negotium 0.2.27 → 0.2.28

package/dist/runtime/src/storage/api-topics.ts

@@ -34,6 +34,56 @@ export function normalizeTopicSurface(value: unknown): TopicSurface {
   return value === "telegram" || value === "otium" || value === "terminal" ? value : "terminal";
 }
 
+/**
+ * The surface instance new rooms are filed under when the caller names none.
+ *
+ * `surface` alone is not enough once a node may be attached to several Otium
+ * workspaces (M-2): two workspaces are two independent namespaces on the same
+ * surface. The adapter that owns the attachment installs the active scope at
+ * mount time; `terminal` and `telegram` are singletons and stay null.
+ *
+ * Kept as process state rather than an argument threaded through every creation
+ * path because the value is a property of *this process's attachment*, not of
+ * any individual call — the same reason `defaultTopicSurface()` exists.
+ */
+let activeSurfaceScope: string | null = null;
+
+export function normalizeSurfaceScope(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+
+export function defaultSurfaceScope(): string | null {
+  return activeSurfaceScope ?? normalizeSurfaceScope(process.env.NEGOTIUM_SURFACE_SCOPE);
+}
+
+/** Install (or clear) the scope new rooms inherit. Returns the previous value. */
+export function setDefaultSurfaceScope(scope: string | null): string | null {
+  const previous = activeSurfaceScope;
+  activeSurfaceScope = normalizeSurfaceScope(scope);
+  return previous;
+}
+
+/**
+ * Whether an Otium room must name a workspace to be created at all (M-3).
+ *
+ * Off by default, and off for every single-workspace host: an unscoped room is
+ * then legacy, reachable, and perfectly usable. The adapter turns it on only
+ * while several workspaces are attached, because there an unscoped room is
+ * reachable from none of them (M-10) — a room nobody can see is worse than a
+ * refusal that says so.
+ */
+let surfaceScopeRequired = false;
+
+export function setSurfaceScopeRequired(required: boolean): void {
+  surfaceScopeRequired = required;
+}
+
+export function isSurfaceScopeRequired(): boolean {
+  return surfaceScopeRequired;
+}
+
 function tableColumns(table: string): Set<string> {
   const rows = db.query(`PRAGMA table_info(${table})`).all() as Array<{ name: string }>;
   return new Set(rows.map((row) => row.name));
@@ -237,6 +287,7 @@ function initializeApiTopicsSchema(): void {
       is_subagent INTEGER NOT NULL DEFAULT 0 CHECK (is_subagent IN (0,1)),
       visibility TEXT NOT NULL DEFAULT 'visible' CHECK (visibility IN ('visible','hidden')),
       surface TEXT NOT NULL DEFAULT 'terminal' CHECK (surface IN ('terminal','telegram','otium')),
+      surface_scope TEXT,
       browser_profile TEXT NOT NULL DEFAULT 'default',
       browser_profile_owner TEXT,
       session_id TEXT,
@@ -305,8 +356,8 @@ function initializeApiTopicsSchema(): void {
           db.query(
             `INSERT INTO api_topics_next
              (id,title,kind,description,agent,base_model,base_effort,response_policy,
-              created_at,last_message_at,parent_topic_id,memory_topic_id,memory_key,is_fork,is_subagent,visibility,surface,session_id)
-           VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,
+              created_at,last_message_at,parent_topic_id,memory_topic_id,memory_key,is_fork,is_subagent,visibility,surface,surface_scope,session_id)
+           VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,
           ).run(
             String(row.id),
             String(row.title),
@@ -325,6 +376,7 @@ function initializeApiTopicsSchema(): void {
             Number(row.is_subagent ?? 0) !== 0 ? 1 : 0,
             row.visibility === "hidden" ? "hidden" : "visible",
             row.surface === undefined ? defaultTopicSurface() : normalizeTopicSurface(row.surface),
+            normalizeSurfaceScope(row.surface_scope),
             typeof row.session_id === "string" ? row.session_id : null,
           );
         }
@@ -393,6 +445,9 @@ function initializeApiTopicsSchema(): void {
   if (!tableColumns("api_topics").has("surface")) {
     db.exec("ALTER TABLE api_topics ADD COLUMN surface TEXT NOT NULL DEFAULT 'terminal'");
   }
+  if (!tableColumns("api_topics").has("surface_scope")) {
+    db.exec("ALTER TABLE api_topics ADD COLUMN surface_scope TEXT");
+  }
   // `access_mode` was replaced by `surface`: a topic is reachable from Otium
   // because it lives there, not because a flag was flipped (S-4). Dropping the
   // column removes the second, now-contradictory source of truth.
@@ -433,6 +488,60 @@ function initializeApiTopicsSchema(): void {
     "CREATE INDEX IF NOT EXISTS idx_api_topics_last_message ON api_topics(last_message_at DESC)",
   );
   db.exec("CREATE INDEX IF NOT EXISTS idx_api_topics_surface ON api_topics(surface)");
+  db.exec(
+    "CREATE INDEX IF NOT EXISTS idx_api_topics_surface_scope ON api_topics(surface, surface_scope)",
+  );
+}
+
+const SURFACE_SCOPE_STAMP_MIGRATION = "api_topics_surface_scope_stamp_20260809";
+
+/**
+ * M-9 — file every pre-existing Otium room under the workspace attached now.
+ *
+ * Deliberately *not* a schema-init step. The scope is only knowable after the
+ * first successful Central contact (M-3), which happens long after the store
+ * opens; a boot-time migration would see no scope, record itself as applied and
+ * leave every room unstamped forever. The Otium runtime calls this instead, once,
+ * as soon as it has resolved its workspace.
+ *
+ * Runs at most once per store: rooms created after this point are stamped at
+ * creation, and a second workspace joined later must not swallow the first
+ * one's rooms. Unlike the surface migration this can never rename anything —
+ * the scope enters the uniqueness key in the same release, so nothing can start
+ * colliding because of it.
+ */
+export function stampUnscopedOtiumTopics(scope: string): number {
+  const normalized = normalizeSurfaceScope(scope);
+  if (!normalized) return 0;
+  db.exec(`
+  CREATE TABLE IF NOT EXISTS api_schema_migrations (
+    key TEXT PRIMARY KEY,
+    applied_at TEXT NOT NULL
+  )
+`);
+  const applied = db
+    .query("SELECT key FROM api_schema_migrations WHERE key = ?")
+    .get(SURFACE_SCOPE_STAMP_MIGRATION);
+  if (applied) return 0;
+
+  let stamped = 0;
+  db.transaction(() => {
+    stamped = Number(
+      db
+        .query(
+          "UPDATE api_topics SET surface_scope = ? WHERE surface = 'otium' AND surface_scope IS NULL",
+        )
+        .run(normalized).changes ?? 0,
+    );
+    db.query("INSERT INTO api_schema_migrations (key, applied_at) VALUES (?, ?)").run(
+      SURFACE_SCOPE_STAMP_MIGRATION,
+      new Date().toISOString(),
+    );
+  })();
+  if (stamped > 0) {
+    logger.info({ scope: normalized, stamped }, "api_topics: surface scope stamped");
+  }
+  return stamped;
 }
 
 const SURFACE_BACKFILL_MIGRATION = "api_topics_surface_backfill_20260808";
@@ -487,21 +596,28 @@ function renameSurfaceTitleCollisions(): void {
       "SELECT id, title, kind, surface FROM api_topics WHERE kind != 'manager' ORDER BY created_at ASC, rowid ASC",
     )
     .all();
-  const taken = new Set<string>();
+  const keyOf = (surface: string, kind: string, title: string) =>
+    [surface, kind, normalizedTitle(title)].join("\u0000");
+  // Every original title is reserved up front. Allocating only against the
+  // titles seen so far would let an earlier duplicate claim "Foo (2)" while a
+  // real room already named "Foo (2)" sits later in the scan — that room would
+  // then be pushed to "Foo (2) (2)" for no reason.
+  const reserved = new Set(rows.map((row) => keyOf(row.surface, row.kind, row.title)));
+  const used = new Set<string>();
   const update = db.query("UPDATE api_topics SET title = ? WHERE id = ?");
   for (const row of rows) {
-    const key = (title: string) => [row.surface, row.kind, normalizedTitle(title)].join("\u0000");
-    if (!taken.has(key(row.title))) {
-      taken.add(key(row.title));
+    const key = (title: string) => keyOf(row.surface, row.kind, title);
+    if (!used.has(key(row.title))) {
+      used.add(key(row.title));
       continue;
     }
     let suffix = 2;
     let candidate = `${row.title} (${suffix})`;
-    while (taken.has(key(candidate))) {
+    while (reserved.has(key(candidate)) || used.has(key(candidate))) {
       suffix += 1;
       candidate = `${row.title} (${suffix})`;
     }
-    taken.add(key(candidate));
+    used.add(key(candidate));
     update.run(candidate, row.id);
     logger.warn(
       { topicId: row.id, surface: row.surface, from: row.title, to: candidate },
@@ -531,6 +647,7 @@ export interface TopicRow {
   subagent_report_mode: string | null;
   visibility: string | null;
   surface: string | null;
+  surface_scope: string | null;
   browser_profile_owner: string | null;
   session_id: string | null;
 }
@@ -630,6 +747,7 @@ function rowToDto(
       : {}),
     visibility: normalizeTopicVisibility(r.visibility),
     surface: normalizeTopicSurface(r.surface),
+    surfaceScope: normalizeSurfaceScope(r.surface_scope),
   };
 }
 
@@ -726,6 +844,22 @@ function normalizedTitle(title: string): string {
   return title.trim().toLowerCase();
 }
 
+/**
+ * The workspace a written row belongs to.
+ *
+ * Only the `otium` surface has more than one instance, so terminal and telegram
+ * are always null — writing this process's Otium scope onto a terminal room
+ * would partition the terminal namespace for no reason. An explicit
+ * `surfaceScope` in the DTO wins so a hub can file a room it already knows the
+ * workspace of; otherwise the room joins whatever workspace this process is
+ * attached to, which is null until the scope resolves (M-3).
+ */
+function surfaceScopeForWrite(t: TopicDto): string | null {
+  if (normalizeTopicSurface(t.surface ?? defaultTopicSurface()) !== "otium") return null;
+  if (t.surfaceScope !== undefined) return normalizeSurfaceScope(t.surfaceScope);
+  return defaultSurfaceScope();
+}
+
 export function upsertTopic(t: TopicDto): void {
   const normalized = normalizeTopicState({
     id: t.id,
@@ -739,8 +873,8 @@ export function upsertTopic(t: TopicDto): void {
       `INSERT INTO api_topics
        (id,title,kind,description,agent,base_model,base_effort,response_policy,
         created_at,last_message_at,parent_topic_id,memory_topic_id,memory_key,is_fork,is_subagent,visibility,surface,
-        subagent_report_mode)
-     VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+        surface_scope,subagent_report_mode)
+     VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
      ON CONFLICT(id) DO UPDATE SET
        title = excluded.title,
        kind = excluded.kind,
@@ -758,6 +892,10 @@ export function upsertTopic(t: TopicDto): void {
        is_subagent = excluded.is_subagent,
        visibility = excluded.visibility,
        surface = excluded.surface,
+       -- A room's workspace is fixed at creation (M-1). COALESCE, not
+       -- assignment: an update may fill in a scope that was unknown when the
+       -- room was created, but may never move a room to another workspace.
+       surface_scope = COALESCE(api_topics.surface_scope, excluded.surface_scope),
        subagent_report_mode = excluded.subagent_report_mode`,
     ).run(
       t.id,
@@ -781,6 +919,7 @@ export function upsertTopic(t: TopicDto): void {
       // never name one, so defaulting to the literal would file every hub room
       // on the wrong surface.
       normalizeTopicSurface(t.surface ?? defaultTopicSurface()),
+      surfaceScopeForWrite(t),
       t.subagentReportMode ?? "auto",
     );
     db.query("DELETE FROM topic_members WHERE topic_id = ?").run(t.id);
@@ -811,12 +950,23 @@ export function upsertTopic(t: TopicDto): void {
  * cannot leak a telegram room into the terminal picker; adapters pass their own
  * surface and get a closed world back.
  */
-export function listTopics(opts: { surface?: TopicSurface } = {}): TopicDto[] {
+export function listTopics(
+  opts: { surface?: TopicSurface; surfaceScope?: string | null } = {},
+): TopicDto[] {
+  // `surfaceScope: null` is a real filter ("the unscoped rooms"), so presence —
+  // not truthiness — decides whether the scope narrows the query at all.
+  const scoped = Object.hasOwn(opts, "surfaceScope");
   const rows = (
     opts.surface
       ? db
-          .query("SELECT * FROM api_topics WHERE surface = ? ORDER BY last_message_at DESC")
-          .all(normalizeTopicSurface(opts.surface))
+          .query(
+            `SELECT * FROM api_topics WHERE surface = ?${scoped ? " AND surface_scope IS ?" : ""} ORDER BY last_message_at DESC`,
+          )
+          .all(
+            ...(scoped
+              ? [normalizeTopicSurface(opts.surface), normalizeSurfaceScope(opts.surfaceScope)]
+              : [normalizeTopicSurface(opts.surface)]),
+          )
       : db.query("SELECT * FROM api_topics ORDER BY last_message_at DESC").all()
   ) as TopicRow[];
   const participants = getAllTopicParticipants();
@@ -834,19 +984,35 @@ export function getTopic(id: string): TopicDto | null {
 }
 
 /** Return the private manager room owned by a user, excluding the retired shared General row. */
-export function getManagerTopicForUser(userId: string): TopicDto | null {
-  const row = db
-    .query<TopicRow, [string, string]>(
-      `SELECT t.* FROM api_topics t
+/**
+ * The user's own manager room, optionally on one surface.
+ *
+ * A manager room is one per user **per surface**: Terminal and Telegram each
+ * give the same person their own personal room, and returning one surface's
+ * room to the other adapter lets that adapter bind to — and reclassify — a room
+ * belonging to a different surface. Callers that represent an adapter pass
+ * theirs; unscoped lookups stay for maintenance paths that work by user alone.
+ */
+export function getManagerTopicForUser(
+  userId: string,
+  surface?: TopicSurface,
+  opts: { surfaceScope?: string | null } = {},
+): TopicDto | null {
+  const scoped = Object.hasOwn(opts, "surfaceScope");
+  const sql = `SELECT t.* FROM api_topics t
        JOIN topic_members m ON m.topic_id = t.id
        WHERE t.kind = 'manager'
          AND t.id != ?
          AND m.user_id = ?
          AND m.role = 'owner'
+         ${surface ? "AND t.surface = ?" : ""}
+         ${scoped ? "AND t.surface_scope IS ?" : ""}
        ORDER BY t.created_at ASC
-       LIMIT 1`,
-    )
-    .get(GENERAL_TOPIC_ID, userId);
+       LIMIT 1`;
+  const params: Array<string | null> = [GENERAL_TOPIC_ID, userId];
+  if (surface) params.push(surface);
+  if (scoped) params.push(normalizeSurfaceScope(opts.surfaceScope));
+  const row = db.query<TopicRow, Array<string | null>>(sql).get(...params);
   return row ? rowToDto(row) : null;
 }
 
@@ -901,16 +1067,23 @@ export function getTopicByNameAndKind(title: string, kind: TopicKind): TopicDto
 }
 
 /**
- * Titles are unique **per surface**, not per node: `otium` may exist once on
- * the terminal, once on telegram and once on the Otium hub.
+ * Titles are unique **per surface instance**, not per node: `otium` may exist
+ * once on the terminal, once on telegram, and once in *each* attached Otium
+ * workspace (M-1). Two workspaces are two namespaces that never see each other,
+ * so a name taken in one says nothing about the other.
  */
 export function findTopicTitleConflict(
   title: string,
   kind: TopicKind,
-  opts: { excludeTopicId?: string; surface?: TopicSurface } = {},
+  opts: { excludeTopicId?: string; surface?: TopicSurface; surfaceScope?: string | null } = {},
 ): TopicDto | null {
   const wanted = normalizedTitle(title);
   const surface = normalizeTopicSurface(opts.surface ?? defaultTopicSurface());
+  const surfaceScope = Object.hasOwn(opts, "surfaceScope")
+    ? normalizeSurfaceScope(opts.surfaceScope)
+    : surface === "otium"
+      ? defaultSurfaceScope()
+      : null;
   const generalTitleRequested = wanted === normalizedTitle(GENERAL_TOPIC_ID);
   if (generalTitleRequested && opts.excludeTopicId !== GENERAL_TOPIC_ID) {
     const general = db.query("SELECT * FROM api_topics WHERE id = ?").get(GENERAL_TOPIC_ID) as
@@ -925,9 +1098,9 @@ export function findTopicTitleConflict(
   // multi-user host it renamed real rooms out from under their owners.
   if (kind === "manager") return null;
 
-  const params: string[] = [wanted, surface, kind, GENERAL_TOPIC_ID];
+  const params: Array<string | null> = [wanted, surface, surfaceScope, kind, GENERAL_TOPIC_ID];
   let sql =
-    "SELECT * FROM api_topics WHERE LOWER(TRIM(title)) = ? AND surface = ? AND (kind = ? OR id = ?)";
+    "SELECT * FROM api_topics WHERE LOWER(TRIM(title)) = ? AND surface = ? AND surface_scope IS ? AND (kind = ? OR id = ?)";
   if (opts.excludeTopicId) {
     sql += " AND id != ?";
     params.push(opts.excludeTopicId);
@@ -959,12 +1132,13 @@ export function setTopicSurfaces(topicIds: readonly string[], surface: TopicSurf
 export function getTopicByNameForUser(
   title: string,
   userId: string,
-  opts: { surface?: TopicSurface } = {},
+  opts: { surface?: TopicSurface; surfaceScope?: string | null } = {},
 ): TopicDto | null {
   const trimmed = title.trim();
   const qualified = /^(agent|channel|manager):(.+)$/i.exec(trimmed);
   const requestedKind = qualified ? normalizeTopicKind(qualified[1]?.toLowerCase()) : null;
   const requestedTitle = qualified ? qualified[2]!.trim() : trimmed;
+  const scoped = Object.hasOwn(opts, "surfaceScope");
   const rows = db
     .query(
       `SELECT t.* FROM api_topics t
@@ -972,6 +1146,7 @@ export function getTopicByNameForUser(
          AND t.id != ?
          AND t.visibility != 'hidden'
          AND (? IS NULL OR t.surface = ?)
+         ${scoped ? "AND t.surface_scope IS ?" : ""}
          AND EXISTS (
            SELECT 1 FROM topic_members m WHERE m.topic_id = t.id AND m.user_id = ?
          )`,
@@ -981,6 +1156,7 @@ export function getTopicByNameForUser(
       GENERAL_TOPIC_ID,
       opts.surface ?? null,
       opts.surface ?? null,
+      ...(scoped ? [normalizeSurfaceScope(opts.surfaceScope)] : []),
       userId,
     ) as TopicRow[];
   const matches = requestedKind ? rows.filter((row) => row.kind === requestedKind) : rows;

package/dist/runtime/src/storage/runtime-turn-requests.ts

@@ -42,6 +42,12 @@ export interface RuntimeUserTurnExecution {
   providerSessionId?: string;
   /** Request ids whose ordered messages were folded into this replacement. */
   supersededRequestIds?: string[];
+  /**
+   * Slack-style thread this turn belongs to, when it was asked in one. Carried
+   * on the request rather than the message because it decides both where the
+   * answer goes and which pending requests may merge with it (S-13).
+   */
+  threadRootId?: string;
 }
 
 export interface RuntimeUserTurnRequest {
@@ -312,7 +318,16 @@ export function mergeRuntimeUserTurnRequest(input: {
           "SELECT * FROM runtime_user_turn_requests WHERE topic_id = ? ORDER BY created_at ASC, rowid ASC",
         )
         .all(input.topicId);
-      const previous = rows.map(rowToRequest);
+      // Merging exists to fold consecutive utterances of one conversation into
+      // a single turn. A different thread is by definition a different
+      // conversation, and a merged batch spanning two of them has no correct
+      // place to answer — so requests are only ever folded within one thread,
+      // and a pending request from another thread is left standing to run on
+      // its own (S-13).
+      const thread = input.execution.threadRootId;
+      const previous = rows
+        .map(rowToRequest)
+        .filter((request) => request.execution?.threadRootId === thread);
       const omittedRequestIds = new Set([
         ...(input.omitRequestIds ?? []),
         ...previous
@@ -371,7 +386,16 @@ export function mergeRuntimeUserTurnRequest(input: {
       }
       const attachments = flattenUserTurnAttachments(userMessages);
 
-      db.query("DELETE FROM runtime_user_turn_requests WHERE topic_id = ?").run(input.topicId);
+      // Delete only what this replacement actually absorbed. Clearing the whole
+      // topic would drop another thread's pending question on the floor — it
+      // was never folded in, so nothing would ever answer it (S-13).
+      const absorbed = previous.map((request) => request.requestId);
+      if (absorbed.length > 0) {
+        db.query(
+          `DELETE FROM runtime_user_turn_requests
+           WHERE topic_id = ? AND request_id IN (${absorbed.map(() => "?").join(",")})`,
+        ).run(input.topicId, ...absorbed);
+      }
       db.query(
         `INSERT INTO runtime_user_turn_requests
          (request_id, topic_id, user_id, prompt, user_messages_json, attachments_json,

package/dist/runtime/src/storage/token-stats.ts

@@ -1,8 +1,9 @@
 import { createHash } from "node:crypto";
-import { mkdirSync } from "node:fs";
+import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { appendJsonlEntry, readJsonlLines } from "#platform/jsonl";
 import { logger } from "#platform/logger";
+import { getTopicSessionId } from "#storage/api-topics";
 import { resolveStorageLogDir } from "#storage/storage-host";
 import type { AgentKind, TokenUsage } from "#types";
 
@@ -207,6 +208,24 @@ export function recordUsage(
   }
 }
 
+export function deleteTopicStats(userId: number | string, topicId: string): void {
+  const path = queriesPath(userId);
+  try {
+    const kept = readJsonlLines(path).filter((line) => {
+      try {
+        const record = JSON.parse(line) as { topicId?: unknown };
+        return record.topicId !== topicId;
+      } catch {
+        return true;
+      }
+    });
+    writeFileSync(path, kept.length > 0 ? `${kept.join("\n")}\n` : "", "utf-8");
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code === "ENOENT") return;
+    logger.warn({ err: e, userId, topicId }, "token-stats: Failed to delete topic stats");
+  }
+}
+
 export function getStats(
   userId: number | string,
   from?: string,
@@ -292,7 +311,11 @@ export function getStats(
 }
 
 /** Exact all-time usage for one topic, independent of transcript pagination. */
-export function getTopicStats(userId: number | string, topicId: string): TopicUsageSummary {
+export function getTopicStats(
+  userId: number | string,
+  topicId: string,
+  activeProviderSessionId = getTopicSessionId(topicId) ?? undefined,
+): TopicUsageSummary {
   const total = emptyBucket();
   let currentSession: CurrentSessionUsage | undefined;
 
@@ -310,6 +333,8 @@ export function getTopicStats(userId: number | string, topicId: string): TopicUs
       raw.contextTokens !== undefined &&
       raw.contextWindow !== undefined &&
       raw.contextWindow > 0 &&
+      activeProviderSessionId !== undefined &&
+      raw.providerSessionId === activeProviderSessionId &&
       (!currentSession || raw.timestamp > currentSession.timestamp)
     ) {
       currentSession = {

package/dist/runtime/src/topics/create.ts

@@ -14,8 +14,11 @@ import { FALLBACK_AGENT, resolveTopicWorkspaceDir } from "#platform/config";
 import { RESERVED_TOPIC_NAMES } from "#platform/constants";
 import { logger } from "#platform/logger";
 import {
+  defaultSurfaceScope,
   defaultTopicSurface,
   findTopicTitleConflict,
+  isSurfaceScopeRequired,
+  normalizeSurfaceScope,
   normalizeTopicKind,
   normalizeTopicState,
   normalizeTopicSurface,
@@ -50,6 +53,11 @@ export interface RegisterTopicOptions {
    * adapter must pass their own surface; unset falls back to the host default.
    */
   surface?: TopicSurface;
+  /**
+   * Which instance of that surface owns the room. Only meaningful for `otium`;
+   * unset means "the workspace this process is attached to".
+   */
+  surfaceScope?: string | null;
 }
 
 /**
@@ -68,7 +76,24 @@ export function registerTopic(opts: RegisterTopicOptions): TopicDto {
     throw new TopicValidationError("Manager rooms are system-managed");
   }
   const surface = normalizeTopicSurface(opts.surface ?? defaultTopicSurface());
-  const conflict = findTopicTitleConflict(title, requestedKind, { surface });
+  // Which instance of that surface — for Otium, which workspace (M-1). Names
+  // collide only inside one workspace, so the conflict check must be scoped the
+  // same way the row will be written.
+  const surfaceScope =
+    opts.surfaceScope !== undefined
+      ? normalizeSurfaceScope(opts.surfaceScope)
+      : surface === "otium"
+        ? defaultSurfaceScope()
+        : null;
+  // M-3: a room that names no workspace while several are attached would be
+  // filed under none and therefore visible to none. Refuse it here, where the
+  // caller can still be told, rather than creating a room nobody can reach.
+  if (surface === "otium" && !surfaceScope && isSurfaceScopeRequired()) {
+    throw new TopicValidationError(
+      "this node serves several Otium workspaces; a room must name one to be created",
+    );
+  }
+  const conflict = findTopicTitleConflict(title, requestedKind, { surface, surfaceScope });
   if (conflict) {
     throw new TopicValidationError(`A topic named "${title}" already exists on ${surface}`);
   }
@@ -113,6 +138,7 @@ export function registerTopic(opts: RegisterTopicOptions): TopicDto {
     aiMode,
     participants: [{ userId: opts.userId, role: "owner" }],
     surface,
+    surfaceScope,
     createdAt: now,
     lastMessageAt: now,
   };

package/dist/runtime/src/topics/derive.ts

@@ -56,7 +56,9 @@ import {
 import type { AgentKind } from "#types";
 import type { TopicDto, TopicSurface } from "#types/api";
 
-export function getTopics(opts: { surface?: TopicSurface } = {}): TopicDto[] {
+export function getTopics(
+  opts: { surface?: TopicSurface; surfaceScope?: string | null } = {},
+): TopicDto[] {
   return listTopics(opts).filter((topic) => !isLegacySharedGeneral(topic.id));
 }
 
@@ -66,7 +68,9 @@ export function getTopics(opts: { surface?: TopicSurface } = {}): TopicDto[] {
  * Callers that represent one product surface pass it, so a telegram room never
  * appears in the terminal picker and vice versa (S-6).
  */
-export function getVisibleTopics(opts: { surface?: TopicSurface } = {}): TopicDto[] {
+export function getVisibleTopics(
+  opts: { surface?: TopicSurface; surfaceScope?: string | null } = {},
+): TopicDto[] {
   return getTopics(opts)
     .filter(isTopicVisible)
     .map((topic) => {
@@ -107,9 +111,10 @@ function nextDerivedTopicTitle(
   kind: TopicDto["kind"],
   suffix: "fork" | "spawn" | "agent",
   surface?: TopicSurface,
+  surfaceScope?: string | null,
 ): string {
   const visibleTitles = new Set(
-    listTopics(surface ? { surface } : {})
+    listTopics(surface ? { surface, surfaceScope: surfaceScope ?? null } : {})
       .filter((topic) => topic.kind === kind)
       .map((topic) => topic.title.toLowerCase()),
   );
@@ -272,8 +277,13 @@ async function createDerivedTopicImpl(
       : [{ userId, role: "owner" as const }];
   const kind = topic.kind ?? inferTopicKind(topic);
   const surface = topic.surface ?? defaultTopicSurface();
-  const title = opts?.name?.trim() || nextDerivedTopicTitle(topic.title, kind, suffix, surface);
-  const conflict = findTopicTitleConflict(title, kind, { surface });
+  // A derived room joins its parent's workspace, not this process's current
+  // one: a subagent spawned from a workspace-A room belongs to workspace A even
+  // if the node has since attached to another (M-1).
+  const surfaceScope = topic.surfaceScope ?? null;
+  const title =
+    opts?.name?.trim() || nextDerivedTopicTitle(topic.title, kind, suffix, surface, surfaceScope);
+  const conflict = findTopicTitleConflict(title, kind, { surface, surfaceScope });
   if (conflict) {
     logger.info(
       { sourceTopicId, title, kind, conflictTopicId: conflict.id },
@@ -301,6 +311,7 @@ async function createDerivedTopicImpl(
     visibility: topic.visibility,
     // A derived room lives on the same surface as the room it came from.
     surface,
+    surfaceScope,
   };
 
   let sessionId: string | undefined;
@@ -452,7 +463,10 @@ async function createDerivedTopicImpl(
         ) {
           throw new TopicDeriveBusyError("Source topic changed while deriving; try again");
         }
-        const transactionalConflict = findTopicTitleConflict(title, kind, { surface });
+        const transactionalConflict = findTopicTitleConflict(title, kind, {
+          surface,
+          surfaceScope,
+        });
         if (transactionalConflict) throw new TopicTitleConflictError(title);
         upsertTopic(derived);
         if (subagent) {

package/dist/runtime/src/topics/lifecycle.ts

@@ -47,6 +47,7 @@ import {
 } from "#storage/runtime-turn-requests";
 import { deleteSelfSchedulesForTopic } from "#storage/self-schedules";
 import { deletePendingAsksForTopic } from "#storage/session-asks";
+import { deleteTopicStats } from "#storage/token-stats";
 import { archiveConversationEvents, archiveTopicMessages } from "#storage/topic-archive";
 import { deleteTopicArchiveState } from "#storage/topic-archive-state";
 import type { TopicDto } from "#types/api";
@@ -111,6 +112,7 @@ async function cleanupParticipantResources(
     cleanupSessionInboxFiles(participantUserId, topic.id, topic.title);
     clearQueryState(participantUserId, topic.id, topic.title);
     clearQueryUsageAlert(participantUserId, topic.id);
+    deleteTopicStats(participantUserId, topic.id);
     deletePendingAsksForTopic({ userId: participantUserId, topicName: topic.title });
   }
   return true;