fix(daemon): avoid discarded health diagnosis census projections (#1920)

A malformed structured field on an unrelated row tagged health-diagnosis could prevent diagnosis enumeration. Read only matching IDs for the preliminary census, then read each owned occurrence fresh. Keep exact tag selection, newest-created ordering, and the 10,000-row refusal before filtering for ownership.

The preliminary census intentionally stops producing discarded row projections and their incidental activity effects and errors. Owned validation, custody, and human-delivery receipts retain their existing reads.

Validation: the regression fails on the base; implementation and independent QA each pass all 24 affected tests, and daemon typecheck passes. No production speedup or stall-cure result is claimed.

packages/daemon/src/domain/health-diagnosis.ts

@@ -83,9 +83,14 @@ export class HealthDiagnosisService {
   }
   list(refresh = true) {
     // Refuse a truncated ownership census rather than treating a hidden occurrence as absent.
-    const rows = this.deps.queue.list({ tag: "health-diagnosis", limit: 10000 });
-    if (rows.length === 10000) throw new Error("health_diagnosis_census_truncated");
-    const occurrences = rows.filter((r) => this.owns(r)).map((r) => this.show(r.qitemId, false));
+    // The same selection as queue.list({ tag, limit }) (exact tag membership, newest created first), reading only
+    // ids: a full row of every topical match would be built and discarded. show re-reads each owned row fresh.
+    const ids = (this.deps.queue.db.prepare(`SELECT qitem_id FROM queue_items
+      WHERE EXISTS (SELECT 1 FROM json_each(queue_items.tags) WHERE value = ?) ORDER BY ts_created DESC LIMIT ?`)
+      .all("health-diagnosis", 10000) as Array<{ qitem_id: string }>).map((r) => r.qitem_id);
+    if (ids.length === 10000) throw new Error("health_diagnosis_census_truncated");
+    // The tag is proven by the query; the id namespace marks an occurrence (show checks both on the fresh row).
+    const occurrences = ids.filter((id) => id.startsWith(this.id(""))).map((id) => this.show(id, false));
     if (!refresh) return occurrences;
     const current = new Map(this.deps.projection.records().map((finding) => [finding.id, finding]));
     return occurrences.map((o) => {

packages/daemon/test/health-diagnosis.test.ts

@@ -95,6 +95,23 @@ it("ignores a canceled topical Markdown receipt in the census and scheduled eval
   expect(t.queue.listTransitions(foreignId)).toEqual(transitions);
 });
 
+it("reads the census without projecting non-owned topical rows, and still refuses a full census before ownership", async () => {
+  const t = setup(); const p = t.policy.read().policy;
+  t.policy.apply({ ...p, diagnosis: { ...p.diagnosis, enabled: true, owner: "owner@rig" } }, "actor@rig");
+  const id = (await t.service.evaluate("actor@rig", true)).actions[0]!.qitemId;
+  // A topical row (not an occurrence) whose unrelated structured field is malformed: only a full row projection reads it.
+  const foreign = await t.queue.create({ sourceSession: "peer@rig", destinationSession: "owner@rig", nudge: false,
+    body: "topical note", tags: ["health-diagnosis"] });
+  t.db.prepare("UPDATE queue_items SET chain_of_record = ? WHERE qitem_id = ?").run("{not json", foreign.qitemId);
+  expect(t.service.list().map((o) => o.row.qitemId)).toEqual([id]);
+
+  // Exactly 10000 tagged rows refuses the census even though none of the extra rows is owned.
+  const insert = t.db.prepare(`INSERT INTO queue_items (qitem_id, ts_created, ts_updated, source_session, destination_session, state, body, tags)
+    VALUES (?, ?, ?, 'peer@rig', 'owner@rig', 'done', 'x', '["health-diagnosis"]')`);
+  t.db.transaction(() => { for (let i = 0; i < 9998; i++) insert.run(`qitem-topical-${i}`, "2026-09-01T00:00:00Z", "2026-09-01T00:00:00Z"); })();
+  expect(() => t.service.list()).toThrow("health_diagnosis_census_truncated");
+});
+
 it.each(["markdown", "null", "schema", "finding-id", "authority", "presentedAt"])("refuses corrupt owned occurrence state (%s) instead of hiding or certifying it", async (defect) => {
   const t = setup(); const p = t.policy.read().policy;
   t.policy.apply({ ...p, diagnosis: { ...p.diagnosis, enabled: true, owner: "owner@rig" } }, "actor@rig");