Merge remote-tracking branch 'origin/main' into codex/remove-agent-pool-timeout

# Conflicts:
#	plugin/scripts/mcp-server.cjs
#	plugin/scripts/worker-service.cjs

src/npx-cli/commands/install.ts

@@ -540,7 +540,11 @@ function runNpmInstallInMarketplace(): void {
 
   if (!existsSync(packageJsonPath)) return;
 
-  execSync('npm install --production', {
+  // --legacy-peer-deps suppresses a known false-positive ERESOLVE between
+  // tree-sitter@0.21 and @tree-sitter-grammars/* peer ranges. The native
+  // bindings path is unused (we load .wasm), so the conflict is benign.
+  // Revisit if real peer constraints are added to the marketplace deps.
+  execSync('npm install --omit=dev --legacy-peer-deps', {
     cwd: marketplaceDir,
     stdio: 'pipe',
     encoding: 'utf8',

src/services/sqlite/schema.sql

@@ -6,7 +6,7 @@
 -- it via the migration runner.
 --
 -- Source of truth: src/services/sqlite/migrations/runner.ts
--- Regenerated by: PATHFINDER-2026-04-22 Plan 01 (Data Integrity).
+-- Regenerated from the migration runner and current schema invariants.
 --
 -- Invariants enforced here (Plan 01):
 --   * pending_messages.UNIQUE(content_session_id, tool_use_id) — replaces

src/services/worker/agents/ResponseProcessor.ts

@@ -35,14 +35,14 @@ export async function processAgentResponse(
   const parsed = parseAgentXml(text, session.contentSessionId);
 
   if (!parsed.valid) {
-    logger.warn('PARSER', `${agentName} returned unparseable response — leaving queue intact`, {
+    logger.warn('PARSER', `${agentName} returned non-XML/empty response — ignoring queued batch`, {
       sessionId: session.sessionDbId,
     });
-    // Reset claimed messages back to pending so they're re-claimed on the
-    // next pass instead of leaving them in `processing` (which counts toward
-    // pendingCount, which triggers a respawn loop, which trips the restart
-    // guard, which deletes the message — silent data loss).
-    sessionManager.getPendingMessageStore().resetProcessingToPending(session.sessionDbId);
+    // Plain-text skip responses are intentionally ignored. Re-queueing them
+    // creates an observer loop where the same low-signal batch is retried
+    // until the restart guard fires or the provider quota is exhausted.
+    sessionManager.clearPendingForSession(session.sessionDbId);
+    session.earliestPendingTimestamp = null;
     return;
   }