negotium 0.2.3 → 0.2.5

package/dist/runtime/src/agents/fork.ts

@@ -1,4 +1,5 @@
 import { existsSync, unlinkSync } from "node:fs";
+import type { ForkRegistryResult } from "#agents/contracts";
 import { getRegistryOperations } from "#agents/registry";
 import { logger } from "#platform/logger";
 import type { AgentKind, EffortLevel } from "#types";
@@ -7,9 +8,10 @@ import type { AgentKind, EffortLevel } from "#types";
  * Agent-aware fork primitives.
  *
  * Strategy lives in each agent's registry (`*-registry.ts:forkSession`).
- * Claude uses the SDK's native `forkSession` (byte-equivalent rollout copy);
- * Codex synthesizes a rollout from the provider-agnostic conversation log
- * because the SDK has no fork API. Both surfaces converge on `ForkHandle`.
+ * Claude uses the SDK's native `forkSession`, Codex uses App Server's native
+ * `thread/fork`, and Maestro uses the SDK's `forkSessionAt`. Providers without
+ * a native branch primitive synthesize from the provider-agnostic conversation
+ * log. All surfaces converge on ForkHandle.
  */
 
 export interface ForkAgentSessionOptions {
@@ -35,13 +37,15 @@ export interface ForkHandle {
   forkId: string;
   /** Absolute path of the rollout file to remove on cleanup. */
   rolloutPath: string;
+  /** Additional provider-owned files removed with the primary rollout. */
+  cleanupPaths?: string[];
 }
 
 export interface AgentForkHost {
   forkSession(
     agent: AgentKind,
     options: Omit<ForkAgentSessionOptions, "agent">,
-  ): Promise<{ forkId: string; rolloutPath: string }>;
+  ): Promise<ForkRegistryResult>;
   exists(path: string): boolean;
   unlink(path: string): void;
   warn(details: Record<string, unknown>, message: string): void;
@@ -56,22 +60,24 @@ export function createAgentForkHelpers(host: AgentForkHost): AgentForkHelpers {
   return {
     async forkAgentSession(options) {
       const { agent, ...forkOptions } = options;
-      const { forkId, rolloutPath } = await host.forkSession(agent, forkOptions);
-      return { agent, forkId, rolloutPath };
+      const { forkId, rolloutPath, cleanupPaths } = await host.forkSession(agent, forkOptions);
+      return { agent, forkId, rolloutPath, ...(cleanupPaths?.length ? { cleanupPaths } : {}) };
     },
     cleanupAgentFork(handle) {
-      try {
-        if (host.exists(handle.rolloutPath)) host.unlink(handle.rolloutPath);
-      } catch (error) {
-        host.warn(
-          {
-            error,
-            agent: handle.agent,
-            forkId: handle.forkId,
-            rolloutPath: handle.rolloutPath,
-          },
-          "cleanupAgentFork: failed to remove rollout",
-        );
+      for (const path of [handle.rolloutPath, ...(handle.cleanupPaths ?? [])]) {
+        try {
+          if (host.exists(path)) host.unlink(path);
+        } catch (error) {
+          host.warn(
+            {
+              error,
+              agent: handle.agent,
+              forkId: handle.forkId,
+              path,
+            },
+            "cleanupAgentFork: failed to remove rollout",
+          );
+        }
       }
     },
   };

package/dist/runtime/src/agents/idle-archiver.ts

@@ -1,5 +1,8 @@
 import { runArchiverTurn } from "#agents/archiver";
-import { countMemoryArchiveExchanges } from "#agents/memory-archive-policy";
+import {
+  countMemoryArchiveExchanges,
+  meetsMemoryArchiveExchangeThreshold,
+} from "#agents/memory-archive-policy";
 import { logger } from "#platform/logger";
 import { getRoomQuery } from "#query/active-rooms";
 import { getMessagesForTopicAfterRowid } from "#storage/api-messages";
@@ -141,7 +144,9 @@ export function archiveActiveTopicForMemory(
       return null;
     }
     const exchangeCount = countMemoryArchiveExchanges(pending);
-    skipMemoryTurn = options.minExchanges !== undefined && exchangeCount < options.minExchanges;
+    skipMemoryTurn =
+      options.minExchanges !== undefined &&
+      !meetsMemoryArchiveExchangeThreshold(exchangeCount, options.minExchanges, topic);
     const archived = (options.archiveMessages ?? archiveTopicMessages)(topicId, topic.title, {
       afterRowid,
       reason: options.reason,

package/dist/runtime/src/agents/index.ts

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { hostedCodexHomePath } from "#agents/execution-host";
 import { getRegistryOperations } from "#agents/registry";
 import { encodeClaudeCwd } from "#agents/rollout/claude";
 import { resolveTaskEventScope, withTaskSnapshots } from "#agents/task-events";
@@ -108,7 +109,7 @@ export async function resolveSessionFileMissing(
       return !existsSync(path);
     }
     case "codex": {
-      const sessionsDir = join(process.env.CODEX_HOME || join(homedir(), ".codex"), "sessions");
+      const sessionsDir = join(hostedCodexHomePath(), "sessions");
       const glob = new Bun.Glob(`**/rollout-*-${sessionId}.jsonl`);
       for await (const _rel of glob.scan({ cwd: sessionsDir, onlyFiles: true })) {
         return false; // found at least one match → session exists
@@ -128,18 +129,17 @@ export async function resolveSessionFileMissing(
 
 /**
  * Rebuild a missing SDK session file from the unified conversation log, or
- * fall back to a fresh session. Returns true when the session file is confirmed
- * to exist (either pre-existing or successfully rebuilt), false when the agent
- * should start a fresh session (no entries, rebuild failed, etc.).
+ * report whether the session is ready, genuinely has no history, or could not
+ * be repaired. Repair failures must not silently discard conversation context.
  */
 async function maybeRebuildSession(
   opts: AgentQueryOptions & { userId: string; session: string },
-): Promise<boolean> {
-  if (!opts.sessionId) return true; // fresh session, nothing to rebuild
+): Promise<"ready" | "fresh" | "failed"> {
+  if (!opts.sessionId) return "ready"; // fresh session, nothing to rebuild
 
   try {
     const missing = await resolveSessionFileMissing(opts.agent, opts.sessionId, opts.cwd);
-    if (!missing) return true; // file still on disk
+    if (!missing) return "ready"; // file still on disk
 
     logger.info(
       { agent: opts.agent, sessionId: opts.sessionId, topic: opts.session },
@@ -152,7 +152,7 @@ async function maybeRebuildSession(
         { agent: opts.agent, sessionId: opts.sessionId },
         "no unified log entries to rebuild — starting fresh session",
       );
-      return false;
+      return "fresh";
     }
 
     const operations = getRegistryOperations(opts.agent);
@@ -167,13 +167,13 @@ async function maybeRebuildSession(
       { agent: opts.agent, sessionId: result.sessionId, rolloutPath: result.rolloutPath },
       "session rebuilt from unified log",
     );
-    return true;
+    return "ready";
   } catch (err) {
     logger.warn(
       { err, agent: opts.agent, sessionId: opts.sessionId },
-      "session rebuild failed — starting fresh session",
+      "session rebuild failed — preserving resume key",
     );
-    return false;
+    return "failed";
   }
 }
 
@@ -182,11 +182,17 @@ export async function* runAgent(opts: AgentQueryOptions): AsyncGenerator<Unified
   const dispatchOpts: AgentQueryOptions = { ...opts };
 
   if (hasSessionRepairContext(dispatchOpts)) {
-    const ok = await maybeRebuildSession(dispatchOpts);
-    if (!ok) {
-      // Rebuild failed / no entries → clear sessionId so the agent starts
-      // a fresh session instead of trying to resume a non-existent one.
+    const repair = await maybeRebuildSession(dispatchOpts);
+    if (repair === "fresh") {
+      // No unified history exists, so a new provider session is intentional.
       dispatchOpts.sessionId = undefined;
+    } else if (repair === "failed") {
+      yield {
+        type: "error",
+        content:
+          "Provider session could not be rebuilt from conversation history; the existing session was preserved for retry.",
+      };
+      return;
     }
   }
 

package/dist/runtime/src/agents/maestro-provider.ts

@@ -242,7 +242,7 @@ export function maestroProvider(opts: AgentQueryOptions): AsyncGenerator<Unified
   if (opts.agent !== undefined && opts.agent !== "maestro") {
     throw new Error(`maestroProvider: unexpected agent "${opts.agent}", expected "maestro"`);
   }
-  const userId = opts.userId ?? "";
+  const userId = opts.vaultUserId ?? opts.userId ?? "";
   // The SDK deliberately ships with an empty MCP resolver. Keep this wiring in
   // the provider adapter rather than every host bootstrap so a new Negotium
   // channel cannot accidentally run Maestro with zero runtime/wiki/task MCPs.

package/dist/runtime/src/agents/maestro-registry.ts

@@ -5,7 +5,6 @@ import { join, resolve } from "node:path";
 import type { AgentRegistry, AgentRegistryOperations } from "#agents/contracts";
 import { assertUuidLike, ensureCwdExists, extractChatPairs } from "#agents/rollout/shared";
 import { logger } from "#platform/logger";
-import { readConversation } from "#storage/conversations";
 import { MAESTRO_EFFORT_VALUES } from "#types";
 
 const ALIAS_MAP: Record<string, string> = {
@@ -80,7 +79,7 @@ function writeRollout(options: Parameters<AgentRegistryOperations["writeRollout"
         version: 1,
         cwd: options.cwd,
         createdAt: existingCreatedAt(path) ?? new Date().toISOString(),
-        sdkVersion: "0.1.54",
+        sdkVersion: "0.2.0",
       },
     },
     ...messages,
@@ -96,13 +95,33 @@ export const maestroRegistryOperations: AgentRegistryOperations = {
     return writeRollout(options);
   },
   async forkSession(options) {
-    const rollout = writeRollout({
+    // Fork the full raw history while preserving the compacted working view.
+    // A compacted parent that cannot copy its active projection is not a usable
+    // cache-preserving fork, so let the caller fall back to bounded synthesis.
+    const { deleteMaestroSession, forkSessionAt, loadRawMaestroSession } = await import(
+      "maestro-agent-sdk"
+    );
+    const parentMessages = loadRawMaestroSession(options.parentSessionId);
+    if (!parentMessages) {
+      throw new Error(`Maestro parent session not found: ${options.parentSessionId}`);
+    }
+    const parentHasActiveProjection = existsSync(maestroActiveSessionPath(options.parentSessionId));
+    const fork = forkSessionAt({
+      parentSessionId: options.parentSessionId,
+      messageIndex: parentMessages.length,
       cwd: options.cwd,
-      entries: readConversation(options.userId, options.topicName),
-      ...(options.model ? { model: options.model } : {}),
-      ...(options.effort ? { effort: options.effort } : {}),
+      userId: String(options.userId),
     });
-    return { forkId: rollout.sessionId, rolloutPath: rollout.rolloutPath };
+    if (parentHasActiveProjection && !fork.activeProjectionForked) {
+      deleteMaestroSession(fork.sessionId);
+      throw new Error(`Maestro active projection could not be forked: ${options.parentSessionId}`);
+    }
+    const activePath = maestroActiveSessionPath(fork.sessionId);
+    return {
+      forkId: fork.sessionId,
+      rolloutPath: fork.rolloutPath,
+      ...(existsSync(activePath) ? { cleanupPaths: [activePath] } : {}),
+    };
   },
   async cleanupRollouts(options) {
     // Keep the SDK off the daemon startup path, but use its canonical cleanup

package/dist/runtime/src/agents/memory-archive-policy.ts

@@ -12,6 +12,26 @@ export interface MemoryArchiveMessage {
  */
 export const MIN_MEMORY_ARCHIVE_EXCHANGES = 6;
 
+export interface MemoryArchiveTopicContext {
+  isSubagent?: boolean;
+  memoryTopicId?: string;
+}
+
+/**
+ * Explicit-memory subagents are usually short, focused turns. Persist one
+ * completed exchange back to their selected memory topic, while retaining the
+ * normal threshold for regular topics and incomplete/failed turns.
+ */
+export function meetsMemoryArchiveExchangeThreshold(
+  exchangeCount: number,
+  minExchanges: number,
+  topic: MemoryArchiveTopicContext,
+): boolean {
+  if (exchangeCount <= 0) return false;
+  if (topic.isSubagent && topic.memoryTopicId) return true;
+  return exchangeCount >= minExchanges;
+}
+
 /** Count completed conversational exchanges while ignoring system/tool/card noise. */
 export function countMemoryArchiveExchanges(rows: readonly MemoryArchiveMessage[]): number {
   let waitingForAssistant = false;

package/dist/runtime/src/agents/rollout/codex.ts

@@ -10,14 +10,15 @@
  * synthesized `response_item`/`event_msg` pairs per turn.
  *
  * Tool history is folded into assistant text as `[Tool: ...]` annotations
- * (see shared.ts:extractChatPairs) — the SDK has no fork API and synthetic
- * tool_use IDs across SDKs are too fragile to reconstruct structurally.
+ * (see shared.ts:extractChatPairs). Native same-agent forks use App Server's
+ * `thread/fork`; this encoder remains the fallback and cross-agent bridge,
+ * where synthetic tool_use IDs are too fragile to reconstruct structurally.
  */
 
 import { randomBytes } from "node:crypto";
 import { existsSync, readFileSync, realpathSync, statSync, unlinkSync } from "node:fs";
-import { homedir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
+import { hostedCodexHomePath } from "#agents/execution-host";
 import {
   assertUuidLike,
   type ChatPair,
@@ -40,7 +41,7 @@ interface CodexShell {
 }
 
 function codexSessionsDir(): string {
-  return join(process.env.CODEX_HOME || join(homedir(), ".codex"), "sessions");
+  return join(hostedCodexHomePath(), "sessions");
 }
 
 let _shellCache: CodexShell | null = null;
@@ -156,6 +157,19 @@ export interface CodexPatchPreview {
   changes: CodexPatchChangePreview[];
 }
 
+function codexRolloutPath(threadId: string, fallback: Date): string {
+  const threadCreatedAt = decodeUuidV7Timestamp(threadId);
+  const createdAt = threadCreatedAt === null ? fallback : new Date(threadCreatedAt);
+  const yyyy = String(createdAt.getFullYear());
+  const mm = String(createdAt.getMonth() + 1).padStart(2, "0");
+  const dd = String(createdAt.getDate()).padStart(2, "0");
+  const hh = String(createdAt.getHours()).padStart(2, "0");
+  const min = String(createdAt.getMinutes()).padStart(2, "0");
+  const ss = String(createdAt.getSeconds()).padStart(2, "0");
+  const dir = join(codexSessionsDir(), yyyy, mm, dd);
+  return join(dir, `rollout-${yyyy}-${mm}-${dd}T${hh}-${min}-${ss}-${threadId}.jsonl`);
+}
+
 function canonicalFilePath(path: string): string {
   const absolute = resolve(path);
   try {
@@ -420,7 +434,7 @@ export function migrateCodexRolloutNativeMultiAgentMetadata(threadId: string): b
   }
 }
 
-function latestCodexRolloutPath(threadId: string): string | undefined {
+export function latestCodexRolloutPath(threadId: string): string | undefined {
   const sessionsDir = codexSessionsDir();
   const candidates: string[] = [];
   const buckets = candidateDateBuckets(threadId);
@@ -563,22 +577,17 @@ export function writeCodexRollout(opts: CodexRolloutOptions): CodexRolloutResult
     payload: { type: "task_complete" },
   });
 
-  const yyyy = now.getUTCFullYear();
-  const mm = String(now.getUTCMonth() + 1).padStart(2, "0");
-  const dd = String(now.getUTCDate()).padStart(2, "0");
-  const tsStr = tsIso.replace(/[:.]/g, "-").slice(0, 19);
-  const dir = join(codexSessionsDir(), String(yyyy), mm, dd);
-  const path = join(dir, `rollout-${tsStr}-${threadId}.jsonl`);
+  // Codex indexes a thread by the local wall-clock timestamp encoded in its
+  // UUIDv7 creation time. A cross-agent round-trip may rewrite the rollout
+  // much later, but the path must remain the original canonical path or
+  // `thread/resume` rejects it as missing and the provider starts fresh.
+  const path = codexRolloutPath(threadId, now);
 
   // Round-trip cleanup: when the caller reused a threadId (claude→codex→...
   // or maestro→codex→... cycles via `findLastSessionIdForAgent`), the SDK's
-  // original rollout for that threadId still sits at its ORIGINAL-date
-  // directory (`~/.codex/sessions/<orig-yyyy>/<orig-mm>/<orig-dd>/...`).
-  // Writing today's synthetic rollout next to it leaves two jsonls sharing
-  // the same threadId — `codex resume <tid>` globs `~/.codex/sessions/**`
-  // and the SDK has no spec for which match it picks, so behavior becomes
-  // environment-/codex-version-dependent. Sweep every prior file for this
-  // threadId BEFORE writing the new one so resume always reads our synth.
+  // original rollout for that threadId still sits at its canonical path.
+  // Sweep every prior file for this threadId BEFORE replacing that path so
+  // legacy writers cannot leave ambiguous duplicates behind.
   //
   // Synchronous on purpose: writeCodexRollout's signature is sync (called
   // inside set_agent's DB transaction), and an async sweep would race with
@@ -671,11 +680,10 @@ function sweepPriorRolloutsFullTree(threadId: string, sessionsDir: string): void
 }
 
 /**
- * UUIDv7 ids encode their creation time in the first 48 bits. `writeCodexRollout`
- * buckets new files at `<yyyy>/<mm>/<dd>/` keyed off the WRITE time, so a
- * thread's rollouts can only live between (threadId's birth date) and
- * (today's date) — typically a 0-2 day span. We enumerate every day in that
- * inclusive range so a Mon-bridge / Tue-rebridge picks up both.
+ * UUIDv7 ids encode their creation time in the first 48 bits. Current writers
+ * always use that canonical birth-date bucket, but older writers used the
+ * rewrite date during cross-agent bridges. Enumerate the inclusive range from
+ * birth date to today so cleanup also removes those legacy misplaced files.
  *
  * Returns null when:
  *   - threadId isn't a parseable UUIDv7 (atypical fixture / future format)

package/dist/runtime/src/agents/self-config-core.ts

@@ -89,7 +89,7 @@ export type SelfConfigAgentSwitchResult =
   | {
       ok: true;
       outcome:
-        | { kind: "fresh"; agent: AgentKind; reason: "no-history" | "bridge-failed" }
+        | { kind: "fresh"; agent: AgentKind; reason: "no-history" }
         | {
             kind: "bridged";
             agent: AgentKind;
@@ -386,9 +386,7 @@ export function createSelfConfigCore(
     const sessionNote =
       switched.outcome.kind === "bridged"
         ? ` Conversation history was bridged into a ${agent} session (${switched.outcome.bridgedSessionId}).`
-        : switched.outcome.reason === "bridge-failed"
-          ? " Conversation history bridge failed; the next turn starts fresh."
-          : " No prior conversation history was found; the next turn starts fresh.";
+        : " No prior conversation history was found; the next turn starts fresh.";
     return ok(
       `Agent for this topic set to '${agent}'. Model/effort reset to '${agent}' defaults.${sessionNote}`,
     );

package/dist/runtime/src/agents/topic-agent-switch.ts

@@ -39,7 +39,7 @@ export type SwitchAgentOutcome =
   | {
       kind: "fresh";
       agent: AgentKind;
-      reason: "no-history" | "bridge-failed";
+      reason: "no-history";
     }
   | {
       kind: "bridged";
@@ -128,17 +128,11 @@ export function switchTopicAgent(
   } catch (err) {
     logger.warn(
       { err, userId, topicName, from: oldAgent, to: agent },
-      "switchTopicAgent: rollout encoding failed — falling back to fresh session",
+      "switchTopicAgent: rollout encoding failed — preserving current agent session",
     );
-    const changed = setTopicAgentAndClearSession({
-      userId,
-      topicName,
-      agent,
-    });
-    if (!changed) return { ok: false, error: `failed to set agent for "${topicName}"` };
     return {
-      ok: true,
-      outcome: { kind: "fresh", agent, reason: "bridge-failed" },
+      ok: false,
+      error: `failed to preserve conversation while switching agent for "${topicName}"`,
     };
   }
 

package/dist/runtime/src/application/submit-runtime-gateway-turn.ts

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { appendApiMessage, getApiMessage } from "#storage/api-messages";
 import { getTopicSessionId } from "#storage/api-topics";
 import { db } from "#storage/forum-db";
@@ -8,12 +8,20 @@ import {
   type RuntimeGatewaySubmission,
   recordRuntimeGatewaySubmission,
 } from "#storage/runtime-gateway-submissions";
-import { enqueueRuntimeUserTurnRequest } from "#storage/runtime-turn-requests";
+import { requestRuntimeTurnAbort } from "#storage/runtime-leases";
+import { getRuntimeTopicEpoch } from "#storage/runtime-topic-state";
+import { mergeRuntimeUserTurnRequest } from "#storage/runtime-turn-requests";
 import type { MessageDto, TopicDto } from "#types/api";
 
 export interface SubmitRuntimeGatewayTurnParams {
   topic: TopicDto;
+  /** Canonical execution principal, normally `local`. */
   userId: string;
+  /** Authenticated upstream author retained independently from execution. */
+  actorUserId?: string;
+  actorLabel?: string;
+  /** Topic owner's credential namespace. */
+  vaultUserId?: string;
   text: string;
   clientMessageId: string;
   requestId?: string;
@@ -25,9 +33,30 @@ export interface SubmitRuntimeGatewayTurnResult extends RuntimeGatewaySubmission
   deduplicated: boolean;
 }
 
-function duplicateResult(submission: RuntimeGatewaySubmission): SubmitRuntimeGatewayTurnResult {
+function duplicateResult(
+  submission: RuntimeGatewaySubmission,
+  params: SubmitRuntimeGatewayTurnParams,
+  requestId: string,
+  actorUserId: string,
+  payloadHash: string,
+): SubmitRuntimeGatewayTurnResult {
   const message = getApiMessage(submission.topicId, submission.messageId);
   if (!message) throw new Error("gateway submission references a missing canonical message");
+  if (submission.payloadHash && submission.payloadHash !== payloadHash) {
+    throw new RuntimeGatewayIdempotencyConflictError();
+  }
+  if (
+    (!submission.payloadHash &&
+      (message.authorName !== params.actorLabel ||
+        message.authorId !== actorUserId ||
+        message.text !== params.text)) ||
+    submission.clientMessageId !== params.clientMessageId ||
+    submission.requestId !== requestId ||
+    submission.topicId !== params.topic.id ||
+    submission.userId !== params.userId
+  ) {
+    throw new RuntimeGatewayIdempotencyConflictError();
+  }
   return {
     ...submission,
     message,
@@ -35,6 +64,28 @@ function duplicateResult(submission: RuntimeGatewaySubmission): SubmitRuntimeGat
   };
 }
 
+function gatewayPayloadHash(
+  params: SubmitRuntimeGatewayTurnParams,
+  requestId: string,
+  actorUserId: string,
+): string {
+  return createHash("sha256")
+    .update(
+      JSON.stringify([
+        params.topic.id,
+        params.userId,
+        actorUserId,
+        params.actorLabel ?? null,
+        params.vaultUserId ?? null,
+        params.text,
+        params.clientMessageId,
+        requestId,
+        params.allowAutoContinue ?? true,
+      ]),
+    )
+    .digest("hex");
+}
+
 /**
  * Durable ingress for an authenticated external gateway. It deliberately
  * reuses the canonical message table and existing durable turn worker rather
@@ -45,8 +96,7 @@ function duplicateResult(submission: RuntimeGatewaySubmission): SubmitRuntimeGat
  *
  * A distinct type rather than a plain `Error` because the control plane maps
  * this to 409, and it must not be confused with a *missing* `clientMessageId`,
- * which is a malformed request (400). Matching on message text conflated the
- * two.
+ * which is a malformed request (400).
  */
 export class RuntimeGatewayIdempotencyConflictError extends Error {
   constructor(message = "clientMessageId or requestId is already bound to another turn") {
@@ -59,24 +109,19 @@ export function submitRuntimeGatewayTurn(
   params: SubmitRuntimeGatewayTurnParams,
 ): SubmitRuntimeGatewayTurnResult {
   const requestId = params.requestId ?? params.clientMessageId;
+  const actorUserId = params.actorUserId ?? params.userId;
+  const payloadHash = gatewayPayloadHash(params, requestId, actorUserId);
   const existing = findRuntimeGatewaySubmission(params.clientMessageId, requestId);
   if (existing) {
-    if (
-      existing.clientMessageId !== params.clientMessageId ||
-      existing.requestId !== requestId ||
-      existing.topicId !== params.topic.id ||
-      existing.userId !== params.userId
-    ) {
-      throw new RuntimeGatewayIdempotencyConflictError();
-    }
-    return duplicateResult(existing);
+    return duplicateResult(existing, params, requestId, actorUserId, payloadHash);
   }
 
   const createdAt = new Date().toISOString();
   const message: MessageDto = {
     id: randomUUID(),
     topicId: params.topic.id,
-    authorId: params.userId,
+    authorId: actorUserId,
+    authorName: params.actorLabel,
     sourceAdapter: "runtime-gateway",
     sourceMessageId: params.clientMessageId,
     text: params.text,
@@ -91,23 +136,31 @@ export function submitRuntimeGatewayTurn(
     createdAt,
     ackCursor: 0,
     messageCursor: 0,
+    payloadHash,
   };
 
   try {
     db.transaction(() => {
       appendApiMessage(message, { notify: false });
-      enqueueRuntimeUserTurnRequest({
+      mergeRuntimeUserTurnRequest({
         topicId: params.topic.id,
         userId: params.userId,
-        prompt: params.text,
+        userMessages: [
+          {
+            prompt: params.text,
+            actorUserId,
+            ...(params.actorLabel ? { actorLabel: params.actorLabel } : {}),
+          },
+        ],
         allowAutoContinue: params.allowAutoContinue ?? true,
         requestId,
-        supersedeExisting: false,
+        topicEpoch: getRuntimeTopicEpoch(params.topic.id),
         execution: {
           sessionId: getTopicSessionId(params.topic.id),
           sessionIdSpecified: true,
           conversationPrompts: [params.text],
           loggedUserMessageCount: 0,
+          vaultUserId: params.vaultUserId,
         },
       });
       const acceptedEvent = appendRuntimeEvent("runtime-gateway-ingress", {
@@ -131,9 +184,14 @@ export function submitRuntimeGatewayTurn(
     })();
   } catch {
     const raced = findRuntimeGatewaySubmission(params.clientMessageId, requestId);
-    if (raced) return duplicateResult(raced);
+    if (raced) return duplicateResult(raced, params, requestId, actorUserId, payloadHash);
     throw new Error("failed to persist gateway turn idempotency record");
   }
 
+  // A new human message steers the active topic turn. The durable replacement
+  // is committed first; the provider observes this abort on its next lease
+  // heartbeat and the worker resumes the merged batch after unwind.
+  requestRuntimeTurnAbort(params.topic.id, "internal");
+
   return { ...submission, message, deduplicated: false };
 }

package/dist/runtime/src/application/switch-topic-model.ts

@@ -1,11 +1,10 @@
 import { switchApiTopicAgent } from "#agents/api-topic-agent-switch";
 import { checkAgentModelAuth } from "#agents/auth-check";
-import { resolveModelForAgent, selectableModel } from "#agents/model-catalog";
-import { getRegistry } from "#agents/registry";
+import { selectableModel } from "#agents/model-catalog";
 import { WsHub } from "#bus";
 import { resolveTopicWorkspaceDir } from "#platform/config";
 import { getApiTopicConfig, setApiTopicConfig } from "#storage/api-topic-config";
-import { clearTopicSessionId, getTopic } from "#storage/api-topics";
+import { getTopic } from "#storage/api-topics";
 
 export type SwitchTopicModelResult =
   | { ok: true; model: string; text: string }
@@ -63,14 +62,12 @@ export function switchTopicModel(params: SwitchTopicModelParams): SwitchTopicMod
     });
     if (!switched.ok) return { ok: false, error: switched.error };
   } else {
-    const registry = getRegistry(currentAgent);
-    const previousModel = resolveModelForAgent(
-      currentAgent,
-      currentConfig.model ?? topic.defaultModel,
-      registry,
-    );
     setApiTopicConfig(topic.id, nextConfig);
-    if (previousModel !== target.model) clearTopicSessionId(topic.id, "user-model-switch");
+    // A provider session is not owned by one model. Codex, Claude, and Maestro
+    // all accept the selected model when resuming, so keep the durable resume
+    // key and let the next turn continue the same rollout with the new model.
+    // Clearing it here silently discarded native tool/history structure and
+    // made an ordinary model change look like `/new`.
   }
 
   WsHub.get().broadcastTopicUpdated(topic.id);

package/dist/runtime/src/index.ts

@@ -176,6 +176,10 @@ export { FROM_AUTO_CONTINUE } from "#platform/constants";
 export { errMsg } from "#platform/error";
 export { appendJsonlEntry } from "#platform/jsonl";
 export { onShutdown, runShutdown } from "#platform/lifecycle";
+export {
+  DEFAULT_DAEMON_LOG_ROTATE_BYTES,
+  rotateOversizedLog,
+} from "#platform/log-rotation";
 export { logger } from "#platform/logger";
 export type {
   NodeMcpEntry,