Bound every action-log read path - #298

Drop the pending-set carryover: a settled store now parks just its last
change time by workspace key, and the next linked store opens exactly as
a cold one — subscribe, then page pending — passing the watermark as
startAfter. The gap still replays as upserts through the subscription
(which is what useActionHistory and ChatInterface rely on), the fresh
pages re-snapshot the pending set, and the page loop stays the single
settled signal. Buys back the seeding/skip-page dual path for the cost
of re-paging a set PR #298 already made cheap.

Drop the pending-set carryover: a settled store now parks just its last
change time by workspace key, and the next linked store opens exactly as
a cold one — subscribe, then page pending — passing the watermark as
startAfter. The gap still replays as upserts through the subscription
(which is what useActionHistory and ChatInterface rely on), the fresh
pages re-snapshot the pending set, and the page loop stays the single
settled signal. Buys back the seeding/skip-page dual path for the cost
of re-paging a set PR #298 already made cheap.

Drop the pending-set carryover: a settled store now parks just its last
change time by workspace key, and the next linked store opens exactly as
a cold one — subscribe, then page pending — passing the watermark as
startAfter. The gap still replays as upserts through the subscription
(which is what useActionHistory and ChatInterface rely on), the fresh
pages re-snapshot the pending set, and the page loop stays the single
settled signal. Buys back the seeding/skip-page dual path for the cost
of re-paging a set PR #298 already made cheap.

* feat(frontend): resume action subscriptions with startAfter on reconnect

A settled shared action store now parks its pending set and change-time
watermark (max appliedAt ?? createdAt received) by workspace key when it
closes. The next store linked to the same key seeds from that carryover
and subscribes with startAfter, so the server replays only the gap as
upserts instead of the store re-paging the whole pending set — the
subscribe call resolving is the settled signal. Unsettled or errored
sessions never seed a resume, and unlinked stubs keep cold-open behavior.

useWorkspaceOpen links every minted Overseer stub to its workspace id.
useActionHistory keeps its loaded window and cursor across a resumed
swap (dropping in-flight old-stub pages), and ChatInterface's gap-refetch
effect is now only the cold-open safety net, resolving its startAfter TODO.

* refactor(frontend): carry only a resume watermark across reconnects

Drop the pending-set carryover: a settled store now parks just its last
change time by workspace key, and the next linked store opens exactly as
a cold one — subscribe, then page pending — passing the watermark as
startAfter. The gap still replays as upserts through the subscription
(which is what useActionHistory and ChatInterface rely on), the fresh
pages re-snapshot the pending set, and the page loop stays the single
settled signal. Buys back the seeding/skip-page dual path for the cost
of re-paging a set PR #298 already made cheap.

* fix(frontend): recover from failed action log resume

* fix(frontend): harden the resume watermark and repair channel

Review fixes for the reconnect-resume stack:

A store now parks its watermark only after a cleanly settled session:
pages drained AND the subscribe call resolved (the server delivers the
gap replay before resolving, so 'ready' alone can predate undelivered
replay records) AND no entry listener threw on a delivery. ChatInterface
carries cards a refetch run failed to repair (error, or cancelled
mid-loop) to the next reconnect and retries them even when the resume
replay covers everything else — restoring the repair channel the resume
skip removed.

Also: actionChangeTime() in workshop-shared now owns the
appliedAt ?? createdAt formula shared by the server's byLastChanged
index key, the client watermark, and Activity's display; a status-only
useActionStatus() spares ChatInterface/useActionHistory a re-render per
pending-set change; useActionHistory dedupes its session resets; the
ChatInterface action test uses the shared harness root (fixing a leaked
rAF queue) — plus regression tests for the three behavior changes.

* refactor(frontend): drop the resume failure fallbacks

The consumer-side recovery shell (useActionStatus, resumeFallbackRequired,
unrepairedCardsRef, entryListenerFailed) defended a resumed subscription
failing while the stub stays healthy — reachable only through a server-side
bug, since transport failures swap the stub. The store's invariant already
guarantees eventual healing without it: a failed session never parks a
watermark, so the next stub swap replays its entire gap from the last good
one. Until then the store shows status 'error', so nothing degrades silently.

entryListenerFailed additionally protected nothing real: the refetch path
applies updates through the same applyActionLogUpdateToCachedMessages the
listener uses, so a record that throws in one path throws in both.

Kept the subscription-resolved watermark gate — a page-only watermark is
poison (a pending record's createdAt can exceed a missed resolution's
appliedAt, hiding it from every future replay) — and documented on
actionLogResumed why consumers may trust it without a failure path.

* feat(typed-storage): support ranged reads and index rebuilds

* feat(shared+backend): add indexed paginated action history

* fix(backend): bound action replay and auto-approval scans

* feat(frontend): page action history and reconcile live actions

* fix(backend): index the resume replay by last change time

Review round 3: replace the id-ordered resume sweep (still O(log) per
resubscribe) with a byLastChanged unique index -- last state-change time,
id-disambiguated for the frozen clock -- so startAfter replays only the
records changed during the gap, inclusively (an exclusive bound loses
same-instant siblings). Merge the two index migrations into one v2 -> 3
step covering all three action indexes, drop durationMs from its log
(always zero in sync code), drop byHistoryFilter's redundant "all" bucket
(the collection itself already serves it in id order), and trim comments
per review.

* feat(frontend): resume action subscriptions with startAfter on reconnect

A settled shared action store now parks its pending set and change-time
watermark (max appliedAt ?? createdAt received) by workspace key when it
closes. The next store linked to the same key seeds from that carryover
and subscribes with startAfter, so the server replays only the gap as
upserts instead of the store re-paging the whole pending set — the
subscribe call resolving is the settled signal. Unsettled or errored
sessions never seed a resume, and unlinked stubs keep cold-open behavior.

useWorkspaceOpen links every minted Overseer stub to its workspace id.
useActionHistory keeps its loaded window and cursor across a resumed
swap (dropping in-flight old-stub pages), and ChatInterface's gap-refetch
effect is now only the cold-open safety net, resolving its startAfter TODO.

* refactor(frontend): carry only a resume watermark across reconnects

Drop the pending-set carryover: a settled store now parks just its last
change time by workspace key, and the next linked store opens exactly as
a cold one — subscribe, then page pending — passing the watermark as
startAfter. The gap still replays as upserts through the subscription
(which is what useActionHistory and ChatInterface rely on), the fresh
pages re-snapshot the pending set, and the page loop stays the single
settled signal. Buys back the seeding/skip-page dual path for the cost
of re-paging a set PR cloudflare#298 already made cheap.

* fix(frontend): recover from failed action log resume

* fix(frontend): harden the resume watermark and repair channel

Review fixes for the reconnect-resume stack:

A store now parks its watermark only after a cleanly settled session:
pages drained AND the subscribe call resolved (the server delivers the
gap replay before resolving, so 'ready' alone can predate undelivered
replay records) AND no entry listener threw on a delivery. ChatInterface
carries cards a refetch run failed to repair (error, or cancelled
mid-loop) to the next reconnect and retries them even when the resume
replay covers everything else — restoring the repair channel the resume
skip removed.

Also: actionChangeTime() in workshop-shared now owns the
appliedAt ?? createdAt formula shared by the server's byLastChanged
index key, the client watermark, and Activity's display; a status-only
useActionStatus() spares ChatInterface/useActionHistory a re-render per
pending-set change; useActionHistory dedupes its session resets; the
ChatInterface action test uses the shared harness root (fixing a leaked
rAF queue) — plus regression tests for the three behavior changes.

* refactor(frontend): drop the resume failure fallbacks

The consumer-side recovery shell (useActionStatus, resumeFallbackRequired,
unrepairedCardsRef, entryListenerFailed) defended a resumed subscription
failing while the stub stays healthy — reachable only through a server-side
bug, since transport failures swap the stub. The store's invariant already
guarantees eventual healing without it: a failed session never parks a
watermark, so the next stub swap replays its entire gap from the last good
one. Until then the store shows status 'error', so nothing degrades silently.

entryListenerFailed additionally protected nothing real: the refetch path
applies updates through the same applyActionLogUpdateToCachedMessages the
listener uses, so a record that throws in one path throws in both.

Kept the subscription-resolved watermark gate — a page-only watermark is
poison (a pending record's createdAt can exceed a missed resolution's
appliedAt, hiding it from every future replay) — and documented on
actionLogResumed why consumers may trust it without a failure path.