@agentvault/grok-bridge 0.4.12 → 0.4.14

package/dist/index.js

@@ -1115,6 +1115,58 @@ var init_mls_commit_classify = __esm2({
     "use strict";
   }
 });
+function parseMentions(text) {
+  const mentions = [];
+  const re2 = new RegExp(MENTION_RE.source, MENTION_RE.flags);
+  let match;
+  while ((match = re2.exec(text)) !== null) {
+    mentions.push(match[1].toLowerCase());
+  }
+  return mentions;
+}
+function resolveOwn(mention, names) {
+  if (names.has(mention)) return mention;
+  const parts = mention.split("-");
+  for (let i2 = parts.length - 1; i2 > 0; i2--) {
+    const candidate = parts.slice(0, i2).join("-");
+    if (names.has(candidate)) return candidate;
+  }
+  return null;
+}
+function owesRoomReply(plaintext, agentName, accountId, senderIsAgent, roomDisplayName, ownDisplayName, selfResolved = true) {
+  const mentions = parseMentions(plaintext);
+  if (mentions.length === 0) return false;
+  const ownNames = ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName);
+  if (mentions.some((m2) => resolveOwn(m2, ownNames) !== null)) return true;
+  if (mentions.some((m2) => resolveOwn(m2, BROADCAST_NAMES) !== null)) {
+    return senderIsAgent !== true;
+  }
+  if (!selfResolved) return true;
+  return false;
+}
+function ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName) {
+  const names = /* @__PURE__ */ new Set();
+  const add4 = (n2) => {
+    if (!n2) return;
+    const lower = n2.toLowerCase();
+    names.add(lower);
+    names.add(lower.split(/[\s(]/)[0]);
+  };
+  add4(agentName);
+  add4(accountId);
+  add4(roomDisplayName);
+  add4(ownDisplayName);
+  return names;
+}
+var MENTION_RE;
+var BROADCAST_NAMES;
+var init_room_protocol = __esm2({
+  "src/room-protocol.ts"() {
+    "use strict";
+    MENTION_RE = /@([\w-]+)/gi;
+    BROADCAST_NAMES = /* @__PURE__ */ new Set(["all", "everyone"]);
+  }
+});
 var __filename;
 var __dirname;
 var url2;
@@ -64017,10 +64069,10 @@ var init_mls_group = __esm2({
         const commits = [];
         if (leavesToRemove.length > 0) {
           const { commit } = await this.removeMembers(leavesToRemove);
-          commits.push({ commit, epoch: this.epoch });
+          commits.push({ commit, epoch: this.epoch, state: this.exportState() });
         }
         const added = await this.addMembers(toAdd);
-        commits.push({ commit: added.commit, epoch: this.epoch });
+        commits.push({ commit: added.commit, epoch: this.epoch, state: this.exportState() });
         return { commits, welcome: added.welcome };
       }
       async removeMembers(memberIndices) {
@@ -64605,11 +64657,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.39" : FALLBACK;
+  const v2 = true ? "0.23.41" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "9982fc8-dirty" : "";
+  const raw = true ? "916d6c5-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -65516,6 +65568,7 @@ var CREDENTIAL_MESSAGE_TYPES;
 var CATCHUP_MESSAGE_TYPES;
 var POLL_INTERVAL_MS;
 var RECONNECT_BASE_MS;
+var UUID_RE;
 var RECONNECT_MAX_MS;
 var PENDING_POLL_INTERVAL_MS;
 var OUTBOUND_DEDUPE_WINDOW_MS;
@@ -65531,6 +65584,7 @@ var init_channel = __esm2({
     "use strict";
     init_abstention();
     init_mls_commit_classify();
+    init_room_protocol();
     await init_libsodium_wrappers();
     await init_dist();
     await init_dist();
@@ -65562,6 +65616,7 @@ var init_channel = __esm2({
     ]);
     POLL_INTERVAL_MS = 6e3;
     RECONNECT_BASE_MS = 1e3;
+    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     RECONNECT_MAX_MS = 3e4;
     PENDING_POLL_INTERVAL_MS = 15e3;
     OUTBOUND_DEDUPE_WINDOW_MS = 3e3;
@@ -65733,6 +65788,35 @@ var init_channel = __esm2({
 
 ${text}`;
       }
+      /**
+       * #1161: room attachments whose caption addressed nobody, NOT yet fetched.
+       * The reply gate lives in every consumer of `room_message` (openclaw-entry
+       * and the three native bridges), but its first clause is shared and needs no
+       * identity: a caption with no mention token owes nobody a reply (#1107), so
+       * nobody needs the file yet. Kept per room, newest last, and fetched on the
+       * room's next ADDRESSED turn — the owner attaches, then asks (#1159/#1181).
+       * Hermes does the same (`_defer_room_attachment`).
+       */
+      _deferredRoomAttachments = /* @__PURE__ */ new Map();
+      static DEFERRED_ROOM_ATTACHMENT_MAX = 5;
+      static DEFERRED_ROOM_ATTACHMENT_MS = 60 * 60 * 1e3;
+      _deferRoomAttachment(roomId, info) {
+        const list = this._deferredRoomAttachments.get(roomId) ?? [];
+        list.push({ info, at: Date.now() });
+        while (list.length > _SecureChannel.DEFERRED_ROOM_ATTACHMENT_MAX) list.shift();
+        this._deferredRoomAttachments.set(roomId, list);
+        console.log(
+          `[SecureChannel] room ${roomId.slice(0, 8)}: attachment ${String(info?.filename ?? "file")} deferred \u2014 caption addresses nobody, fetch on the next @-addressed turn (#1161)`
+        );
+      }
+      /** Drain the room's deferred attachments that are still fresh (oldest first). */
+      _takeDeferredRoomAttachments(roomId) {
+        const list = this._deferredRoomAttachments.get(roomId);
+        if (!list?.length) return [];
+        this._deferredRoomAttachments.delete(roomId);
+        const cutoff = Date.now() - _SecureChannel.DEFERRED_ROOM_ATTACHMENT_MS;
+        return list.filter((d2) => d2.at >= cutoff).map((d2) => d2.info);
+      }
       /** In-flight roster-refresh promises (per room) — dedup concurrent refreshes. */
       _roomRosterRefreshInFlight = /* @__PURE__ */ new Map();
       /** Dedup buffer for A2A message IDs (prevents double-delivery via direct + Redis) */
@@ -66828,7 +66912,7 @@ ${text}`;
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.39" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.41" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68766,7 +68850,7 @@ ${text}`;
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.39" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.41" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -69090,7 +69174,7 @@ ${text}`;
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.39" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.41" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69305,45 +69389,78 @@ ${text}`;
                   const mlsGroup = this._mlsGroups.get(`a2a:${channelId}`);
                   if (mlsGroup?.isInitialized) {
                     try {
-                      const kpRes = await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/key-packages?hub_id=${encodeURIComponent(participant.hub_id)}`,
-                        { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-                      );
-                      if (kpRes.ok) {
-                        const kpData = await kpRes.json();
-                        if (kpData.key_package) {
-                          const kpBytes = new Uint8Array(Buffer.from(kpData.key_package, "hex"));
-                          const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                          const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                          if (welcome && this._ws) {
-                            this._ws.send(JSON.stringify({
-                              event: "mls_commit",
-                              data: {
-                                group_id: entry.mlsGroupId,
-                                epoch: Number(mlsGroup.epoch),
-                                payload: Buffer.from(commit).toString("hex")
-                              }
-                            }));
-                            const newDeviceId = participant.device_id || null;
-                            if (!newDeviceId) {
-                              console.warn(
-                                `[SecureChannel] Skipping MLS Welcome to new participant ${participant.hub_address} for A2A ${channelId.slice(0, 8)}: no device_id on participant_joined payload.`
-                              );
-                            } else {
-                              this._ws.send(JSON.stringify({
-                                event: "mls_welcome",
-                                data: {
-                                  group_id: entry.mlsGroupId,
-                                  payload: Buffer.from(welcome).toString("hex"),
-                                  target_device_id: newDeviceId,
-                                  a2a_channel_id: channelId,
-                                  target_hub_id: participant.hub_id
-                                  // observability only
+                      const newDeviceId = participant.device_id || null;
+                      const a2aLabel = `A2A ${channelId.slice(0, 8)} participant_joined`;
+                      if (!newDeviceId) {
+                        console.warn(
+                          `[SecureChannel] ${a2aLabel}: no device_id on the payload for ${participant.hub_address} \u2014 NOT adding (a Welcome could not be addressed)`
+                        );
+                      } else if (!this._wsIsOpen()) {
+                        console.warn(`[SecureChannel] ${a2aLabel}: socket is not OPEN \u2014 NOT advancing the group`);
+                      } else {
+                        const preHead = await this._readGroupHead(entry.mlsGroupId);
+                        const inFlight = preHead.ok && preHead.epoch !== Number(mlsGroup.epoch) ? null : this._reserveCommit(entry.mlsGroupId, a2aLabel);
+                        if (preHead.ok && preHead.epoch !== Number(mlsGroup.epoch)) {
+                          console.warn(
+                            `[SecureChannel] ${a2aLabel}: server head is at epoch ${preHead.epoch}, we are at ${Number(mlsGroup.epoch)} \u2014 NOT committing (it would be refused); resync catches up first`
+                          );
+                          await this._catchUpAfterPreflightSkip(entry.mlsGroupId, preHead.epoch, Number(mlsGroup.epoch), a2aLabel);
+                        } else if (inFlight) {
+                          try {
+                            const kpRes = await fetch(
+                              `${this.config.apiUrl}/api/v1/mls/key-packages?hub_id=${encodeURIComponent(participant.hub_id)}`,
+                              { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                            );
+                            if (kpRes.ok) {
+                              const kpData = await kpRes.json();
+                              if (kpData.key_package) {
+                                const kpBytes = new Uint8Array(Buffer.from(kpData.key_package, "hex"));
+                                const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
+                                const stateBefore = mlsGroup.exportState();
+                                const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
+                                const committedEpoch = Number(mlsGroup.epoch);
+                                if (!welcome) {
+                                  mlsGroup.importState(stateBefore);
+                                  console.warn(`[SecureChannel] ${a2aLabel}: addMembers produced no Welcome \u2014 rolled back`);
+                                } else {
+                                  const verdict = await this._sendCommitConfirmed({
+                                    mlsGroup,
+                                    mlsGroupId: entry.mlsGroupId,
+                                    label: a2aLabel,
+                                    commit,
+                                    epoch: committedEpoch,
+                                    parent: preHead.ok ? preHead.digest : void 0,
+                                    memberDeviceIds: this._commitRoster(
+                                      (entry.participants ?? []).map((p2) => p2.deviceId),
+                                      [newDeviceId]
+                                    ),
+                                    stateBefore,
+                                    inFlight
+                                  });
+                                  if (verdict === "confirmed") {
+                                    const sent = await this._sendFrameConfirmed({
+                                      event: "mls_welcome",
+                                      data: {
+                                        group_id: entry.mlsGroupId,
+                                        payload: Buffer.from(welcome).toString("hex"),
+                                        target_device_id: newDeviceId,
+                                        a2a_channel_id: channelId,
+                                        target_hub_id: participant.hub_id
+                                        // observability only
+                                      }
+                                    }, `${a2aLabel} welcome`);
+                                    await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+                                    if (sent) {
+                                      console.log(`[SecureChannel] Sent MLS Welcome to new participant ${participant.hub_address} (device ${String(newDeviceId).slice(0, 8)})`);
+                                    } else {
+                                      console.warn(`[SecureChannel] ${a2aLabel}: Welcome to ${String(newDeviceId).slice(0, 8)} was NOT written \u2014 the participant will request one`);
+                                    }
+                                  }
                                 }
-                              }));
-                              await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                              console.log(`[SecureChannel] Sent MLS Welcome to new participant ${participant.hub_address} (device ${String(newDeviceId).slice(0, 8)})`);
+                              }
                             }
+                          } finally {
+                            await this._releaseCommit(entry.mlsGroupId, inFlight, a2aLabel);
                           }
                         }
                       }
@@ -69404,6 +69521,7 @@ ${text}`;
                 `[deliver] delivery_result=REJECTED group=${rejectedGroup || "unknown"} detail=${detail}`
               );
               console.error(`[SecureChannel] Server error: ${detail}`);
+              this._noteCommitRefusal(data.data || data);
               await this._handleServerError(data.data || data);
               this.emit("error", new Error(`Server: ${detail}`));
             }
@@ -69705,7 +69823,7 @@ ${text}`;
         try {
           const parsed = JSON.parse(plaintext);
           messageType = parsed.type || "message";
-          messageText = parsed.text || plaintext;
+          messageText = parsed.text ?? plaintext;
           if (parsed.attachment) {
             attachmentInfo = parsed.attachment;
           }
@@ -70457,7 +70575,7 @@ ${baseText}`;
           try {
             const parsed = JSON.parse(rawPlaintext);
             messageType = parsed.type || "message";
-            messageText = parsed.text || rawPlaintext;
+            messageText = parsed.text ?? rawPlaintext;
             if (parsed.attachment) roomAttachment = parsed.attachment;
           } catch {
             messageType = "message";
@@ -70498,10 +70616,19 @@ ${baseText}`;
               await this._refreshRoomRoster(resolvedRoomId);
             }
           }
-          if (roomAttachment) {
-            messageText = await this._augmentWithAttachment(roomAttachment, messageText, resolvedRoomId);
+          const addressed = parseMentions(messageText).length > 0;
+          if (roomAttachment && !addressed) {
+            this._deferRoomAttachment(resolvedRoomId, roomAttachment);
           } else {
-            messageText = this._withRecentRoomAttachmentNote(resolvedRoomId, messageText);
+            const deferred = addressed ? this._takeDeferredRoomAttachments(resolvedRoomId) : [];
+            for (const info of deferred) {
+              messageText = await this._augmentWithAttachment(info, messageText, resolvedRoomId);
+            }
+            if (roomAttachment) {
+              messageText = await this._augmentWithAttachment(roomAttachment, messageText, resolvedRoomId);
+            } else if (deferred.length === 0) {
+              messageText = this._withRecentRoomAttachmentNote(resolvedRoomId, messageText);
+            }
           }
           const roomMembers = this._persisted?.rooms?.[resolvedRoomId]?.members ?? [];
           const senderMember = roomMembers.find((m2) => m2.deviceId === senderDeviceId);
@@ -70625,6 +70752,12 @@ ${baseText}`;
         const groupId = data.group_id;
         const epoch = typeof data.epoch === "number" ? data.epoch : 0;
         this._noteGroupEpoch(groupId, data.epoch);
+        const held = this._commitInFlight.get(groupId);
+        if (held) {
+          held.frames.push(data);
+          console.log(`[SecureChannel] MLS commit for ${groupId.slice(0, 8)} held (epoch=${epoch}) \u2014 our own commit is awaiting confirmation (#1184)`);
+          return true;
+        }
         const target = this._resolveGroupFamily(groupId);
         if (target) {
           const { managerKey: groupKey, label } = target;
@@ -70857,9 +70990,34 @@ ${baseText}`;
        *
        * Returns the number of requests actually fulfilled.
        */
+      /**
+       * #1226: the roster to submit on a commit frame — the caller's known members,
+       * the devices being admitted, and ALWAYS ourselves — deduplicated, UUIDs
+       * only. Self is non-negotiable: once a roster is non-empty the server
+       * requires the committer in it (#469), and our own head read
+       * (`assert_group_member`) requires it too. So with no device id of our own
+       * this returns `[]` and the frame carries NO roster (the pre-#1226 shape)
+       * rather than a roster that locks us out. Non-UUID entries are dropped:
+       * `known` can come off an inbound Welcome frame, and a malformed id in the
+       * outbound frame is refused by the server (`MEMBER_DEVICE_IDS_MALFORMED`).
+       * @internal exposed for tests
+       */
+      _commitRoster(known, targets) {
+        if (!this._deviceId) return [];
+        const out = [];
+        const seen = /* @__PURE__ */ new Set();
+        for (const id of [...known ?? [], ...targets, this._deviceId]) {
+          if (typeof id !== "string" || !UUID_RE.test(id) || seen.has(id)) continue;
+          seen.add(id);
+          out.push(id);
+        }
+        return out;
+      }
       async _fulfilWelcomeRequests(opts) {
         const { mlsGroup, mlsGroupId, label, welcomeFields, targets } = opts;
         if (targets.length === 0) return 0;
+        const rosterBefore = this._commitRoster(opts.memberDeviceIds, []);
+        const rosterAfter = this._commitRoster(opts.memberDeviceIds, targets.map((t2) => t2.deviceId));
         if (!this._wsIsOpen()) {
           console.warn(
             `[SecureChannel] ${label}: socket is not OPEN \u2014 NOT advancing the group; ${targets.length} request(s) stay pending for the next pull`
@@ -70867,73 +71025,154 @@ ${baseText}`;
           return 0;
         }
         const snapshot = mlsGroup.exportState();
-        let parent2 = await this._readGroupHeadDigest(mlsGroupId);
-        const { commits, welcome } = await mlsGroup.reAdmitMembers(targets.map((t2) => t2.keyPackage));
-        let sentCommits = 0;
-        for (const c2 of commits) {
-          const ok = await this._sendFrameConfirmed(
-            {
-              event: "mls_commit",
-              data: {
-                group_id: mlsGroupId,
-                // The epoch this commit PRODUCED. After two commits the manager
-                // only knows the last one, which is why the result carries them.
-                epoch: Number(c2.epoch),
-                payload: Buffer.from(c2.commit).toString("hex"),
-                ...parent2 ? { parent_digest: parent2 } : {}
-              }
-            },
-            `${label} commit ${sentCommits + 1}/${commits.length}`
-          );
-          if (!ok) break;
-          parent2 = this._commitDigest(c2.commit);
-          sentCommits++;
-        }
-        if (sentCommits === 0) {
-          mlsGroup.importState(snapshot);
-          console.warn(
-            `[SecureChannel] ${label}: commit was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing fulfilled, requests stay pending`
-          );
-          return 0;
-        }
-        await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-        if (sentCommits < commits.length) {
+        const preHead = await this._readGroupHead(mlsGroupId);
+        if (preHead.ok && preHead.epoch !== Number(mlsGroup.epoch)) {
           console.warn(
-            `[SecureChannel] ${label}: only ${sentCommits}/${commits.length} commits reached the wire \u2014 requests stay PENDING for the next pull`
+            `[SecureChannel] ${label}: server head is at epoch ${preHead.epoch}, we are at ${Number(mlsGroup.epoch)} \u2014 NOT committing (it would be refused, #1184); ${targets.length} request(s) stay pending`
           );
+          await this._catchUpAfterPreflightSkip(mlsGroupId, preHead.epoch, Number(mlsGroup.epoch), label);
           return 0;
         }
-        if (!welcome) {
+        let parent2 = preHead.ok ? preHead.digest : void 0;
+        if (this._commitInFlight.has(mlsGroupId)) {
           console.warn(
-            `[SecureChannel] ${label}: addMembers produced NO Welcome \u2014 ${targets.length} request(s) left pending rather than marked fulfilled`
+            `[SecureChannel] ${label}: another commit for this group is in flight \u2014 NOT advancing; ${targets.length} request(s) stay pending for the next pull`
           );
           return 0;
         }
-        let fulfilled = 0;
-        for (const t2 of targets) {
-          const sent = await this._sendFrameConfirmed(
-            {
-              event: "mls_welcome",
-              data: {
-                target_device_id: t2.deviceId,
-                group_id: mlsGroupId,
-                ...welcomeFields,
-                payload: Buffer.from(welcome).toString("hex")
-              }
-            },
-            `${label} welcome\u2192${t2.deviceId.slice(0, 8)}`
-          );
-          if (!sent) {
+        const inFlight = { frames: [], sent: [] };
+        this._commitInFlight.set(mlsGroupId, inFlight);
+        try {
+          const { commits, welcome } = await mlsGroup.reAdmitMembers(targets.map((t2) => t2.keyPackage));
+          let sentCommits = 0;
+          let refusedAt = -1;
+          let verdict = "confirmed";
+          for (const c2 of commits) {
+            const ours = this._commitDigest(c2.commit);
+            inFlight.sent.push({
+              epoch: Number(c2.epoch),
+              digest: ours,
+              verified: false,
+              stateBefore: sentCommits === 0 ? snapshot : commits[sentCommits - 1].state
+            });
+            const ok = await this._sendFrameConfirmed(
+              {
+                event: "mls_commit",
+                data: {
+                  group_id: mlsGroupId,
+                  // The epoch this commit PRODUCED. After two commits the manager
+                  // only knows the last one, which is why the result carries them.
+                  epoch: Number(c2.epoch),
+                  payload: Buffer.from(c2.commit).toString("hex"),
+                  ...parent2 ? { parent_digest: parent2 } : {},
+                  ...(sentCommits === commits.length - 1 ? rosterAfter : rosterBefore).length > 0 ? { member_device_ids: sentCommits === commits.length - 1 ? rosterAfter : rosterBefore } : {}
+                }
+              },
+              `${label} commit ${sentCommits + 1}/${commits.length}`
+            );
+            if (!ok) {
+              verdict = "unsent";
+              inFlight.sent.pop();
+              break;
+            }
+            verdict = await this._confirmCommitAtHead(mlsGroupId, Number(c2.epoch), ours, inFlight, label);
+            if (verdict === "confirmed") {
+              inFlight.sent[sentCommits].verified = true;
+            } else if (verdict === "unverifiable") {
+              console.warn(
+                `[SecureChannel] ${label}: commit ${sentCommits + 1}/${commits.length} at epoch ${Number(c2.epoch)} could not be verified and was not refused \u2014 proceeding UNCHECKED (#1184)`
+              );
+            } else {
+              refusedAt = sentCommits;
+              break;
+            }
+            parent2 = ours;
+            sentCommits++;
+          }
+          const cutFromRefusal = () => {
+            const r2 = inFlight.refusal;
+            if (r2 === void 0) return refusedAt;
+            return refusedAt === -1 ? r2.from : Math.min(refusedAt, r2.from);
+          };
+          const rollBackTo = async (cut2, stage, persisted) => {
+            const why = inFlight.refusal?.detail ?? verdict.toUpperCase();
+            mlsGroup.importState(inFlight.sent[cut2].stateBefore);
+            sentCommits = cut2;
             console.warn(
-              `[SecureChannel] ${label}: Welcome for ${t2.deviceId.slice(0, 8)} was NOT written \u2014 leaving the request PENDING so the next pull retries it`
+              `[SecureChannel] ${label}: commit ${cut2 + 1}/${commits.length} ${stage} \u2014 "${why}" \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}` + (cut2 === 0 ? ", nothing" : ` (after commit ${cut2}), only that`) + ` persisted, ${targets.length} request(s) stay pending`
             );
-            continue;
+            if (persisted) await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+          };
+          let cut = cutFromRefusal();
+          if (cut !== -1) {
+            await rollBackTo(cut, "was refused by the server", false);
+            if (sentCommits === 0) return 0;
+          }
+          if (sentCommits === 0) {
+            mlsGroup.importState(snapshot);
+            console.warn(
+              `[SecureChannel] ${label}: commit was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing fulfilled, requests stay pending`
+            );
+            return 0;
+          }
+          await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+          cut = cutFromRefusal();
+          if (cut !== -1 && cut < sentCommits) {
+            await rollBackTo(cut, "was refused by the server after the window (during persist)", true);
+            return 0;
           }
-          if (await this._postFulfilWelcome(mlsGroupId, t2.requestId, `${label} ${t2.deviceId.slice(0, 8)}`)) {
-            fulfilled++;
+          if (sentCommits < commits.length) {
+            console.warn(
+              `[SecureChannel] ${label}: only ${sentCommits}/${commits.length} commits were confirmed \u2014 requests stay PENDING for the next pull`
+            );
+            return 0;
+          }
+          if (!welcome) {
+            console.warn(
+              `[SecureChannel] ${label}: addMembers produced NO Welcome \u2014 ${targets.length} request(s) left pending rather than marked fulfilled`
+            );
+            return 0;
+          }
+          let fulfilled = 0;
+          for (const t2 of targets) {
+            const sent = await this._sendFrameConfirmed(
+              {
+                event: "mls_welcome",
+                data: {
+                  target_device_id: t2.deviceId,
+                  group_id: mlsGroupId,
+                  ...welcomeFields,
+                  payload: Buffer.from(welcome).toString("hex")
+                }
+              },
+              `${label} welcome\u2192${t2.deviceId.slice(0, 8)}`
+            );
+            if (!sent) {
+              console.warn(
+                `[SecureChannel] ${label}: Welcome for ${t2.deviceId.slice(0, 8)} was NOT written \u2014 leaving the request PENDING so the next pull retries it`
+              );
+              continue;
+            }
+            cut = cutFromRefusal();
+            if (cut !== -1 && cut < sentCommits) {
+              await rollBackTo(cut, "was refused by the server after the window (during the Welcome)", true);
+              return fulfilled;
+            }
+            if (await this._postFulfilWelcome(mlsGroupId, t2.requestId, `${label} ${t2.deviceId.slice(0, 8)}`)) {
+              fulfilled++;
+            }
+          }
+          return fulfilled;
+        } finally {
+          this._commitInFlight.delete(mlsGroupId);
+          for (const frame of inFlight.frames) {
+            try {
+              await this._handleMlsCommit(frame);
+            } catch (err) {
+              console.error(`[SecureChannel] ${label}: replaying a held MLS commit failed:`, err);
+            }
           }
         }
-        return fulfilled;
       }
       /**
        * Resolve an MLS group id to the family that owns it.
@@ -70974,31 +71213,364 @@ ${baseText}`;
         return this._ws?.readyState === 1;
       }
       /** SHA-256 hex of a commit's bytes — its identity on the server (#1175/#1177). */
+      /**
+       * #1225: send ONE commit over the socket and wait for the server's verdict,
+       * with the #1184 machinery — an in-flight record (so a `… commit rejected`
+       * frame is correlated to it and a concurrent commit for the group is held
+       * and replayed), the head poll, and rollback. The three A2A commit sites
+       * (`a2a_participant_joined`, the `/distribute` WS fallback, `_foundA2AGroup`)
+       * used a raw `ws.send` and treated "the socket took it" as "the server
+       * stored it" — two of them then PERSISTED a state the server never saw.
+       *
+       * Returns the verdict. On `refused` / `unsent` the manager has been restored
+       * to `stateBefore` and nothing must be persisted or minted from it.
+       * `unverifiable` (head unreadable on every try AND no refusal) proceeds
+       * UNCHECKED, the same deliberate choice as the fulfil site.
+       */
+      /**
+       * #1225 (review F1): reserve the single in-flight slot for a group. The
+       * record is what `_noteCommitRefusal` correlates a refusal to and what
+       * `_handleMlsCommit` holds concurrent socket commits behind; a second run on
+       * the same group would clobber both (measured: two overlapping joins → two
+       * commits claiming one epoch, one Welcome instead of two, the manager AHEAD
+       * of the server). Taken BEFORE the commit is generated; released by
+       * `_releaseCommit` after the last step that depends on it.
+       */
+      /**
+       * A pre-flight skip must not be a dead end. The skip happens because the
+       * server's head is somewhere else; before this the group "caught up through
+       * the normal divergence path", which only runs when a message for the group
+       * arrives — so a group nobody writes to stayed diverged and its pending
+       * Welcome requests were never fulfilled (named in PR #1227). When the server
+       * is AHEAD, replay the missing commits now so the next pull can commit; when
+       * WE are ahead there is nothing to replay (the fork-ahead direction, #972).
+       */
+      async _catchUpAfterPreflightSkip(mlsGroupId, serverEpoch, localEpoch, label) {
+        if (serverEpoch < localEpoch) {
+          console.warn(`[SecureChannel] ${label}: we are AHEAD of the server (${localEpoch} > ${serverEpoch}) \u2014 nothing to replay`);
+          return;
+        }
+        const fam = this._resolveGroupFamily(mlsGroupId);
+        if (!fam) return;
+        try {
+          const caughtUp = await this._resyncOnDivergence(fam.managerKey, mlsGroupId);
+          console.log(`[SecureChannel] ${label}: catch-up after pre-flight skip ${caughtUp ? "replayed the missing commits" : "could not replay"}`);
+        } catch (err) {
+          console.warn(`[SecureChannel] ${label}: catch-up after pre-flight skip failed:`, err);
+        }
+      }
+      _reserveCommit(groupId, label) {
+        if (this._commitInFlight.has(groupId)) {
+          console.warn(
+            `[SecureChannel] ${label}: another commit for group ${groupId.slice(0, 8)} is in flight \u2014 NOT advancing the group (a Welcome can be requested again)`
+          );
+          return null;
+        }
+        const rec = { frames: [], sent: [] };
+        this._commitInFlight.set(groupId, rec);
+        return rec;
+      }
+      /** Release the slot taken by `_reserveCommit` and replay the socket commits held meanwhile. */
+      async _releaseCommit(groupId, rec, label) {
+        if (this._commitInFlight.get(groupId) === rec) this._commitInFlight.delete(groupId);
+        for (const frame of rec.frames) {
+          try {
+            await this._handleMlsCommit(frame);
+          } catch (err) {
+            console.error(`[SecureChannel] ${label}: replaying a held MLS commit failed:`, err);
+          }
+        }
+      }
+      /**
+       * #1225: send ONE commit over the socket and wait for the server's verdict
+       * with the #1184 machinery (refusal frame correlated through the reserved
+       * in-flight record, head poll). The three A2A commit sites
+       * (`a2a_participant_joined`, the `/distribute` WS fallback, `_foundA2AGroup`)
+       * used a raw `ws.send` and treated "the socket took it" as "the server
+       * stored it" — two of them then PERSISTED a state the server never saw.
+       *
+       * Only `confirmed` proceeds. `unverifiable` (head unreadable on every try,
+       * no refusal) is a ROLLBACK here, unlike the fulfil site: that site proceeds
+       * UNCHECKED because 79 of 80 production rooms 403 the head read on an empty
+       * roster; an A2A head read admits any active participant (observer
+       * fallback), so five failed reads there mean an outage, not a routine 403.
+       * On anything but `confirmed` the manager is back at `stateBefore`.
+       */
+      async _sendCommitConfirmed(opts) {
+        const { mlsGroup, mlsGroupId, label, commit, epoch, parent: parent2, memberDeviceIds, stateBefore, inFlight } = opts;
+        const ours = this._commitDigest(commit);
+        inFlight.sent.push({ epoch, digest: ours, verified: false, stateBefore });
+        const ok = await this._sendFrameConfirmed(
+          {
+            event: "mls_commit",
+            data: {
+              group_id: mlsGroupId,
+              epoch,
+              payload: Buffer.from(commit).toString("hex"),
+              ...parent2 ? { parent_digest: parent2 } : {},
+              ...memberDeviceIds && memberDeviceIds.length > 0 ? { member_device_ids: memberDeviceIds } : {}
+            }
+          },
+          `${label} commit`
+        );
+        if (!ok) {
+          inFlight.sent.pop();
+          mlsGroup.importState(stateBefore);
+          console.warn(
+            `[SecureChannel] ${label}: commit at epoch ${epoch} was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}`
+          );
+          return "unsent";
+        }
+        const verdict = await this._confirmCommitAtHead(mlsGroupId, epoch, ours, inFlight, label);
+        if (inFlight.refusal === void 0 && verdict === "confirmed") {
+          inFlight.sent[inFlight.sent.length - 1].verified = true;
+          return "confirmed";
+        }
+        const why = inFlight.refusal?.detail ?? verdict.toUpperCase();
+        mlsGroup.importState(stateBefore);
+        console.warn(
+          `[SecureChannel] ${label}: commit at epoch ${epoch} was ${verdict === "unverifiable" ? "not verified (head unreadable)" : "refused by the server"} \u2014 "${why}" \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing persisted`
+        );
+        return "refused";
+      }
       _commitDigest(bytes) {
         return createHash("sha256").update(bytes).digest("hex");
       }
       /**
        * #1177: the digest of the commit at the server's head, or undefined.
        *
-       * Undefined covers "no head yet", "older backend", AND "could not read" —
-       * deliberately the same value. The commit is sent either way: the server
-       * skips the parent check for an ABSENT field and refuses a MALFORMED one,
-       * so a read failure must degrade to "unchecked", never to "blocked" (a
-       * rescue that cannot run is the 2026-09-04 lockout) and never to `null`.
+       * Undefined covers "no head yet" (a pruned group: epoch known, digest NULL —
+       * 29 in production) AND "could not read" — deliberately the same value. The
+       * commit is sent either way: the server skips the parent check for an
+       * ABSENT field and refuses a MALFORMED one, so a read failure must degrade
+       * to "unchecked", never to "blocked" (a rescue that cannot run is the
+       * 2026-09-04 lockout) and never to `null`.
        */
       async _readGroupHeadDigest(groupId) {
+        const head = await this._readGroupHead(groupId);
+        return head.ok ? head.digest : void 0;
+      }
+      /**
+       * #1184: the server's head — its `current_epoch` and the digest of the commit
+       * that produced it.
+       *
+       *   - `{ ok: true, epoch, digest? }`  the server described its head. `digest`
+       *                                     is absent on a pruned group (NULL
+       *                                     `last_commit_digest`).
+       *   - `{ ok: false, why }`            the read failed: a non-2xx (the 403
+       *                                     `assert_group_member` returns on an
+       *                                     EMPTY roster — 79 of 80 production
+       *                                     rooms — or a 5xx), a timeout, or a body
+       *                                     with no `current_epoch`. Callers may
+       *                                     retry; a failure is never a verdict.
+       *
+       * `current_epoch` is a required field of `MLSGroupResponse`, so "200 with
+       * no head" is not a shape any deployed backend produces; it is folded into
+       * `ok: false` rather than given a branch of its own (the first cut of #1184
+       * had one, and it was the only branch the suite exercised).
+       */
+      async _readGroupHead(groupId) {
         try {
           const res = await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${groupId}`, {
-            headers: { Authorization: `Bearer ${this._deviceJwt}` }
+            headers: { Authorization: `Bearer ${this._deviceJwt}` },
+            // The confirm loop holds `_deliveryPulling`; a black-holed read must
+            // not hold it for undici's 300 s default. A timeout is a failed read.
+            signal: AbortSignal.timeout(_SecureChannel.HEAD_READ_TIMEOUT_MS)
           });
-          if (!res.ok) return void 0;
+          if (!res.ok) return { ok: false, why: `HTTP ${res.status}` };
           const head = await res.json();
-          const d2 = head?.last_commit_digest;
-          return typeof d2 === "string" && /^[0-9a-f]{64}$/.test(d2) ? d2 : void 0;
-        } catch {
-          return void 0;
+          if (typeof head?.current_epoch !== "number") return { ok: false, why: "no current_epoch in body" };
+          const d2 = head.last_commit_digest;
+          return { ok: true, epoch: head.current_epoch, digest: typeof d2 === "string" && /^[0-9a-f]{64}$/.test(d2) ? d2 : void 0 };
+        } catch (err) {
+          return { ok: false, why: err instanceof Error ? err.name : String(err) };
         }
       }
+      /**
+       * #1184: after each read of the head, how long to wait before the next.
+       * The web's schedule (`lib/mls-commit-confirm.ts`) plus one immediate read:
+       * five reads, ~3.75 s, no resend — an MLS commit cannot be regenerated. The
+       * immediate read catches the common case where the server stored the frame
+       * before the GET lands. Instance-level so tests can run the decision logic
+       * without the clock; an empty schedule still reads once (`_confirmCommitAtHead`).
+       */
+      _commitConfirmDelaysMs = [0, 250, 500, 1e3, 2e3];
+      static HEAD_READ_TIMEOUT_MS = 5e3;
+      /**
+       * #1184: groups with a commit of OURS between "built" and "confirmed or rolled
+       * back". Each record holds the `mls_commit` frames the socket delivered for
+       * that group meanwhile — before the confirm loop that window was
+       * microseconds; now it is up to ~3.75 s, and a commit applied to our
+       * unconfirmed local state would be lost by the rollback (in memory) after
+       * being persisted (on disk). Held frames are replayed, in order, once the
+       * group is back on a real state. The record also carries the server's
+       * REFUSAL, when one arrives on the socket (`_noteCommitRefusal`), and a
+       * `wake` the confirm loop installs so a refusal ends its wait at once.
+       */
+      _commitInFlight = /* @__PURE__ */ new Map();
+      /** #1184: a pull was requested while one was running — run once more after. */
+      _deliveryPullRequested = false;
+      /**
+       * #1184: an `error` frame naming a group we have a commit in flight for, with
+       * a `… commit rejected` detail, is the server's refusal of one of those
+       * commits — every rejection the `mls_commit` WS handler sends (malformed
+       * parent, PARENT_MISMATCH, EPOCH_CONFLICT, not-a-member, no-participants)
+       * ends with those words and carries `group_id` (pinned by
+       * `tests/test_1184_commit_reject_frame_contract.py`). It is sent on OUR
+       * socket after the server processed OUR frame, so it is deterministic in a
+       * way the head poll is not, and it is the only refusal signal on a group
+       * whose head we cannot read (403).
+       *
+       * WHICH commit, and what else the frame proves (re-review of #1227):
+       *   - EPOCH_CONFLICT carries `expected_epoch` (the epoch we claimed to build
+       *     on) and `current_epoch` (the server's); PARENT_MISMATCH carries
+       *     `current_epoch` (the head, which equalled our claim or the epoch check
+       *     would have fired first) and `head_digest`. The refused commit is the
+       *     one built on that epoch. A frame naming an epoch none of our in-flight
+       *     commits claimed is a refusal of some EARLIER attempt — ignored.
+       *   - the server's `current_epoch` bounds our earlier commits too: any of
+       *     ours ABOVE it did not land.
+       *   - `head_digest` at `current_epoch` is our commit at that epoch → that one
+       *     positively LANDED; someone else's → ours at that epoch did not.
+       *   - the un-numbered shapes refuse all of ours alike: the cut is the first
+       *     commit the head poll has not positively confirmed.
+       * Recorded as the index of the first commit shown not to hold; the fulfil
+       * path honours it whenever it arrives. A frame for a group with nothing in
+       * flight is somebody else's business.
+       */
+      _noteCommitRefusal(payload) {
+        const groupId = typeof payload?.group_id === "string" ? payload.group_id : void 0;
+        const detail = typeof payload?.detail === "string" ? payload.detail : "";
+        if (!groupId || !detail.endsWith("commit rejected")) return;
+        const inFlight = this._commitInFlight.get(groupId);
+        if (!inFlight) return;
+        const num = (v2) => typeof v2 === "number" && Number.isFinite(v2) ? v2 : void 0;
+        const current = num(payload.current_epoch);
+        const claimed = num(payload.expected_epoch) ?? current;
+        const headDigest = typeof payload.head_digest === "string" ? payload.head_digest : void 0;
+        const sent = inFlight.sent;
+        const tag = `[SecureChannel] refusal for ${groupId.slice(0, 8)} ("${detail}")`;
+        let from = -1;
+        if (claimed !== void 0) {
+          from = sent.findIndex((c2) => c2.epoch === claimed + 1);
+          if (from === -1) {
+            console.warn(`${tag} names epoch ${claimed + 1}, which no commit in flight claimed \u2014 an earlier attempt's; ignored`);
+            return;
+          }
+        }
+        if (current !== void 0) {
+          const above = sent.findIndex((c2) => c2.epoch > current && !c2.verified);
+          if (above !== -1 && (from === -1 || above < from)) from = above;
+        }
+        if (headDigest !== void 0 && current !== void 0) {
+          const at = sent.findIndex((c2) => c2.epoch === current);
+          if (at !== -1) {
+            if (sent[at].digest === headDigest) {
+              sent[at].verified = true;
+            } else if (from === -1 || at < from) {
+              from = at;
+            }
+          }
+        }
+        if (from === -1) from = sent.findIndex((c2) => !c2.verified);
+        if (from === -1 || sent[from].verified) {
+          console.warn(`${tag} contradicts a head read that showed our commit \u2014 stale; ignored`);
+          return;
+        }
+        if (inFlight.refusal !== void 0 && inFlight.refusal.from <= from) return;
+        inFlight.refusal = { detail, from };
+        inFlight.wake?.();
+      }
+      /**
+       * #1184: a commit is CONFIRMED when the server's head shows OUR digest at OUR
+       * epoch — never when the socket took the bytes (#1015 covers only that). The
+       * server sends no ack for a stored commit, so, like the web, we read the
+       * head back; but it DOES send a refusal on the socket (`_noteCommitRefusal`),
+       * and that is checked first, before every read and during every wait.
+       *
+       *   confirmed     head.epoch === ours && head.digest === ours
+       *   conflict      the server refused ours on the socket, OR the head is at
+       *                 our epoch with ANOTHER digest, OR already past us
+       *   unconfirmed   the head was READ (at least once) but never reached our
+       *                 epoch within the window — the server described its state
+       *                 and ours is not in it
+       *   unverifiable  the head could not be read on ANY try (403 on an empty
+       *                 roster, an outage) and no refusal arrived — or it is at
+       *                 our epoch but keeps no digest (a pruned group). Nothing
+       *                 can be decided on; the caller proceeds UNCHECKED (#1177's
+       *                 rule: a rescue that cannot run is the 2026-09-04 lockout)
+       *
+       * The first cut returned `unverifiable` only for a body with no
+       * `current_epoch`, which no deployed backend produces, and rolled back on
+       * every real read failure — the opposite of the rule it stated.
+       */
+      async _confirmCommitAtHead(groupId, epoch, ours, inFlight, label) {
+        const refused = () => {
+          if (inFlight.refusal === void 0) return void 0;
+          console.warn(`[SecureChannel] ${label}: server refused our commit at epoch ${epoch} \u2014 "${inFlight.refusal.detail}"`);
+          return "conflict";
+        };
+        let lastSeen;
+        let described = false;
+        let lastFailure = "";
+        const delays = this._commitConfirmDelaysMs.length > 0 ? this._commitConfirmDelaysMs : [0];
+        for (const delay of delays) {
+          if (delay > 0) {
+            await new Promise((resolve3) => {
+              const timer = setTimeout(() => {
+                inFlight.wake = void 0;
+                resolve3();
+              }, delay);
+              inFlight.wake = () => {
+                clearTimeout(timer);
+                inFlight.wake = void 0;
+                resolve3();
+              };
+            });
+          }
+          const early = refused();
+          if (early) return early;
+          const head = await this._readGroupHead(groupId);
+          const duringRead = refused();
+          if (duringRead) return duringRead;
+          if (!head.ok) {
+            lastFailure = head.why;
+            continue;
+          }
+          described = true;
+          lastSeen = head.epoch;
+          if (head.epoch === epoch) {
+            if (head.digest === ours) return "confirmed";
+            if (head.digest === void 0) return "unverifiable";
+            console.warn(
+              `[SecureChannel] ${label}: head at epoch ${epoch} is NOT our commit (${head.digest.slice(0, 12)}\u2026 vs ours ${ours.slice(0, 12)}\u2026) \u2014 ours was refused`
+            );
+            return "conflict";
+          }
+          if (head.epoch > epoch) {
+            console.warn(`[SecureChannel] ${label}: head already at epoch ${head.epoch}, past our ${epoch} \u2014 ours was refused`);
+            return "conflict";
+          }
+        }
+        const late2 = refused();
+        if (late2) return late2;
+        if (!described && !this._wsIsOpen()) {
+          console.warn(
+            `[SecureChannel] ${label}: the socket closed during the confirm window and the head could not be read \u2014 a refusal of commit at epoch ${epoch} may have been lost; treating as refused`
+          );
+          return "unconfirmed";
+        }
+        if (!described) {
+          console.warn(
+            `[SecureChannel] ${label}: could not read the head on any of ${delays.length} tries (last: ${lastFailure}) and the server sent no refusal \u2014 cannot verify commit at epoch ${epoch}`
+          );
+          return "unverifiable";
+        }
+        console.warn(
+          `[SecureChannel] ${label}: commit at epoch ${epoch} never appeared at the head (last seen ${lastSeen}) \u2014 treating as refused`
+        );
+        return "unconfirmed";
+      }
       /**
        * #1015: write one frame and report whether the socket took it.
        *
@@ -71519,7 +72091,11 @@ ${baseText}`;
        * Called on WS connect, on mls_delivery ping, and every 30s heartbeat.
        */
       async _pullDeliveryQueue() {
-        if (!this._deviceId || !this._deviceJwt || this._deliveryPulling) return;
+        if (!this._deviceId || !this._deviceJwt) return;
+        if (this._deliveryPulling) {
+          this._deliveryPullRequested = true;
+          return;
+        }
         this._deliveryPulling = true;
         try {
           const res = await fetch(
@@ -71710,7 +72286,9 @@ ${baseText}`;
                   mlsGroupId: roomState.mlsGroupId,
                   label: `room ${roomId.slice(0, 8)}`,
                   welcomeFields: { room_id: roomId },
-                  targets: roomTargets
+                  targets: roomTargets,
+                  memberDeviceIds: (roomState.members ?? []).map((m2) => m2.deviceId)
+                  // #1226
                 });
                 if (done > 0) {
                   console.log(
@@ -71765,7 +72343,9 @@ ${baseText}`;
                   mlsGroupId: entry.mlsGroupId,
                   label: `shared group ${gid.slice(0, 8)}`,
                   welcomeFields: { conversation_group_id: gid },
-                  targets: sharedTargets
+                  targets: sharedTargets,
+                  memberDeviceIds: entry.memberDeviceIds ?? []
+                  // #1226
                 });
                 if (done > 0) {
                   console.log(`[SecureChannel] Batched Welcome for ${done}/${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
@@ -71779,7 +72359,9 @@ ${baseText}`;
                       mlsGroupId: entry.mlsGroupId,
                       label: `shared group ${gid.slice(0, 8)}`,
                       welcomeFields: { conversation_group_id: gid },
-                      targets: [target]
+                      targets: [target],
+                      memberDeviceIds: entry.memberDeviceIds ?? []
+                      // #1226
                     });
                     if (done > 0) {
                       console.log(`[SecureChannel] Individual Welcome for ${target.deviceId.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
@@ -71826,7 +72408,11 @@ ${baseText}`;
                       requestId: req.id,
                       deviceId: req.requesting_device_id,
                       keyPackage: memberKp
-                    }]
+                    }],
+                    // #1226: a 1:1 roster is [self, owner] — the web's shape too.
+                    memberDeviceIds: [this._persisted?.sessions?.[convId]?.ownerDeviceId].filter(
+                      (d2) => typeof d2 === "string"
+                    )
                   });
                   if (done > 0) {
                     console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
@@ -71884,192 +72470,8 @@ ${baseText}`;
               console.log(`[SecureChannel] ${pending.length} pending A2A Welcome requests for channel ${chId.slice(0, 8)}`);
               for (const req of pending) {
                 try {
-                  const kpRes = await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
-                    { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-                  );
-                  if (!kpRes.ok) continue;
-                  const kpData = await kpRes.json();
-                  const kpHex = kpData[req.requesting_device_id];
-                  if (!kpHex) continue;
-                  const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
-                  const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  console.log(`[SecureChannel] A2A addMembers for ${req.requesting_device_id.slice(0, 8)} group=${chState.mlsGroupId.slice(0, 8)} epoch=${mlsGroup.epoch}`);
-                  let parentDigest = await this._readGroupHeadDigest(chState.mlsGroupId);
-                  let commit;
-                  let welcome;
-                  try {
-                    const result = await mlsGroup.addMembers([memberKp]);
-                    commit = result.commit;
-                    welcome = result.welcome;
-                  } catch (addErr) {
-                    const errMsg = addErr instanceof Error ? addErr.message : String(addErr);
-                    if (errMsg.includes("already in the group")) {
-                      console.log(`[SecureChannel] A2A member already in group \u2014 removing and re-adding ${req.requesting_device_id.slice(0, 8)}`);
-                      const preRemoveState = JSON.stringify(mlsGroup.exportState());
-                      let removeCommitPublished = false;
-                      try {
-                        const identityBytes = new TextEncoder().encode(req.requesting_device_id);
-                        const leafIndex = mlsGroup.memberLeafIndex(identityBytes);
-                        if (leafIndex === null) {
-                          console.log(`[SecureChannel] A2A re-add: no leaf index for ${req.requesting_device_id.slice(0, 8)} \u2014 cannot remove`);
-                          continue;
-                        }
-                        const removeResult = await mlsGroup.removeMember(leafIndex);
-                        try {
-                          const removeResp = await fetch(
-                            `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
-                            {
-                              method: "POST",
-                              headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                              body: JSON.stringify({
-                                group_id: chState.mlsGroupId,
-                                device_id: this._deviceId,
-                                commit: Buffer.from(removeResult.commit).toString("hex"),
-                                commit_epoch: Number(mlsGroup.epoch),
-                                ...parentDigest ? { parent_digest: parentDigest } : {}
-                              })
-                            }
-                          );
-                          if (removeResp.ok) {
-                            removeCommitPublished = true;
-                            parentDigest = this._commitDigest(removeResult.commit);
-                          } else {
-                            const detail = await removeResp.text().catch(() => "");
-                            console.warn(`[SecureChannel] A2A remove-commit distribute failed (${removeResp.status}): ${detail}`);
-                          }
-                        } catch (distErr) {
-                          console.warn(`[SecureChannel] A2A remove-commit distribute network error:`, distErr);
-                        }
-                        if (!removeCommitPublished) {
-                          mlsGroup.importState(JSON.parse(preRemoveState));
-                          continue;
-                        }
-                        const kpRes2 = await fetch(
-                          `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
-                          { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-                        );
-                        if (kpRes2.ok) {
-                          const kpData2 = await kpRes2.json();
-                          const kpHex2 = kpData2[req.requesting_device_id];
-                          if (kpHex2) {
-                            const kpBytes2 = new Uint8Array(Buffer.from(kpHex2, "hex"));
-                            const memberKp2 = MLSGroupManager.deserializeKeyPackage(kpBytes2);
-                            const result2 = await mlsGroup.addMembers([memberKp2]);
-                            commit = result2.commit;
-                            welcome = result2.welcome;
-                          } else {
-                            console.log(`[SecureChannel] A2A re-add: no fresh KeyPackage for ${req.requesting_device_id.slice(0, 8)}`);
-                            continue;
-                          }
-                        } else {
-                          console.log(`[SecureChannel] A2A re-add: KeyPackage fetch failed (${kpRes2.status})`);
-                          continue;
-                        }
-                      } catch (readdErr) {
-                        console.log(`[SecureChannel] A2A remove+re-add FAILED: ${readdErr instanceof Error ? readdErr.message : String(readdErr)}`);
-                        if (!removeCommitPublished) {
-                          try {
-                            mlsGroup.importState(JSON.parse(preRemoveState));
-                          } catch {
-                          }
-                        }
-                        continue;
-                      }
-                    } else {
-                      console.log(`[SecureChannel] A2A addMembers FAILED: ${errMsg}`);
-                      continue;
-                    }
-                  }
-                  if (!welcome) {
-                    console.warn(`[SecureChannel] A2A addMembers produced no Welcome for ${req.requesting_device_id.slice(0, 8)}`);
-                    continue;
-                  }
-                  const commitHex = Buffer.from(commit).toString("hex");
-                  const welcomeHex = Buffer.from(welcome).toString("hex");
-                  let distributed = false;
-                  const updatedMembers = [this._deviceId, req.requesting_device_id];
-                  try {
-                    const distResp = await fetch(
-                      `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
-                      {
-                        method: "POST",
-                        headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                        body: JSON.stringify({
-                          group_id: chState.mlsGroupId,
-                          device_id: this._deviceId,
-                          commit: commitHex,
-                          commit_epoch: Number(mlsGroup.epoch),
-                          welcomes: [{ target_device_id: req.requesting_device_id, payload: welcomeHex }],
-                          member_device_ids: updatedMembers,
-                          ...parentDigest ? { parent_digest: parentDigest } : {}
-                        })
-                      }
-                    );
-                    if (distResp.ok) {
-                      distributed = true;
-                    } else {
-                      const detail = await distResp.text().catch(() => "");
-                      console.warn(`[SecureChannel] A2A distribute failed (${distResp.status}): ${detail}`);
-                    }
-                  } catch (distErr) {
-                    console.warn(`[SecureChannel] A2A distribute network error:`, distErr);
-                  }
-                  if (!distributed && this._wsIsOpen()) {
-                    const a2aLabel = `A2A ${chId.slice(0, 8)}`;
-                    const commitSent = await this._sendFrameConfirmed({
-                      event: "mls_commit",
-                      data: {
-                        group_id: chState.mlsGroupId,
-                        epoch: Number(mlsGroup.epoch),
-                        payload: commitHex,
-                        ...parentDigest ? { parent_digest: parentDigest } : {}
-                      }
-                    }, `${a2aLabel} commit`);
-                    const welcomeSent = commitSent && await this._sendFrameConfirmed({
-                      event: "mls_welcome",
-                      data: {
-                        target_device_id: req.requesting_device_id,
-                        group_id: chState.mlsGroupId,
-                        a2a_channel_id: chId,
-                        payload: welcomeHex
-                      }
-                    }, `${a2aLabel} welcome`);
-                    if (!welcomeSent) {
-                      console.warn(`[SecureChannel] ${a2aLabel}: Welcome frames were NOT written \u2014 leaving the request pending`);
-                      continue;
-                    }
-                    try {
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({
-                            group_id: chState.mlsGroupId,
-                            device_id: this._deviceId,
-                            commit_epoch: Number(mlsGroup.epoch),
-                            member_device_ids: updatedMembers
-                          })
-                        }
-                      );
-                    } catch {
-                    }
-                    distributed = true;
-                  }
-                  if (!distributed) {
-                    console.warn(`[SecureChannel] Cannot deliver Welcome \u2014 HTTP distribute and WS both unavailable`);
-                    continue;
-                  }
-                  const a2aFulfilled = await this._postFulfilWelcome(
-                    chState.mlsGroupId,
-                    req.id,
-                    `A2A ${chId.slice(0, 8)}`
-                  );
-                  await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                  if (a2aFulfilled) {
-                    console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
-                  }
+                  const next = await this._fulfilA2AWelcome(chId, chState, mlsGroup, req);
+                  if (next === "stop") break;
                 } catch (fulfillErr) {
                   console.log(`[SecureChannel] A2A Welcome fulfill failed: ${fulfillErr instanceof Error ? fulfillErr.message : String(fulfillErr)}`);
                 }
@@ -72081,6 +72483,10 @@ ${baseText}`;
           console.warn("[SecureChannel] Delivery pull error:", err);
         } finally {
           this._deliveryPulling = false;
+          if (this._deliveryPullRequested) {
+            this._deliveryPullRequested = false;
+            void this._pullDeliveryQueue().catch((err) => console.warn("[SecureChannel] Coalesced delivery pull error:", err));
+          }
         }
       }
       /**
@@ -72164,7 +72570,7 @@ ${baseText}`;
               try {
                 const parsed = JSON.parse(plaintext);
                 messageType = parsed.type || "message";
-                messageText = parsed.text || plaintext;
+                messageText = parsed.text ?? plaintext;
               } catch {
                 messageType = "message";
                 messageText = plaintext;
@@ -72336,6 +72742,227 @@ ${baseText}`;
           }
         }
       }
+      /**
+       * #1225: fulfil ONE pending A2A Welcome request — the `/distribute` path.
+       * Extracted from the delivery pull so the in-flight slot (review F1) is held
+       * for exactly this request and released on every exit. Returns "stop" when
+       * nothing else on this channel can succeed this pull (review F2).
+       */
+      async _fulfilA2AWelcome(chId, chState, mlsGroup, req) {
+        const a2aLabel = `A2A ${chId.slice(0, 8)}`;
+        const preHead = await this._readGroupHead(chState.mlsGroupId);
+        if (preHead.ok && preHead.epoch !== Number(mlsGroup.epoch)) {
+          console.warn(
+            `[SecureChannel] ${a2aLabel}: server head is at epoch ${preHead.epoch}, we are at ${Number(mlsGroup.epoch)} \u2014 NOT committing (it would be refused); resync catches up first`
+          );
+          await this._catchUpAfterPreflightSkip(chState.mlsGroupId, preHead.epoch, Number(mlsGroup.epoch), a2aLabel);
+          return "stop";
+        }
+        const inFlight = this._reserveCommit(chState.mlsGroupId, a2aLabel);
+        if (!inFlight) return "stop";
+        try {
+          const kpRes = await fetch(
+            `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
+            { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+          );
+          if (!kpRes.ok) return "next";
+          const kpData = await kpRes.json();
+          const kpHex = kpData[req.requesting_device_id];
+          if (!kpHex) return "next";
+          const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
+          const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
+          console.log(`[SecureChannel] A2A addMembers for ${req.requesting_device_id.slice(0, 8)} group=${chState.mlsGroupId.slice(0, 8)} epoch=${mlsGroup.epoch}`);
+          let parentDigest = preHead.ok ? preHead.digest : void 0;
+          let commit;
+          let welcome;
+          let preAddState = mlsGroup.exportState();
+          try {
+            const result = await mlsGroup.addMembers([memberKp]);
+            commit = result.commit;
+            welcome = result.welcome;
+          } catch (addErr) {
+            const errMsg = addErr instanceof Error ? addErr.message : String(addErr);
+            if (errMsg.includes("already in the group")) {
+              console.log(`[SecureChannel] A2A member already in group \u2014 removing and re-adding ${req.requesting_device_id.slice(0, 8)}`);
+              const preRemoveState = JSON.stringify(mlsGroup.exportState());
+              let removeCommitPublished = false;
+              try {
+                const identityBytes = new TextEncoder().encode(req.requesting_device_id);
+                const leafIndex = mlsGroup.memberLeafIndex(identityBytes);
+                if (leafIndex === null) {
+                  console.log(`[SecureChannel] A2A re-add: no leaf index for ${req.requesting_device_id.slice(0, 8)} \u2014 cannot remove`);
+                  return "next";
+                }
+                const removeResult = await mlsGroup.removeMember(leafIndex);
+                try {
+                  const removeResp = await fetch(
+                    `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
+                    {
+                      method: "POST",
+                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+                      body: JSON.stringify({
+                        group_id: chState.mlsGroupId,
+                        device_id: this._deviceId,
+                        commit: Buffer.from(removeResult.commit).toString("hex"),
+                        commit_epoch: Number(mlsGroup.epoch),
+                        expected_epoch: Number(mlsGroup.epoch) - 1,
+                        // #1225: exact-step, like the WS path
+                        ...parentDigest ? { parent_digest: parentDigest } : {}
+                      })
+                    }
+                  );
+                  if (removeResp.ok) {
+                    removeCommitPublished = true;
+                    await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+                    parentDigest = this._commitDigest(removeResult.commit);
+                  } else {
+                    const detail = await removeResp.text().catch(() => "");
+                    console.warn(`[SecureChannel] A2A remove-commit distribute failed (${removeResp.status}): ${detail}`);
+                  }
+                } catch (distErr) {
+                  console.warn(`[SecureChannel] A2A remove-commit distribute network error:`, distErr);
+                }
+                if (!removeCommitPublished) {
+                  mlsGroup.importState(JSON.parse(preRemoveState));
+                  return "next";
+                }
+                const kpRes2 = await fetch(
+                  `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
+                  { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                );
+                if (kpRes2.ok) {
+                  const kpData2 = await kpRes2.json();
+                  const kpHex2 = kpData2[req.requesting_device_id];
+                  if (kpHex2) {
+                    const kpBytes2 = new Uint8Array(Buffer.from(kpHex2, "hex"));
+                    const memberKp2 = MLSGroupManager.deserializeKeyPackage(kpBytes2);
+                    preAddState = mlsGroup.exportState();
+                    const result2 = await mlsGroup.addMembers([memberKp2]);
+                    commit = result2.commit;
+                    welcome = result2.welcome;
+                  } else {
+                    console.log(`[SecureChannel] A2A re-add: no fresh KeyPackage for ${req.requesting_device_id.slice(0, 8)}`);
+                    return "next";
+                  }
+                } else {
+                  console.log(`[SecureChannel] A2A re-add: KeyPackage fetch failed (${kpRes2.status})`);
+                  return "next";
+                }
+              } catch (readdErr) {
+                console.log(`[SecureChannel] A2A remove+re-add FAILED: ${readdErr instanceof Error ? readdErr.message : String(readdErr)}`);
+                if (!removeCommitPublished) {
+                  try {
+                    mlsGroup.importState(JSON.parse(preRemoveState));
+                  } catch {
+                  }
+                }
+                return "next";
+              }
+            } else {
+              console.log(`[SecureChannel] A2A addMembers FAILED: ${errMsg}`);
+              return "next";
+            }
+          }
+          if (!welcome) {
+            console.warn(`[SecureChannel] A2A addMembers produced no Welcome for ${req.requesting_device_id.slice(0, 8)}`);
+            return "next";
+          }
+          const commitHex = Buffer.from(commit).toString("hex");
+          const welcomeHex = Buffer.from(welcome).toString("hex");
+          let distributed = false;
+          let transportFailed = false;
+          const updatedMembers = this._commitRoster([this._deviceId], [req.requesting_device_id]);
+          try {
+            const distResp = await fetch(
+              `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
+              {
+                method: "POST",
+                headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+                body: JSON.stringify({
+                  group_id: chState.mlsGroupId,
+                  device_id: this._deviceId,
+                  commit: commitHex,
+                  commit_epoch: Number(mlsGroup.epoch),
+                  welcomes: [{ target_device_id: req.requesting_device_id, payload: welcomeHex }],
+                  member_device_ids: updatedMembers,
+                  expected_epoch: Number(mlsGroup.epoch) - 1,
+                  // #1225: exact-step, like the WS path
+                  ...parentDigest ? { parent_digest: parentDigest } : {}
+                })
+              }
+            );
+            if (distResp.ok) {
+              distributed = true;
+            } else {
+              const detail = await distResp.text().catch(() => "");
+              console.warn(`[SecureChannel] A2A distribute failed (${distResp.status}): ${detail}`);
+              if (distResp.status >= 500) {
+                transportFailed = true;
+              } else if (distResp.status === 409) {
+                mlsGroup.importState(preAddState);
+                console.warn(
+                  `[SecureChannel] ${a2aLabel}: add commit lost the race (409) \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, request stays pending`
+                );
+                return "next";
+              } else {
+                mlsGroup.importState(preAddState);
+                console.error(
+                  `[SecureChannel] ${a2aLabel}: add commit refused with ${distResp.status} \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}; not retrying this channel this pull`
+                );
+                return "stop";
+              }
+            }
+          } catch (distErr) {
+            console.warn(`[SecureChannel] A2A distribute network error:`, distErr);
+            transportFailed = true;
+          }
+          if (!distributed && transportFailed && this._wsIsOpen()) {
+            const verdict = await this._sendCommitConfirmed({
+              mlsGroup,
+              mlsGroupId: chState.mlsGroupId,
+              label: a2aLabel,
+              commit,
+              epoch: Number(mlsGroup.epoch),
+              parent: parentDigest,
+              memberDeviceIds: updatedMembers,
+              stateBefore: preAddState,
+              inFlight
+            });
+            if (verdict !== "confirmed") return "next";
+            const welcomeSent = await this._sendFrameConfirmed({
+              event: "mls_welcome",
+              data: {
+                target_device_id: req.requesting_device_id,
+                group_id: chState.mlsGroupId,
+                a2a_channel_id: chId,
+                payload: welcomeHex
+              }
+            }, `${a2aLabel} welcome`);
+            if (!welcomeSent) {
+              await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+              console.warn(`[SecureChannel] ${a2aLabel}: Welcome frame was NOT written \u2014 leaving the request pending`);
+              return "next";
+            }
+            distributed = true;
+          }
+          if (!distributed) {
+            console.warn(`[SecureChannel] Cannot deliver Welcome \u2014 HTTP distribute and WS both unavailable`);
+            return "next";
+          }
+          const a2aFulfilled = await this._postFulfilWelcome(
+            chState.mlsGroupId,
+            req.id,
+            `A2A ${chId.slice(0, 8)}`
+          );
+          await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+          if (a2aFulfilled) {
+            console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+          }
+          return "next";
+        } finally {
+          await this._releaseCommit(chState.mlsGroupId, inFlight, a2aLabel);
+        }
+      }
       /**
        * Found the MLS group for an A2A channel as the creator agent.
        * Calls /mls/a2a/{channelId}/init, creates the local MLS group, and sends
@@ -72378,48 +73005,77 @@ ${baseText}`;
           await saveMlsState(this.config.dataDir, mlsData.group_id, JSON.stringify(mgr.exportState()));
           for (const p2 of participants) {
             if (p2.status !== "active" && p2.status !== "invited") continue;
+            const a2aLabel = `A2A ${channelId.slice(0, 8)} found\u2192${p2.hubAddress}`;
             try {
-              const kpRes = await fetch(
-                `${this.config.apiUrl}/api/v1/mls/key-packages?hub_id=${encodeURIComponent(p2.hubId)}`,
-                { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-              );
-              if (kpRes.ok) {
-                const kpData = await kpRes.json();
-                if (kpData.key_package) {
-                  const kpBytes = new Uint8Array(Buffer.from(kpData.key_package, "hex"));
-                  const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  const { commit, welcome } = await mgr.addMembers([memberKp]);
-                  if (welcome && this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_commit",
+              if (!p2.deviceId) {
+                console.warn(
+                  `[SecureChannel] ${a2aLabel}: no deviceId \u2014 NOT adding (a Welcome could not be addressed). Backend a2a_channel_approved payload may be missing device_id for this participant.`
+                );
+                continue;
+              }
+              if (!this._wsIsOpen()) {
+                console.warn(`[SecureChannel] ${a2aLabel}: socket is not OPEN \u2014 NOT advancing the group`);
+                continue;
+              }
+              const head = await this._readGroupHead(mlsData.group_id);
+              if (head.ok && head.epoch !== Number(mgr.epoch)) {
+                console.warn(`[SecureChannel] ${a2aLabel}: server head is at epoch ${head.epoch}, we are at ${Number(mgr.epoch)} \u2014 NOT committing`);
+                await this._catchUpAfterPreflightSkip(mlsData.group_id, head.epoch, Number(mgr.epoch), a2aLabel);
+                continue;
+              }
+              const inFlight = this._reserveCommit(mlsData.group_id, a2aLabel);
+              if (!inFlight) continue;
+              try {
+                const kpRes = await fetch(
+                  `${this.config.apiUrl}/api/v1/mls/key-packages?hub_id=${encodeURIComponent(p2.hubId)}`,
+                  { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                );
+                if (kpRes.ok) {
+                  const kpData = await kpRes.json();
+                  if (kpData.key_package) {
+                    const kpBytes = new Uint8Array(Buffer.from(kpData.key_package, "hex"));
+                    const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
+                    const stateBefore = mgr.exportState();
+                    const { commit, welcome } = await mgr.addMembers([memberKp]);
+                    const committedEpoch = Number(mgr.epoch);
+                    if (!welcome) {
+                      mgr.importState(stateBefore);
+                      console.warn(`[SecureChannel] ${a2aLabel}: addMembers produced no Welcome \u2014 rolled back`);
+                      continue;
+                    }
+                    const verdict = await this._sendCommitConfirmed({
+                      mlsGroup: mgr,
+                      mlsGroupId: mlsData.group_id,
+                      label: a2aLabel,
+                      commit,
+                      epoch: committedEpoch,
+                      parent: head.ok ? head.digest : void 0,
+                      memberDeviceIds: this._commitRoster(participants.map((q22) => q22.deviceId), [p2.deviceId]),
+                      stateBefore,
+                      inFlight
+                    });
+                    if (verdict !== "confirmed") continue;
+                    const sent = await this._sendFrameConfirmed({
+                      event: "mls_welcome",
                       data: {
                         group_id: mlsData.group_id,
-                        epoch: Number(mgr.epoch),
-                        payload: Buffer.from(commit).toString("hex")
+                        payload: Buffer.from(welcome).toString("hex"),
+                        target_device_id: p2.deviceId,
+                        a2a_channel_id: channelId,
+                        target_hub_id: p2.hubId
+                        // observability only — the backend ignores it
                       }
-                    }));
-                    if (!p2.deviceId) {
-                      console.warn(
-                        `[SecureChannel] Skipping MLS Welcome to ${p2.hubAddress} for A2A ${channelId.slice(0, 8)}: no deviceId. Backend a2a_channel_approved payload may be missing device_id for this participant.`
-                      );
-                    } else {
-                      this._ws.send(JSON.stringify({
-                        event: "mls_welcome",
-                        data: {
-                          group_id: mlsData.group_id,
-                          payload: Buffer.from(welcome).toString("hex"),
-                          target_device_id: p2.deviceId,
-                          a2a_channel_id: channelId,
-                          // Kept for observability — backend ignores but it's
-                          // useful in logs/wire captures to correlate to a hub.
-                          target_hub_id: p2.hubId
-                        }
-                      }));
+                    }, `${a2aLabel} welcome`);
+                    await saveMlsState(this.config.dataDir, mlsData.group_id, JSON.stringify(mgr.exportState()));
+                    if (sent) {
                       console.log(`[SecureChannel] Sent MLS Welcome to ${p2.hubAddress} (device ${p2.deviceId.slice(0, 8)}) for A2A ${channelId.slice(0, 8)}`);
+                    } else {
+                      console.warn(`[SecureChannel] ${a2aLabel}: Welcome was NOT written \u2014 the participant will request one`);
                     }
                   }
-                  await saveMlsState(this.config.dataDir, mlsData.group_id, JSON.stringify(mgr.exportState()));
                 }
+              } finally {
+                await this._releaseCommit(mlsData.group_id, inFlight, a2aLabel);
               }
             } catch (kpErr) {
               console.warn(`[SecureChannel] Failed to Welcome participant ${p2.hubAddress}:`, kpErr);
@@ -72513,7 +73169,7 @@ ${baseText}`;
                 try {
                   const parsed = JSON.parse(plaintext);
                   messageType = parsed.type || "message";
-                  messageText = parsed.text || plaintext;
+                  messageText = parsed.text ?? plaintext;
                 } catch {
                   messageType = "message";
                   messageText = plaintext;
@@ -72798,7 +73454,7 @@ ${baseText}`;
                 try {
                   const parsed = JSON.parse(plaintext);
                   messageType = parsed.type || "message";
-                  messageText = parsed.text || plaintext;
+                  messageText = parsed.text ?? plaintext;
                 } catch {
                   messageType = "message";
                   messageText = plaintext;
@@ -73398,58 +74054,6 @@ var init_gateway_send = __esm2({
     init_openclaw_compat();
   }
 });
-function parseMentions(text) {
-  const mentions = [];
-  const re2 = new RegExp(MENTION_RE.source, MENTION_RE.flags);
-  let match;
-  while ((match = re2.exec(text)) !== null) {
-    mentions.push(match[1].toLowerCase());
-  }
-  return mentions;
-}
-function resolveOwn(mention, names) {
-  if (names.has(mention)) return mention;
-  const parts = mention.split("-");
-  for (let i2 = parts.length - 1; i2 > 0; i2--) {
-    const candidate = parts.slice(0, i2).join("-");
-    if (names.has(candidate)) return candidate;
-  }
-  return null;
-}
-function owesRoomReply(plaintext, agentName, accountId, senderIsAgent, roomDisplayName, ownDisplayName, selfResolved = true) {
-  const mentions = parseMentions(plaintext);
-  if (mentions.length === 0) return false;
-  const ownNames = ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName);
-  if (mentions.some((m2) => resolveOwn(m2, ownNames) !== null)) return true;
-  if (mentions.some((m2) => resolveOwn(m2, BROADCAST_NAMES) !== null)) {
-    return senderIsAgent !== true;
-  }
-  if (!selfResolved) return true;
-  return false;
-}
-function ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName) {
-  const names = /* @__PURE__ */ new Set();
-  const add4 = (n2) => {
-    if (!n2) return;
-    const lower = n2.toLowerCase();
-    names.add(lower);
-    names.add(lower.split(/[\s(]/)[0]);
-  };
-  add4(agentName);
-  add4(accountId);
-  add4(roomDisplayName);
-  add4(ownDisplayName);
-  return names;
-}
-var MENTION_RE;
-var BROADCAST_NAMES;
-var init_room_protocol = __esm2({
-  "src/room-protocol.ts"() {
-    "use strict";
-    MENTION_RE = /@([\w-]+)/gi;
-    BROADCAST_NAMES = /* @__PURE__ */ new Set(["all", "everyone"]);
-  }
-});
 var init_llm_response_parser = __esm2({
   "src/llm-response-parser.ts"() {
     "use strict";
@@ -99543,7 +100147,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.39" : "0.0.0-dev";
+    VERSION = true ? "0.23.41" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -100480,7 +101084,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.12" : void 0
+      true ? "0.4.14" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -100533,7 +101137,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.12" : void 0
+      true ? "0.4.14" : void 0
     )
   });
   channelRef = channel;