From fe09a29d0ecf520deef13c41d57049c323b9d5de Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 04:38:41 -0700
Subject: [PATCH 1/7] fix(agent-activity): cache a context id only after its
 line is written (#1303)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../agentActivity/AgentActivityStore.test.ts  | 22 +++++++++++++++++++
 src/main/agentActivity/AgentActivityStore.ts  | 11 +++++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/src/main/agentActivity/AgentActivityStore.test.ts b/src/main/agentActivity/AgentActivityStore.test.ts
index a4c1eab99..1ce886102 100644
--- a/src/main/agentActivity/AgentActivityStore.test.ts
+++ b/src/main/agentActivity/AgentActivityStore.test.ts
@@ -124,3 +124,25 @@ describe('AgentActivityStore', () => {
     expect(keys.size).toBe(1)
   })
 })
+
+// #1303: the context id was cached BEFORE its context line was written. One
+// failed append (ENOSPC, EIO) then left every later interval for that agent
+// this month pointing at a context line that never reached disk, and
+// readIntervals dropped each one silently.
+describe('a failed context write', () => {
+  it('does not orphan the agent\'s later intervals', async () => {
+    const store = new AgentActivityStore(dir)
+    const internal = store as unknown as { appendLines: (file: string, lines: string[]) => Promise<void> }
+    const realAppend = internal.appendLines.bind(store)
+    let failNext = true
+    internal.appendLines = async (file, lines) => {
+      if (failNext) { failNext = false; throw Object.assign(new Error('no space left'), { code: 'ENOSPC' }) }
+      return realAppend(file, lines)
+    }
+    const start = Date.parse('2026-09-01T09:00:00Z')
+    await expect(store.appendInterval({ context, startedAt: start, endedAt: start + HOUR })).rejects.toThrow('no space left')
+    await store.appendInterval({ context, startedAt: start + 2 * HOUR, endedAt: start + 3 * HOUR })
+    const read = await new AgentActivityStore(dir).readIntervals(start, start + 4 * HOUR)
+    expect(read.map(interval => interval.startedAt)).toEqual([start + 2 * HOUR])
+  })
+})
diff --git a/src/main/agentActivity/AgentActivityStore.ts b/src/main/agentActivity/AgentActivityStore.ts
index 49d69572d..f73a41857 100644
--- a/src/main/agentActivity/AgentActivityStore.ts
+++ b/src/main/agentActivity/AgentActivityStore.ts
@@ -154,15 +154,24 @@ export class AgentActivityStore {
       const key = contextKey(interval.context)
       const lines: string[] = []
       let id = ids.get(key)
+      const isNewContext = id === undefined
       if (id === undefined) {
         id = ids.size + 1
-        ids.set(key, id)
         const contextLine: ContextLine = { t: 'c', c: id, ...interval.context }
         lines.push(JSON.stringify(contextLine))
       }
       const intervalLine: IntervalLine = { t: 'i', c: id, s: interval.startedAt, e: interval.endedAt }
       lines.push(JSON.stringify(intervalLine))
       await this.appendLines(join(this.dir, `${month}.jsonl`), lines)
+      // Cache the id only once its context line is on disk (#1303). Caching it
+      // first meant one failed append (ENOSPC, EIO) left every later interval
+      // for this agent this month pointing at a context line that never
+      // landed, and readIntervals drops an interval with no context. Not
+      // caching on failure means the next interval re-mints the same id
+      // (`ids.size + 1` is unchanged) and writes the context line again. If
+      // the failed append landed partially, a duplicate context line with the
+      // same id and content is harmless on read.
+      if (isNewContext) ids.set(key, id)
     })
   }
 

From 8755ce23f7f18dc52a0c2bf6b9dbe0adf702fdd5 Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 05:44:57 -0700
Subject: [PATCH 2/7] fix(agent-activity): never reissue a context id after a
 failed or partial write (#1414 review a+b)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../agentActivity/AgentActivityStore.test.ts  | 30 +++++++++++++++++++
 src/main/agentActivity/AgentActivityStore.ts  | 23 ++++++++++----
 2 files changed, 48 insertions(+), 5 deletions(-)

diff --git a/src/main/agentActivity/AgentActivityStore.test.ts b/src/main/agentActivity/AgentActivityStore.test.ts
index 1ce886102..2b629ba14 100644
--- a/src/main/agentActivity/AgentActivityStore.test.ts
+++ b/src/main/agentActivity/AgentActivityStore.test.ts
@@ -146,3 +146,33 @@ describe('a failed context write', () => {
     expect(read.map(interval => interval.startedAt)).toEqual([start + 2 * HOUR])
   })
 })
+
+// #1414 review a+b: a PARTIAL write (A's context line lands, then the append
+// fails before its interval line) left id 1 on disk for A. A was not cached, so
+// B's next context also took id 1; after a restart a later A interval reused
+// id 1 and read back as B's time.
+describe('a partially written context', () => {
+  it('never lets another agent reuse its id', async () => {
+    const store = new AgentActivityStore(dir)
+    const internal = store as unknown as { appendLines: (file: string, lines: string[]) => Promise<void> }
+    const realAppend = internal.appendLines.bind(store)
+    let partial = true
+    internal.appendLines = async (file, lines) => {
+      if (partial) {
+        partial = false
+        await appendFile(file, lines[0] + '\n')
+        throw Object.assign(new Error('no space left'), { code: 'ENOSPC' })
+      }
+      return realAppend(file, lines)
+    }
+    const start = Date.parse('2026-09-01T09:00:00Z')
+    const a = { ...context, agentKey: 'A', label: 'A' }
+    const b = { ...context, agentKey: 'B', label: 'B' }
+    await expect(store.appendInterval({ context: a, startedAt: start, endedAt: start + HOUR })).rejects.toThrow('no space left')
+    await store.appendInterval({ context: b, startedAt: start + HOUR, endedAt: start + 2 * HOUR })
+    const restarted = new AgentActivityStore(dir)
+    await restarted.appendInterval({ context: a, startedAt: start + 2 * HOUR, endedAt: start + 3 * HOUR })
+    const read = await new AgentActivityStore(dir).readIntervals(start, start + 4 * HOUR)
+    expect(read.map(interval => interval.context.agentKey)).toEqual(['B', 'A'])
+  })
+})
diff --git a/src/main/agentActivity/AgentActivityStore.ts b/src/main/agentActivity/AgentActivityStore.ts
index f73a41857..1584fea02 100644
--- a/src/main/agentActivity/AgentActivityStore.ts
+++ b/src/main/agentActivity/AgentActivityStore.ts
@@ -115,6 +115,15 @@ export class AgentActivityStore {
   private readonly cleanTails = new Set<string>()
   /** Context ids already written to each month file this process has touched. */
   private readonly monthContexts = new Map<string, Map<string, number>>()
+  /**
+   * The next context id to mint per month (#1414 review). Minting always
+   * advances it, even when the write then fails, so an id is never issued
+   * twice: a PARTIAL write can leave a context line on disk for an id whose
+   * mapping was never cached, and reusing that id for another agent made the
+   * later reads attribute one agent's time to the other. Loaded as the
+   * file's highest id + 1.
+   */
+  private readonly monthNextId = new Map<string, number>()
 
   constructor(private readonly dir: string) {}
 
@@ -132,9 +141,11 @@ export class AgentActivityStore {
     const known = this.monthContexts.get(month)
     if (known) return known
     const ids = new Map<string, number>()
+    let highest = 0
     try {
       for (const line of parseJsonLines(await readFile(join(this.dir, `${month}.jsonl`), 'utf8'))) {
         if (line.t !== 'c' || !isNumber(line.c)) continue
+        highest = Math.max(highest, line.c)
         const context = parseContext(line)
         if (context) ids.set(contextKey(context), line.c)
       }
@@ -142,6 +153,7 @@ export class AgentActivityStore {
       // No file yet for this month.
     }
     this.monthContexts.set(month, ids)
+    this.monthNextId.set(month, highest + 1)
     return ids
   }
 
@@ -156,7 +168,8 @@ export class AgentActivityStore {
       let id = ids.get(key)
       const isNewContext = id === undefined
       if (id === undefined) {
-        id = ids.size + 1
+        id = this.monthNextId.get(month) ?? ids.size + 1
+        this.monthNextId.set(month, id + 1)
         const contextLine: ContextLine = { t: 'c', c: id, ...interval.context }
         lines.push(JSON.stringify(contextLine))
       }
@@ -167,10 +180,10 @@ export class AgentActivityStore {
       // first meant one failed append (ENOSPC, EIO) left every later interval
       // for this agent this month pointing at a context line that never
       // landed, and readIntervals drops an interval with no context. Not
-      // caching on failure means the next interval re-mints the same id
-      // (`ids.size + 1` is unchanged) and writes the context line again. If
-      // the failed append landed partially, a duplicate context line with the
-      // same id and content is harmless on read.
+      // caching on failure means the next interval for this agent mints a
+      // NEW id (monthNextId already advanced) and writes its context line
+      // again. The failed id is burned: if its line landed partially, it
+      // still names this agent, and no other agent is ever given that id.
       if (isNewContext) ids.set(key, id)
     })
   }

From 4c64d3d1355b790c7a221e0bce3742de9f497287 Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 11:59:01 -0700
Subject: [PATCH 3/7] fix(agent-activity): an unreadable month file refuses the
 append instead of restarting ids (#1303, #1414 review a round 2)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../agentActivity/AgentActivityStore.test.ts  | 58 ++++++++++++++++++-
 src/main/agentActivity/AgentActivityStore.ts  | 11 +++-
 2 files changed, 66 insertions(+), 3 deletions(-)

diff --git a/src/main/agentActivity/AgentActivityStore.test.ts b/src/main/agentActivity/AgentActivityStore.test.ts
index 2b629ba14..8ad550480 100644
--- a/src/main/agentActivity/AgentActivityStore.test.ts
+++ b/src/main/agentActivity/AgentActivityStore.test.ts
@@ -1,4 +1,4 @@
-import { appendFile, mkdtemp, readFile, rm } from 'node:fs/promises'
+import { appendFile, chmod, mkdtemp, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
@@ -176,3 +176,59 @@ describe('a partially written context', () => {
     expect(read.map(interval => interval.context.agentKey)).toEqual(['B', 'A'])
   })
 })
+
+// #1414 review a round 2 (q115, "unknown is never empty"): an existing month
+// file that cannot be READ was treated as absent, so a restarted store started
+// ids at 1 and gave a second agent the id the first agent's lines already use.
+// Once readable again, the first agent's later hours read back as the second
+// agent's. Only ENOENT means "no file yet"; any other failure refuses the
+// append, and the bytes stay as they were.
+describe('an unreadable month file', () => {
+  it('refuses the append instead of restarting ids, and ids continue once it is readable', async () => {
+    const start = Date.parse('2026-09-01T09:00:00Z')
+    const a = { ...context, agentKey: 'A', label: 'A' }
+    const b = { ...context, agentKey: 'B', label: 'B' }
+    await new AgentActivityStore(dir).appendInterval({ context: a, startedAt: start, endedAt: start + HOUR })
+    const file = join(dir, '2026-09.jsonl')
+    const before = await readFile(file)
+    await chmod(file, 0o200)
+    try {
+      await expect(new AgentActivityStore(dir).appendInterval({ context: b, startedAt: start + HOUR, endedAt: start + 2 * HOUR })).rejects.toThrow()
+    } finally {
+      await chmod(file, 0o600)
+    }
+    expect(await readFile(file)).toEqual(before)
+    const restarted = new AgentActivityStore(dir)
+    await restarted.appendInterval({ context: b, startedAt: start + HOUR, endedAt: start + 2 * HOUR })
+    await restarted.appendInterval({ context: a, startedAt: start + 2 * HOUR, endedAt: start + 3 * HOUR })
+    const read = await new AgentActivityStore(dir).readIntervals(start, start + 4 * HOUR)
+    expect(read.map(interval => interval.context.agentKey)).toEqual(['A', 'B', 'A'])
+  })
+})
+
+// #1414 review b round 2 (test gap): a failed write that wrote NOTHING still
+// consumed its id, and a restart must continue from the highest id on disk,
+// not from the count of contexts (which would reissue a live id).
+describe('an id gap left by a failed write', () => {
+  it('is never filled by a later context after a restart', async () => {
+    const store = new AgentActivityStore(dir)
+    const internal = store as unknown as { appendLines: (file: string, lines: string[]) => Promise<void> }
+    const realAppend = internal.appendLines.bind(store)
+    let failNext = true
+    internal.appendLines = async (file, lines) => {
+      if (failNext) { failNext = false; throw Object.assign(new Error('no space left'), { code: 'ENOSPC' }) }
+      return realAppend(file, lines)
+    }
+    const start = Date.parse('2026-09-01T09:00:00Z')
+    const a = { ...context, agentKey: 'A', label: 'A' }
+    const b = { ...context, agentKey: 'B', label: 'B' }
+    const c = { ...context, agentKey: 'C', label: 'C' }
+    await expect(store.appendInterval({ context: a, startedAt: start, endedAt: start + HOUR })).rejects.toThrow('no space left')
+    await store.appendInterval({ context: b, startedAt: start + HOUR, endedAt: start + 2 * HOUR })
+    const restarted = new AgentActivityStore(dir)
+    await restarted.appendInterval({ context: c, startedAt: start + 2 * HOUR, endedAt: start + 3 * HOUR })
+    await restarted.appendInterval({ context: b, startedAt: start + 3 * HOUR, endedAt: start + 4 * HOUR })
+    const read = await new AgentActivityStore(dir).readIntervals(start, start + 5 * HOUR)
+    expect(read.map(interval => interval.context.agentKey)).toEqual(['B', 'C', 'B'])
+  })
+})
diff --git a/src/main/agentActivity/AgentActivityStore.ts b/src/main/agentActivity/AgentActivityStore.ts
index 1584fea02..9e4ffc722 100644
--- a/src/main/agentActivity/AgentActivityStore.ts
+++ b/src/main/agentActivity/AgentActivityStore.ts
@@ -149,8 +149,15 @@ export class AgentActivityStore {
         const context = parseContext(line)
         if (context) ids.set(contextKey(context), line.c)
       }
-    } catch {
-      // No file yet for this month.
+    } catch (error) {
+      // Only a missing file means "no contexts yet" (#1414 review a round 2,
+      // q115 "unknown is never empty"). A file that exists but cannot be read
+      // was treated as empty: ids restarted at 1, a second agent got the id
+      // the first agent's lines already use, and once readable the first
+      // agent's later hours read back as the second's. Refuse the append
+      // instead (the interval is lost, as for any failed write); nothing is
+      // cached, so the next append reads again.
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
     }
     this.monthContexts.set(month, ids)
     this.monthNextId.set(month, highest + 1)

From 995e993c1f779d82ddb003acbd97ca824953bee9 Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 12:03:11 -0700
Subject: [PATCH 4/7] fix(agent-activity): an unreadable open-interval snapshot
 is set aside and retried, never overwritten (#1414 review a round 3)

Recovery treated any failure as 'no open file' and overwrote open.json with
an empty snapshot, losing the pending interval. Only ENOENT is empty now;
anything else is moved to open.json.unrecovered-<time> (a rename needs no
read permission) and later starts recover each copy they can read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../agentActivity/AgentActivityStore.test.ts  | 27 ++++++-
 src/main/agentActivity/AgentActivityStore.ts  | 80 ++++++++++++++-----
 2 files changed, 86 insertions(+), 21 deletions(-)

diff --git a/src/main/agentActivity/AgentActivityStore.test.ts b/src/main/agentActivity/AgentActivityStore.test.ts
index 8ad550480..d696b8032 100644
--- a/src/main/agentActivity/AgentActivityStore.test.ts
+++ b/src/main/agentActivity/AgentActivityStore.test.ts
@@ -1,4 +1,4 @@
-import { appendFile, chmod, mkdtemp, readFile, rm } from 'node:fs/promises'
+import { appendFile, chmod, mkdtemp, readFile, readdir, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
@@ -232,3 +232,28 @@ describe('an id gap left by a failed write', () => {
     expect(read.map(interval => interval.context.agentKey)).toEqual(['B', 'C', 'B'])
   })
 })
+
+// #1414 review a round 3 (q115): recovery treated an UNREADABLE open.json as
+// "no open file" and overwrote it with an empty snapshot, so the pending
+// interval was lost for good. Now an unreadable (or corrupt) snapshot is moved
+// aside, bytes intact, and a later start recovers it once it can be read.
+describe('an unreadable open-interval snapshot', () => {
+  it('is set aside instead of overwritten, and recovered once readable', async () => {
+    const start = Date.parse('2026-09-01T09:00:00Z')
+    const lastTouch = start + 2 * HOUR
+    await new AgentActivityStore(dir).writeOpen([{ sessionId: 'session-1', context, startedAt: start }], lastTouch)
+    const file = join(dir, 'open.json')
+    const before = await readFile(file)
+    await chmod(file, 0o200)
+    expect(await new AgentActivityStore(dir).recoverOpenIntervals(start + 10 * HOUR)).toBe(0)
+    const aside = (await readdir(dir)).filter(name => name.startsWith('open.json.unrecovered-'))
+    expect(aside).toHaveLength(1)
+    await chmod(join(dir, aside[0]!), 0o600)
+    expect(await readFile(join(dir, aside[0]!))).toEqual(before)
+    // Readable again: the next start recovers it and removes the set-aside copy.
+    expect(await new AgentActivityStore(dir).recoverOpenIntervals(start + 11 * HOUR)).toBe(1)
+    expect((await readdir(dir)).filter(name => name.startsWith('open.json.unrecovered-'))).toEqual([])
+    const read = await new AgentActivityStore(dir).readIntervals(start, start + 12 * HOUR)
+    expect(read.map(interval => [interval.startedAt, interval.endedAt])).toEqual([[start, lastTouch]])
+  })
+})
diff --git a/src/main/agentActivity/AgentActivityStore.ts b/src/main/agentActivity/AgentActivityStore.ts
index 9e4ffc722..5e51c0055 100644
--- a/src/main/agentActivity/AgentActivityStore.ts
+++ b/src/main/agentActivity/AgentActivityStore.ts
@@ -1,4 +1,4 @@
-import { appendFile, mkdir, open, readFile, readdir, rename, writeFile } from 'node:fs/promises'
+import { appendFile, mkdir, open, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 
 import type { SystemSuspension } from '@shared/types/systemSuspension.js'
@@ -339,32 +339,72 @@ export class AgentActivityStore {
 
   /** Close every interval a previous run left open at that run's last touch.
    *  An unclean shutdown therefore contributes at most one touch period of time
-   *  that was not observed, never the hours until the next launch. */
+   *  that was not observed, never the hours until the next launch.
+   *
+   *  "Unknown is never empty" (#1414 review a round 3, q115): recovery used to
+   *  treat ANY failure (unreadable, corrupt, a failed append midway) as "no
+   *  open file" and then overwrite open.json with an empty snapshot, losing the
+   *  pending interval for good. Now only a missing file (ENOENT) is empty.
+   *  Anything else is moved aside to `open.json.unrecovered-<time>` (a rename
+   *  needs no read permission), so its bytes survive the fresh snapshot this
+   *  run must write, and every later start retries each set-aside copy it can
+   *  read, removing it once recovered. If even the move fails, nothing is
+   *  overwritten and the error propagates. */
   async recoverOpenIntervals(now: number): Promise<number> {
-    let recovered = 0
+    let recovered = await this.recoverSetAside()
+    const path = join(this.dir, 'open.json')
     try {
-      const json: unknown = JSON.parse(await readFile(join(this.dir, 'open.json'), 'utf8'))
-      const record = json && typeof json === 'object' ? (json as Record<string, unknown>) : {}
-      const aliveAt = isNumber(record.aliveAt) ? record.aliveAt : null
-      for (const raw of Array.isArray(record.open) ? record.open : []) {
-        if (!raw || typeof raw !== 'object') continue
-        const entry = raw as Record<string, unknown>
-        const context = entry.context && typeof entry.context === 'object'
-          ? parseContext(entry.context as Record<string, unknown>)
-          : null
-        if (!context || !isNumber(entry.startedAt) || aliveAt === null) continue
-        if (aliveAt > entry.startedAt) {
-          await this.appendInterval({ context, startedAt: entry.startedAt, endedAt: aliveAt })
-          recovered += 1
-        }
-      }
-    } catch {
-      // No open file: a clean first run.
+      recovered += await this.recoverSnapshot(path)
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') await rename(path, `${path}.unrecovered-${now}`)
     }
     await this.writeOpen([], now)
     return recovered
   }
 
+  /** Recover set-aside snapshots that can be read now; keep the rest. */
+  private async recoverSetAside(): Promise<number> {
+    let names: string[]
+    try {
+      names = (await readdir(this.dir)).filter(name => name.startsWith('open.json.unrecovered-')).sort()
+    } catch {
+      // No directory yet, or unlistable: nothing is removed, so nothing is lost.
+      return 0
+    }
+    let recovered = 0
+    for (const name of names) {
+      try {
+        recovered += await this.recoverSnapshot(join(this.dir, name))
+      } catch {
+        continue
+      }
+      await rm(join(this.dir, name), { force: true })
+    }
+    return recovered
+  }
+
+  /** Append the intervals a snapshot left open. Throws on ANY read, parse or
+   *  append failure, so the caller never treats the snapshot as recovered. */
+  private async recoverSnapshot(path: string): Promise<number> {
+    const json: unknown = JSON.parse(await readFile(path, 'utf8'))
+    const record = json && typeof json === 'object' ? (json as Record<string, unknown>) : {}
+    const aliveAt = isNumber(record.aliveAt) ? record.aliveAt : null
+    let recovered = 0
+    for (const raw of Array.isArray(record.open) ? record.open : []) {
+      if (!raw || typeof raw !== 'object') continue
+      const entry = raw as Record<string, unknown>
+      const context = entry.context && typeof entry.context === 'object'
+        ? parseContext(entry.context as Record<string, unknown>)
+        : null
+      if (!context || !isNumber(entry.startedAt) || aliveAt === null) continue
+      if (aliveAt > entry.startedAt) {
+        await this.appendInterval({ context, startedAt: entry.startedAt, endedAt: aliveAt })
+        recovered += 1
+      }
+    }
+    return recovered
+  }
+
   private async monthFiles(): Promise<string[]> {
     try {
       return (await readdir(this.dir)).filter(name => MONTH_FILE.test(name)).sort()

From 7ccbdd65969d7ed3eda62b7d5a28f77cd135dd73 Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 12:15:17 -0700
Subject: [PATCH 5/7] fix(agent-activity): a partial recovery sets aside only
 what was not recovered; no reissue-by-size fallback (#1414 review c)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../agentActivity/AgentActivityStore.test.ts  | 46 +++++++++++++-
 src/main/agentActivity/AgentActivityStore.ts  | 63 ++++++++++++++++---
 2 files changed, 99 insertions(+), 10 deletions(-)

diff --git a/src/main/agentActivity/AgentActivityStore.test.ts b/src/main/agentActivity/AgentActivityStore.test.ts
index d696b8032..198c809a2 100644
--- a/src/main/agentActivity/AgentActivityStore.test.ts
+++ b/src/main/agentActivity/AgentActivityStore.test.ts
@@ -1,4 +1,4 @@
-import { appendFile, chmod, mkdtemp, readFile, readdir, rm } from 'node:fs/promises'
+import { appendFile, chmod, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
@@ -257,3 +257,47 @@ describe('an unreadable open-interval snapshot', () => {
     expect(read.map(interval => [interval.startedAt, interval.endedAt])).toEqual([[start, lastTouch]])
   })
 })
+
+// #1414 review c: a recovery that fails PARTWAY (the second entry's append
+// fails) set the whole snapshot aside, so the next start re-appended the
+// entry already recovered. Only the entries not yet recovered are set aside.
+describe('a recovery that fails partway', () => {
+  it('sets aside only what was not recovered, so nothing is counted twice', async () => {
+    const start = Date.parse('2026-09-01T09:00:00Z')
+    const lastTouch = start + 2 * HOUR
+    const a = { ...context, agentKey: 'A', label: 'A' }
+    const b = { ...context, agentKey: 'B', label: 'B' }
+    await new AgentActivityStore(dir).writeOpen([
+      { sessionId: 'session-a', context: a, startedAt: start },
+      { sessionId: 'session-b', context: b, startedAt: start + HOUR },
+    ], lastTouch)
+    const store = new AgentActivityStore(dir)
+    const internal = store as unknown as { appendLines: (file: string, lines: string[]) => Promise<void> }
+    const realAppend = internal.appendLines.bind(store)
+    let calls = 0
+    internal.appendLines = async (file, lines) => {
+      calls += 1
+      if (calls === 2) throw Object.assign(new Error('no space left'), { code: 'ENOSPC' })
+      return realAppend(file, lines)
+    }
+    expect(await store.recoverOpenIntervals(start + 10 * HOUR)).toBe(1)
+    expect(await new AgentActivityStore(dir).recoverOpenIntervals(start + 11 * HOUR)).toBe(1)
+    const read = await new AgentActivityStore(dir).readIntervals(start, start + 12 * HOUR)
+    expect(read.map(interval => interval.context.agentKey).sort()).toEqual(['A', 'B'])
+  })
+
+  // #1414 review c (test gap): a set-aside copy that still cannot be read is
+  // KEPT for a later start, never deleted.
+  it('keeps a set-aside copy that still cannot be read', async () => {
+    const aside = join(dir, 'open.json.unrecovered-1000')
+    await mkdir(dir, { recursive: true })
+    await writeFile(aside, '{"aliveAt":1,"open":[]}')
+    await chmod(aside, 0o200)
+    try {
+      await new AgentActivityStore(dir).recoverOpenIntervals(Date.parse('2026-09-01T12:00:00Z'))
+      expect((await readdir(dir)).filter(name => name.startsWith('open.json.unrecovered-'))).toEqual(['open.json.unrecovered-1000'])
+    } finally {
+      await chmod(aside, 0o600)
+    }
+  })
+})
diff --git a/src/main/agentActivity/AgentActivityStore.ts b/src/main/agentActivity/AgentActivityStore.ts
index 5e51c0055..a0b453e7d 100644
--- a/src/main/agentActivity/AgentActivityStore.ts
+++ b/src/main/agentActivity/AgentActivityStore.ts
@@ -107,6 +107,16 @@ function parseJsonLines(text: string): Record<string, unknown>[] {
   return out
 }
 
+type SetAsideSnapshot = { aliveAt: number | null; open: unknown[] }
+
+/** An open-interval snapshot recovered only partway: `remaining` starts at
+ *  the entry whose append failed (#1414 review c). */
+class PartialRecovery extends Error {
+  constructor(readonly recovered: number, readonly remaining: SetAsideSnapshot) {
+    super('open-interval recovery stopped partway')
+  }
+}
+
 export class AgentActivityStore {
   private tail: Promise<void> = Promise.resolve()
   /** aliases.jsonl in memory, loaded on first use. */
@@ -175,7 +185,10 @@ export class AgentActivityStore {
       let id = ids.get(key)
       const isNewContext = id === undefined
       if (id === undefined) {
-        id = this.monthNextId.get(month) ?? ids.size + 1
+        // contextsFor always sets the month's next id. No `ids.size + 1`
+        // fallback: counting contexts reissues an id after any gap (#1414
+        // review c; the gap test pins it).
+        id = this.monthNextId.get(month)!
         this.monthNextId.set(month, id + 1)
         const contextLine: ContextLine = { t: 'c', c: id, ...interval.context }
         lines.push(JSON.stringify(contextLine))
@@ -356,7 +369,19 @@ export class AgentActivityStore {
     try {
       recovered += await this.recoverSnapshot(path)
     } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') await rename(path, `${path}.unrecovered-${now}`)
+      if (error instanceof PartialRecovery) {
+        // Only what was NOT recovered goes aside (#1414 review c): setting the
+        // whole snapshot aside made the next start re-append the entries
+        // already written, counting that time twice.
+        recovered += error.recovered
+        try {
+          await this.writeSetAside(`${path}.unrecovered-${now}`, error.remaining)
+        } catch {
+          await rename(path, `${path}.unrecovered-${now}`)
+        }
+      } else if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+        await rename(path, `${path}.unrecovered-${now}`)
+      }
     }
     await this.writeOpen([], now)
     return recovered
@@ -373,24 +398,40 @@ export class AgentActivityStore {
     }
     let recovered = 0
     for (const name of names) {
+      const path = join(this.dir, name)
       try {
-        recovered += await this.recoverSnapshot(join(this.dir, name))
-      } catch {
+        recovered += await this.recoverSnapshot(path)
+      } catch (error) {
+        // Partly recovered: keep only the remainder, so a later start never
+        // re-appends what this one wrote. Unreadable: keep it as it is.
+        if (error instanceof PartialRecovery) {
+          recovered += error.recovered
+          await this.writeSetAside(path, error.remaining).catch(() => {})
+        }
         continue
       }
-      await rm(join(this.dir, name), { force: true })
+      await rm(path, { force: true })
     }
     return recovered
   }
 
-  /** Append the intervals a snapshot left open. Throws on ANY read, parse or
-   *  append failure, so the caller never treats the snapshot as recovered. */
+  private async writeSetAside(path: string, remaining: SetAsideSnapshot): Promise<void> {
+    const temp = `${path}.${process.pid}.tmp`
+    await writeFile(temp, JSON.stringify(remaining))
+    await rename(temp, path)
+  }
+
+  /** Append the intervals a snapshot left open. Throws on a read or parse
+   *  failure, and PartialRecovery (with what is left) when an append fails
+   *  partway, so the caller never treats the snapshot as recovered. */
   private async recoverSnapshot(path: string): Promise<number> {
     const json: unknown = JSON.parse(await readFile(path, 'utf8'))
     const record = json && typeof json === 'object' ? (json as Record<string, unknown>) : {}
     const aliveAt = isNumber(record.aliveAt) ? record.aliveAt : null
+    const entries = Array.isArray(record.open) ? record.open : []
     let recovered = 0
-    for (const raw of Array.isArray(record.open) ? record.open : []) {
+    for (let index = 0; index < entries.length; index += 1) {
+      const raw: unknown = entries[index]
       if (!raw || typeof raw !== 'object') continue
       const entry = raw as Record<string, unknown>
       const context = entry.context && typeof entry.context === 'object'
@@ -398,7 +439,11 @@ export class AgentActivityStore {
         : null
       if (!context || !isNumber(entry.startedAt) || aliveAt === null) continue
       if (aliveAt > entry.startedAt) {
-        await this.appendInterval({ context, startedAt: entry.startedAt, endedAt: aliveAt })
+        try {
+          await this.appendInterval({ context, startedAt: entry.startedAt, endedAt: aliveAt })
+        } catch {
+          throw new PartialRecovery(recovered, { aliveAt, open: entries.slice(index) })
+        }
         recovered += 1
       }
     }

From 12960b68db34ce8a8b664e3dd19a38998a112b20 Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 12:57:39 -0700
Subject: [PATCH 6/7] fix(agent-activity): an unreadable aliases file refuses
 the append and is not cached as empty (#1414, B6 check)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../agentActivity/AgentActivityStore.test.ts  | 24 +++++++++++++++++++
 src/main/agentActivity/AgentActivityStore.ts  | 16 +++++++++----
 2 files changed, 36 insertions(+), 4 deletions(-)

diff --git a/src/main/agentActivity/AgentActivityStore.test.ts b/src/main/agentActivity/AgentActivityStore.test.ts
index 198c809a2..565180c92 100644
--- a/src/main/agentActivity/AgentActivityStore.test.ts
+++ b/src/main/agentActivity/AgentActivityStore.test.ts
@@ -301,3 +301,27 @@ describe('a recovery that fails partway', () => {
     }
   })
 })
+
+// B6 check (q115): an aliases file that exists but cannot be READ was treated
+// as absent twice over. The tail repair skipped its newline check, so a new
+// edge was glued onto a torn last line and lost; and the aliases were cached
+// as empty. Only ENOENT is "no file": otherwise the append is refused, the
+// bytes are untouched, and nothing is cached, so a later call reads again.
+describe('an unreadable aliases file', () => {
+  it('refuses the append instead of gluing onto an unseen tail, and works once readable', async () => {
+    const file = join(dir, 'aliases.jsonl')
+    await mkdir(dir, { recursive: true })
+    await writeFile(file, '{"f":"A","t":"B"}')
+    const before = await readFile(file)
+    await chmod(file, 0o200)
+    try {
+      await expect(new AgentActivityStore(dir).appendAliases([['B', 'C']])).rejects.toThrow()
+    } finally {
+      await chmod(file, 0o600)
+    }
+    expect(await readFile(file)).toEqual(before)
+    await new AgentActivityStore(dir).appendAliases([['B', 'C']])
+    const lines = (await readFile(file, 'utf8')).trim().split('\n').map(line => JSON.parse(line) as { f: string; t: string })
+    expect(lines).toEqual([{ f: 'A', t: 'B' }, { f: 'B', t: 'C' }])
+  })
+})
diff --git a/src/main/agentActivity/AgentActivityStore.ts b/src/main/agentActivity/AgentActivityStore.ts
index a0b453e7d..0333a737d 100644
--- a/src/main/agentActivity/AgentActivityStore.ts
+++ b/src/main/agentActivity/AgentActivityStore.ts
@@ -217,8 +217,12 @@ export class AgentActivityStore {
           aliases.set(line.f, line.t)
         }
       }
-    } catch {
-      // No aliases yet.
+    } catch (error) {
+      // Only a missing file means "no aliases yet" (B6 check, q115). An
+      // unreadable one was cached as empty, so every read grouped agents
+      // wrongly until restart. Throw instead; nothing is cached, so a later
+      // call reads again.
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
     }
     this.aliases = aliases
     return aliases
@@ -281,8 +285,12 @@ export class AgentActivityStore {
         } finally {
           await handle.close()
         }
-      } catch {
-        // No file yet: nothing to repair.
+      } catch (error) {
+        // Only a missing file has no tail to repair (B6 check, q115). A file
+        // that cannot be read (write-only, EIO) has an unseen tail: appending
+        // blindly glued the new line onto a torn last line and lost it.
+        // Refuse the append instead.
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
       }
     }
     await appendFile(path, text)

From 4241aa251ee8d445065ecd029110ed41d5f6776a Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 13:55:08 -0700
Subject: [PATCH 7/7] test(activity): pin loadAliases' ENOENT-only catch on the
 read path

The same store reads while aliases.jsonl is unreadable, then must group A
and B once readable. Red with a catch-all; the append test could not pin
it because the tail check refuses that append on its own (B6 check 2110).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../agentActivity/AgentActivityStore.test.ts  | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/main/agentActivity/AgentActivityStore.test.ts b/src/main/agentActivity/AgentActivityStore.test.ts
index 565180c92..d12ea96c9 100644
--- a/src/main/agentActivity/AgentActivityStore.test.ts
+++ b/src/main/agentActivity/AgentActivityStore.test.ts
@@ -324,4 +324,24 @@ describe('an unreadable aliases file', () => {
     const lines = (await readFile(file, 'utf8')).trim().split('\n').map(line => JSON.parse(line) as { f: string; t: string })
     expect(lines).toEqual([{ f: 'A', t: 'B' }, { f: 'B', t: 'C' }])
   })
+
+  // The READ path has one guard: `loadAliases`' ENOENT-only catch (B6 check,
+  // 2110). The append test above cannot pin it, because the tail repair
+  // refuses that append on its own. Here the SAME store instance reads while
+  // the file is unreadable: with a catch-all, the empty map would be cached
+  // and A and B would stay split for the life of the store.
+  it('does not cache an unreadable file as empty: the same store groups once it is readable', async () => {
+    const file = join(dir, 'aliases.jsonl')
+    await mkdir(dir, { recursive: true })
+    await writeFile(file, '{"f":"A","t":"B"}\n')
+    const store = new AgentActivityStore(dir)
+    await chmod(file, 0o200)
+    try {
+      await expect(store.agentKeyGrouping()).rejects.toThrow()
+    } finally {
+      await chmod(file, 0o600)
+    }
+    const group = await store.agentKeyGrouping()
+    expect(group('A')).toBe(group('B'))
+  })
 })