multi-agent-collaboration-mcp 0.13.0 → 0.16.0

package/dist/db.js

@@ -22,8 +22,6 @@ function resolveDbPath() {
     }
     return join(homedir(), ".agent-chat-mcp", "chat.db");
 }
-/** SQLite's default maximum string/blob byte length (SQLITE_MAX_LENGTH). */
-export const SQLITE_MAX_LENGTH = 1_000_000_000;
 /** Application safety cap. SQLite's ~1 GB theoretical ceiling is not a safe
  * API limit: JSON parsing, validation, binding, WAL, and FTS can hold several
  * copies of one body at once. */
@@ -43,6 +41,17 @@ export const MAX_CLIENT_MESSAGE_ID_CHARS = 200;
  * generates against it before allocating, rather than discovering the overflow
  * as a store assertion after the fact. */
 export const MAX_AGENT_ID_CHARS = 200;
+/**
+ * Longest human BASE name, derived from MAX_AGENT_ID_CHARS rather than chosen:
+ * the canonical id is `human-` + base + `-` + ordinal, and the widest ordinal
+ * is Number.MAX_SAFE_INTEGER at 16 digits.
+ *
+ *   6 ("human-") + 177 (base) + 1 ("-") + 16 (ordinal) = 200
+ *
+ * The complete candidate is still validated before insertion; this bound only
+ * guarantees no VALID base can be rejected later by the id cap.
+ */
+export const MAX_HUMAN_BASE_CHARS = 177;
 /** Above this body length the store's json well-formedness re-validation is
  *  skipped: parsing a ~GB body into memory to walk it would defeat the
  *  memory-bounded read design, and such a caller owns validation (the MCP
@@ -139,8 +148,9 @@ const THREAD_ENVELOPE = JSON.stringify({
 }).length -
     2 -
     2;
-/** Serialized-size allowance below which shrinkToFit is guaranteed to fit any
- *  legal row as a stub (fixed fields ~430 worst case); budgets floor here. */
+/** Serialized array allowance within which boundByBytes can fit any legal
+ *  first row as a stub. It includes the array's two brackets, so boundByBytes
+ *  passes STUB_ALLOWANCE - 2 as the row budget (fixed fields ~430 worst case). */
 const STUB_ALLOWANCE = 500;
 /** Smallest budget that can safely carry catch_up's fixed fields plus one
  *  shrunk message stub. The MCP wrapper subtracts its own routing/wait
@@ -148,62 +158,73 @@ const STUB_ALLOWANCE = 500;
  *  remains it must reject the call rather than advance past an undeliverable
  *  page. */
 export const MIN_CATCH_UP_RESULT_BUDGET = Math.max(CATCH_UP_ENVELOPE, PRIORITY_CATCH_UP_ENVELOPE) + STUB_ALLOWANCE;
-/**
- * A persona-authored operation was fenced out: the runtime that issued it no
- * longer holds the persona, because a later valid resume took it over. Terminal
- * by contract -- retrying cannot succeed, and the caller must create or resume a
- * persona before acting again. A distinct class (not a bare Error) so the MCP
- * layer can render it as `persona_lost` without string-matching a message.
- */
 export class PersonaLostError extends Error {
     agentId;
-    expectedEpoch;
-    currentEpoch;
-    constructor(agentId, expectedEpoch, currentEpoch) {
-        super(currentEpoch === null
-            ? `persona "${agentId}" no longer exists; create or resume a persona before acting`
-            : `persona "${agentId}" was taken over by a later runtime ` +
-                `(your epoch ${expectedEpoch}, current ${currentEpoch}); ` +
-                `this runtime's authority is gone and retrying cannot restore it`);
+    reason;
+    /** The agents row is gone entirely. */
+    missing;
+    /** The row exists and is terminally retired. */
+    retired;
+    constructor(agentId, reason) {
+        super(
+        // Describes ONLY the lost identity and the operation that failed. It
+        // deliberately gives no process-recovery advice: whether the caller
+        // should restart depends on session state this layer cannot see, and an
+        // unconditional "call identify_persona" would contradict the fact that a
+        // process still holding this dead binding is exactly the case where
+        // identify_persona must fail.
+        reason === "missing"
+            ? `persona "${agentId}" no longer exists, so this operation cannot proceed`
+            : reason === "retired"
+                ? `persona "${agentId}" was terminally retired and can never act ` +
+                    `again; its history stands, but it cannot post, advance a read ` +
+                    `marker, claim, or join`
+                : `persona "${agentId}" exists and is live, but it is not the ` +
+                    `identity this operation was issued under; that authority is gone ` +
+                    `and retrying this operation cannot restore it`);
         this.name = "PersonaLostError";
         this.agentId = agentId;
-        this.expectedEpoch = expectedEpoch;
-        this.currentEpoch = currentEpoch;
+        this.reason = reason;
+        // Derived here rather than passed, so the two can never both be true: a
+        // row cannot be simultaneously absent and retired, and a live-row binding
+        // mismatch is neither.
+        this.missing = reason === "missing";
+        this.retired = reason === "retired";
     }
 }
 /**
- * A CORRECT resume word presented with a different brand/model/version.
+ * This process generated a connection nonce that some row already carries,
+ * BEFORE it had bound anything.
  *
- * This is not a rejected credential. The word proves the caller is the
- * persona's legitimate owner; what it reports is that the thing sitting behind
- * the seat CHANGED. brand/model/version are immutable by construction, so a
- * runtime whose actual model no longer matches them is a different participant
- * asking to wear an old name, and letting it through would keep posting under a
- * model identifier that is false to every peer reading the room -- the one
- * thing the tuple exists to prevent.
+ * Thrown, not silently resolved, because the only correct response lives in the
+ * process that owns the nonce: generate another one and identify again. The
+ * store must never attach to a row merely because its nonce matches, which is
+ * exactly what a "reuse the matching row" fallback would do -- and that row
+ * belongs to a different process incarnation. Reachable only while unbound; a
+ * bound process compares against the binding it recorded.
+ */
+export class ConnectionNonceCollisionError extends Error {
+    connectionId;
+    constructor(connectionId) {
+        super(`connection nonce ${connectionId} is already recorded against another ` +
+            `persona row; regenerate it and identify again`);
+        this.name = "ConnectionNonceCollisionError";
+        this.connectionId = connectionId;
+    }
+}
+/**
+ * Nickname allocation exhausted its candidates inside the identify transaction.
  *
- * Distinct from a wrong word (a rejected credential, whose remedy is to find
- * the right word) and from PersonaLostError (a takeover, whose remedy is to
- * resume again). The remedy here is a NEW persona.
+ * The six-hex token is only 24 bits, so a collision is a normal event and the
+ * caller retries with a fresh candidate. Running out means the id space for
+ * this tuple is genuinely saturated (or the candidate supplier is broken), and
+ * the transaction rolls back rather than committing a half-transition.
  */
-export class ModelTupleMismatchError extends Error {
-    agentId;
-    stored;
-    offered;
-    /** Rooms the persona is currently present in, so the caller can be told which
-     *  conversations to notify. It has no binding to look them up with itself. */
-    rooms;
-    constructor(agentId, stored, offered, rooms) {
-        super(`persona "${agentId}" is ${stored.brand}/${stored.model}/${stored.version}, ` +
-            `but this runtime is ${offered.brand}/${offered.model}/${offered.version}. ` +
-            `The resume word is correct, so this is a MODEL CHANGE, not a bad ` +
-            `credential: brand/model/version are immutable and a persona cannot be ` +
-            `carried across them. Create a new persona instead.`);
-        this.name = "ModelTupleMismatchError";
-        this.agentId = agentId;
-        this.stored = stored;
-        this.offered = offered;
-        this.rooms = rooms;
+export class NicknameExhaustedError extends Error {
+    constructor(attempts) {
+        super(`could not allocate a free persona nickname after ${attempts} attempts; ` +
+            `no identity was created and any prior binding is unchanged`);
+        this.name = "NicknameExhaustedError";
     }
 }
 /** Serialized-size budget for a metadata listing's row ARRAY, leaving room for
@@ -322,6 +343,33 @@ function fitRows(rows, budget) {
     }
     return { rows: kept, sizeTrimmed };
 }
+/**
+ * Fit an unread-room summary to a byte budget: drop whole rows with fitRows,
+ * then, because fitRows always keeps one, halve a lone survivor's `name` until
+ * the MEASURED serialized size fits. A fixed code-unit cut under-counts JSON
+ * escaping, so a control-heavy name slipped past it; room_id stays the stable
+ * key, and the caller keeps its own reason-for-truncation flag separate.
+ */
+function fitRoomSummary(rooms, budget) {
+    const fitted = fitRows(rooms, budget);
+    const kept = fitted.rows;
+    if (kept.length === 1 && JSON.stringify(kept).length > budget) {
+        let entry = { ...kept[0] };
+        while (JSON.stringify([entry]).length > budget && entry.name.length > 0) {
+            entry = {
+                ...entry,
+                name: safeCut(entry.name, Math.floor(entry.name.length / 2)),
+            };
+        }
+        kept[0] = entry;
+        return { rooms: kept, sizeTrimmed: true };
+    }
+    return { rooms: kept, sizeTrimmed: fitted.sizeTrimmed };
+}
+/** Bounded list of a retired identity's former rooms carried in the transition
+ *  response. The cap exists because a persona can be present in an unbounded
+ *  number of rooms and the response must stay inside the client output cap. */
+export const MAX_PREVIOUS_ROOM_NAMES = 200;
 /** Full body length in CODEPOINTS, the unit the reported `length` field uses
  *  everywhere. Prefers the fetched-row codepoint count; for a synthetic row
  *  built in code (no body_cp), the number of codepoints in the body in hand. */
@@ -357,11 +405,11 @@ function messageCols(bodyCap) {
           length(g.body) AS body_cp,
           g.mentions, g.reply_to_seq,
           datetime(g.created_at, 'localtime') AS created_local,
-          CAST(strftime('%s', g.created_at) AS INTEGER) AS created_unix,
+          unixepoch(g.created_at) AS created_unix,
           g.supersedes_seq,
-          (SELECT s.seq FROM messages s
-            WHERE s.room_id = g.room_id AND s.supersedes_seq = g.seq
-            ORDER BY s.seq DESC LIMIT 1) AS superseded_by,
+          (SELECT MAX(s.seq)
+             FROM messages s INDEXED BY idx_messages_supersedes
+            WHERE s.room_id = g.room_id AND s.supersedes_seq = g.seq) AS superseded_by,
           p.agent_id AS reply_from, substr(p.body, 1, 101) AS reply_preview`;
 }
 // No join to agents: a message envelope carries the author id and nothing else
@@ -370,6 +418,11 @@ function messageCols(bodyCap) {
 // never have held when writing it.
 const MESSAGE_FROM = `messages g
                       LEFT JOIN messages p ON p.room_id = g.room_id AND p.seq = g.reply_to_seq`;
+/** Deleted rooms cannot be rejoined; point callers to valid recovery paths. */
+function deletedRoomMessage(roomId) {
+    return (`room ${roomId} no longer exists (it was deleted); it cannot be rejoined -- ` +
+        "use list_rooms to see what remains, or create_room to make a new one");
+}
 /**
  * SQL predicate for "directed at me": an explicit mention, OR a reply to a
  * message I authored. Binds the agent id to TWO `?` placeholders in order
@@ -386,6 +439,41 @@ export function directedAt(alias) {
     return `(EXISTS (SELECT 1 FROM json_each(${alias}.mentions) WHERE value = ?)
            OR IFNULL(${alias}.reply_to_agent = ?, 0))`;
 }
+function chmodBestEffort(path, mode) {
+    try {
+        chmodSync(path, mode);
+    }
+    catch { }
+}
+function enableWalWithRetry(db) {
+    // Switching a brand-new rollback-journal file to WAL needs an exclusive
+    // lock, and SQLite can return SQLITE_BUSY here WITHOUT consulting the
+    // busy handler (better-sqlite3's default 5s timeout does not cover this
+    // path), so two fresh processes racing to convert the same file
+    // intermittently crashed on startup (reproduced ~1 in 24 synchronized
+    // opens). This is a STARTUP RACE, not a compatibility path: retry with a
+    // short synchronous backoff and the loser finds the file already in WAL
+    // and succeeds immediately. A no-op on already-WAL files, i.e. every
+    // startup after the first.
+    for (let attempt = 1;; attempt++) {
+        try {
+            db.pragma("journal_mode = WAL");
+            break;
+        }
+        catch (e) {
+            // Prefix match: better-sqlite3 surfaces EXTENDED result codes (e.g.
+            // SQLITE_BUSY_RECOVERY when another connection is mid-WAL-recovery,
+            // plausible in exactly this conversion race), and all of them mean
+            // the same thing here: someone else holds the file, try again.
+            const code = e.code ?? "";
+            if (attempt >= 20 || !code.startsWith("SQLITE_BUSY")) {
+                throw e;
+            }
+            // Synchronous sleep (constructor context); ~4.75s worst-case total.
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25 * attempt);
+        }
+    }
+}
 export class ChatStore {
     path;
     db;
@@ -402,56 +490,22 @@ export class ChatStore {
             // already existed; chmod only that. Best-effort: permissions are a
             // hardening layer, not a startup gate (and a no-op concept on Windows).
             const created = mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-            try {
-                if (created)
-                    chmodSync(created, 0o700);
-                for (const p of [path, `${path}-wal`, `${path}-shm`]) {
-                    if (existsSync(p))
-                        chmodSync(p, 0o600);
-                }
+            if (created)
+                chmodBestEffort(created, 0o700);
+            for (const p of [path, `${path}-wal`, `${path}-shm`]) {
+                if (existsSync(p))
+                    chmodBestEffort(p, 0o600);
             }
-            catch { }
         }
         this.db = new Database(path);
         try {
             if (path !== ":memory:") {
-                try {
-                    chmodSync(path, 0o600);
-                }
-                catch { }
-            }
-            // Switching a brand-new rollback-journal file to WAL needs an exclusive
-            // lock, and SQLite can return SQLITE_BUSY here WITHOUT consulting the
-            // busy handler (better-sqlite3's default 5s timeout does not cover this
-            // path), so two fresh processes racing to convert the same file
-            // intermittently crashed on startup (reproduced ~1 in 24 synchronized
-            // opens). This is a STARTUP RACE, not a compatibility path: retry with a
-            // short synchronous backoff and the loser finds the file already in WAL
-            // and succeeds immediately. A no-op on already-WAL files, i.e. every
-            // startup after the first.
-            for (let attempt = 1;; attempt++) {
-                try {
-                    this.db.pragma("journal_mode = WAL");
-                    break;
-                }
-                catch (e) {
-                    // Prefix match: better-sqlite3 surfaces EXTENDED result codes (e.g.
-                    // SQLITE_BUSY_RECOVERY when another connection is mid-WAL-recovery,
-                    // plausible in exactly this conversion race), and all of them mean
-                    // the same thing here: someone else holds the file, try again.
-                    const code = e.code ?? "";
-                    if (attempt >= 20 || !code.startsWith("SQLITE_BUSY")) {
-                        throw e;
-                    }
-                    // Synchronous sleep (constructor context); ~4.75s worst-case total.
-                    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25 * attempt);
-                }
+                chmodBestEffort(path, 0o600);
             }
+            enableWalWithRetry(this.db);
             this.db.pragma("busy_timeout = 5000");
             this.db.pragma("foreign_keys = ON");
-            // One process initializes the schema at a time. Without an IMMEDIATE
-            // transaction, concurrent MCP startups could all find the FTS index
-            // missing and each repeat a full-corpus rebuild.
+            // Initialize the current schema atomically and serialize concurrent starts.
             this.db.transaction(() => this.initializeSchema()).immediate();
         }
         catch (error) {
@@ -480,40 +534,133 @@ export class ChatStore {
         created_at  TEXT NOT NULL DEFAULT (datetime('now'))
       );
 
-      -- One row per PERSONA. An LLM persona carries an immutable
-      -- brand/model/version tuple and a server-generated resume word; a human
-      -- web participant carries neither. The CHECK makes those the ONLY two
-      -- shapes any writer can create -- including direct ones (the web server,
-      -- sqlite3, a test) that never pass through this file's JS guards -- so a
-      -- half-persona (resumable without metadata, or metadata with no resume
-      -- path) cannot exist in the database.
+      -- One row per PERSONA, in exactly three legal shapes:
+      --
+      --   human            human_base/human_ordinal set, no tuple, no
+      --                    connection, never retired
+      --   bound LLM        complete tuple, a connection nonce, not retired
+      --   retired LLM      complete tuple, no connection, retired_at set
+      --
+      -- The CHECK is what makes those the ONLY shapes ANY writer can create,
+      -- including the direct ones (web/server.mjs holds its own handle, tests
+      -- open the file, sqlite3 exists) that never pass through this file's JS
+      -- guards. JS still owns trim() semantics, UUID format, and readable
+      -- messages; SQL owns the shape, because JS cannot reach the other
+      -- writers.
+      --
+      -- "Bound" deliberately does not say LIVE. A hard-killed process leaves a
+      -- non-null connection_id behind and nothing may read that as liveness or
+      -- as possession: no caller can submit a connection value, and a first
+      -- bind that collides regenerates instead of adopting the row.
       CREATE TABLE IF NOT EXISTS agents (
-        id            TEXT PRIMARY KEY,
+        -- NOT NULL is NOT redundant here. In an ordinary rowid table SQLite
+        -- deliberately departs from the standard: a PRIMARY KEY on a non-
+        -- INTEGER column does not imply NOT NULL, so 'id TEXT PRIMARY KEY'
+        -- alone accepts NULL, and repeatedly, because NULLs compare distinct in
+        -- the implicit unique index. Two nameless participants is the result.
+        id            TEXT PRIMARY KEY NOT NULL,
         is_human      INTEGER NOT NULL DEFAULT 0,
         brand         TEXT,
         model         TEXT,
         version       TEXT,
-        resume_word   TEXT,
-        -- Monotonic, never reused. Creation binds runtime 1; every bindingless
-        -- attach increments. A runtime captures this value when it binds, and
-        -- an operation carrying a captured value below the current one is from
-        -- a superseded tenure. Monotonicity is what a reusable process nonce
-        -- lacked: a nonce can be handed back to the same runtime after it lost
-        -- and regained the persona, making a stale in-flight write look current.
-        runtime_epoch INTEGER NOT NULL DEFAULT 1,
+        -- The MCP stdio server PROCESS INCARNATION holding this identity.
+        -- Internal association only: it is never returned by a tool, never
+        -- accepted as input, and never joined into a message or listing.
+        connection_id TEXT,
+        human_base    TEXT,
+        human_ordinal INTEGER,
+        -- Terminal for LLM rows. Never cleared, so a nickname is never
+        -- reactivated: A -> B -> A is three distinct identities.
+        retired_at    TEXT,
         description   TEXT,
         created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+        CHECK (is_human IN (0, 1)),
+        -- NUL FIRST, because it is what makes every other text check honest.
+        -- SQLite's length(), substr(), and GLOB all stop at the first NUL, so
+        -- without this an id of 'ab<NUL>cd' measures 2, passes the bounds, and
+        -- passes the character grammar -- while every listing that reads it
+        -- back silently loses the tail. Measured, not assumed: length() of a
+        -- NUL-bearing string returns the prefix count, and the || operator
+        -- PRESERVES the NUL, which is why this one check also covers
+        -- human_base through the id-equality rule below.
+        CHECK (instr(id, char(0)) = 0),
+        -- Lower bound as well as upper: '' is a legal TEXT primary key in
+        -- SQLite, and an empty nickname would be an addressable participant
+        -- nobody can mention, reply to, or tell apart from a missing value.
+        CHECK (length(id) BETWEEN 1 AND ${MAX_AGENT_ID_CHARS}),
         CHECK (
           (is_human = 1
-             AND brand IS NULL AND model IS NULL
-             AND version IS NULL AND resume_word IS NULL)
+             AND brand IS NULL AND model IS NULL AND version IS NULL
+             AND connection_id IS NULL AND retired_at IS NULL
+             AND human_base IS NOT NULL AND human_ordinal IS NOT NULL
+             AND length(human_base) BETWEEN 1 AND ${MAX_HUMAN_BASE_CHARS}
+             -- ASCII letters, digits, underscore, dot, dash only. GLOB is
+             -- case-sensitive, so this rejects whitespace, ordinary control
+             -- characters, and anything non-ASCII. It does NOT reject an
+             -- embedded NUL: GLOB stops scanning there, so a NUL-bearing base
+             -- passes this test. The global instr(id, ...) check above is what
+             -- covers that case, via the id-equality rule below.
+             AND human_base NOT GLOB '*[^A-Za-z0-9_.-]*'
+             AND substr(human_base, 1, 1) GLOB '[A-Za-z0-9_]'
+             AND lower(substr(human_base, 1, 6)) <> 'human-'
+             -- typeof, not just bounds: 1.5 satisfies both bounds, and
+             -- CAST(1.5 AS TEXT) is '1.5', so the id-equality rule would
+             -- happily accept 'human-alex-1.5' as a canonical identity.
+             AND typeof(human_ordinal) = 'integer'
+             AND human_ordinal > 0
+             AND human_ordinal <= ${Number.MAX_SAFE_INTEGER}
+             -- Implies the reserved lowercase prefix: id is BUILT from it.
+             AND id = 'human-' || human_base || '-' || CAST(human_ordinal AS TEXT))
           OR
           (is_human = 0
-             AND brand IS NOT NULL AND model IS NOT NULL
-             AND version IS NOT NULL AND resume_word IS NOT NULL)
+             AND human_base IS NULL AND human_ordinal IS NULL
+             AND brand IS NOT NULL AND model IS NOT NULL AND version IS NOT NULL
+             -- length() is NUL-terminated in SQLite, so the instr() guards do
+             -- the real work: a lone NUL measures 0 and fails the lower bound,
+             -- but a NUL in the MIDDLE measures only the prefix before it and
+             -- would otherwise pass.
+             AND length(brand) BETWEEN 1 AND 100
+             AND length(model) BETWEEN 1 AND 100
+             AND length(version) BETWEEN 1 AND 100
+             AND instr(brand, char(0)) = 0
+             AND instr(model, char(0)) = 0
+             AND instr(version, char(0)) = 0
+             -- Case-insensitive, so 'Human-' cannot squat the namespace.
+             AND lower(substr(id, 1, 6)) <> 'human-'
+             AND ((retired_at IS NULL AND connection_id IS NOT NULL)
+                  OR (retired_at IS NOT NULL AND connection_id IS NULL)))
         )
       );
 
+      -- Durable idempotency for human nickname allocation, keyed by an
+      -- operation UUID the BROWSER generates before its first request. It
+      -- turns "the response was lost" and "localStorage.setItem threw" from
+      -- duplicate-identity events into replays.
+      --
+      -- Deliberately NO foreign key on room_id: deleting a room must not erase
+      -- the record needed to answer a replay. A replay for a deleted room
+      -- returns the identity that was committed and reports the room gone,
+      -- which is recoverable; losing the row would allocate a second ordinal
+      -- for one user action, which is not.
+      --
+      -- This is idempotency, not ownership. It authenticates nothing.
+      CREATE TABLE IF NOT EXISTS human_allocations (
+        -- NOT NULL for the same SQLite reason as agents.id, and here it is the
+        -- whole point of the table: NULL keys compare distinct, so without it
+        -- one browser could insert unlimited NULL-keyed rows and the
+        -- idempotency this table exists to provide would silently not exist.
+        operation_id    TEXT PRIMARY KEY NOT NULL,
+        room_id         INTEGER NOT NULL,
+        human_base      TEXT NOT NULL,
+        result_agent_id TEXT NOT NULL REFERENCES agents(id),
+        created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+        -- typeof for the same reason as human_ordinal: affinity would let 1.5
+        -- through, and this value is compared against a rooms.id integer when
+        -- a replay decides whether the requested room still exists.
+        CHECK (typeof(room_id) = 'integer'
+               AND room_id > 0 AND room_id <= ${Number.MAX_SAFE_INTEGER})
+      );
+
       -- role is ROOM-LOCAL and nullable: one persona can be reviewer in one
       -- room and writer in another, and "no role" is a real state distinct from
       -- an empty string. It is deliberately NOT on agents, where a single value
@@ -604,6 +751,35 @@ export class ChatStore {
       WHEN instr(NEW.description, char(0)) > 0 BEGIN
         SELECT RAISE(ABORT, 'agent description contains a NUL character (U+0000)');
       END;
+
+      -- An allocation record must AGREE with the identity it records. The
+      -- foreign key only proves result_agent_id names some agent, so without
+      -- this a row could record base 'sam' against human-alex-1, or point at an
+      -- LLM row outright -- and a replay would then hand the browser back an
+      -- identity that is not the one the base asked for. A CHECK cannot express
+      -- this because it cannot read another table, hence a trigger.
+      CREATE TRIGGER IF NOT EXISTS human_allocations_require_matching_human
+      BEFORE INSERT ON human_allocations
+      WHEN NOT EXISTS (
+        SELECT 1 FROM agents a
+         WHERE a.id = NEW.result_agent_id
+           AND a.is_human = 1
+           AND a.human_base = NEW.human_base
+      ) BEGIN
+        SELECT RAISE(ABORT, 'human_allocations.result_agent_id must name a human agent whose human_base equals the recorded base');
+      END;
+
+      -- Append-only. Denying UPDATE and DELETE outright is smaller than re-validating either,
+      -- and there is no legitimate reason to rewrite a committed allocation:
+      -- its whole purpose is to be the durable answer a replay returns.
+      CREATE TRIGGER IF NOT EXISTS human_allocations_append_only
+      BEFORE UPDATE ON human_allocations BEGIN
+        SELECT RAISE(ABORT, 'human_allocations is append-only: a committed allocation record cannot be modified');
+      END;
+      CREATE TRIGGER IF NOT EXISTS human_allocations_no_delete
+      BEFORE DELETE ON human_allocations BEGIN
+        SELECT RAISE(ABORT, 'human_allocations is append-only: a committed allocation record cannot be deleted');
+      END;
     `);
         this.db.exec(`
       -- No explicit (room_id, seq) index: UNIQUE(room_id, seq) already provides
@@ -629,6 +805,19 @@ export class ChatStore {
       CREATE INDEX IF NOT EXISTS idx_memberships_agent_present
         ON memberships(agent_id, left_at, room_id);
 
+      -- One process incarnation holds at most one current LLM nickname. This
+      -- is the DATABASE's statement of that rule, so a direct writer cannot
+      -- point two live identities at one connection. Partial: retired and
+      -- human rows carry NULL and cost no index entry.
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_agents_connection
+        ON agents(connection_id) WHERE connection_id IS NOT NULL;
+
+      -- What actually prevents two concurrent viewers from allocating the same
+      -- human-alex-1: SQLite serializes the writes, and this index rejects the
+      -- loser's duplicate ordinal instead of letting both commit.
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_agents_human_identity
+        ON agents(human_base, human_ordinal) WHERE is_human = 1;
+
       -- Advisory single-winner work claims with TTL. Purely advisory: nothing
       -- fences the claimed resource itself; expiry frees claims from crashed
       -- holders.
@@ -653,17 +842,16 @@ export class ChatStore {
       -- memberships), so last_seen is the weaker signal of the two: recent
       -- runtime activity. "watching" stays the strong one.
       --
-      -- Keyed (room_id, agent_id) with the OWNING epoch as data, not as part of
-      -- the key: one persona has one runtime, so it has at most one wait per
-      -- room, and a takeover must REPLACE the loser's row rather than sit
-      -- beside it (two rows would report two watchers for one persona). The
-      -- epoch column is what makes the loser's later cleanup safe: its DELETE
-      -- is guarded on the epoch it captured, so it cannot remove the winner's
-      -- row after an upsert has already overwritten it.
+      -- Keyed (room_id, agent_id) and nothing else. One persona belongs to one
+      -- connection and an agent_id names one tenure for the life of the
+      -- database, so a persona has at most one wait row per room and two rows
+      -- would report two watchers for one persona. A late cleanup from a
+      -- superseded identity cannot reach a successor's row because the
+      -- successor is a DIFFERENT agent_id, and retirement deletes the retired
+      -- persona's leases outright in the same transaction.
       CREATE TABLE IF NOT EXISTS wait_leases (
         room_id    INTEGER NOT NULL REFERENCES rooms(id),
         agent_id   TEXT NOT NULL REFERENCES agents(id),
-        epoch      INTEGER NOT NULL,
         started_at TEXT NOT NULL DEFAULT (datetime('now')),
         expires_at TEXT NOT NULL,
         PRIMARY KEY (room_id, agent_id)
@@ -696,51 +884,43 @@ export class ChatStore {
           VALUES ('delete', old.id, old.body);
       END;
     `);
-        // Rebuild decision by INDEX CONSISTENCY, not table existence: a process
-        // dying between the CREATE above and the rebuild below leaves a database
-        // where every later start sees the table and skips the rebuild forever,
-        // making everything written before the crash permanently invisible to
-        // search. The empty/nonempty mismatch repairs that window in O(1), with no
-        // corpus scan. The index row count MUST come from the messages_fts_docsize
-        // shadow table: with external content, COUNT(*) on the virtual table itself
-        // reads the content table and always matches. BOTH counts are read in ONE
-        // statement (a single consistent snapshot): two separate SELECTs could
-        // straddle a concurrent insert -- messages counted pre-insert, fts counted
-        // post-trigger -- making an already-inconsistent {2,1} file read as {2,2}
-        // and skip the rebuild it actually needed.
-        const { hasMessages, hasFtsRows } = this.db
-            .prepare(`SELECT EXISTS(SELECT 1 FROM messages LIMIT 1) AS hasMessages,
-                EXISTS(SELECT 1 FROM messages_fts_docsize LIMIT 1) AS hasFtsRows`)
-            .get();
-        if (hasMessages !== hasFtsRows) {
-            this.db.exec("INSERT INTO messages_fts(messages_fts) VALUES('rebuild')");
-        }
     }
     // --- rooms -------------------------------------------------------------
     /**
-     * Create a room, epoch-fenced to the calling persona.
+     * Create a room, fenced to a live calling persona.
      *
      * Room administration stays UNAUTHENTICATED and global: any current persona
      * can create or delete any room, and nothing verifies who they are. What the
      * fence removes is authority from a runtime the system positively knows is
      * superseded. Leaving the highest-blast-radius operations as the only
-     * unfenced writes made the epoch model exempt exactly what it should protect
+     * unfenced writes made the fence exempt exactly what it should protect
      * most: a fenced-out runtime could not post a message but could delete the
      * room the message was in.
      *
-     * Rooms must precede JOINS, not bindings. create_persona/resume_persona is
-     * one call that every participating runtime makes anyway, and
-     * bind -> create_room -> join_room satisfies the bootstrap workflow.
+     * Rooms must precede JOINS, not identification. identify_persona is one call
+     * that every participating runtime makes anyway, and
+     * identify_persona -> create_room -> join_room satisfies the bootstrap
+     * workflow.
      */
-    createRoom(name, description, pinned, agentId, epoch) {
+    createRoom(name, description, pinned, agentId) {
         assertStorable(name, "room name");
         assertMaxLen(name, "room name", 200);
+        // Room names are exact identifiers, so reject edge whitespace, do not trim.
+        if (name.length === 0 || name !== name.trim()) {
+            throw new Error("room name must be non-empty with no leading or trailing whitespace");
+        }
+        // Numeric references resolve as ids first, so an all-digit name can retarget
+        // reads and destructive operations to a different room.
+        if (/^\d+$/.test(name)) {
+            throw new Error("room names cannot be all digits (ambiguous with room ids); " +
+                "pick a descriptive kebab-case topic name");
+        }
         assertStorable(description, "room description");
         assertMaxLen(description, "room description", 2000);
         assertStorable(pinned, "room pinned intro");
         assertMaxLen(pinned, "room pinned intro", 10_000);
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
+            this.requireLive(agentId);
             return this.db
                 .prepare(`INSERT INTO rooms (name, description, pinned) VALUES (?, ?, ?)
            RETURNING *`)
@@ -748,18 +928,21 @@ export class ChatStore {
         });
         return tx.immediate();
     }
-    setPinned(roomId, agentId, epoch, pinned) {
+    setPinned(roomId, agentId, pinned) {
         assertStorable(pinned, "room pinned intro");
         assertMaxLen(pinned, "room pinned intro", 10_000);
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
+            this.requireLive(agentId);
+            // Writing the pinned intro is room participation.
+            this.requirePresent(roomId, agentId);
             const info = this.db
                 .prepare("UPDATE rooms SET pinned = ? WHERE id = ?")
                 .run(pinned, roomId);
-            // 0 rows = the room vanished under us; report it instead of a false
-            // success the caller would trust.
+            // A present membership has a foreign key to this row in the same
+            // transaction, so zero changes means the invariant is broken.
             if (info.changes === 0) {
-                throw new Error(`room ${roomId} no longer exists (deleted); rejoin with join_room`);
+                throw new Error(`internal invariant violated: room ${roomId} has a live membership ` +
+                    "but no room row; the database may be corrupt");
             }
         });
         tx.immediate();
@@ -767,17 +950,14 @@ export class ChatStore {
     getRoom(roomId) {
         return this.db.prepare("SELECT * FROM rooms WHERE id = ?").get(roomId);
     }
-    /** Throw a clean, recoverable error when the room no longer exists. Called
-     *  INSIDE write transactions whose room reference was resolved earlier, so
-     *  a cross-process delete_room in the window yields this message instead of
-     *  a raw FK constraint failure or a false no-op success. */
+    /** Recheck room existence inside transactions where membership is not the
+     *  gate, so a concurrent deletion returns a useful error. */
     requireRoom(roomId) {
         const row = this.db
             .prepare("SELECT 1 FROM rooms WHERE id = ?")
             .get(roomId);
-        if (!row) {
-            throw new Error(`room ${roomId} no longer exists (deleted); rejoin with join_room`);
-        }
+        if (!row)
+            throw new Error(deletedRoomMessage(roomId));
     }
     /** Exact name lookup (never interprets the value as an id). */
     getRoomByName(name) {
@@ -790,10 +970,10 @@ export class ChatStore {
      */
     currentTime() {
         const r = this.db
-            .prepare(`SELECT CAST(strftime('%s','now') AS INTEGER) AS unix,
+            .prepare(`SELECT unixepoch('now') AS unix,
                 datetime('now','localtime') AS at,
-                CAST(strftime('%s', datetime('now','localtime')) AS INTEGER)
-                  - CAST(strftime('%s','now') AS INTEGER) AS offset_seconds`)
+                unixepoch(datetime('now','localtime'))
+                  - unixepoch('now') AS offset_seconds`)
             .get();
         // ISO 8601 local time with explicit offset, e.g. 2026-07-08T03:35:13-04:00.
         // offset_seconds is the local wall-clock read as UTC minus true UTC, i.e.
@@ -830,6 +1010,8 @@ export class ChatStore {
         // a further page without a tail COUNT.
         const { rows, total } = this.db
             .transaction(() => {
+            // Activity means the timestamp on the highest-seq message, not the
+            // greatest wall-clock value. Clocks can move backward between posts.
             const rows = this.db
                 .prepare(`SELECT r.id, r.name,
                     substr(r.description, 1, ${PREVIEW}) AS description,
@@ -839,7 +1021,8 @@ export class ChatStore {
                     r.created_at,
                     (SELECT COUNT(*) FROM memberships m WHERE m.room_id = r.id AND m.left_at IS NULL) AS members,
                     (SELECT COUNT(*) FROM messages g WHERE g.room_id = r.id) AS messages,
-                    (SELECT MAX(created_at) FROM messages g WHERE g.room_id = r.id) AS last_activity
+                    (SELECT created_at FROM messages g
+                      WHERE g.room_id = r.id ORDER BY g.seq DESC LIMIT 1) AS last_activity
              FROM rooms r WHERE r.id > ? ORDER BY r.id LIMIT ?`)
                 .all(Math.max(0, Math.floor(afterId)), lim + 1);
             const { c: total } = this.db
@@ -879,13 +1062,14 @@ export class ChatStore {
             .get(roomId);
         return c;
     }
-    /** How many rooms an identity is currently present in (for wait_for_messages
-     *  to refuse a doomed all-rooms watch when the agent is in none). */
-    presentRoomCount(agentId) {
-        const { c } = this.db
-            .prepare("SELECT COUNT(*) AS c FROM memberships WHERE agent_id = ? AND left_at IS NULL")
+    /** Total and present room memberships for watcher arm-time diagnostics. */
+    roomMembershipCounts(agentId) {
+        return this.db
+            .prepare(`SELECT COUNT(*) AS total,
+                COALESCE(SUM(CASE WHEN left_at IS NULL THEN 1 ELSE 0 END), 0)
+                  AS present
+         FROM memberships WHERE agent_id = ?`)
             .get(agentId);
-        return c;
     }
     /** Names of the rooms this persona is present in. Bounded: this feeds an
      *  error message, and a persona in hundreds of rooms must not turn one
@@ -918,154 +1102,323 @@ export class ChatStore {
     }
     // --- personas -----------------------------------------------------------
     /**
-     * Verify that `epoch` is still the persona's current runtime epoch, throwing
-     * PersonaLostError if not.
+     * Verify that this identity still EXISTS and is not retired, throwing
+     * PersonaLostError if either fails.
+     *
+     * This is the complete stale-operation fence. An agent_id is allocated once
+     * and never deleted, reinserted, revived, or rebound, so it names exactly one
+     * tenure forever; an operation captured under a superseded identity therefore
+     * carries an id whose row is now retired, and that is what this catches. No
+     * ordinal is needed to tell tenures apart because an id never has two.
      *
      * MUST be called from INSIDE the transaction that performs the guarded write.
-     * Checking first and writing afterwards is not equivalent: a takeover
+     * Checking first and writing afterwards is not equivalent: a retirement
      * committing in the gap leaves the check passing and the write landing under
      * an authority the caller no longer holds, which is the entire failure this
      * exists to prevent. Every caller below is inside a tx.immediate().
      */
-    requireEpoch(agentId, epoch) {
+    requireLive(agentId) {
         const row = this.db
-            .prepare("SELECT runtime_epoch FROM agents WHERE id = ?")
+            .prepare("SELECT retired_at FROM agents WHERE id = ?")
             .get(agentId);
         if (!row)
-            throw new PersonaLostError(agentId, epoch, null);
-        if (row.runtime_epoch !== epoch) {
-            throw new PersonaLostError(agentId, epoch, row.runtime_epoch);
-        }
+            throw new PersonaLostError(agentId, "missing");
+        if (row.retired_at !== null)
+            throw new PersonaLostError(agentId, "retired");
     }
     /**
-     * Verify that this persona is PRESENT in the room, throwing if it has left.
-     *
-     * Like requireEpoch, this MUST run inside the transaction that performs the
-     * guarded write. Checking first and writing afterwards leaves a leave_room
-     * committing in the gap, and the write then lands from a persona every peer
-     * has already been told is absent.
-     *
-     * Participation is what this guards: authoring, advancing a read marker,
-     * changing a role, taking a new claim, and opening a wait. It deliberately
-     * does NOT guard non-advancing history reads or releasing a claim you already
-     * hold -- both are useful while absent and neither claims presence.
-     *
-     * The soft-left membership row survives, so the remedy is always the same and
-     * the error says it: rejoin. join_room keeps the read marker and the role, so
-     * recovery costs one call and loses nothing.
+     * Transactional gate for present-only operations. It returns the cursor from
+     * the same membership read. On failure, a room lookup distinguishes a
+     * cascaded deletion from never-joined and soft-left membership states.
+     * It must run inside the transaction that performs the guarded write.
+     * Non-advancing reads and claim release intentionally bypass this gate.
      */
     requirePresent(roomId, agentId) {
         const row = this.db
-            .prepare("SELECT left_at FROM memberships WHERE room_id = ? AND agent_id = ?")
+            .prepare(`SELECT last_read_seq, left_at FROM memberships
+         WHERE room_id = ? AND agent_id = ?`)
             .get(roomId, agentId);
-        if (!row) {
-            throw new Error(`you are not a member of room ${roomId}; join_room it first`);
+        if (row !== undefined && row.left_at === null) {
+            return { last_read_seq: row.last_read_seq };
         }
-        if (row.left_at !== null) {
-            throw new Error(`you have LEFT room ${roomId}, so you cannot participate in it: ` +
-                `peers see you as absent. Call join_room to rejoin -- your read ` +
-                `position and room-local role are preserved.`);
+        const room = this.db
+            .prepare("SELECT name FROM rooms WHERE id = ?")
+            .get(roomId);
+        if (!room)
+            throw new Error(deletedRoomMessage(roomId));
+        const where = `room "${room.name}" (${roomId})`;
+        if (row === undefined) {
+            throw new Error(`you have never joined ${where}; join_room it first`);
         }
-    }
-    /** The persona's current epoch, or null if the row is gone. For
-     *  NON-advancing reads, which disclose loss without failing. */
-    currentEpoch(agentId) {
+        throw new Error(`you have LEFT ${where}, so you cannot participate in it: ` +
+            `peers see you as absent. Call join_room to rejoin -- your read ` +
+            `position and room-local role are preserved.`);
+    }
+    /** Why this binding is unusable, or null when it is live. For NON-advancing
+     *  reads, which DISCLOSE loss instead of failing, and for arm-time checks
+     *  that need the reason rather than an exception. */
+    personaLoss(expected) {
+        this.assertConnectionId(expected.connectionId);
         const row = this.db
-            .prepare("SELECT runtime_epoch FROM agents WHERE id = ?")
-            .get(agentId);
-        return row ? row.runtime_epoch : null;
+            .prepare("SELECT is_human, connection_id, retired_at FROM agents WHERE id = ?")
+            .get(expected.agentId);
+        if (!row)
+            return "missing";
+        if (row.retired_at !== null)
+            return "retired";
+        return row.is_human !== 0 || row.connection_id !== expected.connectionId
+            ? "binding_mismatch"
+            : null;
     }
     getPersona(id) {
         return this.db.prepare("SELECT * FROM agents WHERE id = ?").get(id);
     }
     /**
-     * Claim a generated persona id atomically. Returns false if the id is taken,
-     * so a caller drawing candidate ids cannot collapse two personas onto one row
-     * (and with it one read marker, one membership set, and one claim owner).
+     * A connection nonce must be a UUID.
+     *
+     * The database only knows connection_id as opaque text, and the specification
+     * assigns UUID format checking to this layer. Without it "" or "conn-A" bind
+     * happily, and the column stops meaning "a value this server generated with
+     * randomUUID()" -- which is the only claim it makes. Lowercase hex only,
+     * because the sole legitimate producer is randomUUID().
      */
-    tryCreatePersona(p) {
+    assertConnectionId(value) {
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value)) {
+            throw new Error("connection id must be a lowercase UUID generated by this server");
+        }
+    }
+    /** Validate the parts of an LLM identity this file is responsible for. The
+     *  table CHECK covers the same ground for writers that never come through
+     *  here; this exists to fail with a message a caller can act on. */
+    assertLlmIdentity(p) {
         assertStorable(p.id, "persona id");
         assertMaxLen(p.id, "persona id", MAX_AGENT_ID_CHARS);
-        assertStorable(p.brand, "brand");
-        assertMaxLen(p.brand, "brand", 100);
-        assertStorable(p.model, "model");
-        assertMaxLen(p.model, "model", 100);
-        assertStorable(p.version, "version");
-        assertMaxLen(p.version, "version", 100);
-        assertStorable(p.resumeWord, "resume word");
-        assertMaxLen(p.resumeWord, "resume word", 200);
+        // A candidate supplier that returns "" is a broken allocator, not a
+        // collision, so say so here rather than letting the CHECK reject it as an
+        // opaque constraint failure after the retry loop has burned its attempts.
+        if (p.id.length === 0) {
+            throw new Error("persona id candidate is empty; the nickname allocator produced no id");
+        }
+        for (const [field, value] of [
+            ["brand", p.brand],
+            ["model", p.model],
+            ["version", p.version],
+        ]) {
+            assertStorable(value, field);
+            assertMaxLen(value, field, 100);
+            // EXACT trim normalization, checked rather than applied: silently
+            // trimming would make " gpt" and "gpt" the same persona on one call and
+            // different ones on the next, depending on which path normalized. The
+            // tuple is compared byte for byte, so it must arrive already exact.
+            if (value !== value.trim() || value.length === 0) {
+                throw new Error(`${field} must be a trimmed, non-empty string (got ${JSON.stringify(value)})`);
+            }
+        }
         assertStorable(p.description, "persona description");
         assertMaxLen(p.description, "persona description", 2000);
+    }
+    /**
+     * Insert one candidate nickname. False means the id was taken, so a caller
+     * drawing candidates cannot collapse two personas onto one row (and with it
+     * one read marker, one membership set, and one claim owner).
+     */
+    tryInsertPersona(p) {
+        this.assertLlmIdentity(p);
         const info = this.db
             .prepare(`INSERT INTO agents
-           (id, is_human, brand, model, version, resume_word, runtime_epoch, description)
-         VALUES (@id, 0, @brand, @model, @version, @resumeWord, 1, @description)
+           (id, is_human, brand, model, version, connection_id, description)
+         VALUES (@id, 0, @brand, @model, @version, @connectionId, @description)
          ON CONFLICT(id) DO NOTHING`)
             .run(p);
         return info.changes > 0;
     }
+    /** Draw candidates until one inserts. The six-hex token is 24 bits, so a
+     *  collision is ordinary and correctness comes from the atomic insert, not
+     *  from the token's width. Exhaustion throws so the enclosing transaction
+     *  rolls back rather than committing half a transition. */
+    allocatePersona(a) {
+        for (let attempt = 0; attempt < a.maxAttempts; attempt++) {
+            const id = a.nextCandidateId();
+            if (this.tryInsertPersona({
+                id,
+                brand: a.brand,
+                model: a.model,
+                version: a.version,
+                connectionId: a.connectionId,
+                description: a.description,
+            })) {
+                // Read back rather than synthesize: created_at is a database default.
+                return this.getPersona(id);
+            }
+        }
+        throw new NicknameExhaustedError(a.maxAttempts);
+    }
     /**
-     * Bindingless resume: take over a persona and return the NEW epoch.
+     * The one identity operation: create, reuse, or replace, decided by this
+     * process's connection nonce and the exact tuple.
+     *
+     * `expected` is what the PROCESS recorded when it last bound, and it is not a
+     * cache. A row whose connection_id equals our nonce is NOT proof we own it --
+     * a UUID collision produces exactly that -- so an unbound process treats any
+     * such row as a collision to regenerate around, and a bound process requires
+     * agent id AND nonce to match before it will touch anything.
      *
-     * The increment is unconditional on success and happens in the same
-     * transaction as the credential check, so "latest valid resume wins" is
-     * decided by SQLite's write serialization rather than by call ordering in any
-     * one process. It runs on EVERY successful attach, not only on a contested
-     * one: a caller cannot tell whether the previous runtime is alive, and an
-     * attach that skipped the increment would leave that runtime's pollers and
-     * captured epochs valid alongside the new one's.
+     * A changed tuple is a REPLACEMENT, not a rename: the old nickname is retired
+     * terminally, keeps its authored history and membership rows, and is never
+     * revived. Marking it retired in the same transaction is what fences the old
+     * identity's in-flight writes, open waits, and detached pollers: they carry
+     * the old agent_id, and that row is now terminal.
      *
-     * The two failures are deliberately distinguished: an unknown id says so, and
-     * bad credentials on a known id say so. That is the right trade HERE because
-     * the threat model is an operator pasting the wrong id, not an attacker
-     * probing for valid ones -- an operator who mistyped an id needs to be told
-     * that, not handed a uniform "rejected" that sends them hunting for a lost
-     * word. This is collision prevention, not authentication.
+     * IMMEDIATE: it reads the binding, then writes under it.
      */
-    attachPersona(a) {
+    identifyPersona(a) {
+        const maxAttempts = a.maxAttempts ?? 12;
+        this.assertConnectionId(a.connectionId);
+        if (a.expected !== null)
+            this.assertConnectionId(a.expected.connectionId);
         return this.db
             .transaction(() => {
-            const row = this.getPersona(a.id);
-            if (!row || row.is_human === 1) {
-                throw new Error(`no LLM persona "${a.id}"; check the id, or create_persona for a new one`);
+            // --- never bound: allocate, refusing to adopt a colliding row -------
+            if (a.expected === null) {
+                const clash = this.db
+                    .prepare("SELECT id FROM agents WHERE connection_id = ?")
+                    .get(a.connectionId);
+                if (clash)
+                    throw new ConnectionNonceCollisionError(a.connectionId);
+                const persona = this.allocatePersona({ ...a, maxAttempts });
+                return { persona, bindingReused: false, identityChanged: false };
             }
-            // Word FIRST, then tuple. A caller who cannot present the word has no
-            // standing to be told anything about the persona, including which model
-            // it is; only after the word matches is a tuple mismatch meaningful --
-            // and then it is a model change, not a rejected credential.
-            if (row.resume_word !== a.resumeWord) {
-                throw new Error(`resume rejected for persona "${a.id}": the resume word does not ` +
-                    `match the one it was created with`);
+            // --- bound: every recorded field must still match -------------------
+            const { agentId, connectionId } = a.expected;
+            const row = this.getPersona(agentId);
+            if (!row)
+                throw new PersonaLostError(agentId, "missing");
+            // Report retirement as retirement: a caller told only "your binding
+            // does not match" would reasonably re-read and retry, and the terminal
+            // wording says that cannot work.
+            if (row.retired_at !== null) {
+                throw new PersonaLostError(agentId, "retired");
             }
-            if (row.brand !== a.brand ||
-                row.model !== a.model ||
-                row.version !== a.version) {
-                throw new ModelTupleMismatchError(a.id, 
-                // Non-null by the is_human check above: the table CHECK keeps an
-                // LLM row's tuple whole.
-                { brand: row.brand, model: row.model, version: row.version }, { brand: a.brand, model: a.model, version: a.version }, this.presentRoomNames(a.id));
+            if (row.is_human === 1 ||
+                row.connection_id !== connectionId ||
+                connectionId !== a.connectionId) {
+                throw new PersonaLostError(agentId, "binding_mismatch");
             }
-            const next = row.runtime_epoch + 1;
+            // Exact string comparison: no case folding, alias table, or version
+            // parsing. "5.0" and "5" are different models to this system because
+            // nothing here is entitled to decide they are the same.
+            if (row.brand === a.brand &&
+                row.model === a.model &&
+                row.version === a.version) {
+                return { persona: row, bindingReused: true, identityChanged: false };
+            }
+            // --- tuple transition ------------------------------------------------
+            const { present } = this.roomMembershipCounts(agentId);
+            const names = this.presentRoomNames(agentId, MAX_PREVIOUS_ROOM_NAMES);
+            // Clear the nonce BEFORE inserting the replacement: both rows would
+            // otherwise hold it at once and the partial unique index would reject
+            // the insert, rolling back a transition that should have succeeded.
             this.db
-                .prepare("UPDATE agents SET runtime_epoch = ? WHERE id = ?")
-                .run(next, a.id);
-            return { epoch: next, persona: { ...row, runtime_epoch: next } };
+                .prepare(`UPDATE agents
+                SET connection_id = NULL, retired_at = datetime('now')
+              WHERE id = ? AND connection_id = ? AND retired_at IS NULL`)
+                .run(agentId, connectionId);
+            this.retireParticipation(agentId);
+            const persona = this.allocatePersona({ ...a, maxAttempts });
+            return {
+                persona,
+                bindingReused: false,
+                identityChanged: true,
+                previousAgentId: agentId,
+                previousRoomCount: present,
+                previousRoomNames: names,
+                previousRoomNamesTruncated: present > names.length,
+            };
         })
             .immediate();
     }
+    /**
+     * Participation effects shared by every terminal retirement, applied only
+     * after the caller's own guarded agents UPDATE proved this runtime still
+     * describes the row, in that same transaction. Memberships are soft-left, so
+     * the rows stay as durable history. Leases and claims are deleted because
+     * their holder is terminal: it can never wake to serve the lease, and can
+     * never release the claim, whose TTL ceiling would otherwise block a live
+     * participant for up to 24h. Deleting claims is the contested call -- it
+     * trades exclusivity away for work that outlived its holder.
+     */
+    retireParticipation(agentId) {
+        this.db
+            .prepare(`UPDATE memberships
+            SET left_at = datetime('now'), last_seen = datetime('now')
+          WHERE agent_id = ? AND left_at IS NULL`)
+            .run(agentId);
+        this.db.prepare("DELETE FROM wait_leases WHERE agent_id = ?").run(agentId);
+        this.db.prepare("DELETE FROM claims WHERE agent_id = ?").run(agentId);
+    }
+    /**
+     * Graceful shutdown retirement, guarded on the EXACT binding this process
+     * recorded.
+     *
+     * Returns false and mutates nothing when any guard differs. Nickname ids are
+     * never reused, so the danger is not that some other process holds this id;
+     * it is that a mismatch means THIS process's recorded state is stale -- the
+     * row was already retired, or transitioned to a new identity, or altered by a
+     * writer outside this file. Acting on a row we no longer describe is exactly
+     * the mutation to refuse, so "a row with this id exists" is never enough.
+     *
+     * A hard kill cannot run this at all. The row then keeps its connection
+     * nonce and its present memberships until the database is replaced. That
+     * stale row confers no authority -- no caller can submit a nonce, and a
+     * first-bind collision regenerates -- but it does inflate member counts,
+     * collect directed work, and block non-forced pruning. There is deliberately
+     * no timeout reaper: an idle live CLI and a dead one are indistinguishable
+     * from here, and a reaper would retire the live one.
+     */
+    retireConnection(a) {
+        this.assertConnectionId(a.connectionId);
+        return this.db
+            .transaction(() => {
+            const info = this.db
+                .prepare(`UPDATE agents
+                SET connection_id = NULL, retired_at = datetime('now')
+              WHERE id = ? AND connection_id = ?
+                AND is_human = 0 AND retired_at IS NULL`)
+                .run(a.agentId, a.connectionId);
+            if (info.changes === 0)
+                return false;
+            this.retireParticipation(a.agentId);
+            return true;
+        })
+            .immediate();
+    }
+    /** Which of `ids` name terminally retired LLM identities. Recipient status
+     *  needs this for ids with NO membership row in the room: without it a
+     *  retired nickname reads as `unknown`, which tells a poster the name was
+     *  wrong when it was real and is simply finished. */
+    retiredIds(ids) {
+        if (ids.length === 0)
+            return new Set();
+        const placeholders = ids.map(() => "?").join(",");
+        const rows = this.db
+            .prepare(`SELECT id FROM agents
+          WHERE retired_at IS NOT NULL AND id IN (${placeholders})`)
+            .all(...ids);
+        return new Set(rows.map((r) => r.id));
+    }
     // --- membership ---------------------------------------------------------
     /**
      * Join (or rejoin) a room: clears any prior leave and refreshes liveness.
      *
-     * Presence is PER PERSONA. With one runtime per persona there is no second
-     * live seat to reconcile: a takeover fences the loser out instead.
+     * Presence is PER PERSONA. A persona belongs to one connection for its whole
+     * life, so there is never a second live seat to reconcile.
      *
      * `cursorStart` applies ONLY when this call creates the membership. A rejoin
-     * must never move a cursor: the whole point of resuming a persona is that its
-     * read position survives, and a "start at latest" that also applied on rejoin
-     * would silently discard the backlog it was resumed to read.
+     * must never move a cursor: a persona that steps out of a room and back keeps
+     * its read position, and a "start at latest" that also applied on rejoin
+     * would silently discard the backlog it returned to read.
      */
-    joinRoom(roomId, agentId, epoch, opts = {}) {
+    joinRoom(roomId, agentId, opts = {}) {
         if (opts.role !== undefined) {
             assertStorable(opts.role, "role");
             assertMaxLen(opts.role, "role", 200);
@@ -1074,10 +1427,10 @@ export class ChatStore {
         // One IMMEDIATE transaction: this is a multi-statement read-then-write path,
         // and a cross-process deleteRoom interleaving between statements otherwise
         // surfaces as an opaque NOT NULL/FK constraint error instead of a clean
-        // failure. It also scopes the epoch guard to the same transaction as every
-        // write below it.
+        // failure. It also scopes the liveness guard to the same transaction as
+        // every write below it.
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
+            this.requireLive(agentId);
             // Existence check INSIDE the write transaction: the caller resolved the
             // room earlier, and a cross-process delete_room in that window otherwise
             // surfaces as a raw "FOREIGN KEY constraint failed".
@@ -1117,15 +1470,13 @@ export class ChatStore {
      * handled by not calling this at all. Room-local by construction: the same
      * persona keeps a different role in every other room.
      */
-    setRole(roomId, agentId, epoch, role) {
+    setRole(roomId, agentId, role) {
         assertStorable(role, "role");
         assertMaxLen(role, "role", 200);
         assertRole(role);
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
-            this.requireRoom(roomId);
-            // A role describes what you are IN THIS ROOM; you cannot hold one while
-            // absent.
+            this.requireLive(agentId);
+            // A role describes participation in this room.
             this.requirePresent(roomId, agentId);
             // Refresh last_seen in the SAME statement. A role change is a deliberate
             // act in THIS room, so the seat is demonstrably attended here; leaving
@@ -1135,8 +1486,10 @@ export class ChatStore {
                 .prepare(`UPDATE memberships SET role = ?, last_seen = datetime('now')
            WHERE room_id = ? AND agent_id = ?`)
                 .run(role, roomId, agentId);
+            // requirePresent proved this row exists in the same transaction.
             if (info.changes === 0) {
-                throw new Error(`you are not a member of room ${roomId}; join_room it first`);
+                throw new Error(`internal invariant violated: membership for room ${roomId} passed ` +
+                    "the presence check and then matched no row; the database may be corrupt");
             }
         });
         tx.immediate();
@@ -1152,9 +1505,9 @@ export class ChatStore {
      * Soft leave: keep the membership row (and its read position and role) but
      * mark the persona not present. Rejoining resumes exactly where it left off.
      */
-    leaveRoom(roomId, agentId, epoch) {
+    leaveRoom(roomId, agentId) {
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
+            this.requireLive(agentId);
             const info = this.db
                 .prepare(`UPDATE memberships SET left_at = datetime('now'), last_seen = datetime('now')
            WHERE room_id = ? AND agent_id = ? AND left_at IS NULL`)
@@ -1164,42 +1517,29 @@ export class ChatStore {
         return tx.immediate();
     }
     /**
-     * Mark a persona alive in a room, clearing that room's left_at (an actively
-     * acting runtime re-asserts presence there).
+     * Mark a persona alive in a room it is PRESENT in. Liveness only: a room this
+     * persona explicitly left stays left, because rejoining is a state transition
+     * join_room owns and an incidental heartbeat must not perform it silently.
+     * A room with no present membership is simply not refreshed. The method is
+     * void because heartbeat callers do not act on whether an update matched.
      *
-     * EPOCH-FENCED like any other write. A liveness touch looks harmless, but it
+     * LIVE-IDENTITY-FENCED like any other write. A liveness touch looks harmless, but it
      * is what makes a persona read as present/active to every other agent and to
      * recipient status; an unfenced touch would let a runtime that has already
      * lost the persona keep publishing it as an available listener, which is the
-     * false-listener-truth failure the epoch exists to close. Throwing here is
+     * false-listener-truth failure this guard exists to close. Throwing here is
      * correct: the caller treats liveness as best-effort and the next real
      * operation reports persona_lost.
      */
-    touch(roomId, agentId, epoch) {
+    touch(roomId, agentId) {
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
+            this.requireLive(agentId);
             this.db
-                .prepare(`UPDATE memberships SET last_seen = datetime('now'), left_at = NULL
-           WHERE room_id = ? AND agent_id = ?`)
-                .run(roomId, agentId);
-        });
-        tx.immediate();
-    }
-    /**
-     * Refresh activity for one room captured by a cross-room operation, WITHOUT
-     * rejoining it: a room this persona explicitly left stays left. Returns false
-     * when there was no present membership to refresh.
-     */
-    touchJoinedRoom(roomId, agentId, epoch) {
-        const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
-            const info = this.db
                 .prepare(`UPDATE memberships SET last_seen = datetime('now')
            WHERE room_id = ? AND agent_id = ? AND left_at IS NULL`)
                 .run(roomId, agentId);
-            return info.changes > 0;
         });
-        return tx.immediate();
+        tx.immediate();
     }
     /**
      * Open an in-turn wait lease: this persona has a blocking catch_up pending in
@@ -1207,49 +1547,45 @@ export class ChatStore {
      * leave a permanent "watching" ghost. Expired rows for the room are reaped in
      * passing.
      *
-     * The upsert writes the CALLER'S epoch into the row (`epoch = excluded.epoch`
-     * on conflict). Leaving the old value in place would invert the guard in
-     * endWaitLease: the winner's row would carry the loser's epoch, so the
-     * loser's cleanup would match and delete it while the winner's own cleanup
-     * would not.
+     * One row per (room, agent) and no tenure column: an agent_id has exactly one
+     * tenure, so there is no second tenure of the same id whose lease this could
+     * be confused with. Concurrent waits from the SAME identity share the row and
+     * are counted process-side; the last waiter out closes it.
      */
-    beginWaitLease(roomId, agentId, epoch, ttlSeconds) {
+    beginWaitLease(roomId, agentId, ttlSeconds) {
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
-            this.requireRoom(roomId);
-            // A lease ADVERTISES this persona as watching the room. An absent
-            // persona advertising a live watch is the exact contradiction the
-            // present-membership rule exists to remove.
+            this.requireLive(agentId);
+            // A lease must not advertise an absent persona as watching.
             this.requirePresent(roomId, agentId);
             this.db
                 .prepare("DELETE FROM wait_leases WHERE room_id = ? AND expires_at <= datetime('now')")
                 .run(roomId);
             this.db
-                .prepare(`INSERT INTO wait_leases (room_id, agent_id, epoch, expires_at)
-           VALUES (?, ?, ?, datetime('now', '+' || ? || ' seconds'))
+                .prepare(
+            // Overlapping waits share one row: keep the aggregate's first start
+            // and furthest deadline rather than letting a later short wait
+            // advertise that the still-open long wait expired.
+            `INSERT INTO wait_leases (room_id, agent_id, expires_at)
+           VALUES (?, ?, datetime('now', '+' || ? || ' seconds'))
            ON CONFLICT(room_id, agent_id) DO UPDATE SET
-             epoch = excluded.epoch,
-             started_at = datetime('now'),
-             expires_at = excluded.expires_at`)
-                .run(roomId, agentId, epoch, Math.max(1, Math.floor(ttlSeconds)));
+             expires_at = max(wait_leases.expires_at, excluded.expires_at)`)
+                .run(roomId, agentId, Math.max(1, Math.floor(ttlSeconds)));
         });
         tx.immediate();
     }
     /**
      * Close an in-turn wait lease (normal return, timeout, or abort alike).
      *
-     * Guarded on the epoch the caller CAPTURED when it opened the lease, never on
-     * the persona's current epoch. A fenced-out runtime still runs its finally
-     * block, and that cleanup can land after the winner has already replaced the
-     * row; an unguarded DELETE would then remove the winner's live lease and
-     * report it as not watching. Deliberately NOT wrapped in requireEpoch: a lost
-     * runtime must still be able to clean up after itself, it just must not touch
-     * anything that is no longer its own.
+     * Deliberately NOT wrapped in requireLive: a retired identity must still be
+     * able to clean up after itself. It cannot reach anything that is not its
+     * own, because the row is keyed by agent_id and a successor identity is a
+     * DIFFERENT agent_id -- so a late cleanup from a superseded persona can only
+     * ever delete that persona's own row.
      */
-    endWaitLease(roomId, agentId, epoch) {
+    endWaitLease(roomId, agentId) {
         this.db
-            .prepare("DELETE FROM wait_leases WHERE room_id = ? AND agent_id = ? AND epoch = ?")
-            .run(roomId, agentId, epoch);
+            .prepare("DELETE FROM wait_leases WHERE room_id = ? AND agent_id = ?")
+            .run(roomId, agentId);
     }
     getMembership(roomId, agentId) {
         return this.db
@@ -1310,12 +1646,13 @@ export class ChatStore {
         // role comes from the MEMBERSHIP, not the persona: it is what this persona
         // is in THIS room.
         const cols = `SELECT a.id, a.brand, a.model, a.version, a.is_human,
+                         a.retired_at,
                          m.role AS role,
                          substr(a.description, 1, ${PREVIEW}) AS description,
                          CASE WHEN length(a.description) > ${PREVIEW} THEN 1 ELSE 0 END AS description_cut,
                          m.joined_at, m.rowid AS _rid,
                          m.last_read_seq, m.last_seen, m.left_at,
-                         (strftime('%s','now') - strftime('%s', m.last_seen)) AS idle_seconds,
+                         (unixepoch('now') - unixepoch(m.last_seen)) AS idle_seconds,
                          EXISTS(SELECT 1 FROM wait_leases wl
                                 WHERE wl.room_id = m.room_id AND wl.agent_id = m.agent_id
                                   AND wl.expires_at > datetime('now')) AS watching
@@ -1369,18 +1706,26 @@ export class ChatStore {
         const page = hasMore ? rows.slice(0, lim) : rows;
         const threshold = activeWithinMinutes * 60;
         const mapped = page.map((r) => {
-            const { left_at, description_cut, _rid, watching, ...rest } = r;
+            const { left_at, retired_at, description_cut, _rid, watching, ...rest } = r;
             void _rid;
-            const isWatching = watching === 1;
+            const retired = retired_at !== null;
+            // Retirement soft-leaves memberships and deletes leases in its own
+            // transaction, so these are already false by the data. Forcing them is
+            // for the writers this file cannot reach: a direct SQL writer can leave
+            // a retired row present, and a listing that showed it as a live member
+            // would send peers work it can never read.
+            const isWatching = !retired && watching === 1;
             return {
                 ...rest,
                 is_human: rest.is_human === 1,
                 ...(description_cut ? { description_truncated: true } : {}),
-                present: left_at === null,
-                active: left_at === null &&
+                present: !retired && left_at === null,
+                active: !retired &&
+                    left_at === null &&
                     (isWatching ||
                         (r.idle_seconds !== null && r.idle_seconds <= threshold)),
                 watching: isWatching,
+                retired,
             };
         });
         const { rows: agents, sizeTrimmed } = fitRows(mapped, LIST_ROW_BUDGET);
@@ -1450,11 +1795,10 @@ export class ChatStore {
      * the guard). The reject baseline is the TOKEN, unlike the accept path's
      * cursor-relative crossed. opts.crossedPreviewChars additionally returns
      * crossed previews on an ACCEPTED post. A post never consumes an unseen peer
-     * message. After an accepted post, the posting cursor and sibling cursors at
-     * the proven safe peer floor are normalized through the new own row so their
-     * recurring probes do not rescan that suffix.
+     * message. After an accepted post, the persona cursor is normalized through
+     * the new own row when it is already at the proven safe peer floor.
      */
-    postMessage(roomId, agentId, body, format, mentions, replyToSeq, supersedesSeq, epoch, opts = {}) {
+    postMessage(roomId, agentId, body, format, mentions, replyToSeq, supersedesSeq, opts = {}) {
         // Reject unstorable text BEFORE the transaction: a body with an embedded
         // NUL reads back truncated (SQLite substr/length stop at NUL) and catch_up
         // would advance the marker past the lost tail. mentions are agent ids
@@ -1500,16 +1844,12 @@ export class ChatStore {
         }
         const ifToken = opts.ifLastReadSeq ?? null;
         const tx = this.db.transaction(() => {
-            // FIRST, before the dedup lookup: a fenced-out runtime must not even be
-            // told the seq of a message it posted in a previous tenure, and must
+            // FIRST, before the dedup lookup: a retired identity must not even be
+            // told the seq of a message it posted before retirement, and must
             // certainly not insert a new one.
-            this.requireEpoch(agentId, epoch);
-            // The caller's room reference predates this transaction; a concurrent
-            // delete_room otherwise surfaces as a raw FK failure on the INSERT.
-            this.requireRoom(roomId);
-            // Authoring is the loudest form of participation. A persona every peer
-            // has been told is absent must not appear in the transcript.
-            this.requirePresent(roomId, agentId);
+            this.requireLive(agentId);
+            // Presence, room existence, and the cursor share one membership read.
+            const membership = this.requirePresent(roomId, agentId);
             // Lost-response retry: one indexed lookup only when the caller opted in.
             // It precedes CAS/reference validation so a committed first attempt is
             // recoverable even if room state or a referenced parent later changed.
@@ -1560,8 +1900,7 @@ export class ChatStore {
                 (!Number.isSafeInteger(ifToken) || ifToken < 0)) {
                 throw new Error("if_last_read_seq must be a non-negative safe integer");
             }
-            const cursor = this.getCursor(roomId, agentId);
-            const from = cursor?.last_read_seq ?? 0;
+            const from = membership.last_read_seq;
             if (ifToken !== null) {
                 // A future/wrong-cursor token made the predicate `seq > token` empty
                 // and silently disabled the CAS while unread messages still existed.
@@ -1634,15 +1973,20 @@ export class ChatStore {
                     throw new Error(`supersedes_seq ${supersedesSeq} was written by ${target.agent_id}; you can only supersede your own messages`);
                 }
             }
-            // Crossing report: computed before the insert so "unread" excludes the
-            // message being posted. The directedAt pair binds FIRST (it sits in the
-            // SELECT list, ahead of the WHERE placeholders).
-            const crossing = this.db
-                .prepare(`SELECT COUNT(*) AS c, MIN(seq) AS mn, MAX(seq) AS mx,
-                  SUM(CASE WHEN ${directedAt("messages")} THEN 1 ELSE 0 END) AS d
-           FROM messages
-           WHERE room_id = ? AND seq > ? AND agent_id != ?`)
-                .get(agentId, agentId, roomId, from, agentId);
+            // A surviving CAS already proved stale.c === 0 after a token no newer
+            // than `from`, so it also proved there are no crossings after `from`.
+            // Ordinary posts still need the cursor-relative aggregate.
+            let crossing = { c: 0, mn: null, mx: null, d: null };
+            if (ifToken === null) {
+                // The directedAt pair binds FIRST (it sits in the SELECT list, ahead of
+                // the WHERE placeholders).
+                crossing = this.db
+                    .prepare(`SELECT COUNT(*) AS c, MIN(seq) AS mn, MAX(seq) AS mx,
+                    SUM(CASE WHEN ${directedAt("messages")} THEN 1 ELSE 0 END) AS d
+             FROM messages
+             WHERE room_id = ? AND seq > ? AND agent_id != ?`)
+                    .get(agentId, agentId, roomId, from, agentId);
+            }
             const { next } = this.db
                 .prepare("SELECT COALESCE(MAX(seq), 0) + 1 AS next FROM messages WHERE room_id = ?")
                 .get(roomId);
@@ -1706,14 +2050,21 @@ export class ChatStore {
         // reported length (an emoji counts once). Deciding on codepointLen (the full
         // codepoint count) rather than a UTF-16 length keeps the threshold in the
         // same unit as the cut.
-        const truncate = previewChars !== undefined && codepointLen(r) > previewChars;
+        // The SQL fetch itself is capped before this mapper runs. body_len is the
+        // exact full UTF-16 length stamped at write time, so it detects that cut
+        // without scanning the body again. A cut JSON body must stay raw: parsing
+        // a valid-looking prefix can change it (a huge numeric prefix becomes
+        // Infinity, then serializes as null) while hiding that bytes remain.
+        const fetchedTruncate = r.body.length < r.body_len;
+        const truncate = fetchedTruncate ||
+            (previewChars !== undefined && codepointLen(r) > previewChars);
         // A truncated body is returned as a raw (possibly partial) string even for
         // json: a sliced JSON string does not parse, so the caller must fetch the
         // full body with get_message. `truncated`/`length` signal exactly that.
-        // A body larger than the fetch cap arrives here already cut; it can never
-        // fit the byte budget anyway, so shrinkToFit re-flags it downstream.
         const content = truncate
-            ? cutToCodepoints(r.body, previewChars)
+            ? previewChars === undefined
+                ? r.body
+                : cutToCodepoints(r.body, previewChars)
             : r.format === "json"
                 ? safeParse(r.body)
                 : r.body;
@@ -1751,7 +2102,7 @@ export class ChatStore {
      * measured size fits -- a single code-unit cut under-counts JSON escaping,
      * which is how control-heavy room names kept escaping the budget. Every
      * stage measures the real serialized output, so for any budget >=
-     * STUB_ALLOWANCE the result is guaranteed to fit.
+     * STUB_ALLOWANCE - 2 the result is guaranteed to fit.
      */
     shrinkToFit(r, previewChars, budget, map) {
         const m = map(r, previewChars);
@@ -1775,8 +2126,11 @@ export class ChatStore {
         // there. Stage 4 sets this explicitly, but stage 2's escaping correction can
         // reach keep=0 on its own for a control-heavy body, and a caller that reads
         // `oversized` to decide "fetch this with get_message" must not miss those.
-        if (h.content === "" && codepointLen(r) > 0)
+        if (h.content === "" && codepointLen(r) > 0) {
             h.oversized = true;
+            // The flag changes the size that gates mention shedding and stubbing.
+            sz = JSON.stringify(head).length;
+        }
         // Stage 3: shed mentions (down to none if needed); size can live
         // entirely in a legal `to` list. Flags set before the deciding measure.
         if (sz > budget && Array.isArray(h.to) && h.to.length > 0) {
@@ -1944,9 +2298,13 @@ export class ChatStore {
         // but returning it is the only progress-safe interpretation of SQLite's
         // one-CODEPOINT window; shrinking it to "" made next_offset repeat forever.
         const firstCodepointUnits = (chunk.codePointAt(0) ?? 0) > 0xffff ? 2 : 1;
-        while (chunk.length > firstCodepointUnits &&
-            JSON.stringify(chunk).length - 2 > cap) {
-            const ratio = cap / (JSON.stringify(chunk).length - 2);
+        // Serializing is the expensive step here, so measure each chunk once and
+        // re-measure only after cutting it.
+        while (chunk.length > firstCodepointUnits) {
+            const serialized = JSON.stringify(chunk).length - 2;
+            if (serialized <= cap)
+                break;
+            const ratio = cap / serialized;
             chunk = safeCut(chunk, Math.min(chunk.length - 1, Math.max(1, Math.floor(chunk.length * ratio))));
         }
         // Codepoints consumed by this slice (bounded, so counting is cheap).
@@ -1989,7 +2347,7 @@ export class ChatStore {
             .get(roomId);
         const rows = this.db
             .prepare(`SELECT agent_id, last_read_seq, left_at,
-                (strftime('%s','now') - strftime('%s', last_seen)) AS idle_seconds,
+                (unixepoch('now') - unixepoch(last_seen)) AS idle_seconds,
                 EXISTS(SELECT 1 FROM wait_leases wl
                        WHERE wl.room_id = memberships.room_id
                          AND wl.agent_id = memberships.agent_id
@@ -1998,9 +2356,28 @@ export class ChatStore {
          WHERE room_id = ? AND agent_id IN (${placeholders})`)
             .all(roomId, ...ids);
         const byId = new Map(rows.map((r) => [r.agent_id, r]));
+        // Retirement is a property of the IDENTITY, not of a membership, so it is
+        // resolved for every requested id -- including ids with no membership row
+        // here, which would otherwise report `unknown` and tell a poster its
+        // recipient never existed when in fact it existed and is finished.
+        const retired = this.retiredIds(ids);
         const threshold = activeWithinMinutes * 60;
         return ids.map((id) => {
             const r = byId.get(id);
+            if (retired.has(id)) {
+                return {
+                    id,
+                    status: "retired",
+                    present: false,
+                    idle_seconds: null,
+                    // Its final cursor is retained history and is still the truthful
+                    // answer to "how far did it get", so report it when a membership
+                    // exists. marker_behind stays meaningful for the same reason.
+                    last_read_seq: r ? r.last_read_seq : null,
+                    marker_behind: r ? Math.max(0, latest - r.last_read_seq) : null,
+                    watching: false,
+                };
+            }
             if (!r) {
                 return {
                     id,
@@ -2054,8 +2431,8 @@ export class ChatStore {
          SELECT mb.agent_id AS agent_id, mb.room_id AS room_id, r.name AS room_name,
                 COUNT(*) AS directed_unread,
                 MIN(g.seq) AS oldest_seq,
-                MIN(CAST(strftime('%s', g.created_at) AS INTEGER)) AS oldest_unix,
-                (strftime('%s','now') - strftime('%s', mb.last_seen)) AS idle_seconds,
+                MIN(unixepoch(g.created_at)) AS oldest_unix,
+                (unixepoch('now') - unixepoch(mb.last_seen)) AS idle_seconds,
                 mb.last_read_seq AS last_read_seq
          FROM memberships mb
          JOIN rooms r ON r.id = mb.room_id
@@ -2122,82 +2499,88 @@ export class ChatStore {
      * page them via get_message.
      */
     getThread(roomId, seq, maxDepth = 3, previewChars) {
-        const focalRow = this.getRawMessage(roomId, seq);
-        if (!focalRow)
-            return undefined;
-        const mapPlain = (r, pc) => this.rowToMessage(r, pc);
-        const budget = DEFAULT_MAX_BYTES - THREAD_ENVELOPE;
-        // Reserve the parent's slot before spending on the focal message: a stub
-        // allowance when a parent exists, 4 chars of literal null otherwise. The
-        // trailing 2 covers an empty replies array.
-        const parentSeq = focalRow.reply_to_seq;
-        const parentReserve = parentSeq === null ? 4 : STUB_ALLOWANCE + 2;
-        const message = this.shrinkToFit(focalRow, undefined, budget - parentReserve - 2, mapPlain);
-        let remaining = budget - JSON.stringify(message).length;
-        let parent = null;
-        if (parentSeq !== null) {
-            const parentRow = this.getRawMessage(roomId, parentSeq);
-            if (parentRow) {
-                // Leave a stub allowance (plus array brackets) for the replies when
-                // more than that remains; otherwise the parent gets a stub itself.
-                parent = this.shrinkToFit(parentRow, undefined, Math.max(STUB_ALLOWANCE, remaining - STUB_ALLOWANCE - 2), mapPlain);
+        const tx = this.db.transaction(() => {
+            const focalRow = this.getRawMessage(roomId, seq);
+            if (!focalRow)
+                return undefined;
+            const mapPlain = (r, pc) => this.rowToMessage(r, pc);
+            const budget = DEFAULT_MAX_BYTES - THREAD_ENVELOPE;
+            // Reserve the parent's slot before spending on the focal message: a stub
+            // allowance when a parent exists, 4 chars of literal null otherwise. The
+            // trailing 2 covers an empty replies array.
+            const parentSeq = focalRow.reply_to_seq;
+            const parentReserve = parentSeq === null ? 4 : STUB_ALLOWANCE + 2;
+            const message = this.shrinkToFit(focalRow, undefined, budget - parentReserve - 2, mapPlain);
+            let remaining = budget - JSON.stringify(message).length;
+            let parent = null;
+            if (parentSeq !== null) {
+                const parentRow = this.getRawMessage(roomId, parentSeq);
+                if (parentRow) {
+                    // Leave a stub allowance (plus array brackets) for the replies when
+                    // more than that remains; otherwise the parent gets a stub itself.
+                    parent = this.shrinkToFit(parentRow, undefined, Math.max(STUB_ALLOWANCE, remaining - STUB_ALLOWANCE - 2), mapPlain);
+                }
             }
-        }
-        remaining -= parent ? JSON.stringify(parent).length : 4;
-        const cap = 500;
-        // Recursive walk of the reply subtree. `path` (zero-padded seq per level)
-        // orders siblings numerically and yields pre-order DFS when sorted. Fetch
-        // cap+1 rows to detect (without a separate COUNT) that more were available,
-        // but memory-bound via fetchBounded so 500 large replies do not all
-        // materialize (~50 MB) just to trim to the thread budget: it stops after
-        // ~budget raw body plus a sentinel. When it stops by SIZE, replies_capped
-        // may under-report (byte_limited then carries "more replies exist"); when
-        // replies are small it fetches the full cap+1 and reports capping exactly.
-        const { rows, exhausted } = this.fetchBounded(this.db.prepare(`WITH RECURSIVE descendants(seq, depth, path) AS (
-           SELECT g.seq, 1, printf('%010d', g.seq)
-             FROM messages g
-            WHERE g.room_id = @room AND g.reply_to_seq = @root
-           UNION ALL
-           SELECT c.seq, d.depth + 1, d.path || '/' || printf('%010d', c.seq)
-             FROM messages c
-             JOIN descendants d ON c.reply_to_seq = d.seq
-            WHERE c.room_id = @room AND d.depth < @maxDepth
-         )
-         SELECT ${messageCols(DEFAULT_MAX_BYTES)}, d.depth AS depth
-           FROM descendants d
-           JOIN messages g ON g.room_id = @room AND g.seq = d.seq
-           LEFT JOIN agents a ON a.id = g.agent_id
-           LEFT JOIN messages p ON p.room_id = g.room_id AND p.seq = g.reply_to_seq
-          ORDER BY d.path
-          LIMIT @lim`), [{ room: roomId, root: seq, maxDepth, lim: cap + 1 }], Math.max(STUB_ALLOWANCE, remaining));
-        const replies_capped = rows.length > cap;
-        // Below a stub allowance boundByBytes cannot guarantee even its head row
-        // fits; omit the replies instead of delivering an over-budget response
-        // (byte_limited says they exist; get_thread on a reply seq fetches them).
-        let replies = [];
-        let byteLimited = false;
-        if (rows.length > 0 && remaining < STUB_ALLOWANCE + 2) {
-            byteLimited = true;
-        }
-        else if (rows.length > 0) {
-            ({ messages: replies, byteLimited } = this.boundByBytes(rows.slice(0, cap), previewChars, remaining, (r, pc) => ({
-                ...this.rowToMessage(r, pc),
-                depth: r.depth,
-            })));
-        }
-        // If fetchBounded stopped on the raw-byte budget (exhausted:false), replies
-        // were left unfetched even when boundByBytes fit everything it got (a
-        // preview_chars cut shrank them all): flag byte_limited so the omission is
-        // never silent. get_thread has no reply-offset param; the recourse is
-        // get_thread on a reply seq, which byte_limited signals is needed.
-        byteLimited = byteLimited || !exhausted;
-        return {
-            message,
-            parent,
-            replies,
-            replies_capped,
-            ...(byteLimited ? { byte_limited: true } : {}),
-        };
+            remaining -= parent ? JSON.stringify(parent).length : 4;
+            const cap = 500;
+            // `path` uses the fixed width needed through Number.MAX_SAFE_INTEGER, the
+            // supported writer bound, so sorting it yields numeric pre-order DFS.
+            // The recursive ORDER/LIMIT keeps at most cap+1 rows for the expensive
+            // message joins and final sort. It bounds the recursive result table, not
+            // candidate discovery: wide fanout may still be enumerated and sorted.
+            // fetchBounded separately stops large bodies at the response budget.
+            const { rows, exhausted } = this.fetchBounded(this.db.prepare(`WITH RECURSIVE descendants(seq, depth, path) AS (
+             SELECT g.seq, 1, printf('%016d', g.seq)
+               FROM messages g
+              WHERE g.room_id = @room AND g.reply_to_seq = @root
+             UNION ALL
+             SELECT c.seq, d.depth + 1,
+                    d.path || '/' || printf('%016d', c.seq) AS path
+               FROM descendants d
+               CROSS JOIN messages c INDEXED BY idx_messages_reply
+              WHERE c.reply_to_seq = d.seq
+                AND c.room_id = @room
+                AND d.depth < @maxDepth
+              ORDER BY path
+              LIMIT @lim
+           )
+           SELECT ${messageCols(DEFAULT_MAX_BYTES)}, d.depth AS depth
+             FROM descendants d
+             CROSS JOIN messages g
+             LEFT JOIN messages p ON p.room_id = g.room_id AND p.seq = g.reply_to_seq
+            WHERE g.room_id = @room AND g.seq = d.seq
+            ORDER BY d.path
+            LIMIT @lim`), [{ room: roomId, root: seq, maxDepth, lim: cap + 1 }], Math.max(STUB_ALLOWANCE, remaining));
+            const replies_capped = rows.length > cap;
+            // Below a stub allowance boundByBytes cannot guarantee even its head row
+            // fits; omit the replies instead of delivering an over-budget response
+            // (byte_limited says they exist; get_thread on a reply seq fetches them).
+            let replies = [];
+            let byteLimited = false;
+            if (rows.length > 0 && remaining < STUB_ALLOWANCE + 2) {
+                byteLimited = true;
+            }
+            else if (rows.length > 0) {
+                ({ messages: replies, byteLimited } = this.boundByBytes(rows.slice(0, cap), previewChars, remaining, (r, pc) => ({
+                    ...this.rowToMessage(r, pc),
+                    depth: r.depth,
+                })));
+            }
+            // If fetchBounded stopped on the raw-byte budget (exhausted:false), replies
+            // were left unfetched even when boundByBytes fit everything it got (a
+            // preview_chars cut shrank them all): flag byte_limited so the omission is
+            // never silent. get_thread has no reply-offset param; the recourse is
+            // get_thread on a reply seq, which byte_limited signals is needed.
+            byteLimited = byteLimited || !exhausted;
+            return {
+                message,
+                parent,
+                replies,
+                replies_capped,
+                ...(byteLimited ? { byte_limited: true } : {}),
+            };
+        });
+        return tx.deferred();
     }
     /** Count of messages newer than the marker that the agent did NOT write. */
     unreadCount(roomId, lastReadSeq, agentId) {
@@ -2218,33 +2601,37 @@ export class ChatStore {
      * lock the way catchUp's IMMEDIATE transaction would. Throws when the
      * membership is gone (room deleted mid-wait), same as catchUp.
      *
-     * EPOCH-FENCED, and this is what bounds how long a fenced-out wait keeps
+     * FENCED ON LIVENESS, and this is what bounds how long a dead wait keeps
      * sitting there. The advancing read on a hit was always fenced, but a QUIET
-     * stale wait never reaches it: with no epoch here, a runtime taken over at
+     * stale wait never reaches it: with no check here, an identity retired at
      * second 3 of a 25-second wait went right on waiting, holding a lease that
      * told peers it was watching, and learned nothing until traffic arrived or
      * the deadline expired. Checking each probe caps that at one interval.
      *
-     * The epoch rides as returned DATA anchored on the persona row, not as a
-     * WHERE predicate: as a predicate a fenced runtime would get "no row", which
+     * retired_at rides as returned DATA anchored on the persona row, not as a
+     * WHERE predicate: as a predicate a dead identity would get "no row", which
      * this method already means "the room or membership is gone" -- a wrong and
      * actively misleading diagnosis. Anchoring on agents keeps the two apart.
      */
-    unreadProbe(roomId, agentId, epoch) {
+    unreadProbe(roomId, agentId) {
         const row = this.db
-            .prepare(`SELECT a.runtime_epoch AS current_epoch,
-                (SELECT mb.last_read_seq FROM memberships mb
-                  WHERE mb.room_id = @room AND mb.agent_id = @agent)
-                  AS last_read_seq
-         FROM agents a WHERE a.id = @agent`)
+            .prepare(`SELECT a.retired_at, mb.last_read_seq, mb.left_at
+         FROM agents a
+         LEFT JOIN memberships mb
+           ON mb.room_id = @room AND mb.agent_id = a.id
+         WHERE a.id = @agent`)
             .get({ room: roomId, agent: agentId });
+        // Same identity fence as requireLive: a quiet in-call wait must stop after
+        // retirement rather than keep advertising a seat that can never act.
         if (!row)
-            throw new PersonaLostError(agentId, epoch, null);
-        if (row.current_epoch !== epoch) {
-            throw new PersonaLostError(agentId, epoch, row.current_epoch);
-        }
+            throw new PersonaLostError(agentId, "missing");
+        if (row.retired_at !== null)
+            throw new PersonaLostError(agentId, "retired");
         if (row.last_read_seq === null)
             throw new Error("not a member of this room");
+        if (row.left_at !== null) {
+            throw new Error(`persona "${agentId}" LEFT room ${roomId} while waiting; rejoin before waiting on it again`);
+        }
         // A wait only needs a yes/no wake signal. COUNT(*) rescanned the complete
         // unread tail twice per second per wait (including a large self-authored
         // tail that never advances); the room/seq index lets this stop at one row.
@@ -2263,8 +2650,9 @@ export class ChatStore {
      * and catch_up's rooms_with_unread disclosure on an empty read. Rooms this
      * persona soft-left are muted by the membership join. excludeRoomId drops the
      * room just read (catch_up's summary lists OTHER rooms). Fetches limit+1 to
-     * report truncation without a tail COUNT. Read-only, so it is safe inside
-     * deferred and immediate transactions alike.
+     * report truncation without a tail COUNT. The returned room set is bounded;
+     * exact unread/directed counts still require scanning every candidate row.
+     * Read-only, so it is safe inside deferred and immediate transactions alike.
      */
     unreadByRoom(agentId, limit, excludeRoomId) {
         const lim = Math.max(1, Math.floor(limit));
@@ -2300,18 +2688,12 @@ export class ChatStore {
      * and advances over lower-priority rows through a disclosed cutoff. Directed
      * rows always qualify so advancing cannot silently erase my_mentions items.
      *
-     * unreadSummary: on an EMPTY read, include a bounded
-     * rooms_with_unread summary of every OTHER room holding unread, computed in
-     * the SAME snapshot as the empty determination -- across two separate
-     * queries a message arriving in this room could make the read report
-     * "empty" while the summary lists this very room.
+     * unreadSummary: on an EMPTY read, include a bounded rooms_with_unread
+     * summary of every OTHER room holding unread. It is advisory and computed
+     * after the current-room transaction so a large cross-room aggregation does
+     * not hold the process-wide writer reservation.
      */
-    catchUp(roomId, agentId, limit, previewChars, 
-    // Defaulted only because it sits after an optional parameter. 0 is a
-    // FAIL-CLOSED sentinel, not "no fencing": personas start at epoch 1 and
-    // only ever increment, so an omitted epoch matches nothing and the read is
-    // rejected rather than silently running unfenced.
-    maxBytes = DEFAULT_MAX_BYTES, epoch = 0, unreadSummary = null) {
+    catchUp(roomId, agentId, limit, previewChars, maxBytes = DEFAULT_MAX_BYTES, unreadSummary = null) {
         if (!Number.isSafeInteger(maxBytes) ||
             maxBytes < MIN_CATCH_UP_RESULT_BUDGET ||
             maxBytes > MAX_BULK_RESULT_CHARS) {
@@ -2325,8 +2707,9 @@ export class ChatStore {
         }
         const pageLimit = Math.min(MAX_CATCH_UP_ROWS, Math.max(1, Math.floor(limit)));
         // Advancing path: read the cursor, fetch, and advance inside one IMMEDIATE
-        // transaction so a concurrent same-identity call serializes behind it and
-        // reads the updated cursor instead of returning overlapping messages.
+        // transaction. A deferred WAL transaction could let another writer commit
+        // after this read snapshot, then fail the cursor update with
+        // SQLITE_BUSY_SNAPSHOT.
         // The byte bound trims BEFORE the advance, so the cursor never covers an
         // undelivered peer row (it may later normalize across own rows, which are
         // never returned): a response the client rejects as oversized can no
@@ -2335,19 +2718,9 @@ export class ChatStore {
             // ADVANCING read: fenced like a mutation, because it moves the read
             // marker. A stale runtime whose catch_up committed would consume messages
             // the current runtime has not seen and can no longer reach.
-            this.requireEpoch(agentId, epoch);
-            const cursor = this.getCursor(roomId, agentId);
-            if (!cursor) {
-                // Distinguish a real non-member from a room deleted after the caller
-                // resolved it. This extra PK lookup runs only on the error path.
-                this.requireRoom(roomId);
-                throw new Error("not a member of this room");
-            }
-            // Consuming messages while absent is invisible consumption: peers see a
-            // left persona and cannot tell their traffic is being read. read_history
-            // stays open for exactly this reason -- it consumes nothing.
-            this.requirePresent(roomId, agentId);
-            const from = cursor.last_read_seq;
+            this.requireLive(agentId);
+            // Advancing reads require presence; read_history remains non-advancing.
+            const from = this.requirePresent(roomId, agentId).last_read_seq;
             const priorityOnly = unreadSummary?.priorityOnly === true;
             // Captured under the same IMMEDIATE snapshot as the filtered scan. Own
             // rows count toward the cutoff but never toward skipped/remaining.
@@ -2409,39 +2782,6 @@ export class ChatStore {
             if (lastSeq > from) {
                 this.setCursor(roomId, agentId, lastSeq);
             }
-            // Empty read: same-snapshot disclosure of where the traffic actually
-            // is. Emitted even when no other room has unread ([]): that positively
-            // answers "is anything anywhere?", the question an empty read raises.
-            const UNREAD_SUMMARY_MAX = 20;
-            let summary = null;
-            if (unreadSummary !== null && messages.length === 0) {
-                const fetched = this.unreadByRoom(agentId, UNREAD_SUMMARY_MAX, roomId);
-                // The v0.9 summary was appended after catch_up had already spent the
-                // entire page budget. Twenty legal, control-heavy room names could
-                // inflate a declared 1k response past 25k. Bound the summary within
-                // the same result budget, using the same measured-fit/name-halving
-                // pattern as my_mentions.by_room.
-                const roomBudget = maxBytes -
-                    (priorityOnly
-                        ? PRIORITY_CATCH_UP_SUMMARY_ENVELOPE
-                        : CATCH_UP_SUMMARY_ENVELOPE);
-                const fitted = fitRows(fetched.rooms, roomBudget);
-                const rooms = fitted.rows;
-                let truncated = fetched.truncated || fitted.sizeTrimmed;
-                if (rooms.length === 1 && JSON.stringify(rooms).length > roomBudget) {
-                    let entry = { ...rooms[0] };
-                    while (JSON.stringify([entry]).length > roomBudget &&
-                        entry.name.length > 0) {
-                        entry = {
-                            ...entry,
-                            name: safeCut(entry.name, Math.floor(entry.name.length / 2)),
-                        };
-                    }
-                    rooms[0] = entry;
-                    truncated = true;
-                }
-                summary = { rooms, truncated };
-            }
             return {
                 messages,
                 new_last_read_seq: lastSeq,
@@ -2460,11 +2800,36 @@ export class ChatStore {
                 // it that a preview/JSON shrink could otherwise hide. `remaining` is the
                 // authoritative "more unread" count here, but keep byte_limited honest.
                 ...(byteLimited || !exhausted ? { byte_limited: true } : {}),
-                ...(summary !== null ? { rooms_with_unread: summary.rooms } : {}),
-                ...(summary?.truncated ? { rooms_with_unread_truncated: true } : {}),
             };
         });
-        return tx.immediate();
+        const result = tx.immediate();
+        if (unreadSummary === null || result.messages.length > 0)
+            return result;
+        // Keep the potentially large all-room aggregate outside IMMEDIATE. The
+        // summary is routing advice; like any response, it can become stale as soon
+        // as the current-room transaction commits.
+        try {
+            const UNREAD_SUMMARY_MAX = 20;
+            const fetched = this.unreadByRoom(agentId, UNREAD_SUMMARY_MAX, roomId);
+            const roomBudget = maxBytes -
+                (unreadSummary.priorityOnly === true
+                    ? PRIORITY_CATCH_UP_SUMMARY_ENVELOPE
+                    : CATCH_UP_SUMMARY_ENVELOPE);
+            const fitted = fitRoomSummary(fetched.rooms, roomBudget);
+            return {
+                ...result,
+                rooms_with_unread: fitted.rooms,
+                ...(fetched.truncated || fitted.sizeTrimmed
+                    ? { rooms_with_unread_truncated: true }
+                    : {}),
+            };
+        }
+        catch {
+            // The cursor may already be committed, including a lossy cutoff, so a
+            // thrown response would invite a retry that cannot reconstruct the old
+            // state. The advisory summary is optional; return the core result.
+            return result;
+        }
     }
     /**
      * Cross-room mentions INBOX: unread messages directed at the agent (its
@@ -2497,6 +2862,9 @@ export class ChatStore {
             // bulk reader with no "more remain" signal when exactly `limit` directed
             // messages fit inside the byte budget: an agent paging on byte_limited
             // (the documented signal) then silently under-read its own inbox.
+            // Keep the candidate predicates in both queries below in sync with
+            // directedAt and idx_messages_directed_candidates. It is redundant for
+            // results but required for SQLite to prove the partial index is eligible.
             const { rows: fetched, exhausted } = this.fetchBounded(this.db.prepare(`SELECT ${messageCols(maxBytes)}, g.id AS gid, g.room_id AS room_id, r.name AS room_name
            FROM ${MESSAGE_FROM}
            JOIN memberships mb ON mb.room_id = g.room_id
@@ -2504,6 +2872,7 @@ export class ChatStore {
            JOIN rooms r ON r.id = g.room_id
            WHERE g.seq > mb.last_read_seq
              AND g.id > ? AND g.agent_id != ?
+             AND (g.mentions IS NOT NULL OR g.reply_to_agent IS NOT NULL)
              AND ${directedAt("g")}
            ORDER BY g.id ASC LIMIT ?`), [agentId, afterId, agentId, agentId, agentId, limit + 1], maxBytes);
             const hasExtra = fetched.length > limit;
@@ -2518,6 +2887,7 @@ export class ChatStore {
                 AND mb.agent_id = ? AND mb.left_at IS NULL
            WHERE g.seq > mb.last_read_seq
              AND g.agent_id != ?
+             AND (g.mentions IS NOT NULL OR g.reply_to_agent IS NOT NULL)
              AND ${directedAt("g")}`)
                 .get(agentId, agentId, agentId, agentId);
             const total_directed = td;
@@ -2526,33 +2896,13 @@ export class ChatStore {
             // lives in unreadByRoom, shared with catch_up's rooms_with_unread.
             const BY_ROOM_MAX = 4000;
             const byRoomFetch = this.unreadByRoom(agentId, BY_ROOM_MAX);
-            let byRoom = byRoomFetch.rooms;
             // Rooms past BY_ROOM_MAX (the least-directed) were dropped -- flag it.
             const roomLimitHit = byRoomFetch.truncated;
             const roomBudget = Math.floor(maxBytes / 3);
-            // Trim off the end (least-directed rooms, already SQL-ordered) with the
-            // LINEAR fitRows, not an O(n^2) re-serialize-per-pop loop. It always keeps
-            // at least one row, so the single-entry name-halving below still handles a
-            // lone oversized room.
-            const trimmed = fitRows(byRoom, roomBudget);
-            byRoom = trimmed.rows;
-            let by_room_truncated = trimmed.sizeTrimmed || roomLimitHit;
-            // A single long-named room can still overflow a small budget: halve
-            // the display name until the MEASURED serialized size fits (a fixed
-            // code-unit cut under-counts JSON escaping, so a control-heavy name
-            // slipped past it); room_id remains the stable key.
-            if (byRoom.length === 1 && JSON.stringify(byRoom).length > roomBudget) {
-                let entry = { ...byRoom[0] };
-                while (JSON.stringify([entry]).length > roomBudget &&
-                    entry.name.length > 0) {
-                    entry = {
-                        ...entry,
-                        name: safeCut(entry.name, Math.floor(entry.name.length / 2)),
-                    };
-                }
-                byRoom[0] = entry;
-                by_room_truncated = true;
-            }
+            // Rows arrive most-directed first, so fitting drops the least-directed.
+            const trimmed = fitRoomSummary(byRoomFetch.rooms, roomBudget);
+            const byRoom = trimmed.rooms;
+            const by_room_truncated = trimmed.sizeTrimmed || roomLimitHit;
             // Joint budget with an exact envelope: messages get what by_room and
             // the fixed response fields leave, floored at the stub allowance
             // (which boundByBytes can always honor; at the schema's 1000-char
@@ -2627,25 +2977,17 @@ export class ChatStore {
      * clamped to [0, latest]. A lower value re-exposes those messages to catch_up.
      * Returns the previous and new marker plus the room's latest seq.
      */
-    markRead(roomId, agentId, epoch, seq) {
+    markRead(roomId, agentId, seq) {
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
-            const cursor = this.getCursor(roomId, agentId);
-            if (!cursor) {
-                // Same ordering rule as claimResource: name a deleted room as deleted
-                // rather than reporting its vanished membership as a non-membership.
-                this.requireRoom(roomId);
-                throw new Error("not a member of this room");
-            }
-            // Advancing a marker is participation: it consumes messages peers can
-            // see you have not read.
-            this.requirePresent(roomId, agentId);
+            this.requireLive(agentId);
+            // Advancing a marker requires presence and reports the prior cursor.
+            const previous = this.requirePresent(roomId, agentId).last_read_seq;
             const { latest } = this.db
                 .prepare("SELECT COALESCE(MAX(seq), 0) AS latest FROM messages WHERE room_id = ?")
                 .get(roomId);
             const target = seq === undefined ? latest : Math.max(0, Math.min(seq, latest));
             this.setCursor(roomId, agentId, target);
-            return { previous: cursor.last_read_seq, new: target, latest };
+            return { previous, new: target, latest };
         });
         return tx.immediate();
     }
@@ -2673,7 +3015,6 @@ export class ChatStore {
         const { rows, exhausted } = this.fetchBounded(this.db.prepare(`SELECT ${messageCols(DEFAULT_MAX_BYTES)}
          FROM messages_fts f
          JOIN messages g ON g.id = f.rowid
-         LEFT JOIN agents a ON a.id = g.agent_id
          LEFT JOIN messages p ON p.room_id = g.room_id AND p.seq = g.reply_to_seq
          WHERE f.body MATCH ? AND g.room_id = ?
          ORDER BY rank, g.id LIMIT ? OFFSET ?`), [query, roomId, limit + 1, off], DEFAULT_MAX_BYTES);
@@ -2696,15 +3037,15 @@ export class ChatStore {
      * Trim a room to its newest `keepLast` messages. Only the oldest are removed,
      * so MAX(seq) is unchanged and future seq numbers stay monotonic.
      */
-    pruneMessages(roomId, agentId, epoch, keepLast, force) {
+    pruneMessages(roomId, agentId, keepLast, force) {
         // Keep at least the newest message: keepLast=0 would hit OFFSET -1
         // (clamped to 0 by SQLite, silently keeping one row anyway), and deleting
         // ALL rows would reset MAX(seq), breaking the monotonic-seq invariant.
         keepLast = Math.max(1, Math.floor(keepLast));
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
-            // A deleted room must not report a successful no-op prune.
-            this.requireRoom(roomId);
+            this.requireLive(agentId);
+            // Pruning requires presence, including when force skips unread checks.
+            this.requirePresent(roomId, agentId);
             const { c: total } = this.db
                 .prepare("SELECT COUNT(*) AS c FROM messages WHERE room_id = ?")
                 .get(roomId);
@@ -2719,12 +3060,22 @@ export class ChatStore {
                 // read position for resume, so their unread is real until they return.
                 // (The author has implicitly "seen" its own message, matching catch_up's
                 // self-exclusion.) Pass force=true to prune past this.
+                //
+                // RETIRED LLM identities are the one exclusion, and it is required
+                // rather than optional: retirement soft-leaves their memberships, and
+                // a left membership blocks by design because it can come back. A
+                // retired one cannot, so without this join a single model transition
+                // would freeze the room's history permanently behind a cursor no
+                // reader will ever advance. Humans that left stay blockers -- they are
+                // resumable, which is exactly the difference.
                 const { u } = this.db
                     .prepare(`SELECT COUNT(*) AS u FROM messages g
              WHERE g.room_id = ? AND g.seq < ?
                AND EXISTS (
                  SELECT 1 FROM memberships mm
+                 JOIN agents aa ON aa.id = mm.agent_id
                  WHERE mm.room_id = g.room_id
+                   AND aa.retired_at IS NULL
                    AND mm.last_read_seq < g.seq AND mm.agent_id != g.agent_id
                )`)
                     .get(roomId, cutoff.seq);
@@ -2735,7 +3086,8 @@ export class ChatStore {
                     // whom the refusal itself exempts.
                     const { m } = this.db
                         .prepare(`SELECT MIN(mm.last_read_seq) AS m FROM memberships mm
-                WHERE mm.room_id = ? AND EXISTS (
+                 JOIN agents aa ON aa.id = mm.agent_id
+                WHERE mm.room_id = ? AND aa.retired_at IS NULL AND EXISTS (
                   SELECT 1 FROM messages g WHERE g.room_id = mm.room_id
                     AND g.seq < ? AND g.seq > mm.last_read_seq
                     AND g.agent_id != mm.agent_id)`)
@@ -2762,12 +3114,12 @@ export class ChatStore {
     /** Hard-delete a room and all of its messages and memberships. Throws a
      *  clean "already deleted" error if another process removed it first,
      *  instead of reporting a false success with zero counts. */
-    deleteRoom(roomId, agentId, epoch) {
+    deleteRoom(roomId, agentId) {
         const tx = this.db.transaction(() => {
             // Fenced for the same reason as createRoom, and more urgently: this is
             // the one irreversible operation in the tool surface. No membership is
             // required (deletion has always been global admin), only a live persona.
-            this.requireEpoch(agentId, epoch);
+            this.requireLive(agentId);
             this.requireRoom(roomId);
             const { c: messages } = this.db
                 .prepare("SELECT COUNT(*) AS c FROM messages WHERE room_id = ?")
@@ -2793,29 +3145,29 @@ export class ChatStore {
      * winner: the read-check and upsert run in one IMMEDIATE transaction, so two
      * simultaneous claimants cannot both be granted (unlike two "I claim X" chat
      * posts, which can cross). Re-claiming your own key renews the TTL; an
-     * expired claim is grantable to anyone. Ownership is per PERSONA, so a claim
-     * survives a resume: the runtime that takes the persona over inherits it.
+     * expired claim is grantable to anyone. Ownership is per PERSONA, and a
+     * persona belongs to one connection for life, so a claim has exactly one
+     * holder until it expires, is released, or its holder is retired (retirement
+     * DELETES it rather than transferring it).
      */
-    claimResource(roomId, key, agentId, epoch, ttlSeconds, note) {
+    claimResource(roomId, key, agentId, ttlSeconds, note) {
         assertStorable(key, "claim key");
         assertMaxLen(key, "claim key", 500);
         assertStorable(note, "claim note");
         assertMaxLen(note, "claim note", 2000);
+        if (!Number.isSafeInteger(ttlSeconds) ||
+            ttlSeconds < 1 ||
+            ttlSeconds > 86_400) {
+            throw new Error("claim ttl_seconds must be an integer from 1 to 86400 seconds");
+        }
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
-            // Same deleted-room window as postMessage: fail cleanly, not with a
-            // raw FK error from the claims INSERT. BEFORE the presence check, because
-            // a delete cascades the membership away and "you are not a member" is a
-            // false diagnosis of a room that no longer exists.
-            this.requireRoom(roomId);
-            // Taking (or renewing) a claim asserts coordination inside a room this
-            // persona is not in. release_claim stays open: dropping a claim you
-            // already hold is cleanup, not participation.
+            this.requireLive(agentId);
+            // Taking a claim requires presence; releasing one remains cleanup.
             this.requirePresent(roomId, agentId);
             const row = this.db
                 .prepare(`SELECT agent_id, note,
                   strftime('%Y-%m-%dT%H:%M:%SZ', expires_at) AS expires_at,
-                  (strftime('%s', expires_at) - strftime('%s', 'now')) AS remaining
+                  (unixepoch(expires_at) - unixepoch('now')) AS remaining
            FROM claims WHERE room_id = ? AND key = ?`)
                 .get(roomId, key);
             if (row && row.remaining > 0 && row.agent_id !== agentId) {
@@ -2849,13 +3201,13 @@ export class ChatStore {
         return tx.immediate();
     }
     /** Release your own claim. Expired claims can be released by anyone. */
-    releaseClaim(roomId, key, agentId, epoch) {
+    releaseClaim(roomId, key, agentId) {
         const tx = this.db.transaction(() => {
-            this.requireEpoch(agentId, epoch);
+            this.requireLive(agentId);
             this.requireRoom(roomId);
             const row = this.db
                 .prepare(`SELECT agent_id,
-                  (strftime('%s', expires_at) - strftime('%s', 'now')) AS remaining
+                  (unixepoch(expires_at) - unixepoch('now')) AS remaining
            FROM claims WHERE room_id = ? AND key = ?`)
                 .get(roomId, key);
             if (!row)
@@ -2897,7 +3249,7 @@ export class ChatStore {
                   substr(note, 1, ${PREVIEW}) AS note,
                   CASE WHEN length(note) > ${PREVIEW} THEN 1 ELSE 0 END AS note_cut,
                   strftime('%Y-%m-%dT%H:%M:%SZ', expires_at) AS expires_at,
-                  (strftime('%s', expires_at) - strftime('%s', 'now')) AS expires_in_seconds
+                  (unixepoch(expires_at) - unixepoch('now')) AS expires_in_seconds
            FROM claims WHERE room_id = ? AND key > ? ORDER BY key LIMIT ?`)
                 .all(roomId, afterKey, lim + 1);
             const { c: total } = this.db