@agentunion/fastaun-browser 0.5.20 → 0.5.21

package/dist/client/v2-e2ee.js

@@ -1,4 +1,5 @@
 import { importCertPublicKeyEcdsa } from '../crypto.js';
+import { _INTERNAL_MESSAGE_FLOW_LIMITS } from '../config.js';
 import { E2EEError, StateError, ValidationError } from '../errors.js';
 import { decryptMessage, encryptGroupMessage, encryptP2PMessage, } from '../v2/e2ee/index.js';
 import { V2Session, V2KeyStore } from '../v2/session/index.js';
@@ -307,6 +308,7 @@ function v2E2eeMeta(envelope) {
         suite,
         encryption_mode: `v2_${suite || 'unknown'}`,
         forward_secrecy: true,
+        need_render: envelope.need_render !== false,
     };
     const protectedHeaders = metadataWithoutAuth(envelope.protected_headers);
     if (protectedHeaders && Object.keys(protectedHeaders).length > 0) {
@@ -329,6 +331,8 @@ function v2E2eeMeta(envelope) {
 function attachV2EnvelopeMetadata(message, meta) {
     if (!meta)
         return;
+    if (typeof meta.need_render === 'boolean')
+        message.need_render = meta.need_render;
     const payloadType = typeof meta.payload_type === 'string' ? meta.payload_type.trim() : '';
     if (payloadType)
         message.payload_type = payloadType;
@@ -799,11 +803,12 @@ export class V2E2EECoordinator {
             return null;
         }
     }
-    pendingSenderIKMessageKey(msg, groupId) {
+    pendingSenderIKMessageKey(msg, groupId, fromAid = '') {
         const client = this.client;
         const messageId = String(msg.message_id ?? '').trim();
         const seq = String(msg.seq ?? '').trim();
-        const prefix = groupId ? `group:${groupId}` : `p2p:${client._aid ?? ''}`;
+        const prefix = groupId ? `group:${groupId}` : client._p2pPeerPullEnabled
+            ? client._delivery.peerNamespace(String(fromAid || msg.sender_aid || msg.from_aid || msg.from || '')) : `p2p:${client._aid ?? ''}`;
         return `${prefix}:${messageId || seq || Math.random().toString(36).slice(2)}`;
     }
     pendingSenderIKFetchKey(fromAid, senderDeviceId, groupId) {
@@ -894,7 +899,7 @@ export class V2E2EECoordinator {
             return;
         const senderDeviceId = String(args.senderDeviceId ?? '');
         const groupId = String(args.groupId ?? '').trim();
-        const messageKey = this.pendingSenderIKMessageKey(args.msg, groupId);
+        const messageKey = this.pendingSenderIKMessageKey(args.msg, groupId, fromAid);
         client._v2SenderIKPending.set(messageKey, {
             msg: { ...args.msg },
             fromAid,
@@ -918,8 +923,9 @@ export class V2E2EECoordinator {
     }
     async resolveSenderIKPending(fromAid, senderDeviceId, groupId, fetchKey, generation) {
         const client = this.client;
-        const generationCurrent = () => generation === undefined
-            || client._delivery.isInlineGenerationCurrent?.(generation) !== false;
+        const runtimeGeneration = Number(client._v2RuntimeGeneration ?? 0);
+        const generationCurrent = () => Number(client._v2RuntimeGeneration ?? 0) === runtimeGeneration
+            && (generation === undefined || client._delivery.isInlineGenerationCurrent?.(generation) !== false);
         try {
             if (!generationCurrent())
                 return;
@@ -930,6 +936,8 @@ export class V2E2EECoordinator {
                         peer_aid: fromAid,
                         e2ee_wrap_capabilities: v2WrapCapabilities(),
                     });
+                    if (!generationCurrent())
+                        return;
                     const peers = (Array.isArray(bs?.peer_devices) ? bs.peer_devices : []);
                     for (const dev of peers)
                         client._cacheV2PeerIKFromDevice(dev, fromAid);
@@ -943,6 +951,8 @@ export class V2E2EECoordinator {
                             group_id: groupId,
                             e2ee_wrap_capabilities: v2WrapCapabilities(),
                         });
+                        if (!generationCurrent())
+                            return;
                         const devices = (Array.isArray(gbs?.devices) ? gbs.devices : []);
                         const audit = (Array.isArray(gbs?.audit_recipients) ? gbs.audit_recipients : []);
                         for (const dev of devices)
@@ -978,6 +988,8 @@ export class V2E2EECoordinator {
                 }
                 if (!generationCurrent())
                     return;
+                if (plaintext && client._p2pPeerPullEnabled && !entry.groupId)
+                    plaintext.need_render = entry.msg.need_render !== false;
                 if (plaintext === null) {
                     if (retryStatus.deferred) {
                         client._clientLog.warn(`V2 pending retry still missing key material: key=${key}`);
@@ -994,12 +1006,17 @@ export class V2E2EECoordinator {
                 }
                 if (!entry.groupId && String(entry.msg.storage ?? '') === 'volatile') {
                     await this.publishPendingV2VolatileMessage(entry.msg, plaintext, 'pending_retry');
+                    if (!generationCurrent())
+                        return;
                     client._v2SenderIKPending.delete(key);
+                    if (client._p2pPeerPullEnabled)
+                        client._delivery.schedulePeerRecovery(entry.fromAid, 0, true);
                     client._clientLog.debug(`V2 sender IK pending retry delivered: key=${key}`);
                     continue;
                 }
                 const seq = Number(entry.msg.seq ?? 0);
                 if (entry.groupId) {
+                    plaintext.need_render = typeof entry.msg.need_render === 'boolean' ? entry.msg.need_render : plaintext.need_render !== false;
                     if (client._delivery.isSelfSentGroupMessage?.(entry.msg)) {
                         client._v2SenderIKPending.delete(key);
                         continue;
@@ -1009,39 +1026,72 @@ export class V2E2EECoordinator {
                     await client._publishPulledMessage('group.message_created', `group:${entry.groupId}`, seq, plaintext, false, 'pending_retry');
                 }
                 else {
-                    await client._publishPulledMessage('message.received', `p2p:${client._aid ?? ''}`, seq, plaintext, false, 'pending_retry');
+                    if (client._p2pPeerPullEnabled) {
+                        await client._delivery.initializePeer(entry.fromAid);
+                        if (!generationCurrent())
+                            return;
+                    }
+                    const ns = client._p2pPeerPullEnabled ? client._delivery.peerNamespace(entry.fromAid) : `p2p:${client._aid ?? ''}`;
+                    await client._publishPulledMessage('message.received', ns, seq, plaintext, false, 'pending_retry');
+                    if (!generationCurrent())
+                        return;
+                    if (client._p2pPeerPullEnabled)
+                        client._delivery.schedulePeerRecovery(entry.fromAid, seq, false);
                 }
                 client._v2SenderIKPending.delete(key);
                 client._clientLog.debug(`V2 sender IK pending retry delivered: key=${key}`);
             }
         }
         finally {
-            client._v2SenderIKFetching.delete(fetchKey);
+            if (generationCurrent())
+                client._v2SenderIKFetching.delete(fetchKey);
         }
     }
     async publishPendingV2VolatileMessage(rawMessage, plaintext, source) {
-        const delivery = this.client._delivery;
+        const client = this.client;
+        const delivery = client._delivery;
+        const sender = String(rawMessage.sender_aid ?? rawMessage.from_aid ?? plaintext.from ?? '');
+        const ns = client._p2pPeerPullEnabled ? delivery.peerNamespace(sender) : '';
+        const generation = Number(client._v2RuntimeGeneration ?? 0);
+        const inlineGeneration = delivery.captureInlineGeneration?.();
+        const guard = () => { if (ns)
+            this.ensureDeliveryCurrent(ns, generation, inlineGeneration); };
+        const ack = async () => {
+            guard();
+            if (!ns) {
+                await delivery.ackVolatileMessages([rawMessage], true, false);
+                return;
+            }
+            await this.ackPeerV2({ sender_aid: sender, volatile_cursors: rawMessage.volatile_cursor ? [rawMessage.volatile_cursor] : [], volatile_ids: rawMessage.message_id ? [rawMessage.message_id] : [], _rpc_background: true });
+            guard();
+            if (rawMessage.volatile_cursor)
+                delivery.setPeerVolatileCursor(sender, String(rawMessage.volatile_cursor));
+        };
         const claim = delivery.beginVolatileDelivery(rawMessage);
         if (claim === 'inflight')
             return;
         if (claim === 'seen') {
-            await delivery.ackVolatileMessages([rawMessage], true, false);
+            await ack();
             return;
         }
         try {
             const publicMessage = delivery.publicVolatileMessage(plaintext);
-            for (const key of ['storage', 'volatile_cursor', 'created_at', 'expires_at', 'persist']) {
+            for (const key of ['storage', 'volatile_cursor', 'created_at', 'expires_at', 'persist', 'need_render']) {
                 if (key in rawMessage)
                     publicMessage[key] = rawMessage[key];
             }
             const appEvent = delivery.p2pAppEventForMessage(publicMessage);
-            await this.client._publishAppEvent(appEvent.event, appEvent.payload, source);
+            if (ns)
+                await client._publishAppEvent(appEvent.event, appEvent.payload, source, ns);
+            else
+                await client._publishAppEvent(appEvent.event, appEvent.payload, source);
+            guard();
             delivery.markVolatileSeen(rawMessage);
         }
         finally {
             delivery.finishVolatileDelivery(rawMessage);
         }
-        await delivery.ackVolatileMessages([rawMessage], true, false);
+        await ack();
     }
     async sendV2(to, payload, opts) {
         const client = this.client;
@@ -1059,6 +1109,7 @@ export class V2E2EECoordinator {
                 messageId: opts?.messageId,
                 timestamp: opts?.timestamp,
                 deviceId: targetDeviceId || undefined,
+                needRender: opts?.needRender !== false,
                 protectedHeaders: opts?.protectedHeaders,
                 context: opts?.context,
                 useCache,
@@ -1080,6 +1131,7 @@ export class V2E2EECoordinator {
                 payload,
                 message_id: opts?.messageId,
                 timestamp: opts?.timestamp,
+                need_render: opts?.needRender !== false,
                 protected_headers: opts?.protectedHeaders,
                 context: opts?.context,
             }, result, true);
@@ -1095,6 +1147,7 @@ export class V2E2EECoordinator {
                     payload,
                     message_id: opts?.messageId,
                     timestamp: opts?.timestamp,
+                    need_render: opts?.needRender !== false,
                     protected_headers: opts?.protectedHeaders,
                     context: opts?.context,
                 }, result, true);
@@ -1110,13 +1163,14 @@ export class V2E2EECoordinator {
             history_error: { code: 'decrypt_failed', message: reason },
         };
     }
-    ensureDeliveryCurrent(ns, generation, inlineGeneration) {
+    ensureDeliveryCurrent(ns, generation, inlineGeneration, namespaceGeneration) {
         if (Number(this.client._v2RuntimeGeneration ?? 0) !== generation
             || (inlineGeneration !== undefined && !this.client._delivery.isInlineGenerationCurrent(inlineGeneration))
+            || (namespaceGeneration !== undefined && this.client._delivery.isSeqNamespaceGenerationCurrent?.(ns, namespaceGeneration) === false)
             || this.client._rpcPipeline?.isPullNamespaceCurrent?.(ns) === false)
             throw new StateError('pull invalidated');
     }
-    async decodeP2PWindowMessage(msg, publish, history, source, orderedPublish = false) {
+    async decodeP2PWindowMessage(msg, publish, history, source, orderedPublish = false, applicationPage, deferredEffects) {
         const client = this.client;
         const seq = strictWindowSeq(msg.seq, 'messages[].seq', true);
         let plaintext = null;
@@ -1142,13 +1196,16 @@ export class V2E2EECoordinator {
             else if (isJsonObject(payload)
                 && ['e2ee.p2p_encrypted', 'e2ee.encrypted'].includes(payloadType)) {
                 msg = { ...msg, envelope_json: JSON.stringify(payload) };
-                plaintext = await client._decryptV2Message(msg, false, !history, true, true, undefined, false, source);
+                plaintext = deferredEffects
+                    ? await client._decryptV2Message(msg, false, !history, true, true, undefined, false, source, deferredEffects)
+                    : await client._decryptV2Message(msg, false, !history, true, true, undefined, false, source);
             }
         }
         else {
             plaintext = source === 'inline_push'
                 ? await client._decryptV2Message(msg, false, false, false, false)
-                : await client._decryptV2Message(msg, false);
+                : deferredEffects ? await client._decryptV2Message(msg, false, true, true, true, undefined, false, source, deferredEffects)
+                    : await client._decryptV2Message(msg, false);
         }
         if (!plaintext) {
             if (history)
@@ -1162,15 +1219,18 @@ export class V2E2EECoordinator {
         if (publish) {
             const event = client._delivery.p2pAppEventForMessage(plaintext);
             if (orderedPublish) {
-                await client._delivery.publishOrderedMessage(event.event, client._aid ? `p2p:${client._aid}` : '', seq, event.payload, source);
+                await client._delivery.publishOrderedMessage(event.event, client._aid ? `p2p:${client._aid}` : '', seq, event.payload, source, undefined, applicationPage);
+            }
+            else if (event.event === 'message.recalled' && typeof client._delivery.publishMessageRecallTombstone === 'function') {
+                await client._delivery.publishMessageRecallTombstone(seq, plaintext, source, applicationPage);
             }
             else {
-                await client._publishAppEvent(event.event, event.payload, source);
+                await client._publishAppEvent(event.event, event.payload, source, applicationPage?.namespace ?? '', undefined, applicationPage);
             }
         }
         return plaintext;
     }
-    async decodeGroupWindowMessage(msg, groupId, groupAid, publish, history, source, orderedPublish = false) {
+    async decodeGroupWindowMessage(msg, groupId, groupAid, publish, history, source, orderedPublish = false, applicationPage) {
         const client = this.client;
         const seq = strictWindowSeq(msg.seq, 'messages[].seq', true);
         let plaintext = null;
@@ -1188,10 +1248,13 @@ export class V2E2EECoordinator {
                 };
                 if (publish) {
                     if (orderedPublish) {
-                        await client._delivery.publishOrderedMessage('group.message_recalled', `group:${groupId}`, seq, recallPayload, source);
+                        await client._delivery.publishOrderedMessage('group.message_recalled', `group:${groupId}`, seq, recallPayload, source, undefined, applicationPage);
+                    }
+                    else if (typeof client._delivery.publishGroupRecallTombstone === 'function') {
+                        await client._delivery.publishGroupRecallTombstone(groupId, seq, recallPayload, source, applicationPage);
                     }
                     else {
-                        await client._publishAppEvent('group.message_recalled', recallPayload, source);
+                        await client._publishAppEvent('group.message_recalled', recallPayload, source, applicationPage?.namespace ?? '', undefined, applicationPage);
                     }
                 }
                 return recallPayload;
@@ -1242,15 +1305,16 @@ export class V2E2EECoordinator {
             client._clientLog.warn(`Group Tail 单条消息解密失败，连续性证明仍保留: group=${groupId}, seq=${seq}`);
             return null;
         }
+        plaintext.need_render = typeof msg.need_render === 'boolean' ? msg.need_render : plaintext.need_render !== false;
         if (publish && !history && client._delivery.isSelfSentGroupMessage?.(msg)) {
             return plaintext;
         }
         if (publish) {
             if (orderedPublish) {
-                await client._delivery.publishOrderedMessage('group.message_created', `group:${groupId}`, seq, plaintext, source);
+                await client._delivery.publishOrderedMessage('group.message_created', `group:${groupId}`, seq, plaintext, source, undefined, applicationPage);
             }
             else {
-                await client._publishAppEvent('group.message_created', plaintext, source);
+                await client._publishAppEvent('group.message_created', plaintext, source, applicationPage?.namespace ?? '', undefined, applicationPage);
             }
         }
         return plaintext;
@@ -1280,11 +1344,19 @@ export class V2E2EECoordinator {
         const result = await client._callRawV2Rpc('message.v2.pull', { window_mode: 'tail', after_seq: afterSeq, limit, _rpc_foreground: true }, pullGateKey);
         const page = validateTailPage(result, afterSeq, limit);
         const decoded = [];
-        for (const msg of page.messages) {
-            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-            const plaintext = await this.decodeP2PWindowMessage(msg, true, false, 'tail', deferPublish);
-            if (plaintext)
-                decoded.push(plaintext);
+        const applicationPage = client._delivery.beginApplicationPage?.(ns, 'tail');
+        try {
+            for (const msg of page.messages) {
+                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                const plaintext = await this.decodeP2PWindowMessage(msg, true, false, 'tail', deferPublish, applicationPage);
+                if (plaintext)
+                    decoded.push(plaintext);
+            }
+            await client._delivery.flushApplicationPage?.(applicationPage);
+        }
+        catch (error) {
+            client._delivery.abortApplicationPage?.(applicationPage, error);
+            throw error;
         }
         this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
         if (ns) {
@@ -1292,7 +1364,7 @@ export class V2E2EECoordinator {
                 windowStartSeq: page.windowStart, headSeq: page.head, coveredThroughSeq: page.head, pageLimit: limit,
             };
             if (deferPublish)
-                client._delivery.deferTailWindow(ns, proof);
+                client._delivery.deferTailWindow(ns, proof, applicationPage);
             else {
                 client._seqTracker.commitTailWindow(ns, proof);
                 client._persistSeq(ns);
@@ -1306,6 +1378,491 @@ export class V2E2EECoordinator {
         client._delivery.onPullWorkSettled?.();
         return { ...result, messages: decoded, raw_count: page.messages.length };
     }
+    peerPageChains = new Map();
+    peerRequestId = 0;
+    async serializePeerPage(ns, operation) {
+        const previous = this.peerPageChains.get(ns) ?? Promise.resolve();
+        let release;
+        const current = new Promise((resolve) => { release = resolve; });
+        this.peerPageChains.set(ns, current);
+        await previous.catch(() => undefined);
+        try {
+            return await operation();
+        }
+        finally {
+            release();
+            if (this.peerPageChains.get(ns) === current)
+                this.peerPageChains.delete(ns);
+        }
+    }
+    hasPeerPageActivity(ns) {
+        return this.peerPageChains.has(ns);
+    }
+    validatePeerPage(result, sender, after, limit, tail, committedAck, preparing = false) {
+        if (result.cursor_scope !== 'peer' || result.sender_aid !== sender)
+            throw new ValidationError('peer response scope mismatch');
+        const scan = strictWindowSeq(result.scan_after_seq ?? (tail ? after : undefined), 'scan_after_seq');
+        const covered = strictWindowSeq(result.covered_through_seq, 'covered_through_seq');
+        const next = strictWindowSeq(result.next_after_seq ?? (tail ? covered : undefined), 'next_after_seq');
+        const head = strictWindowSeq(result.head_seq, 'head_seq');
+        const safeStart = Math.max(after, committedAck, strictWindowSeq(result.retention_floor_seq ?? 0, 'retention_floor_seq'));
+        if (scan < after || (!preparing && scan > safeStart) || covered < scan || covered > head || next !== covered)
+            throw new ValidationError('invalid peer coverage proof');
+        if (!tail && (typeof result.has_more !== 'boolean' || (result.persistent_has_more !== undefined && typeof result.persistent_has_more !== 'boolean')
+            || (result.volatile_has_more !== undefined && typeof result.volatile_has_more !== 'boolean')
+            || (!tail && covered < head && result.persistent_has_more !== true)
+            || (result.persistent_has_more !== undefined && result.has_more !== (result.persistent_has_more === true || result.volatile_has_more === true))))
+            throw new ValidationError('invalid peer continuation proof');
+        const start = tail ? strictWindowSeq(result.window_start_seq, 'window_start_seq') : scan + 1;
+        if (tail && (covered !== head || start > head + 1 || start <= scan))
+            throw new ValidationError('invalid peer tail proof');
+        if (!Array.isArray(result.messages) || result.messages.length > limit)
+            throw new ValidationError('invalid peer page limit');
+        const messages = result.messages;
+        const seen = new Map();
+        for (const row of messages) {
+            if (String(row.sender_aid ?? row.from_aid ?? row.from ?? '') !== sender)
+                throw new ValidationError('peer message sender mismatch');
+            if (this.client._delivery.isVolatileMessage?.(row) || row.storage === 'volatile')
+                continue;
+            const seq = strictWindowSeq(row.seq, 'messages[].seq', true);
+            if (seq <= scan || seq > covered || (tail && seq < start))
+                throw new ValidationError('peer message outside coverage');
+            const serialized = JSON.stringify(row);
+            if (seen.has(seq) && seen.get(seq) !== serialized)
+                throw new ValidationError('conflicting peer delivery');
+            seen.set(seq, serialized);
+        }
+        return { messages, covered, head, start };
+    }
+    async pullPeerV2(sender, params = {}, background = false, budget = { remaining: 100 }, options = {}) {
+        const client = this.client;
+        if (!sender)
+            throw new ValidationError('sender_aid is required');
+        if (params.cursor_scope !== undefined && params.cursor_scope !== 'peer')
+            throw new ValidationError('cursor_scope must equal peer');
+        const limit = strictWindowSeq(params.limit ?? _INTERNAL_MESSAGE_FLOW_LIMITS.pullPageSize, 'limit', true);
+        if (limit > 200)
+            throw new ValidationError('limit must be <= 200');
+        if (params.window_mode !== undefined && params.window_mode !== 'tail')
+            throw new ValidationError('window_mode must equal tail');
+        if (params.window_mode === 'tail' && (params.force === true || params.ack_up_to_seq !== undefined))
+            throw new ValidationError('Tail does not accept force or ack_up_to_seq');
+        const generation = Number(client._v2RuntimeGeneration ?? 0);
+        const inlineGeneration = client._delivery.captureInlineGeneration?.();
+        await client._delivery.initializePeer(sender);
+        const ns = client._delivery.peerNamespace(sender);
+        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+        const requestId = ++this.peerRequestId;
+        const messages = [];
+        let prefetched = null;
+        const cancelled = new AbortController();
+        const reservations = new Set();
+        const preparedApplicationPages = new Set();
+        let durableAck = client._delivery.peerDurableAck?.(ns) ?? client._seqTracker.getContiguousSeq(ns);
+        let confirmedAck = 0;
+        const fetchPage = async (after, cursor, isTail) => {
+            const reservation = await client._dispatcher?._reserveMessageCapacity?.(limit, cancelled.signal);
+            if (reservation)
+                reservations.add(reservation);
+            try {
+                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                if (cancelled.signal.aborted)
+                    throw new StateError('pull invalidated');
+                const request = { cursor_scope: 'peer', sender_aid: sender, after_seq: after, limit,
+                    ...(isTail ? { window_mode: 'tail' } : {}), ...(params.force === true ? { force: true } : {}),
+                    ...(!isTail && cursor ? { after_volatile_cursor: cursor } : {}), ...(background ? { _rpc_background: true } : { _rpc_foreground: true }),
+                };
+                const key = `${ns}|peer=${background ? 'background' : 'application'}|request=${requestId}|after=${after}|tail=${isTail}|force=${params.force === true}|volatile=${cursor}`;
+                const raw = await client._runPullSerialized(key, async () => {
+                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                    if (cancelled.signal.aborted)
+                        throw new StateError('pull invalidated');
+                    if (!isTail && params.force !== true && durableAck > 0)
+                        request.ack_up_to_seq = durableAck;
+                    return await client._callRawV2Rpc('message.v2.pull', request, key);
+                }, background);
+                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                if (cancelled.signal.aborted)
+                    throw new StateError('pull invalidated');
+                return { raw, reservation };
+            }
+            catch (error) {
+                reservation?.release();
+                if (reservation)
+                    reservations.delete(reservation);
+                throw error;
+            }
+        };
+        const decodeRow = async (row, source, deferredEffects) => {
+            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+            if (cancelled.signal.aborted)
+                throw new StateError('pull invalidated');
+            if (row.version !== 'v1' || this.isEncryptedEnvelopePayload(row.legacy_v1?.payload ?? row.payload)) {
+                await client._ensureV2SessionReady?.('message.pull');
+                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+            }
+            const plaintext = await this.decodeP2PWindowMessage(row, false, false, source, false, undefined, deferredEffects);
+            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+            if (!plaintext)
+                throw new E2EEError(`peer delivery could not be decrypted: seq=${Number(row.seq)}`);
+            plaintext.need_render = row.need_render !== false;
+            return plaintext;
+        };
+        const startNextRaw = (raw, after, cursor) => {
+            const proof = this.validatePeerPage(raw, sender, after, limit, false, durableAck, true);
+            const persistentMore = raw.persistent_has_more === true || (raw.persistent_has_more === undefined && raw.has_more === true && raw.volatile_has_more !== true);
+            if (params.force === true || !persistentMore || raw.volatile_has_more === true || proof.covered <= after || budget.remaining <= 0
+                || proof.messages.some((row) => client._delivery.isVolatileMessage?.(row) || row.storage === 'volatile'))
+                return undefined;
+            budget.remaining -= 1;
+            return { after: proof.covered, cursor, response: fetchPage(proof.covered, cursor, false).then((result) => ({ result }), (error) => ({ error })) };
+        };
+        const preparePage = async (pending) => {
+            const outcome = await pending.response;
+            if (outcome.error)
+                throw outcome.error;
+            const page = outcome.result;
+            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+            if (cancelled.signal.aborted)
+                throw new StateError('pull invalidated');
+            const proof = this.validatePeerPage(page.raw, sender, pending.after, limit, false, durableAck, true);
+            const applicationPage = client._delivery.beginApplicationPage?.(ns, 'pull', page.reservation);
+            if (applicationPage)
+                preparedApplicationPages.add(applicationPage);
+            const next = startNextRaw(page.raw, pending.after, pending.cursor);
+            const decoded = new Map();
+            const deferredEffects = [];
+            try {
+                for (const row of [...proof.messages].sort((a, b) => Number(a.seq ?? 0) - Number(b.seq ?? 0))) {
+                    if (client._delivery.isVolatileMessage?.(row) || row.storage === 'volatile' || decoded.has(Number(row.seq)))
+                        continue;
+                    decoded.set(Number(row.seq), await decodeRow(row, 'pull', deferredEffects));
+                }
+            }
+            catch (error) {
+                return { ...page, decoded, next, applicationPage, deferredEffects, failure: { error } };
+            }
+            return { ...page, decoded, next, applicationPage, deferredEffects };
+        };
+        let complete = false;
+        let head = 0;
+        let explicitAfter = params.after_seq === undefined ? undefined : strictWindowSeq(params.after_seq, 'after_seq');
+        let explicitVolatileCursor = params.after_volatile_cursor === undefined ? undefined : String(params.after_volatile_cursor);
+        let tail = params.window_mode === 'tail' || (params.window_mode === undefined && params.force !== true && await client._delivery.ownPeerType?.() === 'human'
+            && client._seqTracker.getSyncState(ns).head <= client._seqTracker.getContiguousSeq(ns));
+        let failed = false;
+        try {
+            while ((budget.remaining > 0 || prefetched !== null) && !complete) {
+                const page = await this.serializePeerPage(ns, async () => {
+                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                    const cached = prefetched;
+                    prefetched = null;
+                    if (!cached && budget.remaining <= 0)
+                        return null;
+                    if (!cached)
+                        budget.remaining -= 1;
+                    const oldAck = client._delivery.peerDurableAck?.(ns) ?? client._seqTracker.getContiguousSeq(ns);
+                    durableAck = oldAck;
+                    const after = cached?.after ?? explicitAfter ?? oldAck;
+                    if (!cached && params.force !== true && explicitAfter !== undefined && explicitAfter > oldAck)
+                        throw new ValidationError('after_seq exceeds committed peer cursor; use force for explicit rereads');
+                    const volatileCursor = cached?.cursor ?? String(explicitVolatileCursor ?? client._delivery.peerVolatileCursor?.(sender) ?? '');
+                    let prepared;
+                    try {
+                        if (cached) {
+                            const outcome = await cached.response;
+                            if (outcome.error)
+                                throw outcome.error;
+                            prepared = outcome.result;
+                        }
+                        else
+                            prepared = { ...await fetchPage(after, volatileCursor, tail), decoded: new Map() };
+                    }
+                    catch (error) {
+                        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                        if (volatileCursor && String(error).toLowerCase().includes('volatile cursor epoch mismatch')) {
+                            explicitVolatileCursor = undefined;
+                            client._delivery.setPeerVolatileCursor(sender, '');
+                            return { retry: true };
+                        }
+                        throw error;
+                    }
+                    try {
+                        const raw = prepared.raw;
+                        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                        const proof = this.validatePeerPage(raw, sender, after, limit, tail, tail || params.force === true ? after : oldAck);
+                        for (const effect of prepared.deferredEffects ?? []) {
+                            await effect();
+                            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                        }
+                        if (prepared.failure)
+                            throw prepared.failure.error;
+                        const serverAck = safeNonNegativeSeq(raw.server_ack_seq ?? raw.peer_ack_seq);
+                        if (serverAck !== null && params.force !== true && !tail) {
+                            confirmedAck = Math.max(confirmedAck, Math.min(serverAck, durableAck));
+                            this.clearForwardAck(ns, confirmedAck);
+                        }
+                        const persistentMore = raw.persistent_has_more === true || (raw.persistent_has_more === undefined && raw.has_more === true && raw.volatile_has_more !== true);
+                        const volatileMore = raw.volatile_has_more === true;
+                        const nextRaw = prepared.next ?? (!tail ? startNextRaw(raw, after, volatileCursor) : undefined);
+                        if (nextRaw) {
+                            prefetched = { after: nextRaw.after, cursor: nextRaw.cursor, response: preparePage(nextRaw).then((result) => ({ result }), (error) => ({ error })) };
+                        }
+                        const decoded = [];
+                        const seen = new Set();
+                        const volatileRows = [];
+                        const applicationPage = prepared.applicationPage ?? client._delivery.beginApplicationPage?.(ns, tail ? 'tail' : 'pull', prepared.reservation);
+                        try {
+                            await client._withPullResponseProcessing(ns, async () => {
+                                for (const row of [...proof.messages].sort((a, b) => Number(a.seq ?? 0) - Number(b.seq ?? 0))) {
+                                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                                    if (client._delivery.isVolatileMessage?.(row) || row.storage === 'volatile') {
+                                        volatileRows.push(row);
+                                        continue;
+                                    }
+                                    const seq = Number(row.seq);
+                                    if (seen.has(seq))
+                                        continue;
+                                    seen.add(seq);
+                                    const plaintext = prepared.decoded.get(seq) ?? await decodeRow(row, tail ? 'tail' : 'pull');
+                                    const event = client._delivery.p2pAppEventForMessage(plaintext);
+                                    if (!client._delivery.isSelfSentP2PMessage?.(plaintext)) {
+                                        if (event.event === 'message.recalled')
+                                            await client._delivery.publishMessageRecallTombstone(seq, plaintext, tail ? 'tail' : 'pull', applicationPage);
+                                        else
+                                            await client._publishAppEvent(event.event, event.payload, tail ? 'tail' : 'pull', ns, undefined, applicationPage);
+                                    }
+                                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                                    decoded.push(plaintext);
+                                }
+                                if (volatileRows.length > 0)
+                                    decoded.push(...await this.publishPeerVolatileMessages(sender, volatileRows, background, generation, inlineGeneration, applicationPage));
+                            });
+                            await client._delivery.flushApplicationPage?.(applicationPage);
+                        }
+                        catch (error) {
+                            client._delivery.abortApplicationPage?.(applicationPage, error);
+                            throw error;
+                        }
+                        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                        if (params.force !== true) {
+                            const snapshot = client._seqTracker.snapshotNamespace(ns);
+                            try {
+                                if (tail && proof.start > oldAck + 1) {
+                                    client._seqTracker.commitTailWindow(ns, { windowStartSeq: proof.start, headSeq: proof.head, coveredThroughSeq: proof.covered, pageLimit: limit, sparse: true, messageCount: seen.size });
+                                }
+                                else
+                                    client._seqTracker.forceContiguousSeq(ns, Math.max(oldAck, proof.covered));
+                                await client._commitSeqTrackerState(ns);
+                                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                                durableAck = client._delivery.peerDurableAck?.(ns) ?? client._seqTracker.getContiguousSeq(ns);
+                                if (durableAck > confirmedAck)
+                                    this.recordForwardAck(ns, durableAck);
+                            }
+                            catch (error) {
+                                if (Number(client._v2RuntimeGeneration ?? 0) === generation
+                                    && (inlineGeneration === undefined || client._delivery.isInlineGenerationCurrent(inlineGeneration))
+                                    && client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false)
+                                    client._seqTracker._restoreNamespaceSnapshotPreservingPush(ns, snapshot);
+                                throw error;
+                            }
+                            const ack = client._seqTracker.getContiguousSeq(ns);
+                            if (ack > 0) {
+                                if (!tail)
+                                    client._delivery.consumePeerBackgroundPullPriority?.(ns, proof.covered, persistentMore && typeof raw.next_pending_seq === 'number' && Number.isSafeInteger(raw.next_pending_seq)
+                                        && raw.next_pending_seq > proof.covered && raw.next_pending_seq <= proof.head ? raw.next_pending_seq : undefined);
+                            }
+                        }
+                        return { decoded, proof, persistentMore, volatileMore, after, tail, volatileCursor,
+                            nextVolatileCursor: String(client._delivery.peerVolatileCursor?.(sender) ?? '') };
+                    }
+                    finally {
+                        if (prepared.applicationPage) {
+                            client._delivery.abortApplicationPage?.(prepared.applicationPage, new StateError('peer page abandoned'));
+                            preparedApplicationPages.delete(prepared.applicationPage);
+                        }
+                        prepared.reservation?.release();
+                        if (prepared.reservation)
+                            reservations.delete(prepared.reservation);
+                    }
+                });
+                if (!page)
+                    break;
+                if (page.retry)
+                    continue;
+                explicitVolatileCursor = undefined;
+                if (options.retainMessages !== false)
+                    messages.push(...page.decoded);
+                head = Math.max(head, page.proof.head);
+                if (page.tail) {
+                    tail = false;
+                    explicitAfter = undefined;
+                    if (params.window_mode === 'tail') {
+                        complete = client._seqTracker.getContiguousSeq(ns) >= page.proof.head;
+                        break;
+                    }
+                }
+                else {
+                    explicitAfter = page.proof.covered;
+                    complete = !page.persistentMore && !page.volatileMore;
+                    if (!complete && page.proof.covered <= page.after && page.nextVolatileCursor === page.volatileCursor)
+                        break;
+                }
+            }
+        }
+        catch (error) {
+            failed = true;
+            throw error;
+        }
+        finally {
+            cancelled.abort();
+            for (const applicationPage of preparedApplicationPages)
+                client._delivery.abortApplicationPage?.(applicationPage, new StateError('pull invalidated'));
+            preparedApplicationPages.clear();
+            for (const reservation of reservations)
+                reservation.release();
+            reservations.clear();
+            if (params.force !== true && this.pendingForwardAck(ns, durableAck) > confirmedAck) {
+                try {
+                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                    await this.ackPeerV2({ cursor_scope: 'peer', sender_aid: sender, up_to_seq: durableAck, ...(background ? { _rpc_background: true } : {}) });
+                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                    this.clearForwardAck(ns, durableAck);
+                }
+                catch (error) {
+                    if (Number(client._v2RuntimeGeneration ?? 0) === generation
+                        && (inlineGeneration === undefined || client._delivery.isInlineGenerationCurrent(inlineGeneration))
+                        && client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false)
+                        client._delivery.schedulePeerRecovery?.(sender, head, true);
+                    if (!failed)
+                        throw error;
+                }
+            }
+        }
+        const ack = client._seqTracker.getContiguousSeq(ns);
+        if (!complete && params.force !== true)
+            client._delivery.schedulePeerRecovery(sender, head, true);
+        return { sender_aid: sender, messages, complete, ack_seq: ack, head_seq: head };
+    }
+    async publishPeerVolatileMessages(sender, rows, background, generation, inlineGeneration, applicationPage) {
+        const client = this.client;
+        const ns = client._delivery.peerNamespace(sender);
+        const published = [];
+        const processed = [];
+        for (const row of rows) {
+            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+            await client._delivery.waitVolatileApplicationDelivery?.(row, applicationPage);
+            const claim = client._delivery.beginVolatileDelivery(row, applicationPage);
+            if (claim === 'inflight')
+                throw new StateError('volatile delivery in progress', { retryable: true });
+            try {
+                let plaintext;
+                if (client._isEncryptedPushMessage(row)) {
+                    await client._ensureV2SessionReady?.('message.pull');
+                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                    plaintext = await client._decryptV2Message(row, false);
+                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                }
+                else {
+                    const legacy = isJsonObject(row.legacy_v1) ? row.legacy_v1 : {};
+                    plaintext = { ...row, from: row.from_aid ?? row.from, payload: legacy.payload ?? row.payload, encrypted: false };
+                }
+                if (!plaintext)
+                    throw new E2EEError('volatile peer message could not be decrypted');
+                plaintext.storage = 'volatile';
+                plaintext.need_render = row.need_render !== false;
+                const message = client._delivery.publicVolatileMessage(plaintext);
+                if (claim !== 'seen') {
+                    await client._publishAppEvent('message.received', message, 'pull', client._delivery.peerNamespace(sender), undefined, applicationPage);
+                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                    client._delivery.markVolatileSeen(row, applicationPage);
+                    client._delivery.finishVolatileDelivery(row, applicationPage);
+                }
+                processed.push(row);
+                published.push(message);
+            }
+            catch (error) {
+                if (claim !== 'seen')
+                    client._delivery.finishVolatileDelivery(row, applicationPage);
+                throw error;
+            }
+        }
+        const cursors = processed.map((row) => String(row.volatile_cursor ?? '')).filter(Boolean);
+        const ids = processed.map((row) => String(row.message_id ?? '')).filter(Boolean);
+        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+        if (cursors.length || ids.length) {
+            const ack = async () => { await this.ackPeerV2({ sender_aid: sender, volatile_cursors: cursors, volatile_ids: ids, ...(background ? { _rpc_background: true } : {}) }); };
+            if (applicationPage?.batch)
+                client._delivery.deferApplicationAfterDelivery(applicationPage, ack);
+            else
+                await ack();
+        }
+        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+        if (cursors.length)
+            client._delivery.setPeerVolatileCursor(sender, cursors[cursors.length - 1], applicationPage);
+        return published;
+    }
+    async ackPeerV2(params) {
+        const client = this.client;
+        const generation = Number(client._v2RuntimeGeneration ?? 0);
+        const inlineGeneration = client._delivery.captureInlineGeneration?.();
+        const session = client._v2Session;
+        const sender = String(params.sender_aid ?? params.peer_aid ?? '').trim();
+        if (!sender || (params.cursor_scope !== undefined && params.cursor_scope !== 'peer'))
+            throw new ValidationError('peer ACK requires sender_aid and cursor_scope=peer');
+        const ns = client._delivery.peerNamespace(sender);
+        const ack = client._delivery.peerDurableAck?.(ns) ?? client._seqTracker.getContiguousSeq(ns);
+        const requested = params.up_to_seq ?? params.seq ?? ack;
+        const seq = strictWindowSeq(requested, 'up_to_seq');
+        const target = Math.min(seq, ack);
+        const result = await client._callRawV2Rpc('message.v2.ack', { cursor_scope: 'peer', sender_aid: sender,
+            ...(target > 0 ? { up_to_seq: target } : {}), ...(Array.isArray(params.volatile_cursors) ? { volatile_cursors: params.volatile_cursors } : {}),
+            ...(Array.isArray(params.volatile_ids) ? { volatile_ids: params.volatile_ids } : {}),
+            ...(params._rpc_background ? { _rpc_background: true } : { _rpc_foreground: true }),
+        });
+        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+        const actual = safeNonNegativeSeq(result.peer_ack_seq ?? result.effective_ack_seq ?? result.server_ack_seq);
+        if (target > 0 && (actual === null || actual < target))
+            throw new E2EEError('peer ACK watermark below target');
+        if (actual !== null)
+            this.clearForwardAck(ns, actual);
+        const safeDevice = safeNonNegativeSeq(result.device_safe_ack_seq);
+        if (safeDevice !== null && safeDevice > 0 && client._v2Session === session)
+            await session?.maybeDestroyOldSPKs(safeDevice);
+        return { ...result, ack_seq: actual ?? 0 };
+    }
+    async historyPeerV2(params) {
+        const generation = Number(this.client._v2RuntimeGeneration ?? 0);
+        const inlineGeneration = this.client._delivery.captureInlineGeneration?.();
+        const sender = String(params.sender_aid ?? params.peer_aid ?? '').trim();
+        if (!sender || (params.cursor_scope !== undefined && params.cursor_scope !== 'peer'))
+            throw new ValidationError('peer History requires sender_aid');
+        const before = strictWindowSeq(params.before_seq, 'before_seq', true);
+        const limit = strictWindowSeq(params.limit ?? _INTERNAL_MESSAGE_FLOW_LIMITS.pullPageSize, 'limit', true);
+        if (limit > 200)
+            throw new ValidationError('limit must be <= 200');
+        const request = { cursor_scope: 'peer', sender_aid: sender, before_seq: before, limit, ...(params.snapshot_head_seq !== undefined ? { snapshot_head_seq: params.snapshot_head_seq } : {}) };
+        const ns = this.client._delivery.peerNamespace(sender);
+        const result = await this.client._runPullSerialized(`${ns}|history|before=${before}|limit=${limit}|snapshot=${String(params.snapshot_head_seq ?? '')}`, () => this.client._callRawV2Rpc('message.history', request), false);
+        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+        if (result.cursor_scope !== 'peer' || result.sender_aid !== sender)
+            throw new ValidationError('peer History scope mismatch');
+        const rows = validateHistoryPage(result, before);
+        if (rows.length > limit || rows.some((row) => String(row.sender_aid ?? row.from_aid ?? row.from ?? '') !== sender))
+            throw new ValidationError('invalid peer History messages');
+        const messages = [];
+        for (const row of rows) {
+            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+            const value = await this.decodeP2PWindowMessage(row, false, true, 'history');
+            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+            if (value) {
+                value.need_render = row.need_render !== false;
+                messages.push(value);
+            }
+        }
+        return { ...result, messages };
+    }
     async historyV2Internal(params) {
         const beforeSeq = strictWindowSeq(params.before_seq, 'before_seq', true);
         const limit = strictWindowLimit(params.limit ?? V2_PULL_DEFAULT_PAGE_LIMIT);
@@ -1464,321 +2021,333 @@ export class V2E2EECoordinator {
         };
         try {
             while (pageCount < maxPages) {
-                let pipelinePage;
-                if (pipelineRunning) {
-                    pipelinePage = await pipelineQueue.take();
-                    if (!pipelinePage) {
-                        pipelineRunning = false;
-                        if (pipelineError)
-                            throw pipelineError;
-                        break;
-                    }
-                }
-                pageCount += 1;
-                const volatileCursorBeforePage = pipelinePage?.requestedVolatileCursor ?? volatileCursor;
-                const ackUpToSeq = pipelinePage?.ackUpToSeq ?? pendingAckSeq;
-                const pendingInlineGeneration = pipelinePage?.inlineAckGeneration ?? (ackUpToSeq > 0
-                    ? client._delivery?.pendingP2PInlineAckGeneration?.(ns) ?? null
-                    : null);
-                let result;
-                if (pipelinePage) {
-                    nextAfterSeq = pipelinePage.afterSeq;
-                    result = pipelinePage.result;
-                }
-                else {
-                    try {
-                        result = await client._callRawV2Rpc('message.v2.pull', {
-                            after_seq: nextAfterSeq,
-                            limit,
-                            ...(volatileCursor ? { after_volatile_cursor: volatileCursor } : {}),
-                            ...(opts?.force ? { force: true } : {}),
-                            ...(ackUpToSeq > 0 ? { ack_up_to_seq: ackUpToSeq } : {}),
-                        }, pullGateKey);
-                    }
-                    catch (exc) {
-                        const text = exc instanceof Error ? exc.message : String(exc);
-                        if (!volatileCursor || !text.toLowerCase().includes('volatile cursor epoch mismatch'))
-                            throw exc;
-                        client._delivery.resetVolatilePullCursor();
-                        volatileCursor = '';
-                        pageCount -= 1;
-                        continue;
-                    }
-                }
-                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-                if (!opts?.force)
-                    client._delivery.observeBackgroundPullResponse?.(ns, nextAfterSeq, result, limit);
-                if (ackUpToSeq > 0) {
-                    const actualAckSeq = client._delivery?.resolveP2PPullAckSeq?.(result, ackUpToSeq) ?? 0;
-                    if (actualAckSeq >= ackUpToSeq) {
-                        if (pendingInlineGeneration !== null) {
-                            client._delivery?.completePendingP2PInlineAckUpTo?.(ns, actualAckSeq, pendingInlineGeneration);
+                let applicationPage;
+                try {
+                    let pipelinePage;
+                    if (pipelineRunning) {
+                        pipelinePage = await pipelineQueue.take();
+                        if (!pipelinePage) {
+                            pipelineRunning = false;
+                            if (pipelineError)
+                                throw pipelineError;
+                            break;
                         }
-                        if (pendingAckSeq <= ackUpToSeq)
-                            pendingAckSeq = 0;
-                        lastAutoAckSeq = Math.max(lastAutoAckSeq, ackUpToSeq);
-                        this.clearForwardAck(ns, ackUpToSeq);
+                    }
+                    pageCount += 1;
+                    const volatileCursorBeforePage = pipelinePage?.requestedVolatileCursor ?? volatileCursor;
+                    const ackUpToSeq = pipelinePage?.ackUpToSeq ?? pendingAckSeq;
+                    const pendingInlineGeneration = pipelinePage?.inlineAckGeneration ?? (ackUpToSeq > 0
+                        ? client._delivery?.pendingP2PInlineAckGeneration?.(ns) ?? null
+                        : null);
+                    let result;
+                    if (pipelinePage) {
+                        nextAfterSeq = pipelinePage.afterSeq;
+                        result = pipelinePage.result;
                     }
                     else {
-                        client._clientLog.warn(`message.v2.pull piggyback ACK below target: requested=${ackUpToSeq}, actual=${actualAckSeq}; fallback terminal ACK`);
-                        pendingAckSeq = Math.max(pendingAckSeq, ackUpToSeq);
-                        this.recordForwardAck(ns, ackUpToSeq);
+                        try {
+                            result = await client._callRawV2Rpc('message.v2.pull', {
+                                after_seq: nextAfterSeq,
+                                limit,
+                                ...(volatileCursor ? { after_volatile_cursor: volatileCursor } : {}),
+                                ...(opts?.force ? { force: true } : {}),
+                                ...(ackUpToSeq > 0 ? { ack_up_to_seq: ackUpToSeq } : {}),
+                            }, pullGateKey);
+                        }
+                        catch (exc) {
+                            const text = exc instanceof Error ? exc.message : String(exc);
+                            if (!volatileCursor || !text.toLowerCase().includes('volatile cursor epoch mismatch'))
+                                throw exc;
+                            client._delivery.resetVolatilePullCursor();
+                            volatileCursor = '';
+                            pageCount -= 1;
+                            continue;
+                        }
                     }
-                }
-                const pageMessages = (Array.isArray(result?.messages) ? result.messages : []);
-                const volatileMessages = client._delivery.volatileMessages(pageMessages);
-                if (volatileMessages.length > 0) {
-                    decrypted.push(...await this.publishV2VolatileMessages(volatileMessages, 'pull', true));
-                    volatileCursor = client._delivery.volatilePullCursor();
-                }
-                const volatileAdvanced = Boolean(volatileCursor) && volatileCursor !== volatileCursorBeforePage;
-                const messages = deduplicateForwardPageMessages(pageMessages, nextAfterSeq);
-                const cursor = isJsonObject(result.cursor) ? result.cursor : null;
-                const hasMoreField = Object.prototype.hasOwnProperty.call(result, 'has_more');
-                const hasMore = result.has_more === true;
-                const serverHead = safeNonNegativeSeq(cursor?.latest_seq) ?? 0;
-                client._clientLog.debug(`message.v2.pull page response: page=${pageCount}, raw_count=${messages.length}, stale_count=${Math.max(0, pageMessages.length - messages.length)}, has_more=${String(result.has_more ?? '')}, server_head=${serverHead}, server_ack_seq=${String(result.server_ack_seq ?? '')}`);
-                const seqs = messages
-                    .map((msg) => Number(msg.seq ?? 0))
-                    .filter((seq) => Number.isFinite(seq) && seq > 0);
-                const pageContigBefore = ns ? client._seqTracker.getContiguousSeq(ns) : 0;
-                let pageTrackerSnapshot;
-                const pageMaxSeq = seqs.length > 0 ? Math.max(...seqs) : nextAfterSeq;
-                const pageContiguousSeq = contiguousPullSeq(pageContigBefore, seqs, result.contiguous_seq);
-                if (!pipelineRunning && volatileMessages.length === 0 && shouldContinueForwardPage({
-                    rawCount: messages.length, nextAfterSeq, nextAfter: pageMaxSeq, limit,
-                    hasMoreField, hasMore, serverHead, pendingAckSeq: 0,
-                    observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
-                        ? client._seqTracker.getMaxSeenSeq(ns) : pageMaxSeq,
-                }))
-                    startPipeline(pageMaxSeq, volatileCursor);
-                const deferredKeyFetches = new Map();
-                let blockedSeq = 0;
-                const pageDecryptedBefore = decrypted.length;
-                for (const msg of messages) {
-                    const seq = Number(msg.seq ?? 0);
-                    if (!Number.isFinite(seq) || seq <= 0)
-                        continue;
-                    const version = String(msg.version ?? 'v2');
-                    if (version === 'v1') {
-                        const legacy = isJsonObject(msg.legacy_v1) ? msg.legacy_v1 : {};
-                        const legacyPayload = legacy.payload !== undefined ? legacy.payload : msg.payload;
-                        const payloadType = isJsonObject(legacyPayload)
-                            ? String(legacyPayload.type ?? '').trim()
-                            : '';
-                        if (legacyPayload !== undefined && legacyPayload !== null
-                            && !['e2ee.encrypted', 'e2ee.group_encrypted', 'e2ee.p2p_encrypted'].includes(payloadType)) {
-                            const v1Msg = {
-                                message_id: String(msg.message_id ?? ''),
-                                from: String(msg.from_aid ?? ''),
-                                to: String(legacy.to ?? client._aid ?? ''),
-                                seq: msg.seq,
-                                type: String(msg.type ?? ''),
-                                timestamp: msg.t_server,
-                                payload: legacyPayload,
-                                encrypted: false,
-                            };
-                            const direction = String(msg.direction ?? '').trim();
-                            if (direction)
-                                v1Msg.direction = direction;
-                            else if (String(msg.from_aid ?? '').trim() && String(msg.from_aid ?? '').trim() !== String(client._aid ?? '').trim()) {
-                                v1Msg.direction = 'inbound';
+                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                    if (!opts?.force)
+                        client._delivery.observeBackgroundPullResponse?.(ns, nextAfterSeq, result, limit);
+                    if (ackUpToSeq > 0) {
+                        const actualAckSeq = client._delivery?.resolveP2PPullAckSeq?.(result, ackUpToSeq) ?? 0;
+                        if (actualAckSeq >= ackUpToSeq) {
+                            if (pendingInlineGeneration !== null) {
+                                client._delivery?.completePendingP2PInlineAckUpTo?.(ns, actualAckSeq, pendingInlineGeneration);
                             }
-                            if (msg.sender_device_id !== undefined)
-                                v1Msg.sender_device_id = msg.sender_device_id;
-                            attachGatewayProximity(v1Msg, msg);
-                            const appEvent = client._delivery.p2pAppEventForMessage(v1Msg);
-                            if (ns)
-                                await client._publishPulledMessage(appEvent.event, ns, seq, appEvent.payload, false);
-                            else
-                                await client._publishAppEvent(appEvent.event, appEvent.payload, 'pull');
-                            decrypted.push(v1Msg);
+                            if (pendingAckSeq <= ackUpToSeq)
+                                pendingAckSeq = 0;
+                            lastAutoAckSeq = Math.max(lastAutoAckSeq, ackUpToSeq);
+                            this.clearForwardAck(ns, ackUpToSeq);
+                        }
+                        else {
+                            client._clientLog.warn(`message.v2.pull piggyback ACK below target: requested=${ackUpToSeq}, actual=${actualAckSeq}; fallback terminal ACK`);
+                            pendingAckSeq = Math.max(pendingAckSeq, ackUpToSeq);
+                            this.recordForwardAck(ns, ackUpToSeq);
                         }
-                        else if (isJsonObject(legacyPayload)
-                            && ['e2ee.p2p_encrypted', 'e2ee.encrypted'].includes(payloadType)) {
-                            const deferStatus = {};
-                            const plaintext = await client._decryptV2Message({ ...msg, envelope_json: JSON.stringify(legacyPayload) }, true, true, true, true, deferStatus, true, 'pull');
-                            if (deferStatus.deferred) {
-                                blockedSeq = blockedSeq > 0 ? Math.min(blockedSeq, seq) : seq;
-                                if (deferStatus.fromAid) {
-                                    const key = `${deferStatus.fromAid}\u0000${deferStatus.senderDeviceId ?? ''}\u0000${deferStatus.groupId ?? ''}`;
-                                    deferredKeyFetches.set(key, { fromAid: deferStatus.fromAid, senderDeviceId: deferStatus.senderDeviceId ?? '', groupId: deferStatus.groupId ?? '' });
+                    }
+                    applicationPage = client._delivery.beginApplicationPage?.(ns);
+                    const pageMessages = (Array.isArray(result?.messages) ? result.messages : []);
+                    const volatileMessages = client._delivery.volatileMessages(pageMessages);
+                    if (volatileMessages.length > 0) {
+                        decrypted.push(...await this.publishV2VolatileMessages(volatileMessages, 'pull', true, applicationPage));
+                    }
+                    const messages = deduplicateForwardPageMessages(pageMessages, nextAfterSeq);
+                    const cursor = isJsonObject(result.cursor) ? result.cursor : null;
+                    const hasMoreField = Object.prototype.hasOwnProperty.call(result, 'has_more');
+                    const hasMore = result.has_more === true;
+                    const serverHead = safeNonNegativeSeq(cursor?.latest_seq) ?? 0;
+                    client._clientLog.debug(`message.v2.pull page response: page=${pageCount}, raw_count=${messages.length}, stale_count=${Math.max(0, pageMessages.length - messages.length)}, has_more=${String(result.has_more ?? '')}, server_head=${serverHead}, server_ack_seq=${String(result.server_ack_seq ?? '')}`);
+                    const seqs = messages
+                        .map((msg) => Number(msg.seq ?? 0))
+                        .filter((seq) => Number.isFinite(seq) && seq > 0);
+                    const pageContigBefore = ns ? client._seqTracker.getContiguousSeq(ns) : 0;
+                    let pageTrackerSnapshot;
+                    const pageMaxSeq = seqs.length > 0 ? Math.max(...seqs) : nextAfterSeq;
+                    const pageContiguousSeq = contiguousPullSeq(pageContigBefore, seqs, result.contiguous_seq);
+                    if (!pipelineRunning && volatileMessages.length === 0 && shouldContinueForwardPage({
+                        rawCount: messages.length, nextAfterSeq, nextAfter: pageMaxSeq, limit,
+                        hasMoreField, hasMore, serverHead, pendingAckSeq: 0,
+                        observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
+                            ? client._seqTracker.getMaxSeenSeq(ns) : pageMaxSeq,
+                    }))
+                        startPipeline(pageMaxSeq, volatileCursor);
+                    const deferredKeyFetches = new Map();
+                    let blockedSeq = 0;
+                    const pageDecryptedBefore = decrypted.length;
+                    for (const msg of messages) {
+                        const seq = Number(msg.seq ?? 0);
+                        if (!Number.isFinite(seq) || seq <= 0)
+                            continue;
+                        const version = String(msg.version ?? 'v2');
+                        if (version === 'v1') {
+                            const legacy = isJsonObject(msg.legacy_v1) ? msg.legacy_v1 : {};
+                            const legacyPayload = legacy.payload !== undefined ? legacy.payload : msg.payload;
+                            const payloadType = isJsonObject(legacyPayload)
+                                ? String(legacyPayload.type ?? '').trim()
+                                : '';
+                            if (legacyPayload !== undefined && legacyPayload !== null
+                                && !['e2ee.encrypted', 'e2ee.group_encrypted', 'e2ee.p2p_encrypted'].includes(payloadType)) {
+                                const v1Msg = {
+                                    message_id: String(msg.message_id ?? ''),
+                                    from: String(msg.from_aid ?? ''),
+                                    to: String(legacy.to ?? client._aid ?? ''),
+                                    seq: msg.seq,
+                                    type: String(msg.type ?? ''),
+                                    timestamp: msg.t_server,
+                                    payload: legacyPayload,
+                                    encrypted: false,
+                                };
+                                const direction = String(msg.direction ?? '').trim();
+                                if (direction)
+                                    v1Msg.direction = direction;
+                                else if (String(msg.from_aid ?? '').trim() && String(msg.from_aid ?? '').trim() !== String(client._aid ?? '').trim()) {
+                                    v1Msg.direction = 'inbound';
                                 }
-                            }
-                            if (plaintext) {
+                                if (msg.sender_device_id !== undefined)
+                                    v1Msg.sender_device_id = msg.sender_device_id;
+                                attachGatewayProximity(v1Msg, msg);
+                                const appEvent = client._delivery.p2pAppEventForMessage(v1Msg);
                                 if (ns)
-                                    await client._publishPulledMessage('message.received', ns, seq, plaintext, false);
+                                    await client._publishPulledMessage(appEvent.event, ns, seq, appEvent.payload, false, 'pull', undefined, applicationPage);
                                 else
-                                    await client._publishAppEvent('message.received', plaintext, 'pull');
-                                decrypted.push(plaintext);
+                                    await client._publishAppEvent(appEvent.event, appEvent.payload, 'pull', ns, undefined, applicationPage);
+                                decrypted.push(v1Msg);
+                            }
+                            else if (isJsonObject(legacyPayload)
+                                && ['e2ee.p2p_encrypted', 'e2ee.encrypted'].includes(payloadType)) {
+                                const deferStatus = {};
+                                const plaintext = await client._decryptV2Message({ ...msg, envelope_json: JSON.stringify(legacyPayload) }, true, true, true, true, deferStatus, true, 'pull');
+                                if (deferStatus.deferred) {
+                                    blockedSeq = blockedSeq > 0 ? Math.min(blockedSeq, seq) : seq;
+                                    if (deferStatus.fromAid) {
+                                        const key = `${deferStatus.fromAid}\u0000${deferStatus.senderDeviceId ?? ''}\u0000${deferStatus.groupId ?? ''}`;
+                                        deferredKeyFetches.set(key, { fromAid: deferStatus.fromAid, senderDeviceId: deferStatus.senderDeviceId ?? '', groupId: deferStatus.groupId ?? '' });
+                                    }
+                                }
+                                if (plaintext) {
+                                    if (ns)
+                                        await client._publishPulledMessage('message.received', ns, seq, plaintext, false, 'pull', undefined, applicationPage);
+                                    else
+                                        await client._publishAppEvent('message.received', plaintext, 'pull', ns, undefined, applicationPage);
+                                    decrypted.push(plaintext);
+                                }
+                            }
+                            else {
+                                client._clientLog.debug(`message.v2.pull skipping V1 envelope seq=${seq} payload_type=${payloadType || '<none>'} (V1 E2EE removed)`);
                             }
+                            continue;
+                        }
+                        if (version !== 'v2') {
+                            client._clientLog.debug(`message.v2.pull skipping non-V2 row seq=${seq} version=${String(msg.version ?? '')}`);
+                            continue;
+                        }
+                        const msgSpkId = String(msg.spk_id ?? '');
+                        if (msgSpkId && client._v2Session && !client._v2Session.isCurrentSPK(msgSpkId)) {
+                            client._v2Session.trackOldSPKMaxSeq(msgSpkId, seq);
+                        }
+                        const deferStatus = {};
+                        const plaintext = await client._decryptV2Message(msg, true, true, true, true, deferStatus, true, 'pull');
+                        if (deferStatus.deferred) {
+                            blockedSeq = blockedSeq > 0 ? Math.min(blockedSeq, seq) : seq;
+                        }
+                        if (deferStatus.deferred && deferStatus.fromAid) {
+                            const key = `${deferStatus.fromAid}\u0000${deferStatus.senderDeviceId ?? ''}\u0000${deferStatus.groupId ?? ''}`;
+                            deferredKeyFetches.set(key, {
+                                fromAid: deferStatus.fromAid,
+                                senderDeviceId: deferStatus.senderDeviceId ?? '',
+                                groupId: deferStatus.groupId ?? '',
+                            });
+                        }
+                        if (plaintext === null)
+                            continue;
+                        if (ns) {
+                            await client._publishPulledMessage('message.received', ns, seq, plaintext, false, 'pull', undefined, applicationPage);
+                            decrypted.push(plaintext);
                         }
                         else {
-                            client._clientLog.debug(`message.v2.pull skipping V1 envelope seq=${seq} payload_type=${payloadType || '<none>'} (V1 E2EE removed)`);
+                            await client._publishAppEvent('message.received', plaintext, 'pull', ns, undefined, applicationPage);
+                            decrypted.push(plaintext);
                         }
-                        continue;
                     }
-                    if (version !== 'v2') {
-                        client._clientLog.debug(`message.v2.pull skipping non-V2 row seq=${seq} version=${String(msg.version ?? '')}`);
-                        continue;
-                    }
-                    const msgSpkId = String(msg.spk_id ?? '');
-                    if (msgSpkId && client._v2Session && !client._v2Session.isCurrentSPK(msgSpkId)) {
-                        client._v2Session.trackOldSPKMaxSeq(msgSpkId, seq);
-                    }
-                    const deferStatus = {};
-                    const plaintext = await client._decryptV2Message(msg, true, true, true, true, deferStatus, true, 'pull');
-                    if (deferStatus.deferred) {
-                        blockedSeq = blockedSeq > 0 ? Math.min(blockedSeq, seq) : seq;
-                    }
-                    if (deferStatus.deferred && deferStatus.fromAid) {
-                        const key = `${deferStatus.fromAid}\u0000${deferStatus.senderDeviceId ?? ''}\u0000${deferStatus.groupId ?? ''}`;
-                        deferredKeyFetches.set(key, {
-                            fromAid: deferStatus.fromAid,
-                            senderDeviceId: deferStatus.senderDeviceId ?? '',
-                            groupId: deferStatus.groupId ?? '',
-                        });
-                    }
-                    if (plaintext === null)
-                        continue;
+                    const hasServerAckSeq = Object.prototype.hasOwnProperty.call(result, 'server_ack_seq');
+                    const parsedServerAckSeq = hasServerAckSeq ? safeNonNegativeSeq(result.server_ack_seq) : null;
+                    const serverAckSeq = parsedServerAckSeq ?? 0;
+                    const retentionFloor = Math.max(0, Number(result.retention_floor_seq ?? 0));
                     if (ns) {
-                        await client._publishPulledMessage('message.received', ns, seq, plaintext, false);
-                        decrypted.push(plaintext);
-                    }
-                    else {
-                        await client._publishAppEvent('message.received', plaintext, 'pull');
-                        decrypted.push(plaintext);
-                    }
-                }
-                const hasServerAckSeq = Object.prototype.hasOwnProperty.call(result, 'server_ack_seq');
-                const parsedServerAckSeq = hasServerAckSeq ? safeNonNegativeSeq(result.server_ack_seq) : null;
-                const serverAckSeq = parsedServerAckSeq ?? 0;
-                const retentionFloor = Math.max(0, Number(result.retention_floor_seq ?? 0));
-                if (ns) {
-                    let commitTarget = Math.max(pageContigBefore, Number.isFinite(retentionFloor) ? retentionFloor : 0, pageCount === 1 ? deferredServerCursor : 0, serverAckSeq, blockedSeq > 0 ? blockedSeq - 1 : pageContiguousSeq);
-                    commitTarget = client._delivery.pendingTailDeliveryThrough?.(ns, commitTarget) ?? commitTarget;
-                    let ackSeq = pageContigBefore;
-                    let contigAdvanced = false;
-                    try {
-                        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-                        const state = client._seqTracker.getSyncState?.(ns);
-                        const deliveryThrough = client._delivery.pendingTailDeliveryThrough?.(ns, state && commitTarget >= state.tail - 1 ? Math.max(commitTarget, state.head) : commitTarget) ?? (state && commitTarget >= state.tail - 1 ? Math.max(commitTarget, state.head) : commitTarget);
-                        await client._drainOrderedMessages(ns, undefined, false, false, deliveryThrough);
-                        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-                        pageTrackerSnapshot = client._seqTracker.snapshotNamespace?.(ns);
-                        client._delivery.commitPendingTailWindow?.(ns, commitTarget);
-                        if (commitTarget > pageContigBefore) {
-                            client._seqTracker.forceContiguousSeq(ns, commitTarget);
-                            if (retentionFloor > pageContigBefore) {
-                                client._clientLog.info(`message.v2.pull retention-floor advance: ns=${ns} contiguous=${pageContigBefore} -> retention_floor_seq=${retentionFloor}`);
+                        let commitTarget = Math.max(pageContigBefore, Number.isFinite(retentionFloor) ? retentionFloor : 0, pageCount === 1 ? deferredServerCursor : 0, serverAckSeq, blockedSeq > 0 ? blockedSeq - 1 : pageContiguousSeq);
+                        commitTarget = client._delivery.pendingTailDeliveryThrough?.(ns, commitTarget) ?? commitTarget;
+                        let ackSeq = pageContigBefore;
+                        let contigAdvanced = false;
+                        try {
+                            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                            const state = client._seqTracker.getSyncState?.(ns);
+                            const deliveryThrough = client._delivery.pendingTailDeliveryThrough?.(ns, state && commitTarget >= state.tail - 1 ? Math.max(commitTarget, state.head) : commitTarget) ?? (state && commitTarget >= state.tail - 1 ? Math.max(commitTarget, state.head) : commitTarget);
+                            await client._drainOrderedMessages(ns, undefined, false, false, deliveryThrough, applicationPage);
+                            await client._delivery.flushApplicationPage?.(applicationPage);
+                            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                            pageTrackerSnapshot = client._seqTracker.snapshotNamespace?.(ns);
+                            client._delivery.commitPendingTailWindow?.(ns, commitTarget);
+                            if (commitTarget > pageContigBefore) {
+                                client._seqTracker.forceContiguousSeq(ns, commitTarget);
+                                if (retentionFloor > pageContigBefore) {
+                                    client._clientLog.info(`message.v2.pull retention-floor advance: ns=${ns} contiguous=${pageContigBefore} -> retention_floor_seq=${retentionFloor}`);
+                                }
+                                if (deferredServerCursor > pageContigBefore && pageCount === 1) {
+                                    client._clientLog.info(`message.v2.pull restore local A from deferred server ACK cursor: ns=${ns}, contiguous=${pageContigBefore} -> server_ack_seq=${deferredServerCursor}`);
+                                }
+                                if (seqs.length > 0) {
+                                    client._clientLog.debug(`message.v2.pull force contiguous: ns=${ns}, page_max_seq=${pageMaxSeq}, previous=${pageContigBefore}`);
+                                }
                             }
-                            if (deferredServerCursor > pageContigBefore && pageCount === 1) {
-                                client._clientLog.info(`message.v2.pull restore local A from deferred server ACK cursor: ns=${ns}, contiguous=${pageContigBefore} -> server_ack_seq=${deferredServerCursor}`);
+                            ackSeq = client._seqTracker.getContiguousSeq(ns);
+                            contigAdvanced = ackSeq !== pageContigBefore;
+                            if (contigAdvanced) {
+                                await client._commitSeqTrackerState(ns);
+                                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                                if (pageCount === 1 && deferredServerCursor > 0)
+                                    this.clearForwardCursor(ns, ackSeq);
                             }
-                            if (seqs.length > 0) {
-                                client._clientLog.debug(`message.v2.pull force contiguous: ns=${ns}, page_max_seq=${pageMaxSeq}, previous=${pageContigBefore}`);
+                            client._delivery.completePendingTailWindow?.(ns);
+                            committedAckSeq = ackSeq;
+                        }
+                        catch (exc) {
+                            if (Number(client._v2RuntimeGeneration ?? 0) === generation
+                                && (inlineGeneration === undefined || client._delivery.isInlineGenerationCurrent(inlineGeneration))
+                                && client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false
+                                && pageTrackerSnapshot !== undefined
+                                && typeof client._seqTracker.restoreNamespaceSnapshot === 'function') {
+                                client._seqTracker._restoreNamespaceSnapshotPreservingPush(ns, pageTrackerSnapshot);
                             }
+                            client._clientLog.error?.(`message.v2.pull Forward commit rolled back: ns=${ns} target=${commitTarget} error=${formatE2EEError(exc)}`);
+                            throw exc;
                         }
-                        ackSeq = client._seqTracker.getContiguousSeq(ns);
-                        contigAdvanced = ackSeq !== pageContigBefore;
-                        if (contigAdvanced) {
-                            await client._commitSeqTrackerState(ns);
-                            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-                            if (pageCount === 1 && deferredServerCursor > 0)
-                                this.clearForwardCursor(ns, ackSeq);
+                        for (const fetch of deferredKeyFetches.values()) {
+                            this.scheduleSenderIKFetch(fetch.fromAid, fetch.senderDeviceId, fetch.groupId);
                         }
-                        client._delivery.completePendingTailWindow?.(ns);
-                        committedAckSeq = ackSeq;
-                    }
-                    catch (exc) {
-                        if (Number(client._v2RuntimeGeneration ?? 0) === generation
-                            && (inlineGeneration === undefined || client._delivery.isInlineGenerationCurrent(inlineGeneration))
-                            && client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false
-                            && pageTrackerSnapshot !== undefined
-                            && typeof client._seqTracker.restoreNamespaceSnapshot === 'function') {
-                            client._seqTracker._restoreNamespaceSnapshotPreservingPush(ns, pageTrackerSnapshot);
+                        if (parsedServerAckSeq !== null && serverAckSeq > ackSeq) {
+                            this.recordForwardCursor(ns, serverAckSeq, ackSeq);
+                        }
+                        // 无本页服务端水位时，只有本页成功提交了比已知服务端更高的 A
+                        // 才新增 ACK 义务。空页不能仅因本地已有 A 而重复 ACK。
+                        const knownServerAckSeq = hasServerAckSeq
+                            ? serverAckSeq
+                            : (pageCount === 1 ? deferredServerCursor : 0);
+                        const ackNeeded = ackSeq > 0
+                            && ackSeq > lastAutoAckSeq
+                            && ((hasServerAckSeq && ackSeq > serverAckSeq)
+                                || (contigAdvanced && ackSeq > knownServerAckSeq));
+                        if (ackNeeded) {
+                            this.recordForwardAck(ns, ackSeq);
+                            pendingAckSeq = Math.max(pendingAckSeq, ackSeq);
                         }
-                        client._clientLog.error?.(`message.v2.pull Forward commit rolled back: ns=${ns} target=${commitTarget} error=${formatE2EEError(exc)}`);
-                        throw exc;
                     }
-                    for (const fetch of deferredKeyFetches.values()) {
-                        this.scheduleSenderIKFetch(fetch.fromAid, fetch.senderDeviceId, fetch.groupId);
+                    if (!ns)
+                        await client._delivery.flushApplicationPage?.(applicationPage);
+                    if (volatileMessages.length > 0)
+                        volatileCursor = client._delivery.volatilePullCursor();
+                    const volatileAdvanced = Boolean(volatileCursor) && volatileCursor !== volatileCursorBeforePage;
+                    if (ns)
+                        client._delivery.onPullPage?.(ns, decrypted.length - pageDecryptedBefore, hasMore, pageMaxSeq, typeof result.remaining === 'number' && Number.isSafeInteger(result.remaining) && result.remaining >= 0 ? result.remaining : null, messages.length, client._seqTracker.getContiguousSeq(ns), pageMaxSeq);
+                    const nextAfter = Math.max(pageContiguousSeq, nextAfterSeq);
+                    const rawCount = messages.length;
+                    if (blockedSeq > 0)
+                        break;
+                    let shouldContinue = shouldContinueForwardPage({
+                        rawCount,
+                        nextAfterSeq,
+                        nextAfter,
+                        limit,
+                        hasMoreField,
+                        hasMore,
+                        serverHead,
+                        pendingAckSeq,
+                        observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
+                            ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter,
+                    });
+                    const volatileHasMoreField = Object.prototype.hasOwnProperty.call(result, 'volatile_has_more');
+                    const volatileHasMore = result.volatile_has_more === true;
+                    if (!shouldContinue && volatileAdvanced && (volatileHasMore || hasMore || (!volatileHasMoreField && limit > 0 && pageMessages.length >= limit))) {
+                        shouldContinue = true;
                     }
-                    if (parsedServerAckSeq !== null && serverAckSeq > ackSeq) {
-                        this.recordForwardCursor(ns, serverAckSeq, ackSeq);
+                    const shouldContinueForPipeline = shouldContinueForwardPage({
+                        rawCount,
+                        nextAfterSeq,
+                        nextAfter,
+                        limit,
+                        hasMoreField,
+                        hasMore,
+                        serverHead,
+                        pendingAckSeq: 0,
+                        observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
+                            ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter,
+                    });
+                    if (!shouldContinue)
+                        break;
+                    if (pipelinePage && volatileMessages.length > 0) {
+                        await stopPipeline();
+                        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                        pipelineQueue = new V2PullPageQueue(V2_PULL_PIPELINE_QUEUE_CAPACITY);
+                        pipelineStopped = false;
+                        pipelineError = null;
                     }
-                    // 无本页服务端水位时，只有本页成功提交了比已知服务端更高的 A
-                    // 才新增 ACK 义务。空页不能仅因本地已有 A 而重复 ACK。
-                    const knownServerAckSeq = hasServerAckSeq
-                        ? serverAckSeq
-                        : (pageCount === 1 ? deferredServerCursor : 0);
-                    const ackNeeded = ackSeq > 0
-                        && ackSeq > lastAutoAckSeq
-                        && ((hasServerAckSeq && ackSeq > serverAckSeq)
-                            || (contigAdvanced && ackSeq > knownServerAckSeq));
-                    if (ackNeeded) {
-                        this.recordForwardAck(ns, ackSeq);
-                        pendingAckSeq = Math.max(pendingAckSeq, ackSeq);
+                    if (shouldContinueForPipeline && !volatileAdvanced && !pipelineRunning && limit >= V2_PULL_MAX_PAGE_LIMIT) {
+                        startPipeline(nextAfter, volatileCursor);
                     }
+                    if (!pipelineRunning && pullGateKey && opts?.gateLocked && client._rpcPipeline?.yieldPullGate) {
+                        const nextKey = pullGateKeyForClient(client, 'message.v2.pull', {
+                            after_seq: nextAfter, after_volatile_cursor: volatileCursor, force: opts?.force === true, limit,
+                        }, `${ns}|forward|after=${nextAfter}|force=${String(Boolean(opts?.force))}|limit=${limit}`);
+                        await client._rpcPipeline.yieldPullGate(pullGateKey, nextKey, true);
+                        pullGateKey = nextKey;
+                    }
+                    const tailDelayMs = v2PullTailDelayMs(rawCount, limit);
+                    if (!pipelineRunning && tailDelayMs > 0)
+                        await v2Sleep(tailDelayMs);
+                    nextAfterSeq = nextAfter;
                 }
-                if (ns)
-                    client._delivery.onPullPage?.(ns, decrypted.length - pageDecryptedBefore, hasMore, pageMaxSeq, typeof result.remaining === 'number' && Number.isSafeInteger(result.remaining) && result.remaining >= 0 ? result.remaining : null, messages.length, client._seqTracker.getContiguousSeq(ns), pageMaxSeq);
-                const nextAfter = Math.max(pageContiguousSeq, nextAfterSeq);
-                const rawCount = messages.length;
-                if (blockedSeq > 0)
-                    break;
-                let shouldContinue = shouldContinueForwardPage({
-                    rawCount,
-                    nextAfterSeq,
-                    nextAfter,
-                    limit,
-                    hasMoreField,
-                    hasMore,
-                    serverHead,
-                    pendingAckSeq,
-                    observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
-                        ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter,
-                });
-                const volatileHasMoreField = Object.prototype.hasOwnProperty.call(result, 'volatile_has_more');
-                const volatileHasMore = result.volatile_has_more === true;
-                if (!shouldContinue && volatileAdvanced && (volatileHasMore || hasMore || (!volatileHasMoreField && limit > 0 && pageMessages.length >= limit))) {
-                    shouldContinue = true;
-                }
-                const shouldContinueForPipeline = shouldContinueForwardPage({
-                    rawCount,
-                    nextAfterSeq,
-                    nextAfter,
-                    limit,
-                    hasMoreField,
-                    hasMore,
-                    serverHead,
-                    pendingAckSeq: 0,
-                    observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
-                        ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter,
-                });
-                if (!shouldContinue)
-                    break;
-                if (pipelinePage && volatileMessages.length > 0) {
-                    await stopPipeline();
-                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-                    pipelineQueue = new V2PullPageQueue(V2_PULL_PIPELINE_QUEUE_CAPACITY);
-                    pipelineStopped = false;
-                    pipelineError = null;
-                }
-                if (shouldContinueForPipeline && !volatileAdvanced && !pipelineRunning && limit >= V2_PULL_MAX_PAGE_LIMIT) {
-                    startPipeline(nextAfter, volatileCursor);
-                }
-                if (!pipelineRunning && pullGateKey && opts?.gateLocked && client._rpcPipeline?.yieldPullGate) {
-                    const nextKey = pullGateKeyForClient(client, 'message.v2.pull', {
-                        after_seq: nextAfter, after_volatile_cursor: volatileCursor, force: opts?.force === true, limit,
-                    }, `${ns}|forward|after=${nextAfter}|force=${String(Boolean(opts?.force))}|limit=${limit}`);
-                    await client._rpcPipeline.yieldPullGate(pullGateKey, nextKey, true);
-                    pullGateKey = nextKey;
+                catch (error) {
+                    client._delivery.abortApplicationPage?.(applicationPage, error);
+                    throw error;
                 }
-                const tailDelayMs = v2PullTailDelayMs(rawCount, limit);
-                if (!pipelineRunning && tailDelayMs > 0)
-                    await v2Sleep(tailDelayMs);
-                nextAfterSeq = nextAfter;
             }
         }
         finally {
@@ -1795,7 +2364,7 @@ export class V2E2EECoordinator {
         client._delivery.onPullWorkSettled?.();
         return deduplicatePulledResults(decrypted);
     }
-    async publishV2VolatileMessages(messages, source, advanceCursor) {
+    async publishV2VolatileMessages(messages, source, advanceCursor, applicationPage) {
         const client = this.client;
         if (!client._v2Session)
             return [];
@@ -1803,7 +2372,8 @@ export class V2E2EECoordinator {
         const plaintextMessages = [];
         let complete = true;
         for (const rawMessage of messages) {
-            const claim = client._delivery.beginVolatileDelivery(rawMessage);
+            await client._delivery.waitVolatileApplicationDelivery?.(rawMessage, applicationPage);
+            const claim = client._delivery.beginVolatileDelivery(rawMessage, applicationPage);
             if (claim === 'seen') {
                 processed.push(rawMessage);
                 continue;
@@ -1848,17 +2418,17 @@ export class V2E2EECoordinator {
                         publicMessage[key] = rawMessage[key];
                 }
                 const appEvent = client._delivery.p2pAppEventForMessage(publicMessage);
-                await client._publishAppEvent(appEvent.event, appEvent.payload, source);
-                client._delivery.markVolatileSeen(rawMessage);
+                await client._publishAppEvent(appEvent.event, appEvent.payload, source, applicationPage?.namespace ?? '', undefined, applicationPage);
+                client._delivery.markVolatileSeen(rawMessage, applicationPage);
                 processed.push(rawMessage);
                 plaintextMessages.push(publicMessage);
             }
             finally {
-                client._delivery.finishVolatileDelivery(rawMessage);
+                client._delivery.finishVolatileDelivery(rawMessage, applicationPage);
             }
         }
         if (processed.length > 0) {
-            await client._delivery.ackVolatileMessages(processed, true, advanceCursor && complete && processed.length === messages.length);
+            await client._delivery.ackVolatileMessages(processed, true, advanceCursor && complete && processed.length === messages.length, applicationPage);
         }
         return plaintextMessages;
     }
@@ -1959,6 +2529,7 @@ export class V2E2EECoordinator {
                 payload,
                 messageId: opts?.messageId,
                 timestamp: opts?.timestamp,
+                needRender: opts?.needRender !== false,
                 protectedHeaders: opts?.protectedHeaders,
                 context: opts?.context,
                 useCache,
@@ -1982,6 +2553,7 @@ export class V2E2EECoordinator {
                 payload,
                 message_id: opts?.messageId,
                 timestamp: opts?.timestamp,
+                need_render: opts?.needRender !== false,
                 protected_headers: opts?.protectedHeaders,
                 context: opts?.context,
             }, groupAid), result, true);
@@ -2003,6 +2575,7 @@ export class V2E2EECoordinator {
                     payload,
                     message_id: opts?.messageId,
                     timestamp: opts?.timestamp,
+                    need_render: opts?.needRender !== false,
                     protected_headers: opts?.protectedHeaders,
                     context: opts?.context,
                 }, groupAid), result, true);
@@ -2010,7 +2583,7 @@ export class V2E2EECoordinator {
             throw exc;
         }
     }
-    async pullGroupV2TailInternal(params, deferPublish = false) {
+    async pullGroupV2TailInternal(params, deferPublish = false, namespaceLocked = false) {
         const client = this.client;
         const generation = Number(client._v2RuntimeGeneration ?? 0);
         const inlineGeneration = client._delivery.captureInlineGeneration?.();
@@ -2041,33 +2614,57 @@ export class V2E2EECoordinator {
             limit,
             _group_cursor_params: explicitCursorParams,
         }, `${ns}|tail|after=${afterSeq}|limit=${limit}`);
-        const result = await client._callRawV2Rpc('group.v2.pull', withExplicitGroupAid({
+        if (!namespaceLocked)
+            return await client._rpcPipeline.runPullNamespaceSerialized(pullGateKey, () => this.pullGroupV2TailInternal(params, deferPublish, true), false);
+        client._delivery.rememberCommittedSeqState?.(ns);
+        const namespaceGeneration = client._delivery.captureSeqNamespaceGeneration?.(ns);
+        const result = await client._runPullSerialized(pullGateKey, () => client._callRawV2Rpc('group.v2.pull', withExplicitGroupAid({
             group_id: groupId, window_mode: 'tail', after_seq: afterSeq, limit,
             _group_cursor_params: explicitCursorParams, _rpc_foreground: true,
-        }, groupAid), pullGateKey);
+        }, groupAid), pullGateKey), false);
         const resultAid = String(result.group_aid ?? result.groupAid ?? '').trim();
         if (resultAid)
             groupAid = resultAid;
         const page = validateTailPage(result, afterSeq, limit);
         const decoded = [];
-        for (const msg of page.messages) {
-            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-            client._logMessageDebug?.('tail-raw', 'group.v2.pull', 'group.message_created', msg);
-            const plaintext = await this.decodeGroupWindowMessage(msg, groupId, groupAid, true, false, 'tail', deferPublish);
-            if (plaintext)
-                decoded.push(plaintext);
+        const applicationPage = client._delivery.beginApplicationPage?.(ns, 'tail');
+        try {
+            for (const msg of page.messages) {
+                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                client._logMessageDebug?.('tail-raw', 'group.v2.pull', 'group.message_created', msg);
+                const plaintext = await this.decodeGroupWindowMessage(msg, groupId, groupAid, true, false, 'tail', deferPublish, applicationPage);
+                if (plaintext)
+                    decoded.push(plaintext);
+            }
+            await client._delivery.flushApplicationPage?.(applicationPage);
         }
-        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+        catch (error) {
+            client._delivery.abortApplicationPage?.(applicationPage, error);
+            throw error;
+        }
+        this.ensureDeliveryCurrent(ns, generation, inlineGeneration, namespaceGeneration);
         const proof = {
             windowStartSeq: page.windowStart, headSeq: page.head, coveredThroughSeq: page.head, pageLimit: limit,
         };
         if (deferPublish)
-            client._delivery.deferTailWindow(ns, proof);
+            client._delivery.deferTailWindow(ns, proof, applicationPage);
         else {
-            client._seqTracker.commitTailWindow(ns, proof);
-            client._persistSeq(ns);
-            await client._saveSeqTrackerState?.();
-            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+            const snapshot = client._seqTracker.snapshotNamespace?.(ns);
+            try {
+                client._seqTracker.commitTailWindow(ns, proof);
+                await client._commitSeqTrackerState(ns);
+                this.ensureDeliveryCurrent(ns, generation, inlineGeneration, namespaceGeneration);
+            }
+            catch (error) {
+                if (Number(client._v2RuntimeGeneration ?? 0) === generation
+                    && (inlineGeneration === undefined || client._delivery.isInlineGenerationCurrent(inlineGeneration))
+                    && client._delivery.isSeqNamespaceGenerationCurrent?.(ns, namespaceGeneration) !== false
+                    && client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false
+                    && snapshot !== undefined && typeof client._seqTracker.restoreNamespaceSnapshot === 'function') {
+                    client._seqTracker._restoreNamespaceSnapshotPreservingPush(ns, snapshot);
+                }
+                throw error;
+            }
         }
         const ack = client._seqTracker.getContiguousSeq(ns);
         if (ownsCursor)
@@ -2082,9 +2679,10 @@ export class V2E2EECoordinator {
         let groupAid = String(params.group_aid ?? '').trim();
         const beforeSeq = strictWindowSeq(params.before_seq, 'before_seq', true);
         const limit = strictWindowLimit(params.limit ?? V2_PULL_DEFAULT_PAGE_LIMIT);
-        const result = await this.client._callRawV2Rpc('group.history', withExplicitGroupAid({
+        const key = pullGateKeyForClient(this.client, 'group.history', params, `group:${groupId}|history|before=${beforeSeq}|limit=${limit}`);
+        const result = await this.client._runPullSerialized(key, () => this.client._callRawV2Rpc('group.history', withExplicitGroupAid({
             group_id: groupId, before_seq: beforeSeq, limit, _rpc_foreground: true,
-        }, groupAid));
+        }, groupAid), key), false);
         const resultAid = String(result.group_aid ?? result.groupAid ?? '').trim();
         if (resultAid)
             groupAid = resultAid;
@@ -2099,7 +2697,6 @@ export class V2E2EECoordinator {
     }
     async pullGroupV2Internal(params) {
         await this.pullGroupV2(params.group_id, params.after_seq, params.limit, {
-            gateLocked: true,
             explicitAfterSeq: true,
             force: params.force === true,
         });
@@ -2127,7 +2724,7 @@ export class V2E2EECoordinator {
                     group_id: gid, window_mode: 'tail', after_seq: afterSeq, limit,
                     _group_cursor_params: opts?.cursorParams,
                 }, `${ns}|tail|after=${afterSeq}|limit=${limit}`);
-                return await client._runPullSerialized(key, () => this.pullGroupV2Impl(gid, afterSeq, limit, {
+                return await client._rpcPipeline.runPullNamespaceSerialized(key, () => this.pullGroupV2Impl(gid, afterSeq, limit, {
                     ...(opts ?? {}),
                     gateLocked: true,
                 }), false);
@@ -2137,7 +2734,7 @@ export class V2E2EECoordinator {
                 _group_cursor_params: opts?.cursorParams,
                 group_id: String(opts.wireGroupId ?? gid), group_aid: groupAid || undefined,
                 window_mode: 'tail', after_seq: afterSeq, limit,
-            });
+            }, false, true);
             return Array.isArray(result.messages) ? result.messages : [];
         }
         if (!opts?.gateLocked) {
@@ -2145,21 +2742,21 @@ export class V2E2EECoordinator {
                 group_id: gid, after_seq: afterSeq, force: opts?.force === true, limit,
                 _group_cursor_params: opts?.cursorParams,
             }, `${ns}|forward|after=${afterSeq}|force=${String(Boolean(opts?.force))}|limit=${limit}`);
-            return await client._runPullSerialized(key, () => this.pullGroupV2Impl(gid, afterSeq, limit, {
+            return await client._rpcPipeline.runPullNamespaceSerialized(key, () => this.pullGroupV2Impl(gid, afterSeq, limit, {
                 ...(opts ?? {}),
                 gateLocked: true,
-            }), true);
+            }), opts?.background !== false);
         }
         const decrypted = [];
         const wireGroupId = String(opts?.wireGroupId ?? groupId ?? '').trim() || gid;
         const cursorParams = opts?.cursorParams ?? {};
         const ownsCursor = opts?.ownsCursor !== false;
+        if (ownsCursor)
+            client._delivery.rememberCommittedSeqState?.(ns);
+        const namespaceGeneration = ownsCursor ? client._delivery.captureSeqNamespaceGeneration?.(ns) : undefined;
         if (ownsCursor)
             client._delivery.onPullStarted?.(ns);
-        let pullGateKey = pullGateKeyForClient(client, 'group.v2.pull', {
-            group_id: gid, after_seq: afterSeq, force: opts?.force === true, limit,
-            _group_cursor_params: cursorParams,
-        }, `${ns}|forward|after=${afterSeq}|force=${String(Boolean(opts?.force))}|limit=${limit}`);
+        const background = opts?.background !== false;
         let nextAfterSeq = (opts?.explicitAfterSeq || opts?.force)
             ? afterSeq
             : (afterSeq || client._seqTracker.getContiguousSeq(ns));
@@ -2171,6 +2768,20 @@ export class V2E2EECoordinator {
         let lastAutoAckSeq = 0;
         let pendingAckSeq = deferredForwardAck;
         let committedAckSeq = ownsCursor ? client._seqTracker.getContiguousSeq(ns) : 0;
+        const fetchPage = async (after, ack) => {
+            const key = pullGateKeyForClient(client, 'group.v2.pull', {
+                group_id: gid, after_seq: after, force: opts?.force === true, limit, _group_cursor_params: cursorParams,
+            }, `${ns}|forward|after=${after}|force=${String(Boolean(opts?.force))}|limit=${limit}`);
+            return await client._runPullSerialized(key, async () => {
+                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                return await client._callRawV2Rpc('group.v2.pull', withExplicitGroupAid({
+                    group_id: wireGroupId, after_seq: after, limit, ...cursorParams,
+                    ...(opts?.force ? { force: true } : {}),
+                    ...(ack > 0 ? { ack_up_to_seq: Math.min(ack, committedAckSeq) } : {}),
+                    _rpc_background: background, _rpc_foreground: !background,
+                }, groupAid), key);
+            }, background);
+        };
         const maxPages = Math.max(1, Math.min(100, Math.trunc(Number(opts?.maxPages ?? 100) || 100)));
         let pipelineRunning = false;
         let pipelineError = null;
@@ -2190,14 +2801,7 @@ export class V2E2EECoordinator {
                     const ackUpToSeq = Math.min(pendingAckSeq, committedAckSeq);
                     const inlineAckGeneration = ackUpToSeq > 0
                         ? client._delivery?.pendingGroupInlineAckGeneration?.(ns) ?? null : null;
-                    const result = await client._callRawV2Rpc('group.v2.pull', withExplicitGroupAid({
-                        group_id: wireGroupId,
-                        after_seq: producerAfterSeq,
-                        limit,
-                        ...cursorParams,
-                        ...(opts?.force ? { force: true } : {}),
-                        ...(ackUpToSeq > 0 ? { ack_up_to_seq: ackUpToSeq } : {}),
-                    }, groupAid), pullGateKey);
+                    const result = await fetchPage(producerAfterSeq, ackUpToSeq);
                     if (pipelineStopped)
                         break;
                     this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
@@ -2250,107 +2854,130 @@ export class V2E2EECoordinator {
         };
         try {
             while (pageCount < maxPages) {
-                let pipelinePage;
-                if (pipelineRunning) {
-                    pipelinePage = await pipelineQueue.take();
-                    if (!pipelinePage) {
-                        pipelineRunning = false;
-                        if (pipelineError)
-                            throw pipelineError;
-                        break;
-                    }
-                }
-                pageCount += 1;
-                const ackUpToSeq = ownsCursor ? (pipelinePage?.ackUpToSeq ?? pendingAckSeq) : 0;
-                const pendingInlineGeneration = pipelinePage?.inlineAckGeneration ?? (ackUpToSeq > 0
-                    ? client._delivery?.pendingGroupInlineAckGeneration?.(ns) ?? null
-                    : null);
-                let result;
-                if (pipelinePage) {
-                    nextAfterSeq = pipelinePage.afterSeq;
-                    result = pipelinePage.result;
-                }
-                else {
-                    result = await client._callRawV2Rpc('group.v2.pull', withExplicitGroupAid({
-                        group_id: wireGroupId,
-                        after_seq: nextAfterSeq,
-                        limit,
-                        ...cursorParams,
-                        ...(opts?.force ? { force: true } : {}),
-                        ...(ackUpToSeq > 0 ? { ack_up_to_seq: ackUpToSeq } : {}),
-                    }, groupAid), pullGateKey);
-                }
-                this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-                if (ownsCursor && !opts?.force)
-                    client._delivery.observeBackgroundPullResponse?.(ns, nextAfterSeq, result, limit);
-                if (ackUpToSeq > 0) {
-                    const actualAckSeq = client._delivery?.resolveGroupPullAckSeq?.(result, ackUpToSeq) ?? 0;
-                    if (actualAckSeq >= ackUpToSeq) {
-                        if (pendingInlineGeneration !== null) {
-                            client._delivery?.completePendingGroupInlineAckUpTo?.(ns, actualAckSeq, pendingInlineGeneration);
+                let applicationPage;
+                try {
+                    let pipelinePage;
+                    if (pipelineRunning) {
+                        pipelinePage = await pipelineQueue.take();
+                        if (!pipelinePage) {
+                            pipelineRunning = false;
+                            if (pipelineError)
+                                throw pipelineError;
+                            break;
                         }
-                        if (pendingAckSeq <= ackUpToSeq)
-                            pendingAckSeq = 0;
-                        lastAutoAckSeq = Math.max(lastAutoAckSeq, ackUpToSeq);
-                        this.clearForwardAck(ns, ackUpToSeq);
+                    }
+                    pageCount += 1;
+                    const ackUpToSeq = ownsCursor ? (pipelinePage?.ackUpToSeq ?? pendingAckSeq) : 0;
+                    const pendingInlineGeneration = pipelinePage?.inlineAckGeneration ?? (ackUpToSeq > 0
+                        ? client._delivery?.pendingGroupInlineAckGeneration?.(ns) ?? null
+                        : null);
+                    let result;
+                    if (pipelinePage) {
+                        nextAfterSeq = pipelinePage.afterSeq;
+                        result = pipelinePage.result;
                     }
                     else {
-                        client._clientLog.warn(`group.v2.pull piggyback ACK below target: group=${gid}, requested=${ackUpToSeq}, actual=${actualAckSeq}; fallback terminal ACK`);
-                        pendingAckSeq = Math.max(pendingAckSeq, ackUpToSeq);
-                        this.recordForwardAck(ns, ackUpToSeq);
+                        result = await fetchPage(nextAfterSeq, ackUpToSeq);
                     }
-                }
-                const resultGroupAid = String(result.group_aid ?? result.groupAid ?? '').trim();
-                if (resultGroupAid)
-                    groupAid = resultGroupAid;
-                const eventGroupAid = resultGroupAid || groupAid || gid;
-                const pageMessages = (Array.isArray(result?.messages) ? result.messages : []);
-                const messages = deduplicateForwardPageMessages(pageMessages, nextAfterSeq);
-                const cursor = isJsonObject(result.cursor) ? result.cursor : null;
-                const hasMoreField = Object.prototype.hasOwnProperty.call(result, 'has_more');
-                const hasMore = result.has_more === true;
-                const serverHead = Math.max(safeNonNegativeSeq(result.latest_message_seq) ?? 0, safeNonNegativeSeq(cursor?.latest_seq) ?? 0);
-                const seqs = messages
-                    .map((msg) => Number(msg.seq ?? 0))
-                    .filter((seq) => Number.isFinite(seq) && seq > 0);
-                const pageContigBefore = client._seqTracker.getContiguousSeq(ns);
-                let pageTrackerSnapshot;
-                const pageMaxSeq = seqs.length > 0 ? Math.max(...seqs) : nextAfterSeq;
-                const pageContiguousSeq = contiguousPullSeq(pageContigBefore, seqs, result.contiguous_seq);
-                if (!pipelineRunning && shouldContinueForwardPage({
-                    rawCount: messages.length, nextAfterSeq, nextAfter: pageMaxSeq, limit,
-                    hasMoreField, hasMore, serverHead, pendingAckSeq: 0,
-                    observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
-                        ? client._seqTracker.getMaxSeenSeq(ns) : pageMaxSeq,
-                }))
-                    startPipeline(pageMaxSeq);
-                const deferredKeyFetches = new Map();
-                let blockedSeq = 0;
-                const pageDecryptedBefore = decrypted.length;
-                for (const msg of messages) {
-                    const seq = Number(msg.seq ?? 0);
-                    if (!Number.isFinite(seq) || seq <= 0)
-                        continue;
-                    const version = String(msg.version ?? 'v2');
-                    if (version === 'v1') {
-                        const legacy = isJsonObject(msg.legacy_v1) ? msg.legacy_v1 : {};
-                        const payload = msg.payload !== undefined ? msg.payload : legacy.payload;
-                        const payloadObj = isJsonObject(payload) ? payload : null;
-                        // 群撤回 tombstone（占位 / 通知）：归一化为 group.message_recalled 事件，仍占 seq。
-                        if (typeof client._delivery?.recallEventFromGroupMessage === 'function'
-                            && client._delivery.recallEventFromGroupMessage(msg)) {
-                            await client._delivery.publishGroupRecallTombstone(gid, seq, {
-                                ...msg,
-                                group_id: gid,
-                                group_aid: eventGroupAid,
-                            }, 'pull');
-                            client._markPublishedSeq(ns, seq);
-                            client._clientLog.debug(`group.v2.pull recall tombstone delivered: group=${gid}, seq=${seq}`);
-                            continue;
+                    this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+                    if (ownsCursor && !opts?.force)
+                        client._delivery.observeBackgroundPullResponse?.(ns, nextAfterSeq, result, limit);
+                    if (ackUpToSeq > 0) {
+                        const actualAckSeq = client._delivery?.resolveGroupPullAckSeq?.(result, ackUpToSeq) ?? 0;
+                        if (actualAckSeq >= ackUpToSeq) {
+                            if (pendingInlineGeneration !== null) {
+                                client._delivery?.completePendingGroupInlineAckUpTo?.(ns, actualAckSeq, pendingInlineGeneration);
+                            }
+                            if (pendingAckSeq <= ackUpToSeq)
+                                pendingAckSeq = 0;
+                            lastAutoAckSeq = Math.max(lastAutoAckSeq, ackUpToSeq);
+                            this.clearForwardAck(ns, ackUpToSeq);
+                        }
+                        else {
+                            client._clientLog.warn(`group.v2.pull piggyback ACK below target: group=${gid}, requested=${ackUpToSeq}, actual=${actualAckSeq}; fallback terminal ACK`);
+                            pendingAckSeq = Math.max(pendingAckSeq, ackUpToSeq);
+                            this.recordForwardAck(ns, ackUpToSeq);
                         }
-                        if (payloadObj) {
-                            const payloadType = String(payloadObj.type ?? '').trim();
-                            if (payloadType !== 'e2ee.encrypted' && payloadType !== 'e2ee.group_encrypted' && payloadType !== 'e2ee.p2p_encrypted') {
+                    }
+                    const resultGroupAid = String(result.group_aid ?? result.groupAid ?? '').trim();
+                    if (resultGroupAid)
+                        groupAid = resultGroupAid;
+                    const eventGroupAid = resultGroupAid || groupAid || gid;
+                    applicationPage = client._delivery.beginApplicationPage?.(ns);
+                    const pageMessages = (Array.isArray(result?.messages) ? result.messages : []);
+                    const messages = deduplicateForwardPageMessages(pageMessages, nextAfterSeq);
+                    const cursor = isJsonObject(result.cursor) ? result.cursor : null;
+                    const hasMoreField = Object.prototype.hasOwnProperty.call(result, 'has_more');
+                    const hasMore = result.has_more === true;
+                    const serverHead = Math.max(safeNonNegativeSeq(result.latest_message_seq) ?? 0, safeNonNegativeSeq(cursor?.latest_seq) ?? 0);
+                    const seqs = messages
+                        .map((msg) => Number(msg.seq ?? 0))
+                        .filter((seq) => Number.isFinite(seq) && seq > 0);
+                    const pageContigBefore = client._seqTracker.getContiguousSeq(ns);
+                    let pageTrackerSnapshot;
+                    const pageMaxSeq = seqs.length > 0 ? Math.max(...seqs) : nextAfterSeq;
+                    const pageContiguousSeq = contiguousPullSeq(pageContigBefore, seqs, result.contiguous_seq);
+                    if (!pipelineRunning && shouldContinueForwardPage({
+                        rawCount: messages.length, nextAfterSeq, nextAfter: pageMaxSeq, limit,
+                        hasMoreField, hasMore, serverHead, pendingAckSeq: 0,
+                        observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
+                            ? client._seqTracker.getMaxSeenSeq(ns) : pageMaxSeq,
+                    }))
+                        startPipeline(pageMaxSeq);
+                    const deferredKeyFetches = new Map();
+                    let blockedSeq = 0;
+                    const pageDecryptedBefore = decrypted.length;
+                    for (const msg of messages) {
+                        const seq = Number(msg.seq ?? 0);
+                        if (!Number.isFinite(seq) || seq <= 0)
+                            continue;
+                        const version = String(msg.version ?? 'v2');
+                        if (version === 'v1') {
+                            const legacy = isJsonObject(msg.legacy_v1) ? msg.legacy_v1 : {};
+                            const payload = msg.payload !== undefined ? msg.payload : legacy.payload;
+                            const payloadObj = isJsonObject(payload) ? payload : null;
+                            // 群撤回 tombstone（占位 / 通知）：归一化为 group.message_recalled 事件，仍占 seq。
+                            if (typeof client._delivery?.recallEventFromGroupMessage === 'function'
+                                && client._delivery.recallEventFromGroupMessage(msg)) {
+                                await client._delivery.publishGroupRecallTombstone(gid, seq, {
+                                    ...msg,
+                                    group_id: gid,
+                                    group_aid: eventGroupAid,
+                                }, 'pull', applicationPage);
+                                client._markPublishedSeq(ns, seq, applicationPage);
+                                client._clientLog.debug(`group.v2.pull recall tombstone delivered: group=${gid}, seq=${seq}`);
+                                continue;
+                            }
+                            if (payloadObj) {
+                                const payloadType = String(payloadObj.type ?? '').trim();
+                                if (payloadType !== 'e2ee.encrypted' && payloadType !== 'e2ee.group_encrypted' && payloadType !== 'e2ee.p2p_encrypted') {
+                                    let v1Msg = {
+                                        message_id: String(msg.message_id ?? ''),
+                                        from: String(msg.from_aid ?? ''),
+                                        group_id: gid,
+                                        group_aid: eventGroupAid,
+                                        seq: msg.seq,
+                                        type: String(msg.type ?? ''),
+                                        timestamp: msg.t_server,
+                                        payload,
+                                        encrypted: false,
+                                        need_render: msg.need_render !== false,
+                                    };
+                                    if (msg.sender_device_id !== undefined)
+                                        v1Msg.sender_device_id = msg.sender_device_id;
+                                    v1Msg = normalizeGroupMentionMode(v1Msg, msg, msg.envelope_json);
+                                    attachGatewayProximity(v1Msg, msg);
+                                    if (!client._delivery.isSelfSentGroupMessage?.(msg)) {
+                                        await client._publishPulledMessage('group.message_created', ns, seq, v1Msg, false, 'pull', undefined, applicationPage);
+                                    }
+                                    else {
+                                        client._markPublishedSeq(ns, seq, applicationPage);
+                                    }
+                                    decrypted.push(v1Msg);
+                                    continue;
+                                }
+                            }
+                            else if (payload !== undefined && payload !== null) {
                                 let v1Msg = {
                                     message_id: String(msg.message_id ?? ''),
                                     from: String(msg.from_aid ?? ''),
@@ -2361,218 +2988,196 @@ export class V2E2EECoordinator {
                                     timestamp: msg.t_server,
                                     payload,
                                     encrypted: false,
+                                    need_render: msg.need_render !== false,
                                 };
                                 if (msg.sender_device_id !== undefined)
                                     v1Msg.sender_device_id = msg.sender_device_id;
                                 v1Msg = normalizeGroupMentionMode(v1Msg, msg, msg.envelope_json);
                                 attachGatewayProximity(v1Msg, msg);
-                                if (!client._delivery.isSelfSentGroupMessage?.(msg)) {
-                                    await client._publishPulledMessage('group.message_created', ns, seq, v1Msg, false);
-                                }
-                                else {
-                                    client._markPublishedSeq(ns, seq);
-                                }
+                                await client._publishPulledMessage('group.message_created', ns, seq, v1Msg, false, 'pull', undefined, applicationPage);
                                 decrypted.push(v1Msg);
                                 continue;
                             }
+                            if (payloadObj && ['e2ee.group_encrypted', 'e2ee.p2p_encrypted', 'e2ee.encrypted'].includes(String(payloadObj.type ?? '').trim())) {
+                                const deferStatus = {};
+                                const plaintext = await client._decryptV2Message({ ...msg, envelope_json: JSON.stringify(payloadObj) }, true, true, true, true, deferStatus, true, 'pull');
+                                if (deferStatus.deferred) {
+                                    blockedSeq = blockedSeq > 0 ? Math.min(blockedSeq, seq) : seq;
+                                    if (deferStatus.fromAid) {
+                                        const key = `${deferStatus.fromAid}\u0000${deferStatus.senderDeviceId ?? ''}\u0000${deferStatus.groupId ?? ''}`;
+                                        deferredKeyFetches.set(key, { fromAid: deferStatus.fromAid, senderDeviceId: deferStatus.senderDeviceId ?? '', groupId: deferStatus.groupId ?? '' });
+                                    }
+                                }
+                                if (plaintext) {
+                                    plaintext.need_render = typeof msg.need_render === 'boolean' ? msg.need_render : plaintext.need_render !== false;
+                                    plaintext.group_id = gid;
+                                    plaintext.group_aid = eventGroupAid;
+                                    if (!client._delivery.isSelfSentGroupMessage?.(msg)) {
+                                        await client._publishPulledMessage('group.message_created', ns, seq, plaintext, false, 'pull', undefined, applicationPage);
+                                    }
+                                    else {
+                                        client._markPublishedSeq(ns, seq, applicationPage);
+                                    }
+                                    decrypted.push(plaintext);
+                                }
+                            }
+                            client._clientLog.debug(`group.v2.pull skipping V1 envelope group=${gid} seq=${seq} payload_type=${payloadObj ? String(payloadObj.type ?? '') : '<none>'} (V1 E2EE removed)`);
+                            continue;
                         }
-                        else if (payload !== undefined && payload !== null) {
-                            let v1Msg = {
-                                message_id: String(msg.message_id ?? ''),
-                                from: String(msg.from_aid ?? ''),
-                                group_id: gid,
-                                group_aid: eventGroupAid,
-                                seq: msg.seq,
-                                type: String(msg.type ?? ''),
-                                timestamp: msg.t_server,
-                                payload,
-                                encrypted: false,
-                            };
-                            if (msg.sender_device_id !== undefined)
-                                v1Msg.sender_device_id = msg.sender_device_id;
-                            v1Msg = normalizeGroupMentionMode(v1Msg, msg, msg.envelope_json);
-                            attachGatewayProximity(v1Msg, msg);
-                            await client._publishPulledMessage('group.message_created', ns, seq, v1Msg, false);
-                            decrypted.push(v1Msg);
+                        if (version !== 'v2') {
+                            client._clientLog.debug(`group.v2.pull skipping non-V2 row group=${gid} seq=${seq} version=${String(msg.version ?? '')}`);
                             continue;
                         }
-                        if (payloadObj && ['e2ee.group_encrypted', 'e2ee.p2p_encrypted', 'e2ee.encrypted'].includes(String(payloadObj.type ?? '').trim())) {
-                            const deferStatus = {};
-                            const plaintext = await client._decryptV2Message({ ...msg, envelope_json: JSON.stringify(payloadObj) }, true, true, true, true, deferStatus, true, 'pull');
-                            if (deferStatus.deferred) {
-                                blockedSeq = blockedSeq > 0 ? Math.min(blockedSeq, seq) : seq;
-                                if (deferStatus.fromAid) {
-                                    const key = `${deferStatus.fromAid}\u0000${deferStatus.senderDeviceId ?? ''}\u0000${deferStatus.groupId ?? ''}`;
-                                    deferredKeyFetches.set(key, { fromAid: deferStatus.fromAid, senderDeviceId: deferStatus.senderDeviceId ?? '', groupId: deferStatus.groupId ?? '' });
+                        const deferStatus = {};
+                        let plaintext = await client._decryptV2Message(msg, true, true, true, true, deferStatus, true, 'pull');
+                        if (deferStatus.deferred) {
+                            blockedSeq = blockedSeq > 0 ? Math.min(blockedSeq, seq) : seq;
+                        }
+                        if (deferStatus.deferred && deferStatus.fromAid) {
+                            const key = `${deferStatus.fromAid}\u0000${deferStatus.senderDeviceId ?? ''}\u0000${deferStatus.groupId ?? ''}`;
+                            deferredKeyFetches.set(key, {
+                                fromAid: deferStatus.fromAid,
+                                senderDeviceId: deferStatus.senderDeviceId ?? '',
+                                groupId: deferStatus.groupId ?? '',
+                            });
+                        }
+                        if (plaintext === null)
+                            continue;
+                        plaintext.need_render = typeof msg.need_render === 'boolean' ? msg.need_render : plaintext.need_render !== false;
+                        plaintext = normalizeGroupMentionMode(plaintext, msg, msg.envelope_json);
+                        plaintext.group_id = gid;
+                        plaintext.group_aid = eventGroupAid;
+                        if (!client._delivery.isSelfSentGroupMessage?.(msg)) {
+                            await client._publishPulledMessage('group.message_created', ns, seq, plaintext, false, 'pull', undefined, applicationPage);
+                        }
+                        else {
+                            client._markPublishedSeq(ns, seq, applicationPage);
+                        }
+                        decrypted.push(plaintext);
+                    }
+                    const hasServerCursor = cursor !== null && Object.prototype.hasOwnProperty.call(cursor, 'current_seq');
+                    const parsedCursorCurrentSeq = hasServerCursor ? safeNonNegativeSeq(cursor?.current_seq) : null;
+                    const cursorCurrentSeq = parsedCursorCurrentSeq ?? 0;
+                    const retentionFloor = Math.max(Number(result.retention_floor_message_seq ?? result.retention_floor_seq ?? 0), Number(cursor?.retention_floor_seq ?? 0));
+                    const visibilityFloor = Math.max(0, Math.max(0, Number(result.earliest_available_message_seq ?? 1) - 1), Number(cursor?.join_seq ?? 0));
+                    const effectiveFloor = Math.max(retentionFloor, visibilityFloor);
+                    let commitTarget = Math.max(pageContigBefore, Number.isFinite(effectiveFloor) ? effectiveFloor : 0, ownsCursor && pageCount === 1 ? deferredServerCursor : 0, cursorCurrentSeq, blockedSeq > 0 ? blockedSeq - 1 : pageContiguousSeq);
+                    commitTarget = client._delivery.pendingTailDeliveryThrough?.(ns, commitTarget) ?? commitTarget;
+                    let ackSeq = pageContigBefore;
+                    let contigAdvanced = false;
+                    if (ownsCursor) {
+                        try {
+                            this.ensureDeliveryCurrent(ns, generation, inlineGeneration, namespaceGeneration);
+                            const state = client._seqTracker.getSyncState?.(ns);
+                            const deliveryThrough = client._delivery.pendingTailDeliveryThrough?.(ns, state && commitTarget >= state.tail - 1 ? Math.max(commitTarget, state.head) : commitTarget) ?? (state && commitTarget >= state.tail - 1 ? Math.max(commitTarget, state.head) : commitTarget);
+                            await client._drainOrderedMessages(ns, undefined, false, false, deliveryThrough, applicationPage);
+                            await client._delivery.flushApplicationPage?.(applicationPage);
+                            this.ensureDeliveryCurrent(ns, generation, inlineGeneration, namespaceGeneration);
+                            pageTrackerSnapshot = client._seqTracker.snapshotNamespace?.(ns);
+                            client._delivery.commitPendingTailWindow?.(ns, commitTarget);
+                            if (commitTarget > pageContigBefore) {
+                                client._seqTracker.forceContiguousSeq(ns, commitTarget);
+                                if (effectiveFloor > pageContigBefore) {
+                                    client._clientLog.info(`group.v2.pull floor advance: ns=${ns} contiguous=${pageContigBefore} -> effective_floor=${effectiveFloor} retention_floor=${retentionFloor} visibility_floor=${visibilityFloor}`);
                                 }
-                            }
-                            if (plaintext) {
-                                plaintext.group_id = gid;
-                                plaintext.group_aid = eventGroupAid;
-                                if (!client._delivery.isSelfSentGroupMessage?.(msg)) {
-                                    await client._publishPulledMessage('group.message_created', ns, seq, plaintext, false);
+                                if (deferredServerCursor > pageContigBefore && pageCount === 1) {
+                                    client._clientLog.info(`group.v2.pull restore local A from deferred server ACK cursor: group=${gid}, ns=${ns}, contiguous=${pageContigBefore} -> current_seq=${deferredServerCursor}`);
                                 }
-                                else {
-                                    client._markPublishedSeq(ns, seq);
+                                if (seqs.length > 0) {
+                                    client._clientLog.debug(`group.v2.pull force contiguous: group=${gid}, ns=${ns}, page_max_seq=${pageMaxSeq}, previous=${pageContigBefore}`);
                                 }
-                                decrypted.push(plaintext);
                             }
+                            ackSeq = client._seqTracker.getContiguousSeq(ns);
+                            contigAdvanced = ackSeq !== pageContigBefore;
+                            if (contigAdvanced) {
+                                await client._commitSeqTrackerState(ns);
+                                this.ensureDeliveryCurrent(ns, generation, inlineGeneration, namespaceGeneration);
+                                if (pageCount === 1 && deferredServerCursor > 0)
+                                    this.clearForwardCursor(ns, ackSeq);
+                            }
+                            client._delivery.completePendingTailWindow?.(ns);
+                            committedAckSeq = ackSeq;
+                        }
+                        catch (exc) {
+                            if (Number(client._v2RuntimeGeneration ?? 0) === generation
+                                && (inlineGeneration === undefined || client._delivery.isInlineGenerationCurrent(inlineGeneration))
+                                && client._delivery.isSeqNamespaceGenerationCurrent?.(ns, namespaceGeneration) !== false
+                                && client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false
+                                && pageTrackerSnapshot !== undefined
+                                && typeof client._seqTracker.restoreNamespaceSnapshot === 'function') {
+                                client._seqTracker._restoreNamespaceSnapshotPreservingPush(ns, pageTrackerSnapshot);
+                            }
+                            client._clientLog.error?.(`group.v2.pull Forward commit rolled back: group=${gid} ns=${ns} target=${commitTarget} error=${formatE2EEError(exc)}`);
+                            throw exc;
                         }
-                        client._clientLog.debug(`group.v2.pull skipping V1 envelope group=${gid} seq=${seq} payload_type=${payloadObj ? String(payloadObj.type ?? '') : '<none>'} (V1 E2EE removed)`);
-                        continue;
-                    }
-                    if (version !== 'v2') {
-                        client._clientLog.debug(`group.v2.pull skipping non-V2 row group=${gid} seq=${seq} version=${String(msg.version ?? '')}`);
-                        continue;
-                    }
-                    const deferStatus = {};
-                    let plaintext = await client._decryptV2Message(msg, true, true, true, true, deferStatus, true, 'pull');
-                    if (deferStatus.deferred) {
-                        blockedSeq = blockedSeq > 0 ? Math.min(blockedSeq, seq) : seq;
-                    }
-                    if (deferStatus.deferred && deferStatus.fromAid) {
-                        const key = `${deferStatus.fromAid}\u0000${deferStatus.senderDeviceId ?? ''}\u0000${deferStatus.groupId ?? ''}`;
-                        deferredKeyFetches.set(key, {
-                            fromAid: deferStatus.fromAid,
-                            senderDeviceId: deferStatus.senderDeviceId ?? '',
-                            groupId: deferStatus.groupId ?? '',
-                        });
                     }
-                    if (plaintext === null)
-                        continue;
-                    plaintext = normalizeGroupMentionMode(plaintext, msg, msg.envelope_json);
-                    plaintext.group_id = gid;
-                    plaintext.group_aid = eventGroupAid;
-                    if (!client._delivery.isSelfSentGroupMessage?.(msg)) {
-                        await client._publishPulledMessage('group.message_created', ns, seq, plaintext, false);
+                    if (!ownsCursor)
+                        await client._delivery.flushApplicationPage?.(applicationPage);
+                    for (const fetch of deferredKeyFetches.values()) {
+                        this.scheduleSenderIKFetch(fetch.fromAid, fetch.senderDeviceId, fetch.groupId);
                     }
-                    else {
-                        client._markPublishedSeq(ns, seq);
+                    client._delivery.onPullPage?.(ns, decrypted.length - pageDecryptedBefore, hasMore, pageMaxSeq, typeof result.remaining === 'number' && Number.isSafeInteger(result.remaining) && result.remaining >= 0 ? result.remaining : null, messages.length, client._seqTracker.getContiguousSeq(ns), pageMaxSeq);
+                    if (ownsCursor && parsedCursorCurrentSeq !== null && cursorCurrentSeq > ackSeq) {
+                        this.recordForwardCursor(ns, cursorCurrentSeq, ackSeq);
                     }
-                    decrypted.push(plaintext);
-                }
-                const hasServerCursor = cursor !== null && Object.prototype.hasOwnProperty.call(cursor, 'current_seq');
-                const parsedCursorCurrentSeq = hasServerCursor ? safeNonNegativeSeq(cursor?.current_seq) : null;
-                const cursorCurrentSeq = parsedCursorCurrentSeq ?? 0;
-                const retentionFloor = Math.max(Number(result.retention_floor_message_seq ?? result.retention_floor_seq ?? 0), Number(cursor?.retention_floor_seq ?? 0));
-                const visibilityFloor = Math.max(0, Math.max(0, Number(result.earliest_available_message_seq ?? 1) - 1), Number(cursor?.join_seq ?? 0));
-                const effectiveFloor = Math.max(retentionFloor, visibilityFloor);
-                let commitTarget = Math.max(pageContigBefore, Number.isFinite(effectiveFloor) ? effectiveFloor : 0, ownsCursor && pageCount === 1 ? deferredServerCursor : 0, cursorCurrentSeq, blockedSeq > 0 ? blockedSeq - 1 : pageContiguousSeq);
-                commitTarget = client._delivery.pendingTailDeliveryThrough?.(ns, commitTarget) ?? commitTarget;
-                let ackSeq = pageContigBefore;
-                let contigAdvanced = false;
-                if (ownsCursor) {
-                    try {
-                        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-                        const state = client._seqTracker.getSyncState?.(ns);
-                        const deliveryThrough = client._delivery.pendingTailDeliveryThrough?.(ns, state && commitTarget >= state.tail - 1 ? Math.max(commitTarget, state.head) : commitTarget) ?? (state && commitTarget >= state.tail - 1 ? Math.max(commitTarget, state.head) : commitTarget);
-                        await client._drainOrderedMessages(ns, undefined, false, false, deliveryThrough);
-                        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-                        pageTrackerSnapshot = client._seqTracker.snapshotNamespace?.(ns);
-                        client._delivery.commitPendingTailWindow?.(ns, commitTarget);
-                        if (commitTarget > pageContigBefore) {
-                            client._seqTracker.forceContiguousSeq(ns, commitTarget);
-                            if (effectiveFloor > pageContigBefore) {
-                                client._clientLog.info(`group.v2.pull floor advance: ns=${ns} contiguous=${pageContigBefore} -> effective_floor=${effectiveFloor} retention_floor=${retentionFloor} visibility_floor=${visibilityFloor}`);
-                            }
-                            if (deferredServerCursor > pageContigBefore && pageCount === 1) {
-                                client._clientLog.info(`group.v2.pull restore local A from deferred server ACK cursor: group=${gid}, ns=${ns}, contiguous=${pageContigBefore} -> current_seq=${deferredServerCursor}`);
-                            }
-                            if (seqs.length > 0) {
-                                client._clientLog.debug(`group.v2.pull force contiguous: group=${gid}, ns=${ns}, page_max_seq=${pageMaxSeq}, previous=${pageContigBefore}`);
-                            }
-                        }
-                        ackSeq = client._seqTracker.getContiguousSeq(ns);
-                        contigAdvanced = ackSeq !== pageContigBefore;
-                        if (contigAdvanced) {
-                            await client._commitSeqTrackerState(ns);
-                            this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-                            if (pageCount === 1 && deferredServerCursor > 0)
-                                this.clearForwardCursor(ns, ackSeq);
-                        }
-                        client._delivery.completePendingTailWindow?.(ns);
-                        committedAckSeq = ackSeq;
+                    // 无本页 cursor.current_seq 时，只有本页成功提交了比已知 cursor
+                    // 更高的 A 才新增 ACK 义务；空页不得因已有本地 A 重复确认。
+                    const knownServerCursorSeq = hasServerCursor
+                        ? cursorCurrentSeq
+                        : (ownsCursor && pageCount === 1 ? deferredServerCursor : 0);
+                    const ackNeeded = ackSeq > 0
+                        && ackSeq > lastAutoAckSeq
+                        && ownsCursor
+                        && ((hasServerCursor && ackSeq > cursorCurrentSeq)
+                            || (contigAdvanced && ackSeq > knownServerCursorSeq));
+                    if (ackNeeded) {
+                        this.recordForwardAck(ns, ackSeq);
+                        pendingAckSeq = Math.max(pendingAckSeq, ackSeq);
                     }
-                    catch (exc) {
-                        if (Number(client._v2RuntimeGeneration ?? 0) === generation
-                            && (inlineGeneration === undefined || client._delivery.isInlineGenerationCurrent(inlineGeneration))
-                            && client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false
-                            && pageTrackerSnapshot !== undefined
-                            && typeof client._seqTracker.restoreNamespaceSnapshot === 'function') {
-                            client._seqTracker._restoreNamespaceSnapshotPreservingPush(ns, pageTrackerSnapshot);
-                        }
-                        client._clientLog.error?.(`group.v2.pull Forward commit rolled back: group=${gid} ns=${ns} target=${commitTarget} error=${formatE2EEError(exc)}`);
-                        throw exc;
+                    const nextAfter = Math.max(pageContiguousSeq, nextAfterSeq);
+                    if (!ownsCursor)
+                        break;
+                    const rawCount = messages.length;
+                    if (blockedSeq > 0)
+                        break;
+                    const shouldContinue = shouldContinueForwardPage({
+                        rawCount,
+                        nextAfterSeq,
+                        nextAfter,
+                        limit,
+                        hasMoreField,
+                        hasMore,
+                        serverHead,
+                        pendingAckSeq,
+                        observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
+                            ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter,
+                    });
+                    const shouldContinueForPipeline = shouldContinueForwardPage({
+                        rawCount,
+                        nextAfterSeq,
+                        nextAfter,
+                        limit,
+                        hasMoreField,
+                        hasMore,
+                        serverHead,
+                        pendingAckSeq: 0,
+                        observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
+                            ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter,
+                    });
+                    if (!shouldContinue)
+                        break;
+                    if (shouldContinueForPipeline && !pipelineRunning && limit >= V2_PULL_MAX_PAGE_LIMIT) {
+                        startPipeline(nextAfter);
                     }
+                    const tailDelayMs = v2PullTailDelayMs(rawCount, limit);
+                    if (!pipelineRunning && tailDelayMs > 0)
+                        await v2Sleep(tailDelayMs);
+                    nextAfterSeq = nextAfter;
                 }
-                for (const fetch of deferredKeyFetches.values()) {
-                    this.scheduleSenderIKFetch(fetch.fromAid, fetch.senderDeviceId, fetch.groupId);
-                }
-                client._delivery.onPullPage?.(ns, decrypted.length - pageDecryptedBefore, hasMore, pageMaxSeq, typeof result.remaining === 'number' && Number.isSafeInteger(result.remaining) && result.remaining >= 0 ? result.remaining : null, messages.length, client._seqTracker.getContiguousSeq(ns), pageMaxSeq);
-                if (ownsCursor && parsedCursorCurrentSeq !== null && cursorCurrentSeq > ackSeq) {
-                    this.recordForwardCursor(ns, cursorCurrentSeq, ackSeq);
-                }
-                // 无本页 cursor.current_seq 时，只有本页成功提交了比已知 cursor
-                // 更高的 A 才新增 ACK 义务；空页不得因已有本地 A 重复确认。
-                const knownServerCursorSeq = hasServerCursor
-                    ? cursorCurrentSeq
-                    : (ownsCursor && pageCount === 1 ? deferredServerCursor : 0);
-                const ackNeeded = ackSeq > 0
-                    && ackSeq > lastAutoAckSeq
-                    && ownsCursor
-                    && ((hasServerCursor && ackSeq > cursorCurrentSeq)
-                        || (contigAdvanced && ackSeq > knownServerCursorSeq));
-                if (ackNeeded) {
-                    this.recordForwardAck(ns, ackSeq);
-                    pendingAckSeq = Math.max(pendingAckSeq, ackSeq);
-                }
-                const nextAfter = Math.max(pageContiguousSeq, nextAfterSeq);
-                if (!ownsCursor)
-                    break;
-                const rawCount = messages.length;
-                if (blockedSeq > 0)
-                    break;
-                const shouldContinue = shouldContinueForwardPage({
-                    rawCount,
-                    nextAfterSeq,
-                    nextAfter,
-                    limit,
-                    hasMoreField,
-                    hasMore,
-                    serverHead,
-                    pendingAckSeq,
-                    observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
-                        ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter,
-                });
-                const shouldContinueForPipeline = shouldContinueForwardPage({
-                    rawCount,
-                    nextAfterSeq,
-                    nextAfter,
-                    limit,
-                    hasMoreField,
-                    hasMore,
-                    serverHead,
-                    pendingAckSeq: 0,
-                    observedUpper: typeof client._seqTracker.getMaxSeenSeq === 'function'
-                        ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter,
-                });
-                if (!shouldContinue)
-                    break;
-                if (shouldContinueForPipeline && !pipelineRunning && limit >= V2_PULL_MAX_PAGE_LIMIT) {
-                    startPipeline(nextAfter);
-                }
-                if (!pipelineRunning && pullGateKey && opts?.gateLocked && client._rpcPipeline?.yieldPullGate) {
-                    const nextKey = pullGateKeyForClient(client, 'group.v2.pull', {
-                        group_id: gid, after_seq: nextAfter, force: opts?.force === true, limit,
-                        _group_cursor_params: cursorParams,
-                    }, `${ns}|forward|after=${nextAfter}|force=${String(Boolean(opts?.force))}|limit=${limit}`);
-                    await client._rpcPipeline.yieldPullGate(pullGateKey, nextKey, true);
-                    pullGateKey = nextKey;
+                catch (error) {
+                    client._delivery.abortApplicationPage?.(applicationPage, error);
+                    throw error;
                 }
-                const tailDelayMs = v2PullTailDelayMs(rawCount, limit);
-                if (!pipelineRunning && tailDelayMs > 0)
-                    await v2Sleep(tailDelayMs);
-                nextAfterSeq = nextAfter;
             }
         }
         finally {
@@ -2583,18 +3188,18 @@ export class V2E2EECoordinator {
         }
         if (pendingAckSeq > 0) {
             this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
-            await this.confirmForwardGroupAck(gid, pendingAckSeq, groupAid);
+            await this.confirmForwardGroupAck(gid, pendingAckSeq, groupAid, background);
             pendingAckSeq = 0;
         }
         client._delivery.onPullWorkSettled?.();
         return deduplicatePulledResults(decrypted);
     }
-    async confirmForwardGroupAck(groupId, upToSeq, groupAid) {
+    async confirmForwardGroupAck(groupId, upToSeq, groupAid, background = false) {
         const ns = `group:${String(groupId ?? '').trim()}`;
         const generation = Number(this.client._v2RuntimeGeneration ?? 0);
         const deliveryGeneration = this.client._delivery.captureInlineGeneration?.();
         try {
-            const result = await this.ackGroupV2ForForward(groupId, upToSeq, groupAid);
+            const result = await this.ackGroupV2ForForward(groupId, upToSeq, groupAid, background);
             this.ensureDeliveryCurrent(ns, generation, deliveryGeneration);
             const actualAckSeq = this.client._delivery?.resolveForwardAckSeq?.(result, upToSeq) ?? 0;
             if (actualAckSeq < upToSeq) {
@@ -2613,10 +3218,10 @@ export class V2E2EECoordinator {
     async ackGroupV2(groupId, upToSeq, groupAid, inlineGeneration) {
         return this.ackGroupV2WithConfirmation(groupId, upToSeq, groupAid, inlineGeneration, false);
     }
-    async ackGroupV2ForForward(groupId, upToSeq, groupAid) {
-        return this.ackGroupV2WithConfirmation(groupId, upToSeq, groupAid, undefined, true);
+    async ackGroupV2ForForward(groupId, upToSeq, groupAid, background = false) {
+        return this.ackGroupV2WithConfirmation(groupId, upToSeq, groupAid, undefined, true, background);
     }
-    async ackGroupV2WithConfirmation(groupId, upToSeq, groupAid, inlineGeneration, requireServerWatermark) {
+    async ackGroupV2WithConfirmation(groupId, upToSeq, groupAid, inlineGeneration, requireServerWatermark, background) {
         const client = this.client;
         const gid = typeof groupId === 'string' ? groupId.trim() : '';
         if (!gid)
@@ -2638,7 +3243,9 @@ export class V2E2EECoordinator {
             return { acked: 0 };
         // 与 P2P 一致，必须将 ACK 响应限定到请求开始时对应的 inline generation。
         const ackGeneration = inlineGeneration ?? client._delivery?.pendingGroupInlineAckGeneration?.(ns) ?? null;
-        const raw = await client._callRawV2Rpc('group.v2.ack', withExplicitGroupAid({ group_id: gid, up_to_seq: seq }, explicitGroupAid));
+        const raw = await client._callRawV2Rpc('group.v2.ack', withExplicitGroupAid({ group_id: gid, up_to_seq: seq,
+            ...(background === undefined ? {} : { _rpc_background: background, _rpc_foreground: !background }),
+        }, explicitGroupAid));
         const actualAckSeq = requireServerWatermark
             ? (client._delivery?.resolveForwardAckSeq?.(raw, seq) ?? 0)
             : (client._delivery?.resolveActualAckSeq?.(raw, seq) ?? seq);
@@ -3301,6 +3908,7 @@ export class V2E2EECoordinator {
         }
         const sender = await session.getSenderIdentity();
         const envelope = await encryptP2PMessage(sender, targetSet, opts.payload, { messageId: opts.messageId, timestamp: opts.timestamp, protectedHeaders: opts.protectedHeaders, context: opts.context });
+        envelope.need_render = opts.needRender !== false;
         return envelope;
     }
     async buildV2GroupEnvelope(opts) {
@@ -3423,6 +4031,7 @@ export class V2E2EECoordinator {
         }
         const sender = await session.getSenderIdentity();
         const envelope = await encryptGroupMessage(sender, groupId, epoch, targetSet.targets, opts.payload, { messageId: opts.messageId, timestamp: opts.timestamp, protectedHeaders: opts.protectedHeaders, context: opts.context }, stateCommitment);
+        envelope.need_render = opts.needRender !== false;
         return envelope;
     }
     handleGroupChangedSpk(data, groupId, action) {