fix(agent): handle partial room timestamps without crashing

docs/api/rest.md

@@ -627,6 +627,25 @@ messages/DOM grow with explicit older loads and live updates. Offscreen web rows
 use CSS `content-visibility: auto`, which skips rendering work while retaining
 chronological DOM, selection, find and accessibility; it is not DOM virtualization.
 
+Every room message, including protected tool rows and `activity.queuedMessages`,
+has a string `id`, `role`, `content`, and ISO-8601 `createdAt`. Privacy filtering
+retains this envelope and tool lifecycle metadata (`kind`, `toolCallId`,
+`toolName`, `entryId`, `status`, and available `startedAt`/`completedAt`). Protected
+tools use their public tool name as `content`; private arguments, previews, and
+errors are withheld. Result-only pages may omit initiation metadata.
+
+Historical entries without a known time use `1970-01-01T00:00:00.000Z` as an
+unknown-time sentinel. For compatibility with older partial responses, clients
+may recover missing/invalid `createdAt` from `metadata.startedAt`, then
+`metadata.completedAt`, or use that sentinel; never substitute the current time.
+Older redacted tool rows containing only `id`, `role`, and `name` can retain their
+identity with a tool-name label until a complete upsert arrives. The web client
+uses the same normalization for REST, WebSocket, and queued activity, retains
+known times across partial upserts, and orders by time, numeric `entryId` (when
+present, before absent), then stable `id`. Unknown times display as “Earlier”
+without a clock time. Invalid identities or non-tool message bodies reject the
+page before advancing its replay cursor; timestamps never replace cursors.
+
 ### `POST /v1/agent/messages`
 
 Body: `{ "content": "Check the oven", "requestId": "client-generated-uuid" }`.

docs/api/streaming-chat.md

@@ -326,6 +326,14 @@ with `metadata.kind: "tool_call"`, matching Sybil's tool renderer. REST pages an
 socket messages are upserts keyed by stable `id`. Save each returned cursor after
 applying its entire frame, even when it contains no visible messages.
 
+Both message frames and queued activity use the required message envelope and
+historical timestamp compatibility rules in [REST room history](./rest.md#get-v1agentmessages).
+Protected tool redaction preserves `createdAt`, a safe string `content`, and
+available lifecycle metadata; it does not remove the row's identity or replay
+metadata. Partial tool results may omit `args`/`startedAt`; merge them without
+losing a known creation time or downgrading a completed tool on replay. Validate
+and normalize all rows before applying a frame or advancing its cursor.
+
 Clients may send `{ "type": "ping" }` (receiving `{ "type": "pong" }`) or
 `{ "type": "subscribe", "after": "44" }` to change the replay cursor. Transport
 ping/pong heartbeats detect dead connections. Other writes belong on REST.

ios/Packages/Sybil/Package.swift

@@ -15,7 +15,9 @@ let package = Package(
             targets: ["Sybil"]),
     ],
     dependencies: [
-        .package(url: "https://github.com/gonzalezreal/swift-markdown-ui.git", from: "2.4.1")
+        .package(url: "https://github.com/gonzalezreal/swift-markdown-ui.git", from: "2.4.1"),
+        // Use MarkdownUI's existing parser to remove Agent image/HTML nodes structurally.
+        .package(url: "https://github.com/swiftlang/swift-cmark", from: "0.7.1")
     ],
     targets: [
         // Targets are the basic building blocks of a package, defining a module or a test suite.
@@ -23,7 +25,9 @@ let package = Package(
         .target(
             name: "Sybil",
             dependencies: [
-                .product(name: "MarkdownUI", package: "swift-markdown-ui")
+                .product(name: "MarkdownUI", package: "swift-markdown-ui"),
+                .product(name: "cmark-gfm", package: "swift-cmark"),
+                .product(name: "cmark-gfm-extensions", package: "swift-cmark")
             ],
             resources: [.process("Resources")]),
         .testTarget(

ios/Packages/Sybil/Sources/Sybil/AgentMessageMarkdown.swift

@@ -0,0 +1,87 @@
+import Foundation
+import MarkdownUI
+import cmark_gfm
+import cmark_gfm_extensions
+
+/// Agent images come only from validated attachment descriptors. Rewrite parsed nodes,
+/// including reference/nested images, so neither MarkdownUI image loader receives a URL.
+enum AgentMessageMarkdown {
+    static func content(_ source: String) -> MarkdownContent {
+        cmark_gfm_core_extensions_ensure_registered()
+        guard let parser = cmark_parser_new(CMARK_OPT_DEFAULT) else { return literal(source) }
+        defer { cmark_parser_free(parser) }
+        for name in ["table", "strikethrough", "autolink", "tasklist"] {
+            if let ext = cmark_find_syntax_extension(name) { cmark_parser_attach_syntax_extension(parser, ext) }
+        }
+        source.withCString { cmark_parser_feed(parser, $0, source.utf8.count) }
+        guard let document = cmark_parser_finish(parser) else { return literal(source) }
+        defer { cmark_node_free(document) }
+        stripImagesAndHTML(document)
+        guard let markdown = cmark_render_commonmark(document, CMARK_OPT_DEFAULT, 0) else { return literal(source) }
+        defer { free(markdown) }
+        return MarkdownContent(String(cString: markdown))
+    }
+
+    private static func literal(_ source: String) -> MarkdownContent {
+        MarkdownContent { Paragraph { source } }
+    }
+
+    private static func stripImagesAndHTML(_ parent: UnsafeMutablePointer<cmark_node>) {
+        var child = cmark_node_first_child(parent)
+        while let node = child {
+            child = cmark_node_next(node)
+            let type = cmark_node_get_type(node)
+            if type == CMARK_NODE_IMAGE || type == CMARK_NODE_HTML_INLINE || type == CMARK_NODE_HTML_BLOCK {
+                let text = type == CMARK_NODE_IMAGE ? altText(node) : htmlText(cmark_node_get_literal(node).map { String(cString: $0) } ?? "")
+                let replacement = cmark_node_new(type == CMARK_NODE_HTML_BLOCK ? CMARK_NODE_PARAGRAPH : CMARK_NODE_TEXT)!
+                if type == CMARK_NODE_HTML_BLOCK {
+                    let inline = cmark_node_new(CMARK_NODE_TEXT)!
+                    // cmark includes the HTML block's terminating newline in its literal.
+                    // It is a block delimiter, not an extra line in the visible alt text.
+                    cmark_node_set_literal(inline, text.trimmingCharacters(in: .newlines))
+                    cmark_node_append_child(replacement, inline)
+                } else {
+                    cmark_node_set_literal(replacement, text)
+                }
+                cmark_node_replace(node, replacement)
+                cmark_node_free(node)
+            } else {
+                stripImagesAndHTML(node)
+            }
+        }
+    }
+
+    private static func altText(_ parent: UnsafeMutablePointer<cmark_node>) -> String {
+        var result = "", child = cmark_node_first_child(parent)
+        while let node = child {
+            let type = cmark_node_get_type(node)
+            if type == CMARK_NODE_TEXT || type == CMARK_NODE_CODE {
+                result += cmark_node_get_literal(node).map { String(cString: $0) } ?? ""
+            } else if type == CMARK_NODE_SOFTBREAK || type == CMARK_NODE_LINEBREAK {
+                result += " "
+            } else if type != CMARK_NODE_HTML_INLINE {
+                result += altText(node)
+            }
+            child = cmark_node_next(node)
+        }
+        return result
+    }
+
+    private static func htmlText(_ source: String) -> String {
+        // HTML is never rendered. Retain ordinary text and img alt attributes as text
+        // nodes; quoted '>' characters cannot expose the rest of an image attribute.
+        let tags = try! NSRegularExpression(pattern: #"(?s)<(?:[^>"']|"[^"]*"|'[^']*')*>"#)
+        let alt = try! NSRegularExpression(pattern: #"(?is)^<img\b.*?\s+alt\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))"#)
+        var result = source
+        for tag in tags.matches(in: source, range: NSRange(source.startIndex..., in: source)).reversed() {
+            let range = Range(tag.range, in: source)!
+            let value = String(source[range])
+            let match = alt.firstMatch(in: value, range: NSRange(value.startIndex..., in: value))
+            let label = match.flatMap { match in
+                (1...3).compactMap { Range(match.range(at: $0), in: value).map { String(value[$0]) } }.first
+            } ?? ""
+            result.replaceSubrange(Range(tag.range, in: result)!, with: label)
+        }
+        return result
+    }
+}

ios/Packages/Sybil/Sources/Sybil/SybilAPIClient.swift

@@ -46,7 +46,10 @@ actor SybilAPIClient: SybilAPIClienting, AgentAPIClienting, AgentPushAPIClientin
         guard value.type == "persistent-agent", value.protocol == "pi-room.v1" else {
             throw AgentFailure(message: "Unsupported Agent room protocol.")
         }
-        if configuration.authToken?.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty != false { value.capabilities?.attachments = nil }
+        if configuration.authToken?.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty != false {
+            value.capabilities?.attachments = nil
+            value.capabilities?.assistantImages = nil
+        }
         return value
     }
 

ios/Packages/Sybil/Sources/Sybil/SybilAgentAttachmentViews.swift

@@ -174,9 +174,15 @@ struct AgentAttachmentCard: View {
             if attachment.kind == .image {
                 ZStack {
                     SybilTheme.surface
-                    if let image { Image(uiImage: image).resizable().scaledToFit() }
+                    if let image {
+                        Image(uiImage: image).resizable().scaledToFit()
+                            .accessibilityLabel("Image: \(attachment.filename)")
+                            .accessibilityIdentifier("agent-image-preview")
+                    }
                     else { Image(systemName: "photo").foregroundStyle(SybilTheme.textMuted) }
                 }.frame(height: 180).clipped()
+                    .accessibilityElement(children: .contain)
+                    .accessibilityIdentifier("agent-image-frame")
             }
             if let text {
                 Text(text).font(.system(.caption, design: .monospaced)).lineLimit(6)

ios/Packages/Sybil/Sources/Sybil/SybilAgentAttachments.swift

@@ -44,14 +44,24 @@ struct AgentAttachmentCapabilities: Codable, Equatable, Sendable {
     }
 }
 
+struct AgentAssistantImageCapabilities: Decodable, Equatable, Sendable {
+    var version: Int
+    var supported: Bool { version == 1 }
+}
+
 struct AgentCapabilities: Decodable, Sendable {
     var attachments: AgentAttachmentCapabilities?
-    init(attachments: AgentAttachmentCapabilities? = nil) { self.attachments = attachments }
-    private enum CodingKeys: String, CodingKey { case attachments }
+    var assistantImages: AgentAssistantImageCapabilities?
+    init(attachments: AgentAttachmentCapabilities? = nil, assistantImages: AgentAssistantImageCapabilities? = nil) {
+        self.attachments = attachments
+        self.assistantImages = assistantImages
+    }
+    private enum CodingKeys: String, CodingKey { case attachments, assistantImages }
     init(from decoder: Decoder) throws {
         let values = try decoder.container(keyedBy: CodingKeys.self)
         // Unknown versions or malformed future capabilities must not break text chat.
         attachments = try? values.decode(AgentAttachmentCapabilities.self, forKey: .attachments)
+        assistantImages = try? values.decode(AgentAssistantImageCapabilities.self, forKey: .assistantImages)
     }
 }
 
@@ -91,13 +101,34 @@ struct AgentAttachment: Codable, Hashable, Identifiable, Sendable {
 
 extension Message {
     var agentAttachments: [AgentAttachment] {
-        guard let entries = metadata?.objectValue?["agentAttachments"]?.arrayValue else { return [] }
-        return entries.compactMap {
-            guard let data = try? JSONEncoder().encode($0),
+        guard role == .user || role == .assistant,
+              let info = metadata?.objectValue,
+              let entries = info["agentAttachments"]?.arrayValue else { return [] }
+        if role == .assistant {
+            guard info["kind"]?.stringValue == "message", info["status"]?.stringValue == "complete",
+                  entries.count <= 8 else { return [] }
+        }
+        let attachments: [AgentAttachment] = entries.compactMap { entry in
+            // Inspect the original JSON before Codable can discard unknown fields. Output
+            // descriptors are deliberately path/URL-free; legacy user uploads stay compatible.
+            if role == .assistant {
+                let safeFields: Set<String> = ["id", "kind", "filename", "mimeType", "sizeBytes", "sha256"]
+                guard let fields = entry.objectValue, Set(fields.keys) == safeFields,
+                      fields["kind"]?.stringValue == "image" else { return nil }
+            }
+            guard let data = try? JSONEncoder().encode(entry),
                   let attachment = try? JSONDecoder().decode(AgentAttachment.self, from: data),
                   (try? attachment.validate()) != nil else { return nil }
             return attachment
         }
+        if role == .assistant {
+            // Reject the entire output set, including partially invalid arrays. The
+            // count and per-image bounds above also bound this aggregate calculation.
+            guard attachments.count == entries.count,
+                  Set(attachments.map(\.id)).count == attachments.count,
+                  attachments.reduce(0, { $0 + $1.sizeBytes }) <= 32 * 1024 * 1024 else { return [] }
+        }
+        return attachments
     }
 }
 

ios/Packages/Sybil/Sources/Sybil/SybilAgentModels.swift

@@ -239,7 +239,7 @@ struct AgentPresentation {
     private(set) var suppressed = false
     private(set) var busySince: Date?
     private var seenTools: Set<String> = []
-    static let quietTools: Set<String> = ["user_message", "notify_parent", "clock_wait", "event_decision"]
+    static let quietTools: Set<String> = ["user_message", "output_image", "notify_parent", "clock_wait", "event_decision"]
 
     mutating func receive(_ event: AgentEvent, before: AgentRoomState, after: AgentRoomState, replay: Bool, now: Date) {
         switch event {
@@ -249,7 +249,7 @@ struct AgentPresentation {
                 .sorted { AgentCursor.less($0.agentEntryCursor ?? "0", $1.agentEntryCursor ?? "0") }
             if !replay {
                 for message in fresh {
-                    if message.isAgentPublicReply && !message.content.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty { suppressed = true }
+                    if message.isAgentPublicReply && (!message.content.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty || !message.agentAttachments.isEmpty) { suppressed = true }
                     else if message.role == .user { suppressed = false }
                     else if message.toolCallMetadata?.status == "initiated",
                             !Self.quietTools.contains(message.toolCallMetadata?.toolName ?? ""), !seenTools.contains(message.agentToolID) { suppressed = false }

ios/Packages/Sybil/Sources/Sybil/SybilAgentView.swift

@@ -275,7 +275,9 @@ private struct AgentMessageRow: View {
                 ForEach(message.agentAttachments) { attachment in
                     AgentAttachmentCard(attachment: attachment, room: room)
                 }
+                if !message.content.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty || message.agentAttachments.isEmpty {
                     MessageBubble(message: message, isSending: false, streamingAssistantPresentation: nil, isForking: false, onFork: nil, agentStyle: true)
+                }
                 HStack(spacing: 6) {
                     Text(own ? "You" : "Sybil")
                     Text(message.createdAt, style: .time)

ios/Packages/Sybil/Sources/Sybil/SybilChatTranscriptView.swift

@@ -223,14 +223,14 @@ struct MessageBubble: View {
                         )
                     }
 
-                    if isStreamingAssistant {
+                    if isStreamingAssistant && !agentStyle {
                         StreamingAssistantContentView(
                             content: message.content,
                             isSending: isSending,
                             presentation: matchingStreamingAssistantPresentation
                         )
                     } else if !message.content.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
-                        SybilMessageText(content: message.content, format: isUser ? .literal : .markdown)
+                        SybilMessageText(content: message.content, format: isUser ? .literal : .markdown, agentStyle: agentStyle)
                     }
                 }
                 .padding(.horizontal, isUser || agentStyle ? 14 : 2)

ios/Packages/Sybil/Sources/Sybil/SybilMessageText.swift

@@ -7,6 +7,7 @@ struct SybilMessageText: View {
     enum Format { case literal, markdown }
     var content: String
     var format: Format
+    var agentStyle = false
 
     static func literalContent(_ text: String) -> MarkdownContent {
         // Pasted CRLF/CR and blank lines containing spaces or tabs have the same
@@ -31,7 +32,7 @@ struct SybilMessageText: View {
         #if DEBUG
         let _ = AgentRenderDiagnostics.record("messageTextBuild")
         #endif
-        Markdown(format == .literal ? Self.literalContent(content) : MarkdownContent(content))
+        Markdown(format == .literal ? Self.literalContent(content) : agentStyle ? AgentMessageMarkdown.content(content) : MarkdownContent(content))
             .tint(SybilTheme.primary)
             .foregroundStyle(format == .literal ? SybilTheme.text : SybilTheme.text.opacity(0.95))
             .markdownTheme(.sybilReadable)

ios/Packages/Sybil/Tests/SybilTests/AgentAttachmentTests.swift

@@ -14,10 +14,15 @@ private func sampleAttachment(_ id: String = "opaque-server-id", data: Data = or
     AgentAttachment(id: id, kind: .file, filename: name, mimeType: "application/octet-stream", sizeBytes: data.count,
         sha256: SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined(), workspacePath: "/runtime/provided/\(name)")
 }
-private func descriptorData(capability: Bool = true) throws -> Data {
+private func descriptorData(capability: Bool = true, assistantImages: Bool = false) throws -> Data {
     var object: [String: Any] = ["id": "root", "title": "Sybil", "type": "persistent-agent", "model": "fixture", "protocol": "pi-room.v1", "websocket": "/v1/agent/ws",
         "activity": ["state": "idle", "isThinking": false, "queued": 0, "backgroundWorkers": 0, "tools": [], "queuedMessages": []]]
     if capability { object["capabilities"] = ["attachments": try JSONSerialization.jsonObject(with: JSONEncoder().encode(attachmentLimits)), "future": true] }
+    if assistantImages {
+        var capabilities = object["capabilities"] as? [String: Any] ?? [:]
+        capabilities["assistantImages"] = ["version": 1]
+        object["capabilities"] = capabilities
+    }
     object["unknown"] = ["additive": true]
     return try JSONSerialization.data(withJSONObject: object)
 }
@@ -124,6 +129,126 @@ private func requestBytes(_ request: URLRequest) -> Data {
 }
 
 @Suite(.serialized) struct AgentAttachmentTests {
+    @Test @MainActor func assistantCapabilityDoesNotAdmitInputAndRequiresToken() async throws {
+        AttachmentURLProtocol.install { request in
+            #expect(request.url!.path == "/api/v1/agent") // Never upload or submit references.
+            return (200, [:], try descriptorData(capability: false, assistantImages: true))
+        }
+        let session = attachmentSession(); defer { session.invalidateAndCancel() }
+        for token in [nil, " ", "synthetic-test"] {
+            let client = SybilAPIClient(configuration: .init(baseURL: URL(string: "https://fixture.invalid/api")!, authToken: token), session: session)
+            let descriptor = try await client.agentDescriptor()
+            #expect(descriptor.capabilities?.attachments == nil)
+            #expect((descriptor.capabilities?.assistantImages?.supported == true) == (token == "synthetic-test"))
+            let draft = AgentAttachmentDraft()
+            draft.configure(client: client, storage: nil); draft.updateCapability(descriptor.capabilities?.attachments)
+            #expect(!draft.supportsAttachments)
+            #expect(draft.add(filename: "original.bin") { .init(filename: "original.bin", mimeType: "application/octet-stream", data: originalBytes) } == nil)
+            await #expect(throws: AgentAttachmentIssue.self) { try await client.agentUpload(file: .init(filename: "original.bin", mimeType: "application/octet-stream", data: originalBytes), uploadID: UUID().uuidString) }
+            await #expect(throws: AgentAttachmentIssue.self) { try await client.agentSubmit(AgentSubmission(content: "", requestID: "output-only", attachments: [sampleAttachment()])) }
+        }
+        for json in [#"{"assistantImages":{"version":2}}"#, #"{"assistantImages":{"version":"future"}}"#] {
+            #expect(try JSONDecoder().decode(AgentCapabilities.self, from: Data(json.utf8)).assistantImages?.supported != true)
+        }
+    }
+
+    @Test func assistantDescriptorsRequireCompletedAssistantImageAndSafeFields() throws {
+        let image = AgentAttachment(id: "output-image", kind: .image, filename: "landscape.png", mimeType: "image/png", sizeBytes: 12, sha256: String(repeating: "a", count: 64))
+        var row = Message(id: "outbound:1", createdAt: Date(), role: .assistant, content: "", metadata: .object([
+            "kind": .string("message"), "status": .string("complete"), "agentAttachments": .array([image.metadataValue])]))
+        #expect(row.agentAttachments == [image])
+        for role in [MessageRole.system, .tool] {
+            var wrong = row; wrong.role = role
+            #expect(wrong.agentAttachments.isEmpty)
+        }
+        for (key, value) in [("kind", "tool_call"), ("kind", "other"), ("status", "queued"), ("status", "streaming")] {
+            var wrong = row, fields = row.metadata!.objectValue!
+            fields[key] = .string(value); wrong.metadata = .object(fields)
+            #expect(wrong.agentAttachments.isEmpty)
+        }
+        var descriptors: [JSONValue] = [sampleAttachment().metadataValue]
+        for key in ["workspacePath", "sourcePath", "privatePath", "url", "sourceURL", "downloadUrl", "external", "future"] {
+            var fields = image.metadataValue.objectValue!; fields[key] = .string("/private/synthetic.png")
+            descriptors.append(.object(fields))
+        }
+        for (key, value) in [("filename", "../private.png"), ("filename", "https://example.invalid/a.png"), ("mimeType", "image/svg+xml"), ("sha256", "bad")] {
+            var fields = image.metadataValue.objectValue!; fields[key] = .string(value)
+            descriptors.append(.object(fields))
+        }
+        for descriptor in descriptors {
+            row.metadata = .object(["kind": .string("message"), "status": .string("complete"), "agentAttachments": .array([descriptor])])
+            #expect(row.agentAttachments.isEmpty)
+            row.metadata = .object(["kind": .string("message"), "status": .string("complete"), "agentAttachments": .array([image.metadataValue, descriptor])])
+            #expect(row.agentAttachments.isEmpty) // No valid prefix from an invalid output set.
+        }
+        let maximum = (0..<8).map { index in
+            var item = image; item.id = "image-\(index)"; item.sizeBytes = 4 * 1024 * 1024
+            return item
+        }
+        row.metadata = .object(["kind": .string("message"), "status": .string("complete"), "agentAttachments": .array(maximum.map(\.metadataValue))])
+        #expect(row.agentAttachments == maximum) // Exactly eight IDs and 32 MiB.
+        let tooMany = (0..<9).map { index in
+            var item = image; item.id = "image-\(index)"
+            return item
+        }
+        var tooLarge = maximum; tooLarge[0].sizeBytes += 1
+        for invalid in [tooMany, [image, image], tooLarge] {
+            row.role = .assistant
+            row.metadata = .object(["kind": .string("message"), "status": .string("complete"), "agentAttachments": .array(invalid.map(\.metadataValue))])
+            #expect(row.agentAttachments.isEmpty)
+            row.role = .user
+            #expect(row.agentAttachments == invalid) // These new output limits do not change legacy input parsing.
+        }
+        row.role = .user
+        row.metadata = .object(["agentAttachments": .array([sampleAttachment().metadataValue])])
+        #expect(row.agentAttachments == [sampleAttachment()])
+    }
+
+    @Test @MainActor func imageOnlyAssistantLiveAndHistoryUseSameMergeAndAuthenticatedLoader() async throws {
+        let png = try #require(UIGraphicsImageRenderer(size: CGSize(width: 24, height: 16)).image { context in
+            UIColor.systemTeal.setFill(); context.fill(CGRect(x: 0, y: 0, width: 24, height: 16))
+        }.pngData())
+        let attachment = AgentAttachment(id: "output/opaque", kind: .image, filename: "landscape.png", mimeType: "image/png", sizeBytes: png.count,
+            sha256: SHA256.hash(data: png).map { String(format: "%02x", $0) }.joined())
+        let row = Message(id: "outbound:1", createdAt: Date(timeIntervalSince1970: 1), role: .assistant, content: "", metadata: .object([
+            "kind": .string("message"), "status": .string("complete"), "entryId": .number(1), "agentAttachments": .array([attachment.metadataValue])]))
+        let page = AgentPage(conversationId: "fixture-root", messages: [row], cursor: "1", hasMore: false)
+        let encoder = JSONEncoder(); encoder.dateEncodingStrategy = .iso8601
+        let bytes = try encoder.encode(page)
+        var envelope = try JSONSerialization.jsonObject(with: bytes) as! [String: Any]; envelope["type"] = "messages"
+        let decodedEvent = try AgentEvent.decode(JSONSerialization.data(withJSONObject: envelope))
+        let event = try #require(decodedEvent)
+        let room = SybilAgentRoom(); defer { room.stop() }
+        try room.receive(event); room.flush()
+        var history = AgentRoomState()
+        try history.apply(AgentCoding.decoder().decode(AgentPage.self, from: bytes))
+        // Replay must not duplicate a completed output; no current capability is needed.
+        try room.receive(event); room.flush()
+        #expect(AgentTranscript(messages: room.messages).displayed == AgentTranscript(messages: history.messages).displayed)
+        #expect(room.messages.count == 1); #expect(room.messages[0].content.isEmpty)
+        #expect(room.messages[0].agentAttachments == [attachment])
+        var presentation = AgentPresentation()
+        presentation.receive(event, before: AgentRoomState(), after: history, replay: false, now: Date())
+        #expect(presentation.suppressed)
+
+        AttachmentURLProtocol.install { request in
+            #expect(request.url!.absoluteString == "https://fixture.invalid/api/v1/agent/attachments/output%2Fopaque/content")
+            #expect(request.httpMethod == "GET")
+            #expect(request.value(forHTTPHeaderField: "Authorization") == "Bearer synthetic-test")
+            return (200, ["Content-Length": String(png.count)], png)
+        }
+        let session = attachmentSession(); defer { session.invalidateAndCancel() }
+        let client = SybilAPIClient(configuration: .init(baseURL: URL(string: "https://fixture.invalid/api")!, authToken: "synthetic-test"), session: session)
+        let downloads = AgentAttachmentDownloads()
+        #expect(try await downloads.data(for: attachment, client: client) == png)
+        AttachmentURLProtocol.install { _ in Issue.record("Verified output should be cached"); return (500, [:], Data()) }
+        #expect(try await downloads.data(for: attachment, client: client) == png)
+        AttachmentURLProtocol.install { _ in (200, [:], Data(repeating: 0, count: png.count)) }
+        await #expect(throws: AgentAttachmentIssue.self) { try await client.agentDownload(attachment) }
+        let unauthenticated = SybilAPIClient(configuration: .init(baseURL: URL(string: "https://fixture.invalid/api")!), session: session)
+        await #expect(throws: AgentAttachmentIssue.self) { try await unauthenticated.agentDownload(attachment) }
+    }
+
     @Test func additiveCapabilityAndDistinctMetadata() throws {
         let old = try AgentCoding.decoder().decode(AgentDescriptor.self, from: descriptorData(capability: false))
         #expect(old.capabilities == nil)

ios/Packages/Sybil/Tests/SybilTests/AgentTests.swift

@@ -347,6 +347,33 @@ struct AgentTests {
         #expect(presentation.isTyping(now: now.addingTimeInterval(7.3)))
     }
 
+    @Test func outputImageActivityKeepsImageReplyTypingSuppressed() throws {
+        var presentation = AgentPresentation(), state = AgentRoomState()
+        let now = Date(timeIntervalSince1970: 100)
+        state.activity.isThinking = true
+        presentation.sent(now: now, activity: state.activity)
+        #expect(presentation.isTyping(now: now.addingTimeInterval(0.3)))
+        let image = AgentAttachment(id: "image", kind: .image, filename: "image.png", mimeType: "image/png", sizeBytes: 12, sha256: String(repeating: "a", count: 64))
+        var reply = agentMessage("image-reply", entry: "1", info: ["status": .string("complete"), "agentAttachments": .array([image.metadataValue])])
+        reply.content = ""
+        let page = agentPage([reply], cursor: "1")
+        var after = state; try after.apply(page)
+        presentation.receive(.messages(page), before: state, after: after, replay: false, now: now.addingTimeInterval(1))
+        state = after
+        #expect(presentation.suppressed)
+
+        after.activity.tools = [.init(id: "output-activity", name: "output_image", status: "initiated")]
+        presentation.receive(.activity("root", after.activity), before: state, after: after, replay: false, now: now.addingTimeInterval(2))
+        state = after
+        #expect(!presentation.isTyping(now: now.addingTimeInterval(3)))
+
+        let tool = agentPage([agentMessage("output-tool", entry: "2", role: .tool, info: ["toolName": .string("output_image"), "status": .string("initiated")])], cursor: "2")
+        try after.apply(tool)
+        presentation.receive(.messages(tool), before: state, after: after, replay: false, now: now.addingTimeInterval(4))
+        #expect(presentation.suppressed)
+        #expect(!presentation.isTyping(now: now.addingTimeInterval(5)))
+    }
+
     @Test func socketURLAndAuthentication() throws {
         let config = APIConfiguration(baseURL: URL(string: "https://sybil.bajor.cloud/api/?accidental=query")!, authToken: " token ")
         #expect(try config.agentWebSocketURL().absoluteString == "wss://sybil.bajor.cloud/api/v1/agent/ws")

ios/Packages/Sybil/Tests/SybilTests/MessagePresentationTests.swift

@@ -6,6 +6,57 @@ import UIKit
 
 @Suite @MainActor
 struct MessagePresentationTests {
+    @Test func agentMarkdownKeepsAltAndFormattingWithoutImageOrHTMLNodes() {
+        let source = """
+        **Caption** ![Inline *landscape*](https://images.invalid/inline.png)
+
+        ![Reference landscape][photo]
+
+        [![Linked landscape](//images.invalid/linked.png)](https://example.invalid)
+
+        > ![Nested ![inner](file:///private/image.png)](data:image/png;base64,AAAA)
+
+        <picture><source srcset="https://images.invalid/source.png"><img src="https://images.invalid/html.png" alt="HTML landscape" title="a > b"></picture>
+
+        [Useful link](https://example.invalid)
+
+        [photo]: https://images.invalid/reference.png
+        """
+        let content = AgentMessageMarkdown.content(source)
+        let html = content.renderHTML(), plain = content.renderPlainText()
+        for label in ["Inline landscape", "Reference landscape", "Linked landscape", "Nested inner", "HTML landscape"] {
+            #expect(plain.contains(label))
+        }
+        #expect(!html.contains("<img")); #expect(!html.contains("<picture")); #expect(!html.contains("<source"))
+        #expect(!html.contains("images.invalid")); #expect(!html.contains("/private/"))
+        #expect(html.contains("<strong>Caption</strong>"))
+        #expect(html.contains(#"href="https://example.invalid""#))
+        // Normal chat still uses unmodified MarkdownUI content.
+        #expect(MarkdownContent(source).renderHTML().contains("<img"))
+        #expect(AgentMessageMarkdown.content("<img src='https://images.invalid/a.png' alt='HTML landscape'>\n").renderHTML() == "<p>HTML landscape</p>\n")
+    }
+
+    @Test func agentMarkdownRetainsCodeTablesAndEscapesImageLikeAltText() {
+        let source = """
+        `![literal](https://images.invalid/code.png)`
+
+        ```html
+        <img src="literal-code">
+        ```
+
+        | Image | Value |
+        | --- | --- |
+        | ![Table alt](https://images.invalid/table.png) | **Kept** |
+
+        <IMG ALT='![literal alt](https://images.invalid/alt.png)' SRC='ignored'>
+        """
+        let html = AgentMessageMarkdown.content(source).renderHTML()
+        #expect(html.contains("<table>")); #expect(html.contains("Table alt"))
+        #expect(html.contains("<strong>Kept</strong>"))
+        #expect(html.contains("&lt;img src=")); #expect(html.contains("![literal]"))
+        #expect(html.contains("![literal alt]")); #expect(!html.contains("<img"))
+    }
+
     @Test func userMarkupRemainsLiteral() {
         let source = "**bold** [link](https://example.invalid) `code`\n- item\n<script>literal</script>"
         let content = SybilMessageText.literalContent(source)

ios/Tests/Fixtures/agent_server.py

@@ -3,6 +3,7 @@
 Run with Python + aiohttp, then xcodebuild test -scheme SybilAgentUI.
 """
 import asyncio
+import base64
 import datetime
 import json
 import hashlib
@@ -23,6 +24,8 @@ reply_tasks = set()
 attachments = {}
 uploads = {}
 attachment_capability = True
+assistant_image_capability = False
+fail_image_download = False
 next_upload_error = None
 blocked_proxy = False
 transcript_comparison = False
@@ -95,6 +98,7 @@ async def reply(content):
 
 async def route(request):
     global read_cursor, cursor, busy, attachment_capability, next_upload_error, blocked_proxy, transcript_comparison, push_available, auth_required
+    global assistant_image_capability, fail_image_download
     path = request.path
     log.append(dict(method=request.method, path=path, query=dict(request.query)))
     if path == '/control':
@@ -106,6 +110,7 @@ async def route(request):
             reply_tasks.clear()
             messages.clear(); requests.clear(); attempts.clear(); cursor = 0; read_cursor = 0; busy = False
             attachment_capability = True; next_upload_error = None; blocked_proxy = False; transcript_comparison = False
+            assistant_image_capability = False; fail_image_download = False
             push_installations.clear(); push_retired.clear(); push_requests.clear(); log.clear()
             push_available = True; auth_required = False
             for i in range(body.get('count', 3)):
@@ -120,6 +125,16 @@ async def route(request):
             transcript_comparison = True
         elif action == 'capability':
             attachment_capability = body.get('enabled', True)
+            assistant_image_capability = body.get('assistantImages', False)
+        elif action == 'assistant-image':
+            # Synthetic output supplied by XCTest, never a workspace file or provider.
+            data = base64.b64decode(body['png'], validate=True)
+            descriptor = dict(id='fixture-output-image', kind='image', filename='fixture-landscape.png',
+                              mimeType='image/png', sizeBytes=len(data), sha256=hashlib.sha256(data).hexdigest())
+            attachments[descriptor['id']] = dict(descriptor=descriptor, data=data)
+            fail_image_download = body.get('failFirstDownload', False)
+            row = message(body.get('content', ''), info={'agentAttachments': [descriptor]})
+            await broadcast(dict(type='messages', **page([row])))
         elif action == 'upload-error':
             next_upload_error = body
         elif action == 'blocked-proxy':
@@ -190,6 +205,8 @@ async def route(request):
         descriptor = dict(id='fixture-root', title='Sybil Agent', type='persistent-agent', model='fixture', protocol='pi-room.v1', websocket='/v1/agent/ws', activity=activity())
         if attachment_capability:
             descriptor['capabilities'] = {'attachments': CAPABILITY}
+        if assistant_image_capability:
+            descriptor.setdefault('capabilities', {})['assistantImages'] = dict(version=1)
         return web.json_response(descriptor)
     if path == '/api/v1/agent/push/config':
         if not push_available:
@@ -263,6 +280,9 @@ async def route(request):
         uploads[upload_id] = (identity, attachment_id)
         return web.json_response({'attachment': descriptor}, status=201)
     if path.startswith('/api/v1/agent/attachments/') and path.endswith('/content'):
+        if fail_image_download:
+            fail_image_download = False
+            return attachment_error(503, 'fixture_retry', 'Synthetic image unavailable. Retry the download.')
         attachment_id = path.removeprefix('/api/v1/agent/attachments/').removesuffix('/content')
         stored = attachments.get(attachment_id)
         if stored is None:

ios/Tests/SybilUITests/AgentUITests.swift

@@ -65,6 +65,59 @@ final class AgentUITests: XCTestCase {
         return try XCTUnwrap(json["attachment"] as? [String: Any])
     }
 
+    func testAssistantImageOnlyLiveRetryAndHistoryWithoutInputCapability() async throws {
+        app.terminate()
+        try await control(["action": "reset", "count": 0])
+        try await control(["action": "capability", "enabled": false, "assistantImages": true])
+        try await control(["action": "push-available", "enabled": false])
+        app.launch(); openAgent()
+        XCTAssertFalse(app.buttons["agent-attach"].exists)
+        let image = UIGraphicsImageRenderer(size: CGSize(width: 320, height: 180)).image { context in
+            UIColor.systemTeal.setFill(); context.fill(CGRect(x: 0, y: 0, width: 320, height: 180))
+            UIColor.systemYellow.setFill(); context.cgContext.fillEllipse(in: CGRect(x: 225, y: 25, width: 50, height: 50))
+            UIColor.systemIndigo.setFill()
+            context.cgContext.move(to: CGPoint(x: 0, y: 180)); context.cgContext.addLine(to: CGPoint(x: 120, y: 55))
+            context.cgContext.addLine(to: CGPoint(x: 250, y: 180)); context.cgContext.fillPath()
+        }
+        try await control(["action": "reply", "content": "![Markdown landscape](http://127.0.0.1:8799/blocked-markdown.png)\n\n<img src='http://127.0.0.1:8799/blocked-html.png' alt='HTML landscape'>"])
+        try await control(["action": "assistant-image", "content": "", "png": try XCTUnwrap(image.pngData()).base64EncodedString(), "failFirstDownload": true])
+        XCTAssertTrue(app.staticTexts["fixture-landscape.png"].waitForExistence(timeout: 8))
+        XCTAssertTrue(app.buttons["Retry download"].waitForExistence(timeout: 8))
+        let imageFrame = app.otherElements["agent-image-frame"]
+        XCTAssertTrue(imageFrame.exists)
+        let placeholder = imageFrame.frame
+        XCTAssertGreaterThan(placeholder.width, 0)
+        XCTAssertEqual(placeholder.height, 180, accuracy: 1)
+        app.buttons["Retry download"].tap()
+        let preview = app.images["agent-image-preview"]
+        XCTAssertTrue(preview.waitForExistence(timeout: 8))
+        XCTAssertEqual(preview.label, "Image: fixture-landscape.png")
+        XCTAssertLessThanOrEqual(preview.frame.height, 180)
+        XCTAssertEqual(imageFrame.frame.width, placeholder.width, accuracy: 1)
+        XCTAssertEqual(imageFrame.frame.height, placeholder.height, accuracy: 1)
+        let loadedSize = imageFrame.frame.size
+        XCTAssertTrue(app.staticTexts["Markdown landscape"].exists)
+        XCTAssertTrue(app.staticTexts["HTML landscape"].exists)
+        XCTAssertFalse(app.buttons.matching(NSPredicate(format: "label BEGINSWITH %@", "Copy workspace path:")).firstMatch.exists)
+        capture("agent-assistant-image-live")
+
+        // Previously saved output remains visible when both capabilities disappear.
+        try await control(["action": "capability", "enabled": false, "assistantImages": false])
+        app.terminate(); app.launch(); openAgent()
+        XCTAssertTrue(preview.waitForExistence(timeout: 8))
+        XCTAssertEqual(imageFrame.frame.width, placeholder.width, accuracy: 1)
+        XCTAssertEqual(imageFrame.frame.height, placeholder.height, accuracy: 1)
+        print("Assistant image frame sizes: placeholder=\(placeholder.size), live=\(loadedSize), history=\(imageFrame.frame.size)")
+        XCTAssertEqual(app.staticTexts.matching(NSPredicate(format: "label == %@", "fixture-landscape.png")).count, 1)
+        XCTAssertFalse(app.buttons["agent-attach"].exists)
+        capture("agent-assistant-image-history")
+        let state = try await control(["action": "state"])
+        let log = try XCTUnwrap(state["log"] as? [[String: Any]])
+        XCTAssertFalse(log.contains { ($0["path"] as? String)?.hasPrefix("/blocked-") == true })
+        XCTAssertGreaterThanOrEqual(log.filter { ($0["path"] as? String) == "/api/v1/agent/attachments/fixture-output-image/content" }.count, 3)
+        XCTAssertTrue((state["requests"] as? [String: Any])?.isEmpty == true)
+    }
+
     func testAttachmentHistoryDownloadAndReload() async throws {
         let original = Data("Synthetic original text. <script>plain text only</script>".utf8)
         let file = try await uploadOriginal(name: "fixture-original.txt", mime: "text/plain", bytes: original)

web/src/lib/agent-messages.ts

@@ -0,0 +1,55 @@
+import type { Message } from "./api";
+
+// The runtime also uses the Unix epoch for historical entries without a time.
+// The transcript renders these as "Earlier", without inventing a send time.
+export const UNKNOWN_AGENT_TIME = "1970-01-01T00:00:00.000Z";
+const object = (value: unknown): Record<string, unknown> | undefined => value !== null && typeof value === "object" && !Array.isArray(value)
+  ? value as Record<string, unknown> : undefined;
+const timestamp = (value: unknown): string | undefined => {
+  if (typeof value !== "string" || !value.trim()) return undefined;
+  const time = Date.parse(value);
+  return Number.isFinite(time) && time !== 0 ? new Date(time).toISOString() : undefined;
+};
+
+export function agentMessageTime(message: Pick<Message, "createdAt" | "metadata">): string | undefined {
+  const info = object(message.metadata);
+  return timestamp(message.createdAt) ?? timestamp(info?.startedAt) ?? timestamp(info?.completedAt);
+}
+
+/** Normalize historical/partial rows at both transports, before state or cursors change. */
+export function normalizeAgentMessage(value: unknown): Message {
+  const message = object(value);
+  if (!message || typeof message.id !== "string" || !message.id
+    || typeof message.role !== "string" || !["system", "user", "assistant", "tool"].includes(message.role)) throw new Error("Invalid agent message.");
+  const info = object(message.metadata);
+  // Older runtime REST redaction emitted protected tool rows with only id/role/name.
+  // Keep their identity for a later complete upsert; never discard a whole page.
+  const content = typeof message.content === "string" ? message.content
+    : message.role === "tool" && message.content == null ? (typeof message.name === "string" ? message.name : "Tool") : undefined;
+  if (content === undefined) throw new Error("Invalid agent message.");
+  const createdAt = agentMessageTime(message as Message) ?? UNKNOWN_AGENT_TIME;
+  const needsToolMetadata = message.role === "tool" && info?.kind !== "tool_call";
+  if (message.createdAt === createdAt && message.content === content && !needsToolMetadata) return message as Message;
+  return { ...message, content, createdAt,
+    ...(needsToolMetadata ? { metadata: { ...info, kind: "tool_call" } } : {}),
+  } as Message;
+}
+
+function cursor(message: Message): bigint | undefined {
+  const entryId = object(message.metadata)?.entryId;
+  if ((typeof entryId === "number" && Number.isSafeInteger(entryId) && entryId >= 0)
+    || (typeof entryId === "string" && /^\d+$/.test(entryId))) return BigInt(entryId);
+}
+
+/** One total order for history, queue snapshots and optimistic rows, including ties. */
+export function compareAgentMessages(left: Message, right: Message): number {
+  const byTime = Date.parse(agentMessageTime(left) ?? UNKNOWN_AGENT_TIME) - Date.parse(agentMessageTime(right) ?? UNKNOWN_AGENT_TIME);
+  if (byTime) return byTime;
+  const a = cursor(left), b = cursor(right);
+  if (a !== b) {
+    if (a === undefined) return 1;
+    if (b === undefined) return -1;
+    return a < b ? -1 : 1;
+  }
+  return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+}

web/src/lib/agent-optimistic-outbox.ts

@@ -1,5 +1,6 @@
 import type { Message } from "./api";
 import { agentAttachments, attachmentCaption, parseAgentAttachment, type AgentAttachment } from "./agent-attachments.ts";
+import { compareAgentMessages, normalizeAgentMessage } from "./agent-messages.ts";
 
 export const AGENT_OUTBOX_STORAGE_KEY = "sybil.agent.optimistic-outbox.v1";
 export type AgentDeliveryStatus = "sending" | "queued" | "complete" | "failed" | "unconfirmed";
@@ -165,7 +166,7 @@ export function createAgentOptimisticOutbox(options: {
           metadata: { kind: "message", status: row.status, channel: "sybil", requestId: row.requestId, ...(row.attachments?.length ? { agentAttachments: row.attachments } : {}), ...(row.error ? { error: row.error } : {}) },
         });
       }
-      return [...displayed.values()].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+      return [...displayed.values()].map(normalizeAgentMessage).sort(compareAgentMessages);
     },
     snapshot(): AgentOutboxRow[] { return [...rows.values()].map(row => ({ ...row })); },
   };

web/src/lib/agent-room.ts

@@ -1,6 +1,7 @@
 import type { Message } from "./api";
 import { parseAgentAttachment, type AgentAttachment, type AgentAttachmentCapability } from "./agent-attachments.ts";
 import { agentPushCursor, agentPushSourceId, agentPushUuid } from "./agent-push.ts";
+import { agentMessageTime, compareAgentMessages, normalizeAgentMessage, UNKNOWN_AGENT_TIME } from "./agent-messages.ts";
 
 export type AgentActivity = {
   state: "idle" | "thinking" | "tool" | "waiting" | "error";
@@ -57,7 +58,9 @@ function mergeMessage(previous: Message, incoming: Message): Message {
   const prior = metadata(previous), next = metadata(incoming);
   // A delayed activity snapshot must not demote an already placed user message.
   if (prior?.status === "complete" && next?.status === "queued") return previous;
-  if (prior?.kind !== "tool_call" || next?.kind !== "tool_call") return { ...previous, ...incoming };
+  const priorTime = agentMessageTime(previous), nextTime = agentMessageTime(incoming);
+  if (prior?.kind !== "tool_call" || next?.kind !== "tool_call") return { ...previous, ...incoming,
+    createdAt: nextTime ?? priorTime ?? UNKNOWN_AGENT_TIME };
   const terminal = prior.status === "completed" || prior.status === "failed";
   const staleStart = terminal && next.status === "initiated";
   const merged = staleStart ? { ...defined(next), ...defined(prior) } : { ...defined(prior), ...defined(next) };
@@ -65,23 +68,32 @@ function mergeMessage(previous: Message, incoming: Message): Message {
   const oldArgs = object(prior.args), newArgs = object(next.args);
   if (oldArgs && (!newArgs || Object.keys(newArgs).length === 0)) merged.args = oldArgs;
   return { ...previous, ...incoming, ...(staleStart ? { content: previous.content, name: previous.name } : {}),
-    createdAt: previous.createdAt < incoming.createdAt ? previous.createdAt : incoming.createdAt, metadata: merged };
+    createdAt: priorTime && nextTime ? (priorTime < nextTime ? priorTime : nextTime) : priorTime ?? nextTime ?? UNKNOWN_AGENT_TIME, metadata: merged };
 }
 
 /** Replays and separate tool-start/result pages update stable rows instead of duplicating them. */
 export function mergeAgentMessages(previous: readonly Message[], incoming: readonly Message[]): Message[] {
-  const messages = new Map(previous.map(message => [message.id, message]));
-  for (const message of incoming) {
+  const messages = new Map(previous.map(normalizeAgentMessage).map(message => [message.id, message]));
+  for (const message of incoming.map(normalizeAgentMessage)) {
     const prior = messages.get(message.id);
     messages.set(message.id, prior ? mergeMessage(prior, message) : message);
   }
-  return [...messages.values()].sort((a, b) => {
-    const byTime = a.createdAt.localeCompare(b.createdAt);
-    if (byTime) return byTime;
-    const left = messageCursor(a), right = messageCursor(b);
-    if (left !== null && right !== null && left !== right) return BigInt(left) < BigInt(right) ? -1 : 1;
-    return a.id.localeCompare(b.id);
-  });
+  return [...messages.values()].sort(compareAgentMessages);
+}
+
+function parseAgentPage(value: unknown): AgentMessagesPage {
+  const page = object(value);
+  if (!page || typeof page.conversationId !== "string" || !Array.isArray(page.messages) || typeof page.hasMore !== "boolean") throw new Error("Invalid agent messages frame.");
+  if (page.cursor !== null) normalizeAgentCursor(page.cursor);
+  if (page.beforeCursor != null) normalizeAgentCursor(page.beforeCursor);
+  return { ...page, beforeCursor: page.beforeCursor ?? null, messages: page.messages.map(normalizeAgentMessage) } as AgentMessagesPage;
+}
+function parseAgentActivity(value: unknown): AgentActivity {
+  const activity = object(value);
+  if (!activity || (activity.tools !== undefined && !Array.isArray(activity.tools))
+    || (activity.queuedMessages !== undefined && !Array.isArray(activity.queuedMessages))) throw new Error("Invalid agent activity frame.");
+  return { ...activity, tools: activity.tools ?? [],
+    queuedMessages: ((activity.queuedMessages ?? []) as unknown[]).map(normalizeAgentMessage) } as AgentActivity;
 }
 export const createAgentRoomState = (): AgentRoomState => ({
   conversationId: null, messages: [], cursor: "0", readCursor: "0", activity: null,
@@ -99,6 +111,7 @@ function readSource(state: Pick<AgentRoomState, "sourceId" | "cursor" | "readCur
   return incoming;
 }
 export function applyAgentPage(state: AgentRoomState, page: AgentMessagesPage): AgentRoomState {
+  page = parseAgentPage(page);
   if (state.conversationId !== null && state.conversationId !== page.conversationId) throw new Error("Agent conversation changed; reload the page.");
   // Validate before changing state. Failed delivery/decoding cannot advance replay position.
   const cursor = page.cursor === null ? state.cursor : advanceAgentCursor(state.cursor, page.cursor);
@@ -132,7 +145,7 @@ export function applyAgentEvent(state: AgentRoomState, event: AgentRoomEvent): A
   if (event.type === "read_state") return applyAgentReadState(state, event);
   if (event.type !== "activity") return state;
   if (state.conversationId !== null && state.conversationId !== event.conversationId) throw new Error("Agent activity belongs to a different conversation.");
-  return { ...state, conversationId: event.conversationId, activity: event.activity };
+  return { ...state, conversationId: event.conversationId, activity: parseAgentActivity(event.activity) };
 }
 export function agentUnreadCount(state: AgentRoomState): number {
   return state.messages.filter(message => {
@@ -153,15 +166,12 @@ export function parseAgentRoomEvent(raw: string): AgentRoomEvent | null {
     || (event.updatedAt !== null && typeof event.updatedAt !== "string")
     || (event.sourceId !== undefined && event.sourceId !== null && !agentPushSourceId(event.sourceId)))) throw new Error("Invalid Agent read frame.");
   if (event.type === "messages") {
-    if (typeof event.conversationId !== "string" || !Array.isArray(event.messages) || typeof event.hasMore !== "boolean") throw new Error("Invalid agent messages frame.");
-    if (event.cursor !== null) normalizeAgentCursor(event.cursor);
-    for (const item of event.messages) {
-      const message = object(item);
-      if (!message || typeof message.id !== "string" || typeof message.content !== "string" || typeof message.createdAt !== "string"
-        || !["system", "user", "assistant", "tool"].includes(String(message.role))) throw new Error("Invalid agent message.");
+    return { ...parseAgentPage(event), type: "messages" };
   }
+  if (event.type === "activity") {
+    if (typeof event.conversationId !== "string") throw new Error("Invalid agent activity frame.");
+    return { ...event, activity: parseAgentActivity(event.activity) } as AgentRoomEvent;
   }
-  if (event.type === "activity" && (typeof event.conversationId !== "string" || !object(event.activity))) throw new Error("Invalid agent activity frame.");
   return event as AgentRoomEvent;
 }
 export function agentAuthFrame(token: string | null, cursor: string, presenceSessionId?: string): string {
@@ -197,12 +207,16 @@ export class AgentRoomClient {
     }
     return value as T;
   }
-  descriptor(signal?: AbortSignal): Promise<AgentDescriptor> { return this.request("", { signal }); }
-  messages(after: string, signal?: AbortSignal): Promise<AgentMessagesPage> {
-    return this.request(`/messages?${new URLSearchParams({ after: normalizeAgentCursor(after), limit: "200" })}`, { signal });
+  async descriptor(signal?: AbortSignal): Promise<AgentDescriptor> {
+    const value = object(await this.request("", { signal }));
+    if (!value || typeof value.id !== "string") throw new Error("Invalid agent descriptor.");
+    return { ...value, activity: parseAgentActivity(value.activity) } as AgentDescriptor;
   }
-  history(before?: string, signal?: AbortSignal): Promise<AgentMessagesPage> {
-    return this.request(`/messages?${new URLSearchParams({ ...(before === undefined ? {} : { before: normalizeAgentCursor(before) }), limit: "100" })}`, { signal });
+  async messages(after: string, signal?: AbortSignal): Promise<AgentMessagesPage> {
+    return parseAgentPage(await this.request(`/messages?${new URLSearchParams({ after: normalizeAgentCursor(after), limit: "200" })}`, { signal }));
+  }
+  async history(before?: string, signal?: AbortSignal): Promise<AgentMessagesPage> {
+    return parseAgentPage(await this.request(`/messages?${new URLSearchParams({ ...(before === undefined ? {} : { before: normalizeAgentCursor(before) }), limit: "100" })}`, { signal }));
   }
   readState(signal?: AbortSignal): Promise<AgentReadState> { return this.request("/read-state", { signal }); }
   markRead(cursor: string, signal?: AbortSignal, sourceId?: string | null): Promise<AgentReadState> {

web/tests/agent-optimistic-outbox.test.mjs

@@ -7,6 +7,15 @@ const canonical = (id, content = "Hello", time = "2026-10-14T12:01:00.000Z") =>
   metadata: { kind: "message", entryId: 123, status: "complete", channel: "sybil" },
 });
 const deferred = () => { let resolve, reject; const promise = new Promise((yes, no) => { resolve = yes; reject = no; }); return { promise, resolve, reject }; };
+
+test("display sorts partial server rows and tied entry cursors consistently", () => {
+  const box = createAgentOptimisticOutbox({ submit: async () => assert.fail("no send"),
+    storage: { read: () => [], write: () => {} }, changed: () => {} });
+  const rows = [canonical("z"), { id: "tool:1:partial", role: "tool", name: "owner_phone_context" },
+    { ...canonical("a"), metadata: { entryId: 124 } }];
+  assert.deepEqual(box.display(rows).map(row => row.id), ["tool:1:partial", "z", "a"]);
+  assert.deepEqual(box.display([...rows].reverse()), box.display(rows));
+});
 function fixture(submit, legacy = {}) {
   let stored = null;
   let serial = 0;

web/tests/agent-room.test.mjs

@@ -21,6 +21,91 @@ const sourceA = "4599d348-e053-4937-987d-1392746fb2ce", sourceB = "22222222-2222
 const deferred = () => { let resolve; const promise = new Promise(yes => { resolve = yes; }); return { promise, resolve }; };
 const sourceRoom = () => applyAgentPage(applyAgentReadState(createAgentRoomState(), { sourceId: sourceA, cursor: "90", updatedAt: null }), page("100", [message(100)]));
 
+test("redacted historical tool rows survive REST loading, socket replay and outbox rendering", async () => {
+  const redacted = { id: "tool:1:protected", role: "tool", name: "owner_phone_context" };
+  const input = page("3", [message(1), redacted, message(3)]);
+  const client = new AgentRoomClient({ fetch: async () => Response.json(input) });
+  let state = createAgentRoomState();
+  await syncAgentHistory(client, "0", update => { state = applyAgentPage(state, update); });
+  const initial = state.messages;
+  assert.deepEqual((await client.history()).messages, (await client.messages("0")).messages,
+    "recent/older history uses the same boundary as forward replay");
+  const row = initial.find(row => row.id === redacted.id);
+  assert.equal(row.createdAt, "1970-01-01T00:00:00.000Z", "unknown times are stable, never fabricated as now");
+  assert.equal(row.content, "owner_phone_context");
+  assert.equal(state.cursor, "3");
+  const event = parseAgentRoomEvent(JSON.stringify({ type: "messages", ...input }));
+  state = applyAgentEvent(state, event);
+  assert.deepEqual(state.messages, initial, "replaying partial history is idempotent");
+  const box = createAgentOptimisticOutbox({ submit: async () => assert.fail("no send"),
+    storage: { read: () => [], write: () => {} }, changed: () => {} });
+  assert.deepEqual(box.display(agentDisplayMessages(state)), initial);
+});
+
+test("partial tool updates retain known time, terminal metadata and chronological ordering", () => {
+  const id = "tool:1:partial";
+  const start = message(2, "tool", { id, metadata: { kind: "tool_call", entryId: 2, status: "initiated", startedAt: "2026-10-14T10:00:02.000Z" } });
+  const done = message(3, "tool", { id, createdAt: undefined, metadata: { kind: "tool_call", entryId: 3, status: "completed", completedAt: "2026-10-14T10:00:03.000Z" } });
+  const partial = { id, role: "tool", name: "owner_phone_context" };
+  const rows = mergeAgentMessages([message(1), start], [done, partial, start, message(4)]);
+  assert.deepEqual(rows.map(row => row.id), ["entry:1", id, "entry:4"]);
+  assert.equal(rows[1].createdAt, start.createdAt);
+  assert.equal(rows[1].metadata.status, "completed");
+  assert.equal(rows[1].metadata.completedAt, done.metadata.completedAt);
+  assert.equal(mergeAgentMessages([], [done])[0].createdAt, done.metadata.completedAt);
+  assert.equal(mergeAgentMessages([partial], [start])[0].createdAt, start.createdAt);
+});
+
+test("an unknown historical tool start never masks a known completion timestamp", () => {
+  const unknown = "1970-01-01T00:00:00.000Z", known = "2026-10-14T10:00:03.000Z";
+  const start = message(2, "tool", { id: "tool:1:historical", createdAt: unknown,
+    metadata: { kind: "tool_call", entryId: 2, status: "initiated", startedAt: unknown } });
+  const done = message(3, "tool", { id: start.id, createdAt: known,
+    metadata: { kind: "tool_call", entryId: 3, status: "completed", completedAt: known } });
+  for (const rows of [[start, done], [done, start], [{ ...start, metadata: { ...start.metadata, ...done.metadata } }]]) {
+    const merged = mergeAgentMessages([], rows);
+    assert.equal(merged[0].createdAt, known);
+    assert.equal(merged[0].metadata.status, "completed");
+  }
+});
+
+test("missing, null, invalid and tied timestamps have stable ordering independent of arrival order", () => {
+  const rows = [message(11, "assistant", { createdAt: null }), message(2, "assistant", { createdAt: undefined }),
+    message(3, "assistant", { createdAt: "not-a-date" }), message(4, "assistant", { createdAt: 0 }),
+    message(5, "assistant", { createdAt: null, metadata: { kind: "message" } })];
+  const expected = ["entry:2", "entry:3", "entry:4", "entry:11", "entry:5"];
+  assert.deepEqual(mergeAgentMessages([], rows).map(row => row.id), expected);
+  assert.deepEqual(mergeAgentMessages([], [...rows].reverse()).map(row => row.id), expected);
+  const tied = [message(11, "assistant", { createdAt: "2026-10-14T10:00:00Z" }), message(2, "assistant", { createdAt: "2026-10-14T11:00:00+01:00" })];
+  assert.deepEqual(mergeAgentMessages([], tied).map(row => row.id), ["entry:2", "entry:11"]);
+});
+
+test("REST descriptors and socket activity normalize partial queued messages consistently", async () => {
+  const pending = message(1, "user", { id: "inbound:sybil:partial", createdAt: undefined, metadata: { kind: "message", status: "queued" } });
+  const value = { id: "1", activity: activity([pending]) };
+  const client = new AgentRoomClient({ fetch: async () => Response.json(value) });
+  const descriptor = await client.descriptor();
+  const fromRest = applyAgentEvent(createAgentRoomState(), { type: "activity", conversationId: descriptor.id, activity: descriptor.activity });
+  const fromSocket = applyAgentEvent(createAgentRoomState(), parseAgentRoomEvent(JSON.stringify({ type: "activity", conversationId: "1", activity: value.activity })));
+  assert.deepEqual(agentDisplayMessages(fromRest), agentDisplayMessages(fromSocket));
+  assert.equal(agentDisplayMessages(fromRest)[0].createdAt, "1970-01-01T00:00:00.000Z");
+  const malformed = { ...pending, content: undefined };
+  assert.throws(() => applyAgentEvent(fromRest, { type: "activity", conversationId: "1", activity: activity([malformed]) }), /Invalid agent message/);
+  assert.equal(fromRest.cursor, "0");
+});
+
+test("invalid message bodies fail at both transport boundaries before advancing replay", async () => {
+  for (const malformed of [null, { role: "assistant", content: "missing ID" }, message(2, "assistant", { content: null }), message(2, ["assistant"])]) {
+    const input = page("3", [message(1), malformed]);
+    const client = new AgentRoomClient({ fetch: async () => Response.json(input) });
+    let applied = false;
+    await assert.rejects(syncAgentHistory(client, "0", () => { applied = true; }), /Invalid agent message/);
+    await assert.rejects(client.history(), /Invalid agent message/);
+    assert.equal(applied, false);
+    assert.throws(() => parseAgentRoomEvent(JSON.stringify({ type: "messages", ...input })), /Invalid agent message/);
+  }
+});
+
 test("tool starts and results merge across replay without downgrading completed cards", () => {
   const start = message(2, "tool", { id: "tool:1:call1", metadata: { kind: "tool_call", entryId: 2, status: "initiated", args: { query: "cookie" }, startedAt: "2026-10-14T10:00:00Z" } });
   const done = message(3, "tool", { id: start.id, metadata: { kind: "tool_call", entryId: 3, status: "completed", resultPreview: "found" } });
@@ -312,7 +397,7 @@ test("client uses Sybil auth and routes while websocket credentials remain in th
   let token = "first-session-token";
   const client = new AgentRoomClient({ baseUrl: "https://sybil.example/api/", token: () => token, fetch: async (url, init) => {
     calls.push({ url, init }); return new Response(JSON.stringify(init.method === "POST"
-      ? { id: 1, status: "queued", messageId: "inbound:sybil:request-1" } : { cursor: "0", updatedAt: null }), { status: 200 });
+      ? { id: 1, status: "queued", messageId: "inbound:sybil:request-1" } : url.includes("/messages?") ? page("0") : { cursor: "0", updatedAt: null }), { status: 200 });
   } });
   await client.messages("0");
   token = "second-session-token";