fix(hub): preserve invocation activity timestamps

[junmo-kim]

Problem

Session updatedAt is refreshed by an agent ready event after the CLI has already acknowledged prompt consumption. This moves sidebar recency from the closest observable prompt invocation time to response completion. Replayed messages-consumed acknowledgements can also move activity even though SQLite preserves the original message invocation transition.

Solution

Keep non-empty user text as session activity, but stop treating agent ready events as activity. Add an atomic store operation that marks fresh messages invoked and advances the namespaced session timestamp in the same transaction. Duplicate acknowledgements and rows already stamped by cancellation or session-end cleanup leave session activity unchanged, while replay can still synchronize the persisted timestamp back into the in-memory cache.

Post-commit activity callback failures are isolated from queue-grace handling and the existing messages-consumed SSE. The SSE keeps its established batch ACK timestamp contract; no wire format changes are introduced.

Tests

• Added Hub coverage for user text versus ready, first and duplicate consumption acknowledgements, partial batches, callback-failure replay, sibling-pre-invoked rows, heterogeneous and unknown IDs, wrong-namespace rollback, and archive timestamp stability.
• bun test hub/src/store/messages.test.ts hub/src/sync/sessionModel.test.ts
• bun typecheck
• bun run test
• Isolated Hub, Vite, fake CLI, and Playwright trace confirming duplicate consumption and ready do not move session activity after the first prompt-consumption ACK.

[github-actions]

Findings

• None.

Summary

Review mode: initial

No high-confidence correctness, security, regression, data-loss, performance, or maintainability issues found in the latest full diff. Residual risk is limited to timing-sensitive SQLite/cache synchronization under production concurrency; the added tests cover first-write, replay, partial-batch, unknown-ID, callback-failure, namespace-rollback, and ready-event behavior.

Testing

• Not run (automation). The repository test check passed for the reviewed head.

HAPI Bot