.sequence < 0 ||
-                        typeof row.stored_bytes !== 'number' ||
-                        !Number.isSafeInteger(row.stored_bytes) ||
-                        row.stored_bytes < 1) {
-                        throw new StoredSessionMessageIncompatibleError(sessionId, -1);
-                    }
-                    selectedBytes += row.stored_bytes;
-                    if (selectedBytes > request.maxBytes) {
-                        throw new Error('Session transcript message lookup exceeds its byte limit');
-                    }
-                    selected.push(row.sequence);
-                }
-            }
-            selected.sort((left, right) => left - right);
-            const messages = [];
-            for (let offset = 0; offset < selected.length; offset += SQLITE_TRANSCRIPT_MESSAGE_LOOKUP_BATCH_SIZE) {
-                const batch = selected.slice(offset, offset + SQLITE_TRANSCRIPT_MESSAGE_LOOKUP_BATCH_SIZE);
-                const placeholders = batch.map(() => '?').join(', ');
-                const rows = readStoredMessageRows(this.db, sessionId, batch, placeholders);
-                if (rows.length !== batch.length) {
-                    throw new StoredSessionMessageIncompatibleError(sessionId, -1);
-                }
-                for (const row of rows) {
-                    try {
-                        messages.push(decodeStoredMessage(JSON.parse(row.recordJson)));
-                    }
-                    catch (error) {
-                        throw new StoredSessionMessageIncompatibleError(sessionId, row.sequence, {
-                            cause: error,
-                        });
-                    }
-                }
-            }
-            return messages;
+            const row = this.db
+                .prepare(`
+          SELECT count(*) AS total
+          FROM session_messages AS message
+          JOIN session_metadata AS metadata ON metadata.session_id = message.session_id
+          WHERE message.session_id IN (${sessions})
+            AND COALESCE(json_extract(metadata.payload_json, '$.transcriptLedgerVersion'), -1) <> 1
+            AND message.message_type IN (${SEARCHABLE_MESSAGE_TYPE_PLACEHOLDERS})
+        `)
+                .get(...sessionIds, ...SEARCHABLE_MESSAGE_TYPES);
+            return typeof row?.total === 'number' ? row.total : 0;
         });
     }
-    async readTranscriptRecords(sessionId, request) {
+    async readMessagesAfter(sessionId, request) {
         this.assertOpen();
         assertSafeSessionId(sessionId);
-        assertTranscriptRecordScanRequest(request);
+        if (!Number.isSafeInteger(request.maxMessages) || request.maxMessages < 1) {
+            throw new Error('Invalid Session message count limit');
+        }
+        if (!Number.isSafeInteger(request.maxStoredBytes) || request.maxStoredBytes < 1) {
+            throw new Error('Invalid Session message byte limit');
+        }
+        if (request.afterSequence !== undefined && request.beforeSequence !== undefined) {
+            throw new Error('Invalid Session message scan bounds');
+        }
+        const backward = request.beforeSequence !== undefined;
         return this.readTransaction(() => {
             if (!this.readRecordSync(sessionId))
                 throw new SessionNotFoundError(sessionId);
-            const highWaterRow = this.db
-                .prepare('SELECT MAX(sequence) AS high_water FROM session_messages WHERE session_id = ?')
-                .get(sessionId);
-            const actualHighWater = nullableStoredMessageSequence(highWaterRow.high_water, sessionId);
-            const throughSequence = request.throughSequence === undefined ? actualHighWater : request.throughSequence;
-            if (throughSequence === null) {
-                return { throughSequence: null, records: [], nextPosition: null };
-            }
-            if (actualHighWater === null || throughSequence > actualHighWater) {
-                throw new Error(`Session transcript watermark is ahead of durable storage: ${sessionId}`);
-            }
-            const position = request.position ?? (request.direction === 'older' ? throughSequence : 0);
-            const comparison = request.direction === 'older' ? '<=' : '>=';
-            const order = request.direction === 'older' ? 'DESC' : 'ASC';
             const rows = this.db
                 .prepare(`
-          SELECT message.sequence,
-            coalesce(payload.record_bytes, length(CAST(message.record_json AS BLOB))) AS stored_bytes
+          SELECT message.sequence, message.record_json, payload.record_bytes, payload.sha256
           FROM session_messages AS message
           LEFT JOIN session_message_payloads AS payload
             ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-          WHERE message.session_id = ?
-            AND message.sequence <= ?
-            AND message.sequence ${comparison} ?
-          ORDER BY message.sequence ${order}
+          WHERE message.session_id = ? AND message.sequence ${backward ? '<' : '>'} ?
+          ORDER BY message.sequence ${backward ? 'DESC' : 'ASC'}
           LIMIT ?
         `)
-                .all(sessionId, throughSequence, position, request.maxMessages + 1);
-            const selected = [];
+                .all(sessionId, backward ? request.beforeSequence : (request.afterSequence ?? -1), request.maxMessages);
+            const records = [];
             let storedBytes = 0;
             for (const row of rows) {
-                if (selected.length >= request.maxMessages)
-                    break;
                 const sequence = requireStoredMessageSequence(row.sequence, sessionId);
-                const bytes = requireTranscriptRecordByteLength(row.stored_bytes, sessionId, sequence);
-                if (selected.length > 0 && storedBytes + bytes > request.maxStoredBytes)
+                // A record too large for one row is stored in chunks, with only a
+                // marker inline; its size is the chunk total, not the marker's.
+                const recordBytes = typeof row.record_bytes === 'number' ? row.record_bytes : String(row.record_json).length;
+                // The first record of a page is always taken, so a single row larger
+                // than the budget still makes progress instead of stalling the scan.
+                if (records.length > 0 && storedBytes + recordBytes > request.maxStoredBytes)
                     break;
-                selected.push(sequence);
-                storedBytes += bytes;
-            }
-            const decoded = new Map();
-            for (const row of readStoredMessageRows(this.db, sessionId, selected)) {
-                try {
-                    decoded.set(row.sequence, decodeStoredMessage(JSON.parse(row.recordJson)));
-                }
-                catch (error) {
-                    throw new StoredSessionMessageIncompatibleError(sessionId, row.sequence, {
-                        cause: error,
-                    });
-                }
-            }
-            const records = selected.map((sequence) => {
-                const message = decoded.get(sequence);
-                if (!message)
-                    throw new StoredSessionMessageIncompatibleError(sessionId, sequence);
-                return { sequence, message };
-            });
-            const last = selected.at(-1);
-            return {
-                throughSequence,
-                records,
-                nextPosition: last !== undefined && rows.length > selected.length
-                    ? last + (request.direction === 'older' ? -1 : 1)
-                    : null,
-            };
-        });
-    }
-    async readTranscriptHighWater(sessionId) {
-        this.assertOpen();
-        assertSafeSessionId(sessionId);
-        if (!this.readRecordSync(sessionId))
-            throw new SessionNotFoundError(sessionId);
-        const row = this.db
-            .prepare('SELECT MAX(sequence) AS high_water FROM session_messages WHERE session_id = ?')
-            .get(sessionId);
-        return nullableStoredMessageSequence(row.high_water, sessionId);
-    }
-    async readTurnContributions(sessionId, throughSequence, position, maxContributions) {
-        this.assertOpen();
-        assertSafeSessionId(sessionId);
-        if ((throughSequence !== null &&
-            (!Number.isSafeInteger(throughSequence) || throughSequence < 0)) ||
-            !Number.isSafeInteger(position) ||
-            position < 0 ||
-            !Number.isSafeInteger(maxContributions) ||
-            maxContributions < 1 ||
-            maxContributions > 128) {
-            throw new Error('Invalid Session turn contribution request');
-        }
-        return this.readTransaction(() => {
-            if (!this.readRecordSync(sessionId))
-                throw new SessionNotFoundError(sessionId);
-            const highWaterRow = this.db
-                .prepare('SELECT MAX(sequence) AS high_water FROM session_messages WHERE session_id = ?')
-                .get(sessionId);
-            const actualHighWater = nullableStoredMessageSequence(highWaterRow.high_water, sessionId);
-            const fixedThrough = throughSequence ?? actualHighWater;
-            if (fixedThrough === null) {
-                return { throughSequence: null, contributions: [], nextPosition: null };
-            }
-            if (actualHighWater === null || fixedThrough > actualHighWater) {
-                throw new Error(`Session turn watermark is ahead of durable storage: ${sessionId}`);
-            }
-            const contributions = new Map();
-            let nextPosition = position;
-            let sourceMessages = 0;
-            let sourceBytes = 0;
-            while (nextPosition <= fixedThrough) {
-                const rows = this.db
-                    .prepare(`
-            SELECT message.sequence, message.record_json, payload.record_bytes, payload.sha256
-            FROM session_messages AS message
-            LEFT JOIN session_message_payloads AS payload
-              ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-            WHERE message.session_id = ?
-              AND message.sequence >= ?
-              AND message.sequence <= ?
-            ORDER BY message.sequence ASC
-            LIMIT 128
-          `)
-                    .all(sessionId, nextPosition, fixedThrough);
-                if (rows.length === 0) {
-                    throw new StoredSessionMessageIncompatibleError(sessionId, nextPosition);
-                }
-                for (const row of rows) {
-                    const sequence = requireStoredMessageSequence(row.sequence, sessionId);
-                    const recordBytes = storedMessageRecordBytes(row, sessionId, sequence);
-                    if (sourceMessages > 0 &&
-                        (sourceMessages >= SQLITE_TURN_CONTRIBUTION_MAX_SOURCE_MESSAGES ||
-                            sourceBytes + recordBytes > SQLITE_TURN_CONTRIBUTION_MAX_SOURCE_BYTES)) {
-                        return {
-                            throughSequence: fixedThrough,
-                            contributions: [...contributions.values()],
-                            nextPosition: sequence,
-                        };
-                    }
-                    const message = decodeStoredMessageRecordRow(this.db, sessionId, row);
-                    sourceMessages += 1;
-                    sourceBytes += recordBytes;
-                    if (!('turnId' in message) || typeof message.turnId !== 'string') {
-                        nextPosition = sequence + 1;
-                        continue;
-                    }
-                    const turnId = message.turnId;
-                    if (turnId && !contributions.has(turnId) && contributions.size >= maxContributions) {
-                        nextPosition = sequence;
-                        return {
-                            throughSequence: fixedThrough,
-                            contributions: [...contributions.values()],
-                            nextPosition,
-                        };
-                    }
-                    contributions.set(turnId, foldTurnContribution(contributions.get(turnId), turnId, sequence, message));
-                    nextPosition = sequence + 1;
-                }
+                storedBytes += recordBytes;
+                records.push({
+                    sequence,
+                    message: decodeStoredMessageRecordRow(this.db, sessionId, row),
+                });
             }
+            const highWater = this.db
+                .prepare('SELECT MAX(sequence) AS high_water FROM session_messages WHERE session_id = ?')
+                .get(sessionId);
             return {
-                throughSequence: fixedThrough,
-                contributions: [...contributions.values()],
-                nextPosition: null,
+                records,
+                highWaterSequence: nullableStoredMessageSequence(highWater.high_water, sessionId),
             };
         });
     }
-    async readTurnLandmarks(sessionId, maxLandmarks) {
+    async readTranscriptMessages(sessionId, request) {
         this.assertOpen();
         assertSafeSessionId(sessionId);
-        if (!Number.isSafeInteger(maxLandmarks) || maxLandmarks < 1 || maxLandmarks > 64) {
-            throw new Error('Invalid Session turn landmark limit');
+        if (request.messageIds.some((messageId) => typeof messageId !== 'string')) {
+            throw new Error('Invalid Session transcript message identity set');
+        }
+        if (request.throughSequence !== null &&
+            (!Number.isSafeInteger(request.throughSequence) || request.throughSequence < 0)) {
+            throw new Error('Invalid Session transcript watermark');
+        }
+        if (!Number.isSafeInteger(request.maxBytes) || request.maxBytes < 1) {
+            throw new Error('Invalid Session transcript message byte limit');
+        }
+        if (!Number.isSafeInteger(request.maxMessages) || request.maxMessages < 1) {
+            throw new Error('Invalid Session transcript message count limit');
         }
+        const messageIds = [...new Set(request.messageIds)];
         return this.readTransaction(() => {
             if (!this.readRecordSync(sessionId))
                 throw new SessionNotFoundError(sessionId);
-            const throughRow = this.db
-                .prepare(`
-          SELECT sequence AS through_sequence
-          FROM session_messages
-          WHERE session_id = ?
-          ORDER BY sequence DESC
-          LIMIT 1
-        `)
-                .get(sessionId);
-            const throughSequence = nullableStoredMessageSequence(throughRow?.through_sequence, sessionId);
-            if (throughSequence === null) {
-                return { throughSequence: null, landmarks: [] };
-            }
-            const promptRows = this.db
-                .prepare(`
-          SELECT admission.admitted_at, message.sequence
-          FROM core_root_turn_admissions AS admission
-          JOIN session_messages AS message
-            ON message.session_id = admission.session_id
-            AND message.message_id = json_extract(admission.record_json, '$.userMessageId')
-          LEFT JOIN session_message_payloads AS payload
-            ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-          WHERE admission.session_id = ? AND payload.sequence IS NULL
-          ORDER BY admission.admitted_at ASC, admission.turn_id ASC
-          LIMIT ?
-        `)
-                .all(sessionId, maxLandmarks + 1);
-            const selected = new Set();
-            if (promptRows.length <= maxLandmarks) {
-                for (const row of promptRows) {
-                    selected.add(requireStoredMessageSequence(row.sequence, sessionId));
-                }
-            }
-            const forward = this.db.prepare(`
-        SELECT admission.admitted_at, message.sequence
-        FROM core_root_turn_admissions AS admission
-        JOIN session_messages AS message
-          ON message.session_id = admission.session_id
-          AND message.message_id = json_extract(admission.record_json, '$.userMessageId')
-        LEFT JOIN session_message_payloads AS payload
-          ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-        WHERE admission.session_id = ? AND admission.admitted_at >= ? AND payload.sequence IS NULL
-        ORDER BY admission.admitted_at ASC, admission.turn_id ASC
-        LIMIT 1
-      `);
-            const backward = this.db.prepare(`
-        SELECT admission.admitted_at, message.sequence
-        FROM core_root_turn_admissions AS admission
-        JOIN session_messages AS message
-          ON message.session_id = admission.session_id
-          AND message.message_id = json_extract(admission.record_json, '$.userMessageId')
-        LEFT JOIN session_message_payloads AS payload
-          ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-        WHERE admission.session_id = ? AND admission.admitted_at < ? AND payload.sequence IS NULL
-        ORDER BY admission.admitted_at DESC, admission.turn_id DESC
-        LIMIT 1
-      `);
-            if (promptRows.length > maxLandmarks) {
-                const firstAdmittedAt = requireTurnLandmarkAdmittedAt(promptRows[0]?.admitted_at);
-                const lastRow = this.db
+            if (messageIds.length === 0 || request.throughSequence === null)
+                return [];
+            const selected = [];
+            let selectedBytes = 0;
+            for (let offset = 0; offset < messageIds.length; offset += SQLITE_TRANSCRIPT_MESSAGE_LOOKUP_BATCH_SIZE) {
+                const batch = messageIds.slice(offset, offset + SQLITE_TRANSCRIPT_MESSAGE_LOOKUP_BATCH_SIZE);
+                const placeholders = batch.map(() => '?').join(', ');
+                const remainingMessages = request.maxMessages - selected.length;
+                const rows = this.db
                     .prepare(`
-            SELECT admitted_at
-            FROM core_root_turn_admissions
-            WHERE session_id = ?
-            ORDER BY admitted_at DESC, turn_id DESC
-            LIMIT 1
-          `)
-                    .get(sessionId);
-                const lastAdmittedAt = requireTurnLandmarkAdmittedAt(lastRow?.admitted_at);
-                for (let index = 0; index < maxLandmarks; index += 1) {
-                    const target = maxLandmarks === 1
-                        ? lastAdmittedAt
-                        : firstAdmittedAt +
-                            Math.floor(((lastAdmittedAt - firstAdmittedAt) * index) / (maxLandmarks - 1));
-                    const candidates = [
-                        ...forward.all(sessionId, target),
-                        ...backward.all(sessionId, target),
-                    ];
-                    let nearest;
-                    for (const candidate of candidates) {
-                        const admittedAt = requireTurnLandmarkAdmittedAt(candidate.admitted_at);
-                        if (nearest === undefined ||
-                            Math.abs(admittedAt - target) <
-                                Math.abs(requireTurnLandmarkAdmittedAt(nearest.admitted_at) - target)) {
-                            nearest = candidate;
-                        }
+              SELECT message.sequence,
+                coalesce(payload.record_bytes, length(CAST(message.record_json AS BLOB)))
+                  AS stored_bytes
+              FROM session_messages AS message
+              LEFT JOIN session_message_payloads AS payload
+                ON payload.session_id = message.session_id AND payload.sequence = message.sequence
+              WHERE message.session_id = ? AND message.sequence <= ?
+                AND message.message_id IN (${placeholders})
+              ORDER BY message.sequence ASC
+              LIMIT ?
+            `)
+                    .all(sessionId, request.throughSequence, ...batch, remainingMessages + 1);
+                if (rows.length > remainingMessages) {
+                    throw new Error('Session transcript message lookup exceeds its message limit');
+                }
+                for (const row of rows) {
+                    if (typeof row.sequence !== 'number' ||
+                        !Number.isSafeInteger(row.sequence) ||
+                        row.sequence < 0 ||
+                        typeof row.stored_bytes !== 'number' ||
+                        !Number.isSafeInteger(row.stored_bytes) ||
+                        row.stored_bytes < 1) {
+                        throw new StoredSessionMessageIncompatibleError(sessionId, -1);
                     }
-                    if (nearest)
-                        selected.add(requireStoredMessageSequence(nearest.sequence, sessionId));
+                    selectedBytes += row.stored_bytes;
+                    if (selectedBytes > request.maxBytes) {
+                        throw new Error('Session transcript message lookup exceeds its byte limit');
+                    }
+                    selected.push(row.sequence);
                 }
             }
-            const firstIndexedSequence = promptRows.length > 0
-                ? requireStoredMessageSequence(promptRows[0]?.sequence, sessionId)
-                : null;
-            const legacyThrough = firstIndexedSequence === null ? throughSequence : firstIndexedSequence - 1;
-            if (legacyThrough >= 0) {
-                const firstRow = this.db
-                    .prepare(`
-            SELECT sequence AS first_sequence
-            FROM session_messages
-            WHERE session_id = ?
-            ORDER BY sequence ASC
-            LIMIT 1
-          `)
-                    .get(sessionId);
-                const firstSequence = nullableStoredMessageSequence(firstRow?.first_sequence, sessionId);
-                if (firstSequence === null || firstSequence > legacyThrough) {
-                    throw new StoredSessionMessageIncompatibleError(sessionId, legacyThrough);
+            selected.sort((left, right) => left - right);
+            const messages = [];
+            for (let offset = 0; offset < selected.length; offset += SQLITE_TRANSCRIPT_MESSAGE_LOOKUP_BATCH_SIZE) {
+                const batch = selected.slice(offset, offset + SQLITE_TRANSCRIPT_MESSAGE_LOOKUP_BATCH_SIZE);
+                const placeholders = batch.map(() => '?').join(', ');
+                const rows = readStoredMessageRows(this.db, sessionId, batch, placeholders);
+                if (rows.length !== batch.length) {
+                    throw new StoredSessionMessageIncompatibleError(sessionId, -1);
                 }
-                const forwardLegacy = this.db.prepare(`
-          SELECT message.sequence, message.message_type, payload.sequence AS payload_sequence
-          FROM session_messages AS message
-          LEFT JOIN session_message_payloads AS payload
-            ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-          WHERE message.session_id = ? AND message.sequence >= ? AND message.sequence <= ?
-          ORDER BY message.sequence ASC
-          LIMIT ${SQLITE_TURN_LANDMARK_LEGACY_NEIGHBOR_MESSAGES}
-        `);
-                const backwardLegacy = this.db.prepare(`
-          SELECT message.sequence, message.message_type, payload.sequence AS payload_sequence
-          FROM session_messages AS message
-          LEFT JOIN session_message_payloads AS payload
-            ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-          WHERE message.session_id = ? AND message.sequence < ? AND message.sequence >= ?
-          ORDER BY message.sequence DESC
-          LIMIT ${SQLITE_TURN_LANDMARK_LEGACY_NEIGHBOR_MESSAGES}
-        `);
-                const targetCount = Math.min(maxLandmarks, legacyThrough - firstSequence + 1);
-                for (let index = 0; index < targetCount; index += 1) {
-                    const target = targetCount === 1
-                        ? legacyThrough
-                        : firstSequence +
-                            Math.floor(((legacyThrough - firstSequence) * index) / (targetCount - 1));
-                    const candidates = [
-                        ...forwardLegacy.all(sessionId, target, legacyThrough),
-                        ...backwardLegacy.all(sessionId, target, firstSequence),
-                    ];
-                    let nearest;
-                    for (const candidate of candidates) {
-                        const sequence = requireStoredMessageSequence(candidate.sequence, sessionId);
-                        if (candidate.message_type !== 'user' || candidate.payload_sequence !== null)
-                            continue;
-                        if (nearest === undefined || Math.abs(sequence - target) < Math.abs(nearest - target)) {
-                            nearest = sequence;
-                        }
+                for (const row of rows) {
+                    try {
+                        messages.push(decodeStoredMessage(JSON.parse(row.recordJson)));
+                    }
+                    catch (error) {
+                        throw new StoredSessionMessageIncompatibleError(sessionId, row.sequence, {
+                            cause: error,
+                        });
                     }
-                    if (nearest !== undefined)
-                        selected.add(nearest);
                 }
             }
-            const selectedSequences = [...selected].sort((left, right) => left - right);
-            const sampledSequences = selectedSequences.length <= maxLandmarks
-                ? selectedSequences
-                : Array.from({ length: maxLandmarks }, (_, index) => selectedSequences[maxLandmarks === 1
-                    ? selectedSequences.length - 1
-                    : Math.floor(((selectedSequences.length - 1) * index) / (maxLandmarks - 1))]);
-            const landmarks = readStoredMessageRows(this.db, sessionId, sampledSequences).flatMap(({ sequence, recordJson }) => {
-                let message;
-                try {
-                    message = decodeStoredMessage(JSON.parse(recordJson));
-                }
-                catch (error) {
-                    throw new StoredSessionMessageIncompatibleError(sessionId, sequence, { cause: error });
-                }
-                if (message.type !== 'user') {
-                    throw new StoredSessionMessageIncompatibleError(sessionId, sequence);
-                }
-                const label = (message.displayText ?? message.text).trim();
-                return label ? [{ turnId: message.turnId, sequence, label }] : [];
-            });
-            return { throughSequence, landmarks };
+            return messages;
         });
     }
-    async readMessagesForRecovery(sessionId) {
-        return this.readMessagesWith(sessionId, decodeStoredMessage);
-    }
-    async readPreviewMessages(sessionId, limit = 10) {
+    async readTranscriptHighWater(sessionId) {
         this.assertOpen();
         assertSafeSessionId(sessionId);
-        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 128) {
-            throw new Error('Session message preview limit must be between 1 and 128');
-        }
         if (!this.readRecordSync(sessionId))
             throw new SessionNotFoundError(sessionId);
-        const sequences = this.db
-            .prepare(`
-          SELECT sequence FROM session_messages
-          WHERE session_id = ? ORDER BY sequence DESC LIMIT ?
-        `)
-            .all(sessionId, limit)
-            .map((row) => requireStoredMessageSequence(row.sequence, sessionId))
-            .reverse();
-        return readStoredMessageRows(this.db, sessionId, sequences, sequences.map(() => '?').join(', ')).map((row) => decodeStoredMessageRow({ sequence: row.sequence, record_json: row.recordJson }, sessionId));
+        const row = this.db
+            .prepare('SELECT MAX(sequence) AS high_water FROM session_messages WHERE session_id = ?')
+            .get(sessionId);
+        return nullableStoredMessageSequence(row.high_water, sessionId);
     }
     async beginCatalogProjectionWrite() {
         this.assertOpen();
@@ -2457,6 +2491,22 @@ export class SqliteSessionMetadataStore {
             .all(graphId);
         return rows.map(decodeAgentGraphScheduleUpdateRow);
     }
+    async listAgentGraphScheduleRecoveryGraphIds() {
+        this.assertOpen();
+        const rows = this.db
+            .prepare(`
+        SELECT DISTINCT graph_id
+        FROM agent_graph_schedule_updates
+        ORDER BY graph_id
+      `)
+            .all();
+        return rows.map((row) => {
+            if (typeof row.graph_id !== 'string') {
+                throw new Error('Invalid Agent Graph schedule identity');
+            }
+            return row.graph_id;
+        });
+    }
     async claimAgentGraphSupervisorWake(request) {
         this.assertOpen();
         assertAgentGraphSupervisorWakeClaim(request);
@@ -2494,11 +2544,17 @@ export class SqliteSessionMetadataStore {
     async beginAgentGraphSupervisorWakeAttempt(request) {
         this.assertOpen();
         assertAgentGraphSupervisorWakeAttempt(request);
+        if (request.maxAttempts !== undefined &&
+            (!Number.isSafeInteger(request.maxAttempts) || request.maxAttempts < 1)) {
+            throw new Error('Agent graph supervisor wake max attempts must be positive');
+        }
         return this.transaction(() => {
             const wake = this.requireAgentGraphSupervisorWakeSync(request.graphId, request.wakeId);
             if (wake.status === 'delivered' ||
                 wake.status === 'running' ||
-                wake.status === 'waiting_permission') {
+                wake.status === 'waiting_permission' ||
+                wake.status === 'exhausted' ||
+                (request.maxAttempts !== undefined && wake.attemptCount >= request.maxAttempts)) {
                 return { wake, acquired: false };
             }
             const now = this.now();
@@ -2514,8 +2570,9 @@ export class SqliteSessionMetadataStore {
           WHERE graph_id = ?
             AND wake_id = ?
             AND status IN ('pending', 'retryable_failed')
+            AND (? IS NULL OR attempt_count < ?)
         `)
-                .run(request.attemptId, request.turnId, now, request.graphId, request.wakeId);
+                .run(request.attemptId, request.turnId, now, request.graphId, request.wakeId, request.maxAttempts ?? null, request.maxAttempts ?? null);
             if (updated.changes !== 1) {
                 return {
                     wake: this.requireAgentGraphSupervisorWakeSync(request.graphId, request.wakeId),
@@ -2582,6 +2639,30 @@ export class SqliteSessionMetadataStore {
             return this.requireAgentGraphSupervisorWakeSync(request.graphId, request.wakeId);
         });
     }
+    async exhaustAgentGraphSupervisorWake(graphId, wakeId, reason) {
+        this.assertOpen();
+        assertGraphLookupIdentity(graphId, 'graph id');
+        assertGraphLookupIdentity(wakeId, 'supervisor wake id');
+        if (!reason.trim() || reason.length > 4_000) {
+            throw new Error('Agent graph supervisor wake exhaustion reason must be non-empty and bounded');
+        }
+        return this.transaction(() => {
+            const wake = this.requireAgentGraphSupervisorWakeSync(graphId, wakeId);
+            if (wake.status === 'exhausted')
+                return wake;
+            if (wake.status !== 'retryable_failed') {
+                throw new SessionMetadataConflictError('Agent graph supervisor wake is not retryable');
+            }
+            this.db
+                .prepare(`
+        UPDATE agent_graph_supervisor_wakes
+        SET status = 'exhausted', failure_reason = ?, updated_at = ?
+        WHERE graph_id = ? AND wake_id = ? AND status = 'retryable_failed'
+      `)
+                .run(reason, this.now(), graphId, wakeId);
+            return this.requireAgentGraphSupervisorWakeSync(graphId, wakeId);
+        });
+    }
     async supersedeAgentGraphSupervisorWakes(request) {
         this.assertOpen();
         const sessionIds = [...new Set(request.rootSessionIds)];
@@ -3317,9 +3398,12 @@ export class SqliteSessionMetadataStore {
         this.assertOpen();
         const identities = uniqueVersionedSessionIdentities(sessions);
         return this.transaction(() => {
-            const records = identities.map(({ sessionId, expectedVersion }) => this.setArchivedSync(sessionId, expectedVersion, isArchived));
+            // One instant for the whole set, so a family archived together reads as
+            // archived together.
+            const archivedAt = this.now();
+            const records = identities.map(({ sessionId, expectedVersion }) => this.setArchivedSync(sessionId, expectedVersion, isArchived, archivedAt));
             if (isArchived)
-                this.deleteGoalAuthorities(identities);
+                this.deleteWorkflowAuthorities(identities);
             return records;
         });
     }
@@ -3359,7 +3443,7 @@ export class SqliteSessionMetadataStore {
             }
             const deletedAt = this.now();
             for (const { sessionId, expectedVersion } of archiveIdentities) {
-                this.setArchivedSync(sessionId, expectedVersion, true);
+                this.setArchivedSync(sessionId, expectedVersion, true, deletedAt);
             }
             for (const { sessionId } of present) {
                 const deleted = this.db
@@ -3381,18 +3465,21 @@ export class SqliteSessionMetadataStore {
           `)
                     .run(sessionId, deletedAt, retirementUnitId);
             }
-            this.deleteGoalAuthorities([...identities, ...archiveIdentities]);
+            this.deleteWorkflowAuthorities([...identities, ...archiveIdentities]);
             return identities.map((identity) => identity.sessionId);
         });
     }
-    deleteGoalAuthorities(sessions) {
+    deleteWorkflowAuthorities(sessions) {
         // Standalone metadata stores have no workflow schema. An operational lease
-        // guarantees that Goal authority shares this exact transaction boundary.
+        // guarantees that workflow authority shares this exact transaction boundary.
         if (!this.databaseLease)
             return;
         const remove = this.db.prepare('DELETE FROM workflow_goal_authority WHERE session_id = ?');
-        for (const { sessionId } of sessions)
+        const removeWaits = this.db.prepare('DELETE FROM workflow_event_waits WHERE session_id = ?');
+        for (const { sessionId } of sessions) {
             remove.run(sessionId);
+            removeWaits.run(sessionId);
+        }
     }
     async remove(sessionId) {
         this.assertOpen();
@@ -3522,7 +3609,7 @@ export class SqliteSessionMetadataStore {
             if (boundary.kind !== 'managed') {
                 throw new SessionMetadataConflictError(`Managed sandbox boundary history is invalid: ${sessionId}`);
             }
-            if (!isCanonicalReadOnlySandboxProfile(boundary.profile))
+            if (!isCanonicalReadOnlyPermissionProfile(boundary.profile))
                 return boundary.profile;
         }
         return requireManagedProfile(createGenesisExecutionBoundary('ask'));
@@ -3580,7 +3667,7 @@ export class SqliteSessionMetadataStore {
         }, sessionId);
         return this.persistHeaderSync(sessionId, current, next, options);
     }
-    setArchivedSync(sessionId, expectedVersion, isArchived) {
+    setArchivedSync(sessionId, expectedVersion, isArchived, archivedAt) {
         const current = this.readRecordSync(sessionId);
         if (!current)
             throw new SessionNotFoundError(sessionId);
@@ -3588,7 +3675,13 @@ export class SqliteSessionMetadataStore {
             throw new SessionMetadataVersionConflictError(sessionId, expectedVersion, current.metadataVersion);
         }
         const next = normalizeSessionHeader({ ...current.header, isArchived }, sessionId);
-        return this.persistHeaderSync(sessionId, current, next, { skipNoop: true });
+        // A Session already in the requested state is a no-op below, so an
+        // archived Session keeps the time it was first archived; only a real
+        // transition writes the column. Every other writer leaves it alone.
+        return this.persistHeaderSync(sessionId, current, next, {
+            skipNoop: true,
+            archivedAt: isArchived ? archivedAt : null,
+        });
     }
     persistHeaderSync(sessionId, current, next, options = {}) {
         if (next.id !== sessionId) {
@@ -3620,10 +3713,11 @@ export class SqliteSessionMetadataStore {
           llm_connection_slug = ?,
           model = ?,
           metadata_version = ?,
-          committed_at = ?
+          committed_at = ?,
+          archived_at = CASE WHEN ? = 1 THEN ? ELSE archived_at END
         WHERE session_id = ? AND metadata_version = ?
       `)
-            .run(JSON.stringify(next), next.createdAt, next.lastMessageAt ?? null, next.name, booleanInteger(next.isFlagged), booleanInteger(next.isArchived), next.parentSessionId ?? null, next.subagentParent?.parentSessionId ?? null, next.revisionRootSessionId ?? null, next.revisionIndex ?? null, booleanInteger(next.hasUnread), next.backend, next.llmConnectionSlug, next.model, metadataVersion, committedAt, sessionId, current.metadataVersion);
+            .run(JSON.stringify(next), next.createdAt, next.lastMessageAt ?? null, next.name, booleanInteger(next.isFlagged), booleanInteger(next.isArchived), next.parentSessionId ?? null, next.subagentParent?.parentSessionId ?? null, next.revisionRootSessionId ?? null, next.revisionIndex ?? null, booleanInteger(next.hasUnread), next.backend, next.llmConnectionSlug, next.model, metadataVersion, committedAt, options.archivedAt === undefined ? 0 : 1, options.archivedAt ?? null, sessionId, current.metadataVersion);
         if (updated.changes !== 1) {
             throw new SessionMetadataConflictError(`Session metadata compare-and-set failed: ${sessionId}`);
         }
@@ -3668,7 +3762,7 @@ export class SqliteSessionMetadataStore {
         const nextManagedProfile = kind === 'managed'
             ? projectedMode === 'explore'
                 ? requireManagedProfile(createGenesisExecutionBoundary('explore'))
-                : current.kind === 'managed' && !isCanonicalReadOnlySandboxProfile(current.profile)
+                : current.kind === 'managed' && !isCanonicalReadOnlyPermissionProfile(current.profile)
                     ? current.profile
                     : this.readLatestAutoSandboxProfileSync(sessionId)
             : undefined;
@@ -3739,64 +3833,6 @@ export class SqliteSessionMetadataStore {
             .get(sessionId, messageId);
         return row ? decodeStoredMessageRecordRow(this.db, sessionId, row) : undefined;
     }
-    readSessionMessageOrderingSync(sessionId) {
-        const rows = this.db
-            .prepare(`
-        SELECT message.sequence, message.record_json, payload.record_bytes, payload.sha256
-        FROM session_messages AS message
-        LEFT JOIN session_message_payloads AS payload
-          ON payload.session_id = message.session_id AND payload.sequence = message.sequence
-        WHERE message.session_id = ?
-        ORDER BY message.sequence
-      `)
-            .all(sessionId);
-        return rows.map((row) => {
-            const sequence = requireStoredMessageSequence(row.sequence, sessionId);
-            const recordJson = readStoredMessageRecordJson(this.db, sessionId, sequence, row);
-            return {
-                sequence,
-                message: decodeStoredMessage(JSON.parse(recordJson)),
-            };
-        });
-    }
-    shiftSessionMessageSuffixSync(sessionId, firstSequence, amount) {
-        if (!Number.isSafeInteger(firstSequence) || firstSequence < 0) {
-            throw new SessionMetadataConflictError('Invalid transcript insertion sequence');
-        }
-        if (!Number.isSafeInteger(amount) || amount < 1) {
-            throw new SessionMetadataConflictError('Invalid transcript insertion size');
-        }
-        const sequences = this.db
-            .prepare(`
-          SELECT sequence
-          FROM session_messages
-          WHERE session_id = ? AND sequence >= ?
-          ORDER BY sequence DESC
-        `)
-            .all(sessionId, firstSequence).map((row) => requireStoredMessageSequence(row.sequence, sessionId));
-        const highest = sequences[0];
-        if (highest !== undefined && highest > Number.MAX_SAFE_INTEGER - amount) {
-            throw new SessionMetadataConflictError('Session message sequence overflow');
-        }
-        if (sequences.length === 0)
-            return;
-        this.db.exec('PRAGMA defer_foreign_keys = ON');
-        const moveChunks = this.db.prepare('UPDATE session_message_chunks SET sequence = ? WHERE session_id = ? AND sequence = ?');
-        const movePayload = this.db.prepare('UPDATE session_message_payloads SET sequence = ? WHERE session_id = ? AND sequence = ?');
-        const moveMessage = this.db.prepare('UPDATE session_messages SET sequence = ? WHERE session_id = ? AND sequence = ?');
-        for (const sequence of sequences) {
-            const shifted = sequence + amount;
-            moveChunks.run(shifted, sessionId, sequence);
-            const payload = movePayload.run(shifted, sessionId, sequence);
-            if (payload.changes !== 0 && payload.changes !== 1) {
-                throw new SessionMetadataConflictError('Message payload sequence is ambiguous');
-            }
-            const message = moveMessage.run(shifted, sessionId, sequence);
-            if (message.changes !== 1) {
-                throw new SessionMetadataConflictError('Message transcript sequence changed during repair');
-            }
-        }
-    }
     insertSessionMessagesSync(sessionId, firstSequence, entries) {
         if (!Number.isSafeInteger(firstSequence) ||
             firstSequence < 0 ||
@@ -3897,12 +3933,19 @@ export class SqliteSessionMetadataStore {
         if (!current)
             throw new SessionNotFoundError(sessionId);
         const lastMessageAt = maxTimestamp(current.header.lastMessageAt, projection.lastMessageAt);
+        // The preview refuses to move backwards for the same reason the timestamp
+        // does: a message older than the one on show is a repair of something the
+        // catalog already passed, and recovery replays exactly those.
+        const stale = !replacePreview &&
+            projection.lastMessageAt !== undefined &&
+            current.header.lastMessageAt !== undefined &&
+            projection.lastMessageAt < current.header.lastMessageAt;
         this.updateHeaderSync(sessionId, {
             ...(lockConnection ? { connectionLocked: true } : {}),
             ...(lastMessageAt === undefined ? {} : { lastMessageAt }),
         }, {
             skipNoop: true,
-            ...(replacePreview || projection.lastMessagePreview !== undefined
+            ...(!stale && (replacePreview || projection.lastMessagePreview !== undefined)
                 ? {
                     catalogPreview: {
                         kind: 'replace',
@@ -4470,6 +4513,7 @@ function decodeAgentGraphSupervisorWakeRow(row) {
             'waiting_permission',
             'delivered',
             'superseded',
+            'exhausted',
             'retryable_failed',
         ].includes(row.status) ||
         !Number.isSafeInteger(row.attemptCount) ||
@@ -4537,6 +4581,27 @@ function agentGraphScheduleUpdateRequest(update) {
     const { revision: _revision, committedAt: _committedAt, ...request } = update;
     return request;
 }
+function archiveRetentionCandidatePredicate() {
+    const row = sqliteArchivedTaskRowPredicate();
+    return {
+        // The pinned-family exclusion is deliberately uncorrelated: SQLite
+        // evaluates the pinned family roots once, instead of rescanning
+        // session_metadata for every candidate. The correlated form was quadratic
+        // (about 1 s at 10k Sessions) and runs synchronously on the Host thread.
+        // No index covers is_flagged/is_archived (migration 26 dropped them).
+        sql: `(
+      metadata.is_flagged = 0
+      AND ${row.sql}
+      AND json_type(metadata.payload_json, '$.subagentParent.graph') IS NULL
+      AND COALESCE(metadata.revision_root_session_id, metadata.session_id) NOT IN (
+        SELECT COALESCE(pinned.revision_root_session_id, pinned.session_id)
+        FROM session_metadata pinned
+        WHERE pinned.is_flagged = 1
+      )
+    )`,
+        parameters: row.parameters,
+    };
+}
 function decodeRecord(row) {
     const parsed = JSON.parse(row.payload_json);
     if (!Number.isSafeInteger(row.metadata_version) ||
@@ -4555,12 +4620,22 @@ function decodeCatalogRecord(row) {
         throw new Error(`Invalid SQLite Session catalog activity for ${row.session_id}`);
     }
     const lastMessagePreview = decodeCatalogPreview(row.last_message_preview, row.session_id);
+    const archivedAt = decodeCatalogArchivedAt(row.archived_at, row.session_id);
     return {
         ...decodeRecord(row),
         activityAt: row.activity_at,
         ...(lastMessagePreview === undefined ? {} : { lastMessagePreview }),
+        ...(archivedAt === undefined ? {} : { archivedAt }),
     };
 }
+function decodeCatalogArchivedAt(value, sessionId) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`Invalid SQLite Session archive time for ${sessionId}`);
+    }
+    return value;
+}
 function decodeCatalogPreview(value, sessionId) {
     if (value === null || value === undefined)
         return undefined;
@@ -4650,20 +4725,6 @@ function requireManagedProfile(boundary) {
         throw new Error('Expected a managed execution boundary');
     return boundary.profile;
 }
-function isCanonicalReadOnlySandboxProfile(profile) {
-    const { name: _profileName, ...profilePolicy } = profile;
-    const { name: _canonicalName, ...canonicalPolicy } = requireManagedProfile(createGenesisExecutionBoundary('explore'));
-    return isDeepStrictEqual(profilePolicy, canonicalPolicy);
-}
-function assertGraphLookupIdentity(value, name) {
-    if (typeof value !== 'string' ||
-        value.length === 0 ||
-        value.length > 256 ||
-        value.trim() !== value ||
-        /[\u0000-\u001f\u007f]/.test(value)) {
-        throw new Error(`Invalid agent graph ${name}`);
-    }
-}
 function assertSafeBoundaryRequestId(value) {
     if (!/^[A-Za-z0-9_-]{1,128}$/.test(value)) {
         throw new Error('Invalid sandbox boundary request id');
@@ -4678,92 +4739,6 @@ function assertSandboxBoundaryProvenanceId(value, name) {
         throw new Error(`Invalid sandbox boundary ${name}`);
     }
 }
-function assertAgentGraphSupervisorWakeClaim(request) {
-    if (request.schemaVersion !== AGENT_GRAPH_SUPERVISOR_WAKE_SCHEMA_VERSION) {
-        throw new Error('Invalid agent graph supervisor wake schema');
-    }
-    assertGraphLookupIdentity(request.graphId, 'graph id');
-    assertGraphLookupIdentity(request.wakeId, 'supervisor wake id');
-    assertGraphLookupIdentity(request.snapshotVersion, 'snapshot version');
-    assertSafeSessionId(request.rootSessionId);
-}
-function assertAgentGraphSupervisorWakeAttempt(request) {
-    assertGraphLookupIdentity(request.graphId, 'graph id');
-    assertGraphLookupIdentity(request.wakeId, 'supervisor wake id');
-    assertGraphLookupIdentity(request.attemptId, 'supervisor wake attempt id');
-    assertGraphLookupIdentity(request.turnId, 'supervisor wake turn id');
-}
-function assertAgentGraphSupervisorWakeCompletion(request) {
-    assertGraphLookupIdentity(request.graphId, 'graph id');
-    assertGraphLookupIdentity(request.wakeId, 'supervisor wake id');
-    assertGraphLookupIdentity(request.attemptId, 'supervisor wake attempt id');
-    if (request.status !== 'waiting_permission' &&
-        request.status !== 'delivered' &&
-        request.status !== 'superseded' &&
-        request.status !== 'retryable_failed') {
-        throw new Error('Invalid agent graph supervisor wake completion status');
-    }
-    if ((request.status === 'retryable_failed' || request.status === 'superseded') &&
-        (!request.failureReason?.trim() || request.failureReason.length > 4_000)) {
-        throw new Error('Agent graph supervisor wake failure reason must be non-empty and bounded');
-    }
-}
-function assertAgentGraphClientProjectionRequest(request) {
-    if (request.schemaVersion !== AGENT_GRAPH_CLIENT_PROJECTION_SCHEMA_VERSION ||
-        (request.expectedSnapshotVersion !== null &&
-            typeof request.expectedSnapshotVersion !== 'string') ||
-        typeof request.replaceOperators !== 'boolean' ||
-        !Array.isArray(request.operators) ||
-        !Array.isArray(request.terminalActivities) ||
-        !Array.isArray(request.activityRecords)) {
-        throw new Error('Invalid agent graph client projection request');
-    }
-    assertGraphLookupIdentity(request.graphId, 'graph id');
-    assertSafeSessionId(request.rootSessionId);
-    if (request.expectedSnapshotVersion !== null) {
-        assertGraphLookupIdentity(request.expectedSnapshotVersion, 'expected snapshot version');
-    }
-    assertGraphLookupIdentity(request.snapshotVersion, 'snapshot version');
-    const operatorIds = new Set();
-    for (const operator of request.operators) {
-        assertGraphLookupIdentity(operator.operatorId, 'operator id');
-        if (operatorIds.has(operator.operatorId)) {
-            throw new Error(`Duplicate agent graph client operator ${operator.operatorId}`);
-        }
-        operatorIds.add(operator.operatorId);
-    }
-    const terminalIds = new Set();
-    for (const terminal of request.terminalActivities) {
-        assertGraphLookupIdentity(terminal.recordId, 'terminal record id');
-        assertGraphEventTime(terminal.eventTime);
-        if (terminalIds.has(terminal.recordId)) {
-            throw new Error(`Duplicate agent graph terminal activity ${terminal.recordId}`);
-        }
-        terminalIds.add(terminal.recordId);
-    }
-    const activityIds = new Set();
-    for (const record of request.activityRecords) {
-        assertGraphLookupIdentity(record.recordId, 'activity record id');
-        assertGraphEventTime(record.eventTime);
-        if (activityIds.has(record.recordId)) {
-            throw new Error(`Duplicate agent graph activity ${record.recordId}`);
-        }
-        activityIds.add(record.recordId);
-    }
-    if (request.incrementalRecordId !== undefined) {
-        assertGraphLookupIdentity(request.incrementalRecordId, 'incremental record id');
-        if (request.expectedSnapshotVersion === null || !activityIds.has(request.incrementalRecordId)) {
-            throw new Error('Invalid incremental agent graph projection record');
-        }
-    }
-}
-function encodeProjectionPayload(payload, name) {
-    const encoded = JSON.stringify(payload);
-    if (encoded === undefined) {
-        throw new Error(`Invalid agent graph ${name} payload`);
-    }
-    return encoded;
-}
 function decodeAgentGraphClientProjectionRow(row) {
     if (row.schemaVersion !== AGENT_GRAPH_CLIENT_PROJECTION_SCHEMA_VERSION ||
         !Number.isSafeInteger(row.materializedAt) ||
@@ -4797,16 +4772,6 @@ function decodeAgentGraphClientOperatorProjectionRow(row) {
         materializedAt: row.materializedAt,
     };
 }
-function assertGraphEventTime(value) {
-    if (!Number.isSafeInteger(value) || value < 0) {
-        throw new Error('Invalid agent graph terminal activity event time');
-    }
-}
-function assertGraphIntentId(value) {
-    if (!/^graph_intent_[a-f0-9]{32}$/.test(value)) {
-        throw new Error('Invalid agent graph intent id');
-    }
-}
 function decodeStoredMessageRow(row, sessionId) {
     const sequence = requireStoredMessageSequence(row.sequence, sessionId);
     if (typeof row.record_json !== 'string') {
@@ -4822,22 +4787,6 @@ function decodeStoredMessageRow(row, sessionId) {
         });
     }
 }
-function requireTurnLandmarkAdmittedAt(value) {
-    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
-        throw new Error('Invalid root Turn admission timestamp');
-    }
-    return value;
-}
-function storedMessageRecordBytes(row, sessionId, sequence) {
-    if (row.record_bytes !== null) {
-        return requireTranscriptRecordByteLength(row.record_bytes, sessionId, sequence);
-    }
-    if (typeof row.record_json !== 'string' ||
-        row.record_json === SQLITE_SESSION_MESSAGE_CHUNK_MARKER) {
-        throw new StoredSessionMessageIncompatibleError(sessionId, sequence);
-    }
-    return Buffer.byteLength(row.record_json, 'utf8');
-}
 function decodeStoredMessageRecordRow(db, sessionId, row) {
     const sequence = requireStoredMessageSequence(row.sequence, sessionId);
     return decodeStoredMessageRow({
@@ -4869,6 +4818,29 @@ function readStoredMessageRecordJson(db, sessionId, sequence, row) {
     }
     return recordJson;
 }
+function isWorkHubActionOperation(value) {
+    return (value === 'answer_here' ||
+        value === 'clarify' ||
+        value === 'delegate_existing' ||
+        value === 'create_new' ||
+        value === 'replace' ||
+        value === 'stop');
+}
+function workHubAssignmentAttachmentsMatchTarget(assignment) {
+    const source = assignment.attachments ?? [];
+    const target = assignment.targetAttachments ?? [];
+    return (source.length === target.length &&
+        source.every((attachment, index) => {
+            const copied = target[index];
+            const { ref: sourceRef, ...sourceMetadata } = attachment;
+            const { ref: targetRef, ...targetMetadata } = copied;
+            return (sourceRef.kind === 'session_file' &&
+                sourceRef.sessionId === WORKHUB_COORDINATION_SESSION_ID &&
+                targetRef.kind === 'session_file' &&
+                targetRef.sessionId === assignment.targetSessionId &&
+                isDeepStrictEqual(sourceMetadata, targetMetadata));
+        }));
+}
 function sameWorkHubAssignmentRequest(existing, requested) {
     return isDeepStrictEqual({
         actionId: existing.actionId,
@@ -4877,7 +4849,11 @@ function sameWorkHubAssignmentRequest(existing, requested) {
         targetSessionId: existing.targetSessionId,
         disposition: existing.disposition,
         userText: existing.userText,
+        delegationText: existing.delegationText,
+        attachments: existing.attachments ?? [],
         create: existing.create,
+        replacesActionId: existing.replacesActionId,
+        replacesDelegationId: existing.replacesDelegationId,
     }, {
         actionId: requested.actionId,
         actionFingerprint: requested.actionFingerprint,
@@ -4885,34 +4861,13 @@ function sameWorkHubAssignmentRequest(existing, requested) {
         targetSessionId: requested.targetSessionId,
         disposition: requested.disposition,
         userText: requested.userText,
+        delegationText: requested.delegationText,
+        attachments: requested.attachments ?? [],
         create: requested.create,
+        replacesActionId: requested.replacesActionId,
+        replacesDelegationId: requested.replacesDelegationId,
     });
 }
-function foldTurnContribution(current, turnId, sequence, message) {
-    const contribution = current ?? {
-        turnId,
-        firstSequence: sequence,
-        latestState: null,
-        userPromptPreview: null,
-        hasAssistantMessage: false,
-        hasAssistantOutput: false,
-        hasToolResult: false,
-        hasFailedToolResult: false,
-        hasAbortNote: false,
-    };
-    const userPrompt = message.type === 'user' ? (message.displayText ?? message.text).trim() : '';
-    return {
-        ...contribution,
-        latestState: message.type === 'turn_state' ? { sequence, message } : contribution.latestState,
-        userPromptPreview: contribution.userPromptPreview ?? (userPrompt || null),
-        hasAssistantMessage: contribution.hasAssistantMessage || message.type === 'assistant',
-        hasAssistantOutput: contribution.hasAssistantOutput ||
-            (message.type === 'assistant' && message.text.trim().length > 0),
-        hasToolResult: contribution.hasToolResult || message.type === 'tool_result',
-        hasFailedToolResult: contribution.hasFailedToolResult || (message.type === 'tool_result' && message.isError),
-        hasAbortNote: contribution.hasAbortNote || (message.type === 'system_note' && message.kind === 'abort'),
-    };
-}
 function readStoredMessageRows(db, sessionId, sequences, placeholders = sequences.map(() => '?').join(', ')) {
     if (sequences.length === 0)
         return [];
@@ -4979,173 +4934,9 @@ function nullableStoredMessageSequence(value, sessionId) {
         return null;
     return requireStoredMessageSequence(value, sessionId);
 }
-function requireTranscriptPayloadDigest(value, sessionId, sequence) {
-    if (typeof value !== 'string' || !/^[0-9a-f]{64}$/.test(value)) {
-        throw new StoredSessionMessageIncompatibleError(sessionId, sequence);
-    }
-    return `sha256:${value}`;
-}
 function requireTranscriptRecordByteLength(value, sessionId, sequence) {
     if (!Number.isSafeInteger(value) || value < 1) {
         throw new StoredSessionMessageIncompatibleError(sessionId, sequence);
     }
     return value;
 }
-function readTranscriptSlices(db, sessionId, slices) {
-    if (slices.length === 0)
-        return new Map();
-    const chunkedSlices = slices.filter((slice) => slice.chunked);
-    const values = chunkedSlices.map(() => '(?, ?, ?)').join(', ');
-    const parameters = chunkedSlices.flatMap((slice) => [
-        slice.sequence,
-        Math.floor(slice.byteOffset / SQLITE_SESSION_MESSAGE_CHUNK_BYTES),
-        Math.floor((slice.byteOffset + slice.byteLength - 1) / SQLITE_SESSION_MESSAGE_CHUNK_BYTES),
-    ]);
-    const rows = chunkedSlices.length === 0
-        ? []
-        : db
-            .prepare(`
-        WITH requested(sequence, first_chunk, last_chunk) AS (VALUES ${values})
-        SELECT requested.sequence, chunk.chunk_index, chunk.data, chunk.sha256
-        FROM requested
-        INNER JOIN session_message_chunks AS chunk
-          ON chunk.session_id = ?
-          AND chunk.sequence = requested.sequence
-          AND chunk.chunk_index BETWEEN requested.first_chunk AND requested.last_chunk
-        ORDER BY requested.sequence, chunk.chunk_index
-      `)
-            .all(...parameters, sessionId);
-    const rowsBySequence = new Map();
-    for (const row of rows) {
-        const sequence = requireStoredMessageSequence(row.sequence, sessionId);
-        const grouped = rowsBySequence.get(sequence);
-        if (grouped)
-            grouped.push(row);
-        else
-            rowsBySequence.set(sequence, [row]);
-    }
-    const result = new Map();
-    for (const slice of slices) {
-        if (!slice.chunked)
-            continue;
-        const selected = rowsBySequence.get(slice.sequence) ?? [];
-        const firstChunk = Math.floor(slice.byteOffset / SQLITE_SESSION_MESSAGE_CHUNK_BYTES);
-        const lastChunk = Math.floor((slice.byteOffset + slice.byteLength - 1) / SQLITE_SESSION_MESSAGE_CHUNK_BYTES);
-        if (selected.length !== lastChunk - firstChunk + 1) {
-            throw new StoredSessionMessageIncompatibleError(sessionId, slice.sequence);
-        }
-        const chunks = [];
-        for (let index = 0; index < selected.length; index += 1) {
-            const row = selected[index];
-            if (row.chunk_index !== firstChunk + index ||
-                !(row.data instanceof Uint8Array) ||
-                typeof row.sha256 !== 'string') {
-                throw new StoredSessionMessageIncompatibleError(sessionId, slice.sequence);
-            }
-            const chunk = Buffer.from(row.data);
-            if (createHash('sha256').update(chunk).digest('hex') !== row.sha256) {
-                throw new StoredSessionMessageIncompatibleError(sessionId, slice.sequence);
-            }
-            chunks.push(chunk);
-        }
-        const joined = Buffer.concat(chunks);
-        const start = slice.byteOffset - firstChunk * SQLITE_SESSION_MESSAGE_CHUNK_BYTES;
-        const data = joined.subarray(start, start + slice.byteLength);
-        if (data.byteLength !== slice.byteLength) {
-            throw new StoredSessionMessageIncompatibleError(sessionId, slice.sequence);
-        }
-        result.set(slice.sequence, data);
-    }
-    const inlineSlices = slices.filter((slice) => !slice.chunked);
-    if (inlineSlices.length > 0) {
-        const inlineValues = inlineSlices.map(() => '(?, ?, ?)').join(', ');
-        const inlineParameters = inlineSlices.flatMap((slice) => [
-            slice.sequence,
-            slice.byteOffset + 1,
-            slice.byteLength,
-        ]);
-        const inlineRows = db
-            .prepare(`
-          WITH requested(sequence, byte_start, byte_length) AS (VALUES ${inlineValues})
-          SELECT requested.sequence,
-            substr(CAST(message.record_json AS BLOB), requested.byte_start, requested.byte_length)
-              AS data
-          FROM requested
-          INNER JOIN session_messages AS message
-            ON message.session_id = ? AND message.sequence = requested.sequence
-        `)
-            .all(...inlineParameters, sessionId);
-        for (const row of inlineRows) {
-            const sequence = requireStoredMessageSequence(row.sequence, sessionId);
-            if (!(row.data instanceof Uint8Array)) {
-                throw new StoredSessionMessageIncompatibleError(sessionId, sequence);
-            }
-            result.set(sequence, Buffer.from(row.data));
-        }
-    }
-    return result;
-}
-function validateTranscriptRecord(data, sessionId, sequence) {
-    try {
-        decodeStoredMessage(markPersisted(JSON.parse(typeof data === 'string' ? data : data.toString('utf8'))));
-    }
-    catch (error) {
-        throw new StoredSessionMessageIncompatibleError(sessionId, sequence, {
-            cause: error,
-        });
-    }
-}
-function assertTranscriptPageRequest(request) {
-    if (request.direction !== 'older' && request.direction !== 'newer') {
-        throw new Error('Invalid Session transcript page direction');
-    }
-    if (request.throughSequence !== undefined &&
-        request.throughSequence !== null &&
-        (!Number.isSafeInteger(request.throughSequence) || request.throughSequence < 0)) {
-        throw new Error('Invalid Session transcript watermark');
-    }
-    if (request.position !== undefined &&
-        (!Number.isSafeInteger(request.position) || request.position < 0)) {
-        throw new Error('Invalid Session transcript position');
-    }
-    if (request.byteOffset !== undefined &&
-        (request.position === undefined ||
-            !Number.isSafeInteger(request.byteOffset) ||
-            request.byteOffset < 0)) {
-        throw new Error('Invalid Session transcript byte offset');
-    }
-    if (!Number.isSafeInteger(request.maxBytes) ||
-        request.maxBytes < 1 ||
-        request.maxBytes > 1024 * 1024) {
-        throw new Error('Session transcript page byte limit must be between 1 and 1048576');
-    }
-    if (!Number.isSafeInteger(request.maxMessages) ||
-        request.maxMessages < 1 ||
-        request.maxMessages > 256) {
-        throw new Error('Session transcript page message limit must be between 1 and 256');
-    }
-}
-function assertTranscriptRecordScanRequest(request) {
-    if (request.direction !== 'older' && request.direction !== 'newer') {
-        throw new Error('Invalid Session transcript record direction');
-    }
-    if (request.throughSequence !== undefined &&
-        request.throughSequence !== null &&
-        (!Number.isSafeInteger(request.throughSequence) || request.throughSequence < 0)) {
-        throw new Error('Invalid Session transcript watermark');
-    }
-    if (request.position !== undefined &&
-        (!Number.isSafeInteger(request.position) || request.position < 0)) {
-        throw new Error('Invalid Session transcript position');
-    }
-    if (!Number.isSafeInteger(request.maxStoredBytes) ||
-        request.maxStoredBytes < 1 ||
-        request.maxStoredBytes > 16 * 1024 * 1024) {
-        throw new Error('Invalid Session transcript record byte limit');
-    }
-    if (!Number.isSafeInteger(request.maxMessages) ||
-        request.maxMessages < 1 ||
-        request.maxMessages > 256) {
-        throw new Error('Invalid Session transcript record count limit');
-    }
-}