fix(server): preserve automatic settlement timestamps

[eimexdev]

Problem

Server-side auto-settlement records the sweep time as settledAt. On startup, old threads therefore look newly settled and receive incorrect dates and ordering. #9081 suppresses the resulting notifications, but does not correct the durable timestamp.

Fix

• Carry the latest user/turn activity timestamp through the internal auto-settle command.
• Keep updatedAt at command time, preserving normal update semantics.
• Repair projection_threads.settled_at for identifiable automatic settlements, without changing manual or later re-settled timestamps. The event log is left as recorded: projections and the engine bootstrap from projection rows and cursors, so a projection-only repair is sufficient.
• Web and mobile sort and label the Settled shelf by the same shared resolveSettledThreadTimestamp.
• Document the settled-shelf ordering behavior.

Refs #9057
Pairs with #9081

Verification

• Focused server, client-runtime, web, and mobile tests for the touched files
• Server, contracts, client-runtime, web, and mobile typechecks
• Targeted lint and formatting check

Made with GPT-5.6 Sol in T3 Code through the Codex harness. Follow-up commit by Claude Fable 5 in Claude Code.

---

Note

Medium Risk
Schema-breaking thread.auto-settle now requires settledAt, and migration 046 rewrites settled timestamps on projection rows for identifiable automatic settlements—deployments should run migrations before relying on sidebar ordering.

Overview
Automatic thread settlement now persists when work ended, not when the server sweep ran. resolveAutoSettlementAt returns the activity timestamp (or null); ThreadSettlementReactor passes it as required settledAt on thread.auto-settle, and the decider writes that to settledAt while updatedAt stays the command time.

Migration 046 repairs legacy projection_threads.settled_at rows where auto-settlement stamped the sweep time (identified via server auto-settle events). Manual and later re-settled threads are left alone; orchestration event payloads are unchanged.

Clients share resolveSettledThreadTimestamp from client-runtime so web and mobile sort and label the Settled shelf from the same stamp (settledAt, then latest activity, then updatedAt). Docs describe that ordering behavior.

^{Reviewed by Cursor Bugbot for commit ab67483. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Preserve settledAt timestamp in automatic thread settlement and repair legacy projections

• resolveAutoSettlementAt in ThreadSettlementPolicy.ts now returns an ISO timestamp instead of a boolean; ThreadSettlementReactor includes it on thread.auto-settle commands, and the decider in decider.ts persists it as settledAt while updatedAt remains the event time
• Adds ThreadAutoSettleCommand.settledAt as a required field in orchestration.ts, making commands schema-invalid without a valid settlement timestamp
• Adds migration 045 in 045_RepairAutomaticSettlementTimestamps.ts to fix legacy projection rows where automatic settledAt equals the event time, replacing it with the latest pre-settlement activity or creation timestamp without touching orchestration event payloads
• Introduces shared resolveSettledThreadTimestamp in threadSort.ts and adopts it across web sidebar sorting/labels and mobile settled-row ordering and display so clients prefer persisted settledAt, then latest activity, then updatedAt
• Risk: any out-of-tree consumer dispatching thread.auto-settle without settledAt will now fail schema validation; migration 045 rewrites settled_at on projection rows for automatic settlements where it matched occurred_at, so deployments should verify the migration completes before serving reads

^{Macroscope summarized 673f2cd.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T19:30:23.274174Z	71940bc	New commits
🔒 Security Review	✅ Completed 2026-09-02T19:07:08.772979Z	a77a10d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a77a10d157

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a77a10d. Configure here.}

[macroscopeapp]

Approvability

Verdict: Would Approve

Macroscope's review found this PR approvable — This is a focused correction to automatic settlement timestamps, with coordinated server persistence, bounded repair of legacy projections, and consistent web/mobile display ordering. The change introduces no new workflow, product default, infrastructure change, or static-analysis override, and the affected behavior is covered by targeted tests.

Not approved because:

• Monthly spending limit reached (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Pushed 673f2cd to this branch with a few changes on top of the review:

• Migration 045 no longer rewrites orchestration_events. Projectors bootstrap from projection_state cursors and the engine read model comes from ProjectionSnapshotQuery, so nothing replays the full log. Repairing projection_threads.settled_at is sufficient, and the event log stays as recorded. The migration is now one UPDATE with a comment on why settledAt == occurred_at identifies an unrepaired sweep.
• Migration test covers the no-activity created_at fallback, activity after the sweep being ignored, and asserts event payloads are byte-identical before and after.
• Engine tests passed settledAt: now() (the sweep time, i.e. the bug) and only asserted settledOverride. They now pass a distinct past stamp and assert it survives while updatedAt stays the command time.
• Removed the resolveSettledTimestamp alias in Sidebar.logic.ts; both web call sites import resolveSettledThreadTimestamp directly.
• Mobile slim rows drop the ?? thread.createdAt fallback, which was unreachable since the resolver already falls through to updatedAt.
• User doc: settled ordering is its own paragraph instead of a sentence inside the settlement-rules paragraph.

Thanks for the fix, the core change was right.

[eimexdev]

rad! Thanks for the review!

Dismissing prior approval to re-evaluate ab67483