fix(agent-history): ignore sessions untouched before agent first seen

[dorokuma]

What & why

When a pane agent is first observed, its authoritative session ref (herdr detection or shepherd-pi registration) may not have landed yet, so history resolution falls back to discoverAgentHistory. Discovery scans fixed roots (~/.pi/agent/sessions and peers) and ranks candidates by cwd match plus mtime. If an unrelated, stale session file happens to share the pane's cwd, it gets picked as the "best" candidate; its content is then persisted into the agent's status events and delivered to the orchestrator's wake messages — misattributing another run's output to the new pane agent.

Observed signature: the first status events for a pane carry historyRef.kind === "discovered_file" whose content comes from an unrelated run; once the real registration lands, subsequent events use historyRef.kind === "agent_session" and are clean.

Fix principle

A session file untouched since before the agent's first_seen_at cannot be that agent's live session. Better to report no history than wrong history. Discovery now drops candidates whose mtime is older than firstSeenAtMs - DISCOVERY_RECENCY_GRACE_MS.

• The authoritative agentSession.kind === "path" branch is untouched — it is not a cwd-based guess.
• Grace window is 10 minutes. Herdr observation delay is on the second scale, so 10 minutes is far more generous than needed; it only discards sessions that had already stopped being written well before the agent appeared (the stale candidate in the repro was over an hour older than first_seen).
• firstSeenAtMs is optional. When omitted, behaviour is exactly as before, so cwd-guessing agents that don't pass it (claude / codex / gemini / …) are unaffected.

Changes

• src/agent-history/discovery.ts: add optional firstSeenAtMs to the lookup input, export DISCOVERY_RECENCY_GRACE_MS, and filter stale candidates before ranking.
• src/observability/agent-context-service.ts and src/daemon/observability-server.ts: pass agent.firstSeenAt into the history lookup.
• Tests: stale/grace/boundary/backward-compat cases in test/unit/agent-history-discovery.test.ts, plus a resolveCompactHistory passthrough test in test/unit/agent-history-service.test.ts.

Validation

• pnpm typecheck ✓
• pnpm lint / pnpm format:check ✓
• pnpm test: all tests pass except one pre-existing, unrelated failure in test/unit/shepherd-pi-extension.test.ts ("does not connect outside a complete Herdr environment"), which also fails on pristine origin/main in this environment.

[ryonakae]

Thanks for investigating the stale-session attribution issue. The problem is real, and filtering candidates by recency is a useful direction.

The current implementation still has correctness gaps that should be addressed before merging:

1. A previous session from the same cwd remains eligible for ten minutes, so a recently completed run can still be attributed to a newly started agent. After stale cwd-matching candidates are removed, a newer candidate from a different cwd may also be selected.

2. firstSeenAt is Shepherd's first observation time, not necessarily the agent process start time. When Shepherd first observes an already-running agent, valid history that has not been updated for ten minutes can be rejected. Conversely, first_seen_at can be retained when a stable terminal is reused, making the filter ineffective for a later run.

3. OpenCode cwd discovery and previously persisted discovered_file refs bypass the new recency check.

Please define a discovery rule that fails closed when candidate ownership cannot be established, and add tests for recently completed same-cwd sessions, different-cwd candidates, adoption of an already-running agent, OpenCode, and persisted discovered refs.

I agree with the goal of the PR, but I don't think the current filter is strong enough to prevent the misattribution it is intended to fix. Happy to re-review after these cases are addressed.