@agfpd/iapeer 0.4.116 → 0.4.118

package/docs/15-fleet-api.md

@@ -80,6 +80,7 @@ Field notes:
 - `runtimes[].status` — `live` (session up) · `asleep` (wakeable on demand) · `stopped` (operator stop flag; the daemon won't wake it). Same glyph semantics as the CLI: `●` / `○` / `✕`.
 - `runtimes[].agent` — **agent-endpoint discovery**: `true` iff this declared runtime is an agent runtime the running core can host (listed in `host.agent_runtimes`). A channel that offers a personality's agent endpoints (a Telegram menu, a web picker) offers exactly its `agent: true` runtimes — never a consumer-side runtime list, never a `which`/PATH probe. A declared runtime the core cannot host (a newer peer profile on an older core) is `false` and is not offered. A channel runtime (`telegram`, `web`, …) is always `false`. Additive: a pre-discovery daemon omits it — clients MUST then fall back to treating no runtime as discoverable rather than guessing. Which endpoint a send reaches is a separate rule: an omitted runtime is always `default_runtime` (config-anchored, never «the live one»); a control action for the same dialogue must name the same runtime its send used.
 - `runtimes[].private_dir` — the core-owned private directory of this endpoint (docs/20: the OpenCode journal, state and provider fragments), present only for a runtime that has one (today `opencode`). An observer that the core does not launch (a console, a collector) reads the path HERE or from `iapeer private-dir <peer> [--runtime r]` — it never derives the layout from the root. Additive.
+- `runtimes[].model` — the `provider/model` the endpoint ACTUALLY used for its last assistant turn, as the runtime itself reports it (today `opencode`, from its state; docs/20 §Provider pinning). Absent until a first turn. Lets an operator see an implicit default provider. Additive.
 - `host.agent_runtimes` — the agent runtimes this core build can host, in preference order. It grows when an agent adapter ships (e.g. `opencode`, docs/20).
 - `runtimes[].attached` — present (`true`) only when a **human operator** is attached to that live hosted session.
 - `runtimes[].activity` — **turn activity**: is this runtime *in a turn* right now. See «Activity» below. Additive; absent on a pre-activity daemon, on every non-`live` runtime, and whenever the daemon has no evidence — clients MUST treat absence as **no claim**, never as `idle`.

package/docs/20-opencode.md

@@ -123,6 +123,49 @@ Open core contracts this ABI depends on:
   provision/unprovision per peer and runtime, like the memory slot. Until it
   exists, a manual install is not reported as final.
 
+## Provider pinning
+
+Without an explicit `model`, native OpenCode uses its own hosted default
+(`opencode/big-pickle`), and the composed doctrine, registry and messages go
+there. Owner policy (2026-10-18): this is allowed, but never silent.
+- No explicit `model` (`<provider>/<model>` in the peer's `opencode.json` or the
+  inline `OPENCODE_CONFIG_CONTENT`): the launch proceeds, `lifecycle.log` records
+  `ev=launch-warning warning="opencode-implicit-provider: …"`, and
+  `add-runtime`/`create` warn with the file to fill.
+- An explicit `model` is pinned: `small_model` defaults to `model` (titles and
+  summaries never drift to another provider), `enabled_providers` defaults to
+  exactly the providers of those two; an explicit list that excludes them refuses
+  the launch.
+- The model actually used is reported by the plugin (`state.json` `model`) and
+  appears as the fleet snapshot field `runtimes[].model` (docs/15).
+
+## Durable inbound across a session death (OC07, all agent runtimes)
+
+Invariant: an inbound the core acknowledged is either processed by a later
+session, or its sender is told explicitly that it was not. A runtime's input
+queue lives in its process. Measured 2026-10-18 on claude: a message acked during
+a busy turn had its `user` record (and the API request) in the transcript, the
+process was SIGKILLed before any answer, and the fresh next session never saw it.
+
+- Every confirmed delivery to an agent endpoint (live, wake, launchd-revive,
+  composer queue) is recorded in `<stateDir>/<identity>.inflight.jsonl` with the
+  hosting session token.
+- «Processed» means a model response after the record carrying the envelope:
+  claude — an `assistant` record after a non-`queue-operation` record; codex — a
+  non-user `response_item` or `agent_message`; opencode — an assistant message
+  whose `parentID` is that user message. «Recorded» alone is not processed.
+- After each supervise tick, processed entries leave. Unprocessed entries whose
+  session is gone or was replaced become orphans and are redelivered through the
+  normal route as their original sender, prefixed `[redelivered by iapeer: …]`
+  (wake-on-miss and the crash-loop guard apply). If redelivery fails, the sender
+  receives an explicit notice from `iapeer`. Logged as `ev=inflight-orphaned`
+  (lifecycle.log) and `ev=inflight-redelivered|inflight-undelivered`
+  (delivery.log).
+- A false «not processed» costs a visible duplicate, never a silent loss.
+
+The real death cause is recorded too: the supervisor waits for the reap, so a
+SIGKILL is logged as `dead_signal=SIGKILL`, never as a clean exit 0.
+
 ## Acceptance matrix
 
 `OPEN` includes implementation and/or missing live proof. Unit tests, config-file

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.116",
+  "version": "0.4.118",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -2735,7 +2735,10 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
             `  docs: ${docs.copied ? docs.dest : `skipped (${docs.reason})`}\n` +
             trayLine +
             `  daemon plist ${plistChanged ? 'written' : 'unchanged (byte-identical — no write, no BTM notification)'}: ${plist}\n` +
-            `  (NOT loaded — a live daemon migration is a separate step: launchctl bootstrap gui/$(id -u) ${plist})\n`,
+            (plistChanged
+              ? `  (install does not load it: \`iapeer update\` re-registers the daemon itself (bootout → bootstrap) right after this step; ` +
+                `a standalone install loads it with \`iapeer onboard\` or launchctl bootstrap gui/$(id -u) ${plist})\n`
+              : ''),
         )
         return 0
       }

package/src/daemon/fleet.ts

@@ -35,9 +35,11 @@
 
 import type { IncomingMessage, ServerResponse } from 'http'
 import { closeSync, openSync, readSync, statSync } from 'fs'
+import { join } from 'path'
 import { isSupportedLocalRuntime, SUPPORTED_LOCAL_RUNTIMES } from '../core/constants.ts'
 import { buildProcessAddress } from '../core/socket.ts'
 import { endpointPrivateDir } from '../storage/index.ts'
+import { readOpencodeState } from '../opencode/journal.ts'
 import { IAPEER_VERSION } from '../core/version.ts'
 import {
   ephemeralQueueDepth,
@@ -89,6 +91,9 @@ export interface FleetRuntimeStatus {
   /** Core-owned private directory of this endpoint (docs/20: opencode journal/state). Absent when the
    *  runtime has none. Observers read it from here; they never derive the layout. */
   private_dir?: string
+  /** The model the runtime ACTUALLY used last (`provider/model`, from the endpoint's own state; docs/20
+   *  §Provider pinning). Absent until a first assistant turn, or for runtimes that do not report it. */
+  model?: string
   /** Present (true) iff a HUMAN operator is attached to this live hosted session. */
   attached?: boolean
   /** Whether this runtime is IN A TURN right now — a SEPARATE concept from `status`, which
@@ -240,9 +245,11 @@ export function buildFleetSnapshot(
    *  never emitted, which is exactly its "no claim" semantics. */
   activityOf?: (personality: string, runtime: string) => TurnActivity | undefined,
 ): FleetSnapshot {
-  const privateDirOf = (runtime: string, personality: string): { private_dir?: string } => {
+  const privateDirOf = (runtime: string, personality: string): { private_dir?: string; model?: string } => {
     const d = endpointPrivateDir(runtime, personality, { env })
-    return d ? { private_dir: d } : {}
+    if (!d) return {}
+    const model = (readOpencodeState(join(d, 'state.json')) as { model?: unknown } | null)?.model
+    return { private_dir: d, ...(typeof model === 'string' && model ? { model } : {}) }
   }
   const peers: FleetPeer[] = ops.listPeers({ env }).map(r => {
     const runtimes: FleetRuntimeStatus[] = r.runtimes.map(s => {

package/src/daemon/index.ts

@@ -45,7 +45,7 @@ import { IAPEER_VERSION } from '../core/version.ts'
 import { pluginStateDir, writeFileAtomic, type StorageOptions } from '../storage/index.ts'
 import { readPeersIndex, type PeersIndex } from '../registry/index.ts'
 import { resolveCallerIdentity, type CallerIdentity, type ResolvedCaller } from '../identity/index.ts'
-import { routeSend, type ComposerQueueRouteDeps, type EphemeralRouteDeps, type SendToPeerInput, type WakeFn } from '../transport/index.ts'
+import { routeSend, type ComposerQueueRouteDeps, type EphemeralRouteDeps, type RouteDeps, type SendToPeerInput, type WakeFn } from '../transport/index.ts'
 import { appendDeliveryEvent } from './deliverylog.ts'
 
 export const CALLER_HEADER = 'x-iapeer-identity'
@@ -226,6 +226,8 @@ export interface CallToolDeps {
   noteLiveTopic?: (identity: string, topic: string) => void
   /** В7 — confirmed-delivery stamp → the target's idle-proxy floor (see transport.RouteDeps.noteDelivered). */
   noteDelivered?: (identity: string) => void
+  /** OC07 — confirmed delivery to an agent endpoint → the inflight ledger (see transport.RouteDeps.noteInflight). */
+  noteInflight?: RouteDeps['noteInflight']
   /** Busy-human-composer queue — see transport.createComposerDeliveryQueue. */
   composerQueue?: ComposerQueueRouteDeps
   /** H4 launchd-managed detector — see transport.RouteDeps.isLaunchdManaged (the
@@ -255,6 +257,7 @@ export async function callTool(
       ephemeral: deps.ephemeral,
       noteLiveTopic: deps.noteLiveTopic,
       noteDelivered: deps.noteDelivered,
+      noteInflight: deps.noteInflight,
       composerQueue: deps.composerQueue,
       isLaunchdManaged: deps.isLaunchdManaged,
     })
@@ -466,6 +469,8 @@ export interface StartDaemonOptions extends StorageOptions {
   /** В7 — confirmed-delivery stamp → the target's idle-proxy floor (setLastDelivered). OFF by default;
    *  the production main wires it. */
   noteDelivered?: (identity: string) => void
+  /** OC07 — confirmed delivery to an agent endpoint → the inflight ledger (see transport.RouteDeps.noteInflight). */
+  noteInflight?: RouteDeps['noteInflight']
   /**
    * Busy-human-composer queue — async acceptance for live local TUI delivery when
    * an attached operator has non-dim text in the target composer. OFF by default
@@ -510,6 +515,7 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
     ephemeral: opts.ephemeral,
     noteLiveTopic: opts.noteLiveTopic,
     noteDelivered: opts.noteDelivered,
+    noteInflight: opts.noteInflight,
     composerQueue: opts.composerQueue,
     isLaunchdManaged: opts.isLaunchdManaged,
   }

package/src/daemon/main.ts

@@ -56,7 +56,10 @@ import type { ResolvedCaller } from '../identity/index.ts'
 import { findPeer, readPeersIndex } from '../registry/index.ts'
 import {
   createComposerDeliveryQueue,
+  deliveryProcessed,
   routeSend,
+  type InflightNote,
+  type RouteDeps,
   type ComposerQueueRouteDeps,
   type ComposerQueuedDelivery,
   type EphemeralRouteDeps,
@@ -73,6 +76,9 @@ import { DEFAULT_PROFILE_SYNC_INTERVAL_MS, startProfileSync } from './profilesyn
 import { startGoalWatch } from './goalwatch.ts'
 import { ActivityBoard, startTurnWatch } from './turnwatch.ts'
 import { defaultDaemonSocketPath, startDaemon, type DaemonHandle } from './index.ts'
+import { randomBytes } from 'crypto'
+import { listInflightIdentities, listOrphanIdentities, recordInflight, sweepInflight, takeOrphans, type InflightEntry } from '../lifecycle/inflight.ts'
+import { hostSessionAlive, hostSessionToken } from '../launch/ptyHost.ts'
 
 /** Default TCP loopback port for the always-on router. Real http MCP clients
  *  (claude/codex `--transport http <url>`) bind to a fixed URL, so production needs
@@ -249,6 +255,88 @@ function queuedFailureMessage(job: ComposerQueuedDelivery, reason: string): stri
  *   2) before daemon shutdown/restart, fail every pending queued envelope back
  *      to its sender, so `queued` never becomes silent loss.
  */
+// ─────────────────────────────────────────────────────────────────────────────
+// OC07 — durable inbound across a session death (lifecycle/inflight.ts)
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** The transport hook → the inflight ledger. Best-effort by contract (transport swallows throws). */
+export function makeNoteInflight(cfg: LifecycleConfig): (note: InflightNote) => void {
+  return note => recordInflight(cfg.stateDir, { ...note, id: randomBytes(6).toString('hex'), ts: Date.now() })
+}
+
+/** The redelivery prefix — the model sees it is a re-send, not a duplicate of something it answered. */
+export function redeliveryMessage(e: InflightEntry): string {
+  return `[redelivered by iapeer: the receiving session ended before answering this message; originally sent ${e.sentAt}]\n${e.message}`
+}
+
+/** Body of the explicit non-delivery notice to the original sender. */
+export function undeliveredNotice(e: InflightEntry, reason: string): string {
+  return (
+    `iapeer: your message to "${e.personality}" (${e.runtime}), sent ${e.sentAt}${e.topic ? ` topic=${e.topic}` : ''}, ` +
+    `was acknowledged but NOT processed: the receiving session ended before answering it, and redelivery failed (${reason}). ` +
+    `Resend it if it still matters. First line: ${e.message.split('\n')[0]!.slice(0, 200)}`
+  )
+}
+
+/**
+ * One OC07 pass, run after every supervise tick. (1) Sweep every ledger: processed entries leave;
+ * unprocessed entries whose receiving session is gone or replaced become orphans. (2) Every orphan is
+ * redelivered through the normal route AS ITS ORIGINAL SENDER (wake-on-miss, guards, crash-loop guard
+ * all apply); if that fails, the sender gets an explicit notice from iapeer. Either way the orphan
+ * leaves the store — the invariant «processed by a later session, or the sender knows» holds.
+ */
+export async function processInflight(
+  cfg: LifecycleConfig,
+  env: NodeJS.ProcessEnv,
+  routeDeps: RouteDeps,
+  seam: { send?: typeof routeSend; processed?: (e: InflightEntry) => boolean } = {},
+): Promise<void> {
+  const processed = seam.processed ?? ((e: InflightEntry) => deliveryProcessed(e, env))
+  const send = seam.send ?? routeSend
+  for (const identity of listInflightIdentities(cfg.stateDir)) {
+    const n = sweepInflight(cfg.stateDir, identity, {
+      sessionToken: id => (hostSessionAlive(id, env) ? hostSessionToken(id, env) : null),
+      processed,
+    })
+    if (n > 0) appendLifecycleEvent(cfg.eventLogDir, { ev: 'inflight-orphaned', identity, count: n }, { env })
+  }
+  for (const identity of listOrphanIdentities(cfg.stateDir)) {
+    for (const e of takeOrphans(cfg.stateDir, identity)) {
+      const index = readPeersIndex({ env })
+      let reason: string
+      try {
+        const caller = resolveCallerIdentity({ personality: e.caller.personality, runtime: e.caller.runtime }, index)
+        const r = await send(
+          caller,
+          { personality: e.personality, runtime: e.runtime, message: redeliveryMessage(e), ...(e.topic ? { topic: e.topic } : {}), ...(e.attachments?.length ? { attachments: e.attachments } : {}) },
+          routeDeps,
+        )
+        if (r.ok) {
+          appendDeliveryEvent(cfg.eventLogDir, { ev: 'inflight-redelivered', caller: `${e.caller.runtime}-${e.caller.personality}`, to: e.personality, rt: e.runtime, ok: 'true', woke: String(r.value.woke) })
+          continue
+        }
+        reason = r.error.message
+      } catch (x) {
+        reason = x instanceof Error ? x.message : String(x)
+      }
+      // Redelivery failed → the sender must learn it explicitly.
+      let notified = 'false'
+      try {
+        const self = findPeer(index, 'iapeer')
+        const callerAddr = `${e.caller.runtime}-${e.caller.personality}`
+        if (self && callerAddr !== `${self.runtime}-iapeer`) {
+          const sender = resolveCallerIdentity({ personality: 'iapeer', runtime: self.runtime }, index)
+          const n = await send(sender, { personality: e.caller.personality, runtime: e.caller.runtime, message: undeliveredNotice(e, reason), topic: e.topic ?? 'delivery-failed' }, routeDeps)
+          notified = String(n.ok)
+        }
+      } catch {
+        notified = 'false'
+      }
+      appendDeliveryEvent(cfg.eventLogDir, { ev: 'inflight-undelivered', caller: `${e.caller.runtime}-${e.caller.personality}`, to: e.personality, rt: e.runtime, ok: 'false', err: reason.slice(0, 300), notified })
+    }
+  }
+}
+
 export function makeComposerQueueRouteDeps(cfg: LifecycleConfig, env: NodeJS.ProcessEnv): ComposerQueueRouteDeps {
   const noteLiveTopic = makeNoteLiveTopic(cfg, env)
   const onDelivered = makeArmEphemeralOnDelivered(cfg)
@@ -264,6 +352,7 @@ export function makeComposerQueueRouteDeps(cfg: LifecycleConfig, env: NodeJS.Pro
     logDir: cfg.logDir,
     noteLiveTopic,
     noteDelivered: identity => setLastDelivered(cfg, identity),
+    noteInflight: makeNoteInflight(cfg),
     onDelivered,
     notifyFailed: async (job, reason) => {
       const index = readPeersIndex({ env })
@@ -373,6 +462,7 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
   const armEphemeralOnDelivered = makeArmEphemeralOnDelivered(cfg)
   const ephemeral = makeEphemeralRouteDeps(cfg, env)
   const composerQueue = makeComposerQueueRouteDeps(cfg, env)
+  const noteInflight = makeNoteInflight(cfg)
   // Notice board (docs/19) — ONE instance shared by the mute-watch (raises) and the
   // fleet handler (serves /notices + the snapshot field). Constructed HERE, at the
   // composition point, because that sharing is the whole wiring.
@@ -463,6 +553,8 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
     // В7 — a confirmed live delivery floors the target's idle proxy (setLastDelivered), so a
     // just-delivered message is never reaped away before its turn record lands.
     noteDelivered: identity => setLastDelivered(cfg, identity),
+    // OC07 — confirmed delivery to an agent endpoint → inflight ledger (redelivered if its session dies first).
+    noteInflight,
     // Busy-human-composer queue: fast queued ack, async drain, fail all pending
     // on daemon close/update so a queued envelope is never silently lost.
     composerQueue,
@@ -496,6 +588,16 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
         // start (durable queue), and RETRIES a failed wake (the item stayed at the
         // head). Identities without a queue or with a live session are no-ops.
         await drainAllEphemeralQueues(cfg, { env })
+        // OC07 — acknowledged-but-unanswered inbound of a dead session: redeliver or tell the sender.
+        await processInflight(cfg, env, {
+          env,
+          wake: makeWakeFn(cfg, env),
+          ephemeral,
+          noteLiveTopic,
+          noteDelivered: identity => setLastDelivered(cfg, identity),
+          noteInflight,
+          isLaunchdManaged: (personality: string) => isLaunchdManaged(personality, env),
+        })
       },
       // Surface a supervise-tick throw that the daemon timer would otherwise SWALLOW (the class that
       // hid a stuck reaper for hours): record ev=supervise-error in lifecycle.log, flattened to one
@@ -605,6 +707,14 @@ export interface InstallDaemonPlistResult {
  * com.agfpd.* is the foundation-exclusive daemon namespace, so this never
  * touches the com.iapeer.* persistent-peer fleet.
  */
+/** The EnvironmentVariables.PATH value of a rendered plist (XML-unescaped), or undefined. */
+export function plistEnvPath(xml: string): string | undefined {
+  const m = /<key>EnvironmentVariables<\/key>\s*<dict>([\s\S]*?)<\/dict>/.exec(xml)
+  const v = m ? /<key>PATH<\/key>\s*<string>([\s\S]*?)<\/string>/.exec(m[1]!) : null
+  if (!v) return undefined
+  return v[1]!.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, '&')
+}
+
 export function installDaemonPlist(opts: InstallDaemonPlistOptions = {}): InstallDaemonPlistResult {
   const env = opts.env ?? process.env
   const path = daemonPlistPath(env)
@@ -614,7 +724,19 @@ export function installDaemonPlist(opts: InstallDaemonPlistOptions = {}): Instal
         `(no ownership sentinel) — another manager owns it`,
     )
   }
-  const rendered = renderLaunchdPlist(buildDaemonPlistSpec(opts))
+  // PATH STABILITY: buildDaemonPlistSpec defaults PATH to the INVOKING process's env.PATH, so every
+  // `iapeer update` run from a different shell rewrote the plist (a BTM notification each time, and a
+  // daemon PATH that silently followed whoever deployed last). The first install fixes the PATH; later
+  // installs keep the one on disk unless a caller passes `path` explicitly.
+  let keepPath: string | undefined
+  if (opts.path === undefined) {
+    try {
+      keepPath = plistEnvPath(readFileSync(path, 'utf8'))
+    } catch {
+      keepPath = undefined
+    }
+  }
+  const rendered = renderLaunchdPlist(buildDaemonPlistSpec(keepPath !== undefined ? { ...opts, path: keepPath } : opts))
   mkdirSync(launchAgentsDir(env), { recursive: true })
   mkdirSync(pluginLogsDir('iapeer', { env }), { recursive: true, mode: 0o700 })
   // Write-if-changed: a byte-identical rewrite is a pure no-op for the daemon but

package/src/init/index.ts

@@ -554,6 +554,26 @@ export async function initPeer(opts: InitPeerOptions): Promise<InitPeerResult> {
 
   const doctrine = ensureDoctrineTemplate(provisioned.cwd)
 
+  // OpenCode never launches on an implicit provider (pinProvider). Say so at attach time, with the
+  // exact file to fill, instead of letting the first wake be the first signal.
+  if (provisioned.runtime === 'opencode') {
+    const { opencodePaths } = await import('../opencode/config.ts')
+    const cfgPath = opencodePaths(provisioned.personality, { env }).config
+    let model: unknown
+    try {
+      model = (JSON.parse(readFileSync(cfgPath, 'utf8')) as { model?: unknown }).model
+    } catch {
+      model = undefined
+    }
+    if (typeof model !== 'string' || !model.includes('/')) {
+      opts.warn?.(
+        `opencode provider not configured for "${provisioned.personality}": it will run on OpenCode's own default ` +
+          `provider (doctrine and messages go there) until ${cfgPath} names "model": "<provider>/<model>" ` +
+          `and that provider (docs/20 §Provider pinning)`,
+      )
+    }
+  }
+
   // INFRA peer: per-peer runtime self-config, THEN auto-bootstrap. For an agentic
   // (warm-on-demand) runtime neither applies — it is daemon-woken, never launchd-held,
   // and gets its MCP wiring above instead.

package/src/launch/adapters/opencode.ts

@@ -19,7 +19,7 @@
 
 import { randomBytes } from 'node:crypto'
 import { existsSync, readFileSync, statSync } from 'node:fs'
-import { composeOpencodeConfig, OPENCODE_AGENT, OPENCODE_PLUGIN_SOURCE, opencodePaths, writeOpencodePlugin } from '../../opencode/config.ts'
+import { composeOpencodeConfig, hasExplicitModel, OPENCODE_AGENT, OPENCODE_PLUGIN_SOURCE, opencodePaths, writeOpencodePlugin } from '../../opencode/config.ts'
 import { opencodeControl } from '../../opencode/control.ts'
 import { fileMtimeMs, readJournalFrom, readOpencodeState } from '../../opencode/journal.ts'
 import { resolveDaemonMcpUrl } from '../../storage/index.ts'
@@ -105,7 +105,10 @@ export const opencodeAdapter: RuntimeAdapter = {
       IAPEER_FLEET_URL: resolveFleetBase(env),
     }
     if (spec.resume && spec.resumeRef) out.IAPEER_OPENCODE_SESSION = spec.resumeRef
-    return { env: out, readyToken: launchID }
+    const warnings = hasExplicitModel(config)
+      ? []
+      : [`opencode-implicit-provider: no explicit "model" in ${p.config} — OpenCode's own default provider receives the doctrine and messages`]
+    return { env: out, readyToken: launchID, warnings }
   },
 
   async structuralReady(spec, launchID, deadlineMs, alive, env) {

package/src/launch/index.ts

@@ -200,6 +200,7 @@ export const launch: LaunchFn = async (
         const { PEER_PERSONALITY, PEER_RUNTIME, PEER_IDENTITY } = invocation.env
         invocation.env = { ...invocation.env, ...prepared.env, PEER_PERSONALITY, PEER_RUNTIME, PEER_IDENTITY }
         readyToken = prepared.readyToken
+        for (const w of prepared.warnings ?? []) appendLifecycleEvent(cfg.exitLogDir, { ev: 'launch-warning', identity, warning: w }, { env })
       } catch (e) {
         return fail(identity, `launch preparation failed: ${e instanceof Error ? e.message : String(e)}`)
       }

package/src/launch/types.ts

@@ -449,6 +449,8 @@ export interface ObserveContext {
 export interface PreparedLaunch {
   env: Record<string, string>
   readyToken?: string
+  /** Non-fatal launch facts the primitive records in lifecycle.log (ev=launch-warning). */
+  warnings?: string[]
 }
 
 // ─────────────────────────────────────────────────────────────────────────────

package/src/lifecycle/inflight.ts

@@ -0,0 +1,138 @@
+// Inflight ledger — the core's record of CONFIRMED deliveries a receiving session has not yet
+// PROCESSED (docs/20 OC07; invariant: an inbound the core acknowledged is either processed by a later
+// session or its sender is told explicitly it was not). A runtime's own input queue lives in its
+// process: a session that dies (crash, SIGKILL, operator kill) before answering a queued message
+// takes it along, and a fresh next session never sees it. The ledger survives that death.
+//
+// Lifecycle of an entry: written at delivery (transport → noteInflight) → pruned once the session
+// answered it (transport.deliveryProcessed) → when the receiving session is gone (or replaced) while
+// the entry is unprocessed, moved to the identity's ORPHANS → the daemon redelivers orphans through
+// the normal route, or notifies the sender when that fails.
+//
+// Files under cfg.stateDir: `<identity>.inflight.jsonl` (append) and `<identity>.orphans.jsonl`.
+import { appendFileSync, existsSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+export interface InflightEntry {
+  id: string
+  /** Epoch ms of the confirmed delivery. */
+  ts: number
+  /** Wire sentAt of the original envelope (shown on redelivery). */
+  sentAt: string
+  /** Receiving endpoint. */
+  identity: string
+  personality: string
+  runtime: string
+  cwd: string
+  /** Hosting session token at delivery (supervisor pid) — a different/absent token = that session is gone. */
+  sessionToken: string | null
+  caller: { personality: string; runtime: string }
+  message: string
+  topic?: string
+  attachments?: string[]
+  /** The presented envelope (what the model sees) — the processed-check needle source. */
+  rendered: string
+}
+
+const inflightPath = (stateDir: string, identity: string) => join(stateDir, `${identity}.inflight.jsonl`)
+const orphansPath = (stateDir: string, identity: string) => join(stateDir, `${identity}.orphans.jsonl`)
+
+function readJsonl(path: string): InflightEntry[] {
+  if (!existsSync(path)) return []
+  const out: InflightEntry[] = []
+  for (const line of readFileSync(path, 'utf8').split('\n')) {
+    if (!line.trim()) continue
+    try {
+      out.push(JSON.parse(line) as InflightEntry)
+    } catch {
+      /* a torn line is skipped, never fatal */
+    }
+  }
+  return out
+}
+
+function writeJsonl(path: string, entries: InflightEntry[]): void {
+  if (entries.length === 0) {
+    rmSync(path, { force: true })
+    return
+  }
+  const tmp = `${path}.${process.pid}.tmp`
+  writeFileSync(tmp, entries.map(e => JSON.stringify(e)).join('\n') + '\n', { mode: 0o600 })
+  renameSync(tmp, path)
+}
+
+export function recordInflight(stateDir: string, entry: InflightEntry): void {
+  appendFileSync(inflightPath(stateDir, entry.identity), JSON.stringify(entry) + '\n', { mode: 0o600 })
+}
+
+export function listInflightIdentities(stateDir: string): string[] {
+  let names: string[]
+  try {
+    names = readdirSync(stateDir)
+  } catch {
+    return []
+  }
+  return names.filter(n => n.endsWith('.inflight.jsonl')).map(n => n.slice(0, -'.inflight.jsonl'.length))
+}
+
+export function readInflight(stateDir: string, identity: string): InflightEntry[] {
+  return readJsonl(inflightPath(stateDir, identity))
+}
+
+export interface InflightSweepDeps {
+  /** Current hosting token of the identity's session (null = no live session). */
+  sessionToken: (identity: string) => string | null
+  /** Did the receiving session answer this entry? */
+  processed: (entry: InflightEntry) => boolean
+}
+
+/**
+ * One pass over an identity's ledger: drop processed entries; entries whose receiving session is
+ * gone or was replaced (token differs) and that are still unprocessed move to ORPHANS. Entries of the
+ * still-live session that are unprocessed stay. Returns the number orphaned.
+ */
+export function sweepInflight(stateDir: string, identity: string, deps: InflightSweepDeps): number {
+  const entries = readInflight(stateDir, identity)
+  if (entries.length === 0) return 0
+  const current = deps.sessionToken(identity)
+  const keep: InflightEntry[] = []
+  const orphaned: InflightEntry[] = []
+  for (const e of entries) {
+    let done = false
+    try {
+      done = deps.processed(e)
+    } catch {
+      done = false
+    }
+    if (done) continue
+    if (current !== null && current === e.sessionToken) keep.push(e)
+    else orphaned.push(e)
+  }
+  writeJsonl(inflightPath(stateDir, identity), keep)
+  if (orphaned.length) for (const o of orphaned) appendFileSync(orphansPath(stateDir, identity), JSON.stringify(o) + '\n', { mode: 0o600 })
+  return orphaned.length
+}
+
+export function listOrphanIdentities(stateDir: string): string[] {
+  let names: string[]
+  try {
+    names = readdirSync(stateDir)
+  } catch {
+    return []
+  }
+  return names.filter(n => n.endsWith('.orphans.jsonl')).map(n => n.slice(0, -'.orphans.jsonl'.length))
+}
+
+/** Take (and remove) an identity's orphans — the caller owns redelivery-or-notify for each. */
+export function takeOrphans(stateDir: string, identity: string): InflightEntry[] {
+  const path = orphansPath(stateDir, identity)
+  const entries = readJsonl(path)
+  rmSync(path, { force: true })
+  return entries
+}
+
+/** Remove an identity's ledger + orphans (peer removal). */
+export function purgeInflight(stateDir: string, identity: string): void {
+  rmSync(inflightPath(stateDir, identity), { force: true })
+  rmSync(orphansPath(stateDir, identity), { force: true })
+}

package/src/opencode/config.ts

@@ -61,6 +61,43 @@ export function readOpencodeExtension(path: string): JsonObject {
   return fragment
 }
 
+/** Is the peer's provider explicit (`model` = `<provider>/<model>`)? */
+export function hasExplicitModel(config: JsonObject): boolean {
+  return typeof config.model === 'string' && /^[^/\s]+\/\S+$/.test(config.model)
+}
+
+/**
+ * Provider pinning (docs/20 §Provider pinning, OC04). Without an explicit model OpenCode falls back to
+ * its own hosted default (`opencode/big-pickle`) and the whole composed doctrine goes there. Owner
+ * policy (18.10): allowed, but NEVER silently — an implicit provider passes through unchanged and the
+ * launch records a warning (see the adapter) while the actual model is reported in the fleet snapshot.
+ * An EXPLICIT model is pinned: `small_model` defaults to `model` (titles never drift to another
+ * provider) and `enabled_providers` is exactly those providers; an explicit list that excludes them
+ * is a misconfiguration and refuses loudly.
+ */
+export function pinProvider(config: JsonObject, configPath: string): JsonObject {
+  const hint =
+    `configure the peer's provider in ${configPath} (or OPENCODE_CONFIG_CONTENT in the peer's launch.env): ` +
+    `"model": "<provider>/<model>" plus that provider's "provider" block; see docs/20 §Provider pinning`
+  const providerOf = (v: unknown, field: string): string => {
+    if (typeof v !== 'string' || !/^[^/\s]+\/\S+$/.test(v)) {
+      throw new Error(`opencode: no explicit ${field} — refusing to launch on OpenCode's implicit default provider. ${hint}`)
+    }
+    return v.slice(0, v.indexOf('/'))
+  }
+  if (!hasExplicitModel(config)) return config
+  const model = providerOf(config.model, 'model')
+  const smallModel = config.small_model === undefined ? config.model : config.small_model
+  const small = providerOf(smallModel, 'small_model')
+  const needed = [...new Set([model, small])]
+  let enabled = config.enabled_providers
+  if (enabled === undefined) enabled = needed
+  else if (!Array.isArray(enabled) || !needed.every(p => (enabled as unknown[]).includes(p))) {
+    throw new Error(`opencode: enabled_providers ${JSON.stringify(enabled)} must include ${JSON.stringify(needed)} (the model providers). ${hint}`)
+  }
+  return { ...config, small_model: smallModel, enabled_providers: enabled }
+}
+
 export interface ComposeOpencodeConfigInput {
   personality: string
   doctrine: string
@@ -90,6 +127,7 @@ export function composeOpencodeConfig(input: ComposeOpencodeConfigInput, options
     const path = join(paths.dir, `${stem}.json`)
     if (existsSync(path)) result = mergeOpencodeConfig(result, readOpencodeExtension(path))
   }
+  result = pinProvider(result, paths.config)
   // Last writer for required fields; foreign MCP servers, agents, plugins and
   // provider settings survive. Effective managed overrides still need a live gate.
   return mergeOpencodeConfig(result, {

package/src/opencode/iapeer-plugin.mjs

@@ -151,6 +151,7 @@ async function server(input) {
   function noteModel(info) {
     if (info && info.role === 'assistant' && typeof info.providerID === 'string' && typeof info.modelID === 'string') {
       lastModel = { providerID: info.providerID, modelID: info.modelID }
+      state.model = info.providerID + '/' + info.modelID // the ACTUAL model, for operators (fleet snapshot)
     }
   }
 

package/src/opencode/journal.ts

@@ -17,6 +17,8 @@ export interface OpencodeState {
   lastActivityMs: number
   status: OpencodeStatus
   error?: string
+  /** Actual `provider/model` of the last assistant turn (plugin-reported). */
+  model?: string
 }
 
 export interface OpencodeJournalLine {

package/src/supervisor/daemon.ts

@@ -113,6 +113,10 @@ const SIGWINCH_REDRAW_WAIT_MS = 300
 // Bun-native PTY (Bun ≥1.3.5) is not yet in @types/bun — type the slice we use.
 interface PtyChild {
   pid: number
+  /** Resolves with the exit status once the process is REAPED (the pty exit callback fires earlier). */
+  exited?: Promise<number>
+  exitCode?: number | null
+  signalCode?: string | number | null
   terminal: { write(d: Uint8Array | string): void; resize(cols: number, rows: number): void }
   kill(sig?: number | string): void
 }
@@ -385,26 +389,33 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
           }
         }
       },
-      exit(_t?: unknown, exitCode?: number | null, signalCode?: number | null) {
+      exit() {
         // resilience-b exit-cause (spawn-flip Ф0b): record WHY the hosted child died into exits.log,
         // mirroring the tmux pane-died hook (ev=session-exit dead_status/dead_signal), so the daemon's
         // supervise-tick death classification + crash-loop accounting have the cause. host=supervisor
-        // distinguishes the source. The Bun-native pty exit callback passes (exitCode, signalCode) like
-        // onExit; fall back to the subprocess props. Best-effort — never blocks shutdown.
-        const c = child as { exitCode?: number | null; signalCode?: number | null }
-        const status = exitCode ?? c.exitCode
-        const signal = signalCode ?? c.signalCode
-        exitLogged = true // this IS the death record — shutdown below must not write a second one
-        recordStructuralStop('child-exit', status ?? undefined, signal ?? undefined)
-        appendExitEvent({
-          ev: 'session-exit',
-          identity: session,
-          dead_status: status ?? '',
-          dead_signal: signal ?? '',
-          cause: 'child-exit',
-          host: 'supervisor',
-        })
-        shutdown()
+        // distinguishes the source.
+        //
+        // The Bun-native pty `exit` callback fires on pty EOF, BEFORE the process is reaped, and passes
+        // (0, null) even for a SIGKILL (measured, Bun 1.3.13: callback (0, null); `exited` → 137,
+        // signalCode 'SIGKILL'). Reporting those args recorded a SIGKILL as a clean exit 0 (linus OC07).
+        // So wait for the reap (bounded) and read the subprocess's own exitCode/signalCode.
+        exitLogged = true // this IS the death record — a racing shutdown must not write a second one
+        const finish = (): void => {
+          const status = child.signalCode != null ? undefined : (child.exitCode ?? undefined)
+          const signal = child.signalCode ?? undefined
+          recordStructuralStop('child-exit', status, signal)
+          appendExitEvent({
+            ev: 'session-exit',
+            identity: session,
+            dead_status: status ?? '',
+            dead_signal: signal ?? '',
+            cause: 'child-exit',
+            host: 'supervisor',
+          })
+          shutdown()
+        }
+        const reaped = child.exited ?? Promise.resolve(0)
+        void Promise.race([reaped.catch(() => 0), new Promise(r => setTimeout(r, 2000))]).then(finish)
       },
     },
   } as unknown as Parameters<typeof Bun.spawn>[1]) as unknown as PtyChild

package/src/transport/index.ts

@@ -33,7 +33,7 @@ import {
   type ProcessAddress,
 } from '../core/socket.ts'
 import { buildEnvelope, formatSentAt, renderEnvelopeForAgent } from '../codec/index.ts'
-import { resolveGlobalRoot } from '../storage/index.ts'
+import { endpointPrivateDir, resolveGlobalRoot } from '../storage/index.ts'
 import { findPeer, readPeersIndex, type PeerRecord } from '../registry/index.ts'
 import type { ResolvedCaller } from '../identity/index.ts'
 // Delivery markers are OWNED by the runtime adapter. transport
@@ -805,6 +805,108 @@ export function transcriptCarriesEnvelope(
   return false
 }
 
+/** The shape transport needs to judge one inflight delivery (a subset of lifecycle's InflightEntry —
+ *  transport never imports lifecycle). */
+export interface ProcessedProbe {
+  runtime: string
+  personality: string
+  cwd: string
+  ts: number
+  rendered: string
+}
+
+const PROCESSED_TAIL_BYTES = 16 * 1024 * 1024
+
+/**
+ * Did the receiving session ANSWER this delivery (OC07)? «Recorded» is not «processed»: measured
+ * 18.10 on claude, a message SIGKILLed mid-request had its `user` record (and the API request blob)
+ * in the transcript but no assistant record after it — the model never answered, and a fresh next
+ * session would not see it. So the proof is a model response AFTER the record that carries the
+ * envelope:
+ *   claude — a `type:"assistant"` record after a non-queue-operation record carrying the needles;
+ *   codex  — a non-user `response_item` (assistant message / function_call / reasoning) or an
+ *            `agent_message` event after the user input carrying the needles;
+ *   opencode — an assistant `message.updated` whose parentID is the user message whose text part
+ *            carries the needles (journal; docs/20).
+ * Reads bounded tails only. False → the entry stays inflight (or orphans if its session is gone):
+ * a false negative costs a duplicate redelivery, never a silent loss.
+ */
+export function deliveryProcessed(probe: ProcessedProbe, env: NodeJS.ProcessEnv = process.env): boolean {
+  const needles = confirmNeedles(probe.rendered)
+  if (!needles.length || needles.every(n => !n)) return false
+  if (getAdapter(probe.runtime).deliveryConfirm === 'structural') {
+    const dir = endpointPrivateDir(probe.runtime, probe.personality, { env })
+    if (!dir) return false
+    const path = join(dir, 'events.jsonl')
+    let size = 0
+    try {
+      size = statSync(path).size
+    } catch {
+      return false
+    }
+    const userIDs = new Set<string>()
+    for (const line of readFileTailFrom(path, Math.max(0, size - PROCESSED_TAIL_BYTES)).split('\n')) {
+      if (!line.trim()) continue
+      let e: { type?: string; properties?: { part?: { type?: string; text?: string; messageID?: string }; info?: { role?: string; parentID?: string } } }
+      try {
+        e = JSON.parse(line)
+      } catch {
+        continue
+      }
+      const part = e.properties?.part
+      if (e.type === 'message.part.updated' && part?.type === 'text' && typeof part.text === 'string' && part.messageID) {
+        const text = part.text.replace(/\r/g, '')
+        if (needles.every(n => text.includes(n))) userIDs.add(part.messageID)
+      }
+      const info = e.properties?.info
+      if (e.type === 'message.updated' && info?.role === 'assistant' && info.parentID && userIDs.has(info.parentID)) return true
+    }
+    return false
+  }
+  for (const path of compactCandidateFiles(probe.runtime, probe.cwd, env)) {
+    let st
+    try {
+      st = statSync(path)
+    } catch {
+      continue
+    }
+    if (st.mtimeMs < probe.ts - 5000) continue
+    let carried = false
+    for (const line of readFileTailFrom(path, Math.max(0, st.size - PROCESSED_TAIL_BYTES)).split(/\r?\n/)) {
+      if (!line.trim()) continue
+      let o: { type?: string; payload?: { type?: string; role?: string } }
+      try {
+        o = JSON.parse(line)
+      } catch {
+        continue
+      }
+      if (!carried) {
+        if (o.type !== 'queue-operation' && jsonStringValuesContainAll(o, needles)) carried = true
+        continue
+      }
+      if (o.type === 'assistant') return true // claude
+      if (o.type === 'response_item' && o.payload && o.payload.role !== 'user') return true // codex
+      if (o.type === 'event_msg' && o.payload?.type === 'agent_message') return true // codex
+    }
+  }
+  return false
+}
+
+/** One confirmed delivery to an AGENT endpoint, as transport reports it to the inflight ledger. */
+export interface InflightNote {
+  sentAt: string
+  identity: string
+  personality: string
+  runtime: string
+  cwd: string
+  sessionToken: string | null
+  caller: { personality: string; runtime: string }
+  message: string
+  topic?: string
+  attachments?: string[]
+  rendered: string
+}
+
 function compactDoneTimeoutMs(env: NodeJS.ProcessEnv | undefined): number {
   const raw = env?.IAPEER_COMPACT_DONE_TIMEOUT_MS
   const n = raw === undefined ? NaN : Number(raw)
@@ -1084,6 +1186,8 @@ export interface ComposerQueuedDelivery {
   topic?: string
   enqueuedAtMs: number
   sessionToken: string
+  /** OC07 — what the inflight ledger needs once the queued delivery lands. */
+  inflight?: InflightInfo
 }
 
 export interface ComposerQueueTryEnqueueArgs {
@@ -1094,6 +1198,7 @@ export interface ComposerQueueTryEnqueueArgs {
   topic?: string
   /** Router-acceptance instant (formatSentAt) — the queued ACK's `ts` mirrors it. */
   sentAt?: string
+  inflight?: InflightInfo
 }
 
 export interface ComposerQueueRouteDeps {
@@ -1137,6 +1242,10 @@ export interface RouteDeps {
    *  and cannot reap the session before the just-delivered message's turn record lands. Injected (same
    *  layering as noteLiveTopic — lifecycle.setLastDelivered wired in main.ts). */
   noteDelivered?: (identity: string) => void
+  /** OC07 — record a CONFIRMED delivery to an AGENT endpoint in the inflight ledger, so a session that
+   *  dies before answering it does not take the message along silently (lifecycle.recordInflight wired
+   *  in main.ts; same layering as noteDelivered). Best-effort: a hook error never fails the delivery. */
+  noteInflight?: (note: InflightNote) => void
   /** H4 launchd-managed detector (injected so transport never imports lifecycle —
    *  main.ts wires the real `isLaunchdManaged`). A MISS on a launchd-managed target is
    *  almost always a TRANSIENT restart window (router restart on connect / `iapeer
@@ -1165,6 +1274,37 @@ function noteTopic(deps: RouteDeps, identity: string, topic: string | undefined)
   }
 }
 
+type InflightInfo = { sentAt: string; caller: ResolvedCaller; message: string; topic?: string; attachments?: string[]; envelope: string }
+
+/** Best-effort inflight record (OC07) — only for agent (tui) endpoints. */
+function noteInflight(
+  deps: Pick<RouteDeps, 'noteInflight'>,
+  target: DeliveryTarget,
+  cwd: string,
+  info: InflightInfo,
+  env: NodeJS.ProcessEnv,
+): void {
+  if (!deps.noteInflight) return
+  try {
+    if (getAdapter(target.runtime).kind !== 'tui') return
+    deps.noteInflight({
+      sentAt: info.sentAt,
+      identity: target.address,
+      personality: target.personality,
+      runtime: target.runtime,
+      cwd,
+      sessionToken: hostSessionToken(target.address, env),
+      caller: { personality: info.caller.personality, runtime: info.caller.runtime },
+      message: info.message,
+      ...(info.topic ? { topic: info.topic } : {}),
+      ...(info.attachments?.length ? { attachments: info.attachments } : {}),
+      rendered: renderEnvelopeForAgent(info.envelope),
+    })
+  } catch {
+    /* a post-delivery hook must never fail the delivery */
+  }
+}
+
 /** Best-effort lastDelivered stamp (В7) — records a CONFIRMED live delivery so the idle-reap proxy
  *  cannot reap the session out from under a just-delivered message before its turn record lands. */
 function noteDelivered(deps: RouteDeps, identity: string): void {
@@ -1202,6 +1342,8 @@ export interface ComposerDeliveryQueueOptions {
   noteLiveTopic?: (identity: string, topic: string) => void
   /** В7 — stamp a confirmed queued delivery (same seam as RouteDeps.noteDelivered). */
   noteDelivered?: (identity: string) => void
+  /** OC07 — same seam as RouteDeps.noteInflight, for a queued delivery once it lands. */
+  noteInflight?: (note: InflightNote) => void
   onDelivered?: (caller: ResolvedCaller) => void
 }
 
@@ -1349,6 +1491,7 @@ export function createComposerDeliveryQueue(opts: ComposerDeliveryQueueOptions):
         } catch {
           /* best-effort */
         }
+        if (job.inflight) noteInflight({ noteInflight: opts.noteInflight }, job.target, job.peer.cwd, job.inflight, opts.env ?? process.env)
         try {
           opts.onDelivered?.(job.caller)
         } catch {
@@ -1377,6 +1520,7 @@ export function createComposerDeliveryQueue(opts: ComposerDeliveryQueueOptions):
         topic: args.topic,
         enqueuedAtMs: monotonicMs(),
         sessionToken: token,
+        ...(args.inflight ? { inflight: args.inflight } : {}),
       }
       const q = queues.get(args.target.address) ?? []
       q.push(job)
@@ -1601,6 +1745,8 @@ async function routeSendInner(
     attachments: spooled.value.paths,
     message,
   })
+  // OC07 — what the inflight ledger needs to redeliver this message if the receiving session dies first.
+  const inflightInfo = { sentAt, caller, message, topic, attachments: spooled.value.paths, envelope }
 
   // M3 wake_policy:"ephemeral" — an ephemeral target is NEVER injected into a live
   // session and never woken synchronously here: the delivery is ALWAYS enqueued
@@ -1620,7 +1766,7 @@ async function routeSendInner(
     // target must still obey the domain guard even though selection is exact).
     const liveGuard = telegramSenderGuard(caller, target.value.runtime, personality)
     if (!liveGuard.ok) return liveGuard
-    const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: target.value, envelope, topic, sentAt })
+    const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: target.value, envelope, topic, sentAt, inflight: inflightInfo })
     if (queued) return queued
     // peer.cwd enables the Ф-B transcript-mtime liveness probe (busy-session case).
     // deliverWarm is HOST-AWARE (spawn-flip Ф0b-2): a supervisor-hosted target delivers over its
@@ -1629,6 +1775,7 @@ async function routeSendInner(
     if (!delivered.ok) return delivered
     noteTopic(deps, target.value.address, topic)
     noteDelivered(deps, target.value.address) // В7 — floor the idle proxy so this delivery isn't reaped away
+    noteInflight(deps, target.value, peer.cwd, inflightInfo, env)
     return ok({
       ok: true,
       delivered_to: { personality: target.value.personality, runtime: target.value.runtime },
@@ -1661,6 +1808,7 @@ async function routeSendInner(
       const delivered = await deliverWarm(revived.value, envelope, peer.cwd, {}, env)
       if (delivered.ok) {
         noteTopic(deps, revived.value.address, topic)
+        noteInflight(deps, revived.value, peer.cwd, inflightInfo, env)
         return ok({
           ok: true,
           delivered_to: { personality: revived.value.personality, runtime: revived.value.runtime },
@@ -1701,11 +1849,12 @@ async function routeSendInner(
   // a false ok:true — the class the contract forbids. A delivery failure here is
   // surfaced loudly (false-FAIL over false-OK).
   if (woke.taskDelivered === false) {
-    const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: live.value, envelope, topic, sentAt })
+    const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: live.value, envelope, topic, sentAt, inflight: inflightInfo })
     if (queued) return queued
     const delivered = await deliverWarm(live.value, envelope, peer.cwd, {}, env)
     if (!delivered.ok) return delivered
     noteTopic(deps, live.value.address, topic)
+    noteInflight(deps, live.value, peer.cwd, inflightInfo, env)
     return ok({
       ok: true,
       delivered_to: { personality: live.value.personality, runtime: live.value.runtime },
@@ -1714,6 +1863,7 @@ async function routeSendInner(
     })
   }
   // The envelope was delivered as the boot first-message during wake.
+  noteInflight(deps, live.value, peer.cwd, inflightInfo, env)
   return ok({
     ok: true,
     delivered_to: { personality: live.value.personality, runtime: live.value.runtime },