@dsh-enhanced/assistant-delivery 0.1.65 → 0.1.67

package/lib/store.js

@@ -1,13 +1,28 @@
+import { WorkItemFeedbackStore } from './work-item-feedback-store.js';
+import { AttentionAuditStore } from './attention-audit-store.js';
+import { WorkItemRepliesStore } from './work-item-replies-store.js';
+import { normalizeForegroundTerminationObservation } from './foreground-termination.js';
 import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from 'node:crypto';
 import { isAbsolute } from 'node:path';
 import { acceptanceCanonicalJson } from '@dsh-enhanced/task-acceptance-contract';
 import { ASSISTANT_GROWTH_CONTRACT_VERSION, WORKFLOW_TRACE_SOURCE_ID, growthObjectDigest, validateResolvedWorkflowAutomationTemplate, validateWorkflowAutomationTemplate, validateWorkflowAutomationTemplateContent, validateWorkflowTraceRevision, workflowAutomationTemplateContentDigest, workflowArgumentShapeDigest, workflowScopeKey, workflowTraceRevisionDigest, WORKFLOW_OWNER_ANCHORED_PLACEHOLDER_SCHEDULE, } from '@dsh-enhanced/assistant-growth-contract';
 import { bindingMatchesOwnerRoute, canonicalBackgroundSourceId, canonicalConversation, canonicalLocalOperatorId, canonicalOwnerRouteAuthority, canonicalPrincipal, canonicalTarget, externalPrincipalId, ownerRouteAuthorityHash, ownerRouteBindingSnapshot, } from './canonical.js';
 import { feedbackDispatchRecoveryCode, isFeedbackDeliveryCommand, isFeedbackDispatchRecoveryCode, isExactDeliveryCommand, isLearningDeliveryCommand, isLearningDispatchRecoveryCode, isLearningRetryableFailureCode, isPermissionDeliveryCommand, isWorkflowDeliveryCommand, isWorkflowDispatchRecoveryCode, learningDispatchRecoveryCode, parseDeliveryCommand, permissionDispatchRecoveryCode, permissionDispatchRecoveryFromFailureCode, workflowDispatchRecoveryCode, } from './session-commands.js';
-import { parseFeedbackCommand, parseNaturalObjectiveFeedback } from './feedback-command.js';
+import { parseFeedbackCommand, parseNaturalOwnerReply } from './feedback-command.js';
 import { validateOwnerGoalOutcomeFeedbackLocator, validateOwnerGoalOutcomeFeedbackProof, } from './goal-wake-types.js';
 import { openDeliveryDatabase } from './sqlite.js';
 import { deriveDeterministicallyDeidentifiedWorkflowTemplate, getDeterministicallyDeidentifiedWorkflowTemplate, } from './workflow-auto-producer.js';
+function foregroundTerminationFromBytes(value) {
+    if (value === null)
+        return undefined;
+    if (!(value instanceof Uint8Array) || value.length > 1024)
+        throw new Error('invalid termination bytes');
+    const raw = new TextDecoder('utf-8', { fatal: true }).decode(value);
+    const normalized = normalizeForegroundTerminationObservation(JSON.parse(raw));
+    if (JSON.stringify(normalized) !== raw || !Buffer.from(raw).equals(value))
+        throw new Error('noncanonical termination bytes');
+    return normalized;
+}
 function foregroundSourceByteLimit(value) {
     if (value === undefined)
         return 16_384;
@@ -1026,7 +1041,7 @@ function canonicalMetadata(input, kind) {
 function canonicalIntent(input, binding, maxTextBytes) {
     const allowed = [
         'idempotencyKey', 'bindingId', 'target', 'text', 'format', 'approval', 'modelPicker', 'permissionPicker',
-        'replyToEventId', 'metadata',
+        'replyToEventId', 'metadata', 'attachment',
     ];
     if (input === null || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).some(key => !allowed.includes(key))) {
         throw new DeliveryStoreError('invalid-intent', 'outbound intent shape is invalid');
@@ -1109,12 +1124,28 @@ function canonicalIntent(input, binding, maxTextBytes) {
         }
     }
     const metadata = canonicalMetadata(input.metadata, 'intent');
+    const attachment = canonicalTextAttachment(input.attachment, format, maxTextBytes);
     return { idempotencyKey, bindingId, target, text: input.text, format,
         ...(approval === undefined ? {} : { approval }),
         ...(modelPicker === undefined ? {} : { modelPicker }),
         ...(permissionPicker === undefined ? {} : { permissionPicker }),
         ...(replyToEventId === undefined ? {} : { replyToEventId }),
-        ...(metadata === undefined ? {} : { metadata }) };
+        ...(metadata === undefined ? {} : { metadata }),
+        ...(attachment === undefined ? {} : { attachment }) };
+}
+/** WP19 stage 2b text attachment: plain intents only, digest-bound, within the text byte budget. */
+function canonicalTextAttachment(input, format, maxTextBytes) {
+    if (input === undefined)
+        return undefined;
+    if (format !== 'plain' || input === null || typeof input !== 'object' || Array.isArray(input)
+        || Object.keys(input).length !== 5 || Object.keys(input).some(key => !['kind', 'name', 'mediaType', 'text', 'sha256'].includes(key))
+        || input.kind !== 'text' || typeof input.name !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(input.name)
+        || (input.mediaType !== 'text/plain' && input.mediaType !== 'text/markdown')
+        || typeof input.text !== 'string' || input.text.length === 0 || Buffer.byteLength(input.text, 'utf8') > maxTextBytes
+        || typeof input.sha256 !== 'string' || input.sha256 !== digest(input.text)) {
+        throw new DeliveryStoreError('invalid-intent', 'outbound text attachment is invalid');
+    }
+    return { kind: 'text', name: input.name, mediaType: input.mediaType, text: input.text, sha256: input.sha256 };
 }
 const ownerRouteReceiptKeys = [
     'dsh.route.authority',
@@ -1365,6 +1396,9 @@ function leaseTargetJson(target) {
     return JSON.stringify({ kind: 'construction', sessionId: target.sessionId, conversation: canonicalConversation(target.conversation), principal: canonicalPrincipal(target.principal), workspace: target.workspace, agentPreset: target.agentPreset, generation: target.generation, ...(target.previous === undefined ? {} : { previous: { id: target.previous.id, conversation: canonicalConversation(target.previous.conversation), principal: canonicalPrincipal(target.previous.principal), workspace: target.previous.workspace, agentPreset: target.previous.agentPreset, sessionId: target.previous.sessionId, generation: target.previous.generation, version: target.previous.version, status: 'active' } }) });
 }
 export class DeliveryStore {
+    workItemReplies;
+    workItemFeedback;
+    attentionAudit;
     database;
     /** Scan position only; every candidate is authorized again before a provider retry. */
     progressRecoveryCursors = new Map();
@@ -1379,6 +1413,9 @@ export class DeliveryStore {
         this.now = options.now ?? Date.now;
         this.codeGenerator = options.codeGenerator ?? (() => randomBytes(5).toString('hex').toUpperCase());
         this.maxTextBytes = options.maxTextBytes ?? 65_536;
+        this.workItemReplies = new WorkItemRepliesStore(this.database, operation => this.transaction(operation), id => this.getInbox(id), id => this.getBinding(id), id => this.getOutbox(id), binding => this.getPrincipal(binding.principal));
+        this.workItemFeedback = new WorkItemFeedbackStore(this.database, operation => this.transaction(operation), id => this.getInbox(id));
+        this.attentionAudit = new AttentionAuditStore(this.database, operation => this.writerTransactionActive ? operation() : this.transaction(operation), () => this.now());
         const instance = this.database.prepare(`
       SELECT instance_id FROM delivery_instance WHERE singleton = 1
     `).get();
@@ -1411,6 +1448,25 @@ export class DeliveryStore {
             this.closed = true;
             throw new DeliveryStoreError('conflict', 'workflow trace source authority is missing or stale');
         }
+        this.detachLinksOfInactiveOwners(now);
+    }
+    /**
+     * Idempotent startup repair for links written before revoking an owner
+     * detached them: an active linked principal whose root is not the active
+     * owner yields no alias receipt today, but a later reactivation of that
+     * owner record would silently restore it. Detach exactly those rows, as
+     * `revokePrincipal` now does. No schema change; a no-op once clean. Links
+     * whose owner was already revoked and reactivated before this repair are
+     * indistinguishable from fresh links and are not touched.
+     */
+    detachLinksOfInactiveOwners(now) {
+        this.transaction(() => {
+            this.database.prepare(`
+        UPDATE delivery_principals SET linked_to_id = NULL, updated_at = ?, version = version + 1
+        WHERE role = 'linked' AND status = 'active' AND linked_to_id IS NOT NULL
+          AND linked_to_id NOT IN (SELECT id FROM delivery_principals WHERE role = 'owner' AND status = 'active')
+      `).run(now);
+        });
     }
     instanceId() {
         this.assertOpen();
@@ -1715,6 +1771,84 @@ export class DeliveryStore {
             .get(principalHash(input));
         return row?.status === 'active';
     }
+    /** The single active owner, or `undefined` while owner authority is absent/ambiguous. */
+    activeOwnerPrincipal() {
+        this.assertOpen();
+        const rows = this.database.prepare(`
+      SELECT id, principal_json, role, status, linked_to_id, created_at, updated_at, version
+      FROM delivery_principals WHERE role = 'owner' AND status = 'active' ORDER BY id LIMIT 2
+    `).all();
+        return rows.length === 1 ? principalFromRow(rows[0]) : undefined;
+    }
+    /**
+     * Activate one explicitly allowlisted peer bot as a linked principal of the
+     * current owner. This never creates an owner and never revives a revoked row:
+     * the peer lane is an exact owner-configured authorization, not pairing or a
+     * silent upgrade of an existing identity.
+     */
+    ensurePeerPrincipal(input, ownerPrincipalId, options = {}) {
+        this.assertOpen();
+        const principal = canonicalPrincipal(input);
+        const json = JSON.stringify(principal);
+        const hash = principalHash(principal);
+        return this.transaction(() => {
+            const owner = this.database.prepare(`
+        SELECT id, principal_json, role, status, linked_to_id, created_at, updated_at, version
+        FROM delivery_principals WHERE id = ?
+      `).get(ownerPrincipalId);
+            if (owner === undefined || owner.role !== 'owner' || owner.status !== 'active') {
+                throw new DeliveryStoreError('unauthorized-principal', 'peer agent requires the single active owner');
+            }
+            const existing = this.database.prepare(`
+        SELECT id, principal_json, role, status, linked_to_id, created_at, updated_at, version
+        FROM delivery_principals WHERE key_hash = ?
+      `).get(hash);
+            if (existing === undefined) {
+                const id = `principal_${randomUUID()}`;
+                const now = this.now();
+                this.database.prepare(`
+          INSERT INTO delivery_principals (
+            id, key_hash, principal_json, role, status, linked_to_id, created_at, updated_at, version
+          ) VALUES (?, ?, ?, 'linked', 'active', ?, ?, ?, 1)
+        `).run(id, hash, json, owner.id, now, now);
+                return principalFromRow(this.database.prepare(`
+          SELECT id, principal_json, role, status, linked_to_id, created_at, updated_at, version
+          FROM delivery_principals WHERE id = ?
+        `).get(id));
+            }
+            const reauthorize = options.reauthorize === true;
+            if (existing.role !== 'linked' || (existing.linked_to_id !== owner.id && !reauthorize)) {
+                throw new DeliveryStoreError('unauthorized-principal', 'peer agent identity is not linked to the active owner');
+            }
+            if (existing.status !== 'active') {
+                if (!reauthorize) {
+                    throw new DeliveryStoreError('unauthorized-principal', 'peer agent identity was revoked; re-authorize it explicitly');
+                }
+                // The caller re-read the exact allowlisted tuple for this message. A
+                // previous owner handoff may have revoked the link; re-link it to the
+                // current owner rather than stranding the configured peer forever.
+                this.database.prepare(`
+          UPDATE delivery_principals
+          SET status = 'active', linked_to_id = ?, updated_at = ?, version = version + 1
+          WHERE id = ?
+        `).run(owner.id, this.now(), existing.id);
+                return principalFromRow(this.database.prepare(`
+          SELECT id, principal_json, role, status, linked_to_id, created_at, updated_at, version
+          FROM delivery_principals WHERE id = ?
+        `).get(existing.id));
+            }
+            if (existing.linked_to_id !== owner.id) {
+                this.database.prepare(`
+          UPDATE delivery_principals SET linked_to_id = ?, updated_at = ?, version = version + 1 WHERE id = ?
+        `).run(owner.id, this.now(), existing.id);
+                return principalFromRow(this.database.prepare(`
+          SELECT id, principal_json, role, status, linked_to_id, created_at, updated_at, version
+          FROM delivery_principals WHERE id = ?
+        `).get(existing.id));
+            }
+            return principalFromRow(existing);
+        });
+    }
     getPrincipal(input) {
         this.assertOpen();
         const row = this.database.prepare(`
@@ -1841,6 +1975,75 @@ export class DeliveryStore {
         return this.database.prepare(`${bindingSelect} WHERE status = 'active' ORDER BY created_at, id`)
             .all().map(bindingFromRow);
     }
+    /**
+     * Read-only: newest inbound `received_at` per candidate binding, counting any
+     * generation of the same conversation from the same principal (so a `/new`
+     * rotation keeps its history). Bindings without inbound are absent. Callers
+     * bound the candidate list.
+     */
+    latestInboundAtByBinding(bindingIds) {
+        this.assertOpen();
+        const rows = this.database.prepare(`SELECT c.value AS binding_id, (SELECT max(i.received_at) FROM inbox_messages AS i
+        JOIN conversation_bindings AS ib ON ib.id = i.binding_id
+        WHERE ib.conversation_hash = cb.conversation_hash AND ib.principal_id = cb.principal_id) AS received_at
+      FROM json_each(?) AS c JOIN conversation_bindings AS cb ON cb.id = c.value`)
+            .all(JSON.stringify(bindingIds));
+        return new Map(rows.flatMap(row => row.received_at === null ? [] : [[row.binding_id, row.received_at]]));
+    }
+    /**
+     * Read-only: the newest still-unsettled earlier report of one work item from
+     * one source (any of `sourceIds`: canonical and as-sent forms), so a router can keep the next revision behind it on one lane.
+     * Unsettled means the claim-order states (`pending`, `retry_wait`,
+     * `attempting`, `unknown_after_send`) without an operator cancel; terminal
+     * rows never match. Scoped by the origin binding's workspace and the
+     * `outbox_claim` status index. A linked row is a Host-routed
+     * `dsh.linked-report` v1 row of this origin with a lower `reportRevision`.
+     * An origin row is queued on the origin binding and is either a typed report
+     * (`delivery_work_item_reports` target with a lower `reportRevision`) or a
+     * plain background notice whose WP19 audit row records `purpose: 'result'`
+     * and this `workItemId`; that plain lane carries no revision, so any such
+     * committed row of the item counts as earlier.
+     */
+    findUnsettledWorkItemReport(input) {
+        this.assertOpen();
+        const sourceIds = JSON.stringify([...new Set(input.sourceIds)]);
+        const row = this.database.prepare(`
+      SELECT o.id, o.binding_id, json_extract(o.intent_json, '$.metadata."dsh.linked-report"') IS NOT NULL AS linked
+      FROM outbox_messages AS o
+      JOIN conversation_bindings AS b ON b.id = o.binding_id AND b.workspace = ?
+      WHERE o.status IN ('pending', 'retry_wait', 'attempting', 'unknown_after_send')
+        AND NOT EXISTS (
+          SELECT 1 FROM dead_letter_resolutions AS resolution
+          WHERE resolution.kind = 'outbox' AND resolution.message_id = o.id
+            AND resolution.attempt_count = o.attempt_count AND resolution.resolution = 'cancel'
+        )
+        AND ((
+          o.idempotency_key GLOB 'linked-report:*'
+          AND json_extract(o.intent_json, '$.metadata."dsh.linked-report"') = 'v1'
+          AND json_extract(o.intent_json, '$.metadata."dsh.linked-report.sourceId"') IN (SELECT value FROM json_each(?))
+          AND json_extract(o.intent_json, '$.metadata."dsh.linked-report.originBindingId"') = ?
+          AND json_extract(o.intent_json, '$.metadata."dsh.linked-report.itemId"') = ?
+          AND CAST(json_extract(o.intent_json, '$.metadata."dsh.linked-report.reportRevision"') AS INTEGER) < ?
+        ) OR (
+          o.binding_id = ?
+          AND json_type(o.intent_json, '$.metadata."dsh.linked-report"') IS NULL
+          AND (EXISTS (
+            SELECT 1 FROM delivery_work_item_reports AS report
+            WHERE report.outbox_id = o.id AND json_extract(report.target_json, '$.sourceId') IN (SELECT value FROM json_each(?))
+              AND json_extract(report.target_json, '$.itemId') = ?
+              AND json_extract(report.target_json, '$.reportRevision') < ?
+          ) OR (NOT EXISTS (SELECT 1 FROM delivery_work_item_reports AS report WHERE report.outbox_id = o.id)
+            AND EXISTS (
+              SELECT 1 FROM delivery_attention_audit AS audit
+              WHERE audit.outbox_id = o.id AND audit.lane = 'background' AND audit.purpose = 'result'
+                AND audit.source_id IN (SELECT value FROM json_each(?)) AND audit.work_item_id = ?
+            )))
+        ))
+      ORDER BY o.rowid DESC LIMIT 1
+    `).get(input.workspace, sourceIds, input.originBindingId, input.itemId, input.beforeRevision, input.originBindingId, sourceIds, input.itemId, input.beforeRevision, sourceIds, input.itemId);
+        return row === undefined ? undefined
+            : Object.freeze({ outboxId: row.id, bindingId: row.binding_id, route: row.linked === 1 ? 'linked' : 'origin' });
+    }
     /** Snapshot one exact active owner binding under the Delivery write fence. */
     resolveApprovalRouteByBinding(input) {
         this.assertOpen();
@@ -1957,7 +2160,7 @@ export class DeliveryStore {
         if (typeof input.sessionId !== 'string' || typeof input.workspace !== 'string'
             || typeof input.preset !== 'string')
             return undefined;
-        return this.transaction(() => {
+        const read = () => {
             const binding = this.getBindingBySession(input.sessionId);
             const principal = binding === undefined ? undefined : this.getBindingPrincipal(binding.id);
             if (binding?.status !== 'active' || binding.sessionId !== input.sessionId
@@ -1966,7 +2169,9 @@ export class DeliveryStore {
                 || JSON.stringify(principal.principal) !== JSON.stringify(binding.principal))
                 return undefined;
             return Object.freeze({ binding, principal });
-        });
+        };
+        // A source writer fence already owns this connection's snapshot and lock.
+        return this.writerTransactionActive ? read() : this.transaction(read);
     }
     getModelSelection(input) {
         this.assertOpen();
@@ -2483,6 +2688,37 @@ export class DeliveryStore {
         });
         return this.getInbox(inboxId);
     }
+    /**
+     * Finish an Inbox without dispatching it to the Agent. Slice-5 owner-question
+     * replies are admitted, applied by their registered consumer, and only then
+     * marked processed. Idempotent for an already-processed Inbox bound to the
+     * same binding; any later lifecycle state is a conflict.
+     */
+    markInboxProcessed(inboxId, bindingId) {
+        this.assertOpen();
+        const record = this.getInbox(inboxId);
+        const binding = this.getBinding(bindingId);
+        if (record === undefined || binding === undefined || binding.status !== 'active') {
+            throw new DeliveryStoreError('not-found', 'inbox or active binding was not found');
+        }
+        if (conversationHash(record.envelope.conversation) !== conversationHash(binding.conversation)
+            || principalHash(record.envelope.principal) !== principalHash(binding.principal)) {
+            throw new DeliveryStoreError('conflict', 'inbox envelope does not belong to the binding');
+        }
+        if (record.status === 'processed' && record.bindingId === bindingId)
+            return record;
+        if (record.status !== 'received' && record.status !== 'authorized') {
+            throw new DeliveryStoreError('conflict', `cannot mark inbox processed in ${record.status}`);
+        }
+        const changed = this.database.prepare(`
+      UPDATE inbox_messages SET status = 'processed', binding_id = ?, next_attempt_at = NULL,
+        failure_code = NULL, claimed_by = NULL, fencing_token = NULL, lease_until = NULL, updated_at = ?
+      WHERE id = ? AND status IN ('received', 'authorized')
+    `).run(bindingId, this.now(), inboxId);
+        if (changed.changes !== 1)
+            throw new DeliveryStoreError('conflict', 'inbox process transition lost a race');
+        return this.getInbox(inboxId);
+    }
     /**
      * Establish a durable command boundary before `/stop` or `/new` is queued.
      *
@@ -2589,11 +2825,14 @@ export class DeliveryStore {
             if (!Number.isSafeInteger(cancelledCount)) {
                 throw new DeliveryStoreError('conflict', 'inbox cancellation count is outside the safe integer range');
             }
+            this.workItemFeedback.cancelBefore(bindingId, boundaryRow.admission_sequence);
+            const replyChildItemIds = this.workItemReplies.cancelBefore(bindingId, boundaryRow.admission_sequence);
             return {
                 cancelled: cancelledCount,
                 dispatching: dispatchingRows.length,
                 claimedInboxIds: claimedRows.map(row => row.id),
                 dispatchingInboxIds: dispatchingRows.map(row => row.id),
+                ...(replyChildItemIds.length === 0 ? {} : { replyChildItemIds }),
             };
         });
     }
@@ -3528,6 +3767,47 @@ export class DeliveryStore {
             scope: Object.freeze({ ...input.scope }), owner: Object.freeze({ ...input.owner }),
             binding: Object.freeze({ ...input.binding }), dispatchedAt: row.dispatched_at });
     }
+    /** Internal Host read: the service supplies an actual unsettled-call task proof.
+     * This pending lane does not weaken the separate terminal source reader. */
+    readPendingForegroundToolInput(input) {
+        this.assertOpen();
+        const offset = input.offset ?? 0, limit = input.maxBytes ?? 4096;
+        if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(limit) || limit < 4 || limit > 8192) {
+            throw new DeliveryStoreError('invalid-binding', 'foreground tool input byte page is invalid');
+        }
+        const read = () => {
+            const task = this.inspectPendingForegroundToolTask(input.task);
+            if (task === undefined || acceptanceCanonicalJson(task) !== acceptanceCanonicalJson(input.task))
+                return undefined;
+            const inbox = this.getInbox(task.inboxId);
+            if (inbox === undefined || inbox.status !== 'claimed' || inbox.bindingId !== task.binding.id)
+                return undefined;
+            const model = this.database.prepare(`SELECT model_selection_state, model_provider, model_id, model_reasoning_effort
+        FROM delivery_foreground_executions WHERE inbox_id = ? AND status = 'pending'`).get(task.inboxId);
+            if (model === undefined || !['missing', 'frozen', 'inconsistent'].includes(model.model_selection_state)
+                || model.model_selection_state === 'frozen' && (!model.model_provider || !model.model_id))
+                return undefined;
+            const modelSelectionState = model.model_selection_state;
+            const modelSelection = modelSelectionState === 'frozen' ? Object.freeze({ provider: model.model_provider, model: model.model_id,
+                ...(model.model_reasoning_effort === null ? {} : { reasoningEffort: model.model_reasoning_effort }) }) : undefined;
+            const bytes = Buffer.from(inbox.envelope.text, 'utf8');
+            if (offset > bytes.length || offset < bytes.length && (bytes[offset] & 0xc0) === 0x80) {
+                throw new DeliveryStoreError('invalid-binding', 'foreground tool input offset is not a UTF-8 boundary');
+            }
+            let end = Math.min(bytes.length, offset + limit);
+            while (end > offset && end < bytes.length && (bytes[end] & 0xc0) === 0x80)
+                end--;
+            const fullTextDigest = createHash('sha256').update(bytes).digest('hex');
+            // Native call identity and page window are intentionally absent. Multiple
+            // actual calls in the same claimed human task share one canonical source.
+            const sourceDigest = digest(acceptanceCanonicalJson({ protocol: 'assistant-delivery/foreground-tool-input-source/v1',
+                task, source: { envelopeHash: inbox.envelopeHash, envelope: inbox.envelope }, fullTextDigest, modelSelectionState,
+                ...(modelSelection === undefined ? {} : { modelSelection }) }));
+            return Object.freeze({ sourceDigest, modelSelectionState, ...(modelSelection === undefined ? {} : { modelSelection }), input: Object.freeze({ text: bytes.subarray(offset, end).toString('utf8'),
+                    fullTextDigest, fullBytes: bytes.length, returnedBytes: end - offset, offset, ...(end < bytes.length ? { nextOffset: end } : {}) }) });
+        };
+        return this.writerTransactionActive ? read() : this.transaction(read);
+    }
     /** Immutable pre-prompt receipt for an authenticated owner foreground turn. */
     bindForegroundTaskExecution(input) {
         this.assertOpen();
@@ -3570,15 +3850,31 @@ export class DeliveryStore {
             || !Number.isSafeInteger(input.completedAt) || input.completedAt < 0) {
             throw new DeliveryStoreError('invalid-binding', 'foreground execution completion is invalid');
         }
+        let termination;
+        if (input.termination !== undefined) {
+            try {
+                termination = normalizeForegroundTerminationObservation(input.termination);
+            }
+            catch {
+                throw new DeliveryStoreError('invalid-binding', 'foreground termination observation is invalid');
+            }
+            if (termination.kind === 'completed'
+                ? input.status !== 'succeeded' || !input.quiescent || !termination.handleDisposed
+                : input.status === 'succeeded')
+                throw new DeliveryStoreError('invalid-binding', 'foreground termination contradicts completion');
+        }
+        const terminationJson = termination === undefined ? null : JSON.stringify(termination);
         const status = input.quiescent && input.status === 'succeeded' ? 'succeeded' : 'unknown';
         const quiescent = status === 'succeeded' ? 1 : 0;
         const changed = this.database.prepare(`UPDATE delivery_foreground_executions
-      SET status = ?, quiescent = ?, completed_at = ?, execution_ref = inbox_id
-      WHERE inbox_id = ? AND status = 'pending' AND dispatched_at <= ?`).run(status, quiescent, input.completedAt, input.inboxId, input.completedAt);
+      SET status = ?, quiescent = ?, completed_at = ?, execution_ref = inbox_id, termination_json = ?
+      WHERE inbox_id = ? AND status = 'pending' AND dispatched_at <= ?`).run(status, quiescent, input.completedAt, terminationJson, input.inboxId, input.completedAt);
         if (changed.changes !== 1) {
-            const current = this.database.prepare('SELECT status, quiescent, completed_at FROM delivery_foreground_executions WHERE inbox_id = ?')
+            const current = this.database.prepare('SELECT status, quiescent, completed_at, CAST(termination_json AS BLOB) AS termination_bytes FROM delivery_foreground_executions WHERE inbox_id = ?')
                 .get(input.inboxId);
-            if (current?.status === status && current.quiescent === quiescent && current.completed_at === input.completedAt)
+            if (current?.status === status && current.quiescent === quiescent && current.completed_at === input.completedAt
+                && (terminationJson === null ? current.termination_bytes === null
+                    : current.termination_bytes instanceof Uint8Array && Buffer.from(terminationJson).equals(current.termination_bytes)))
                 return;
             throw new DeliveryStoreError('conflict', 'foreground execution is absent or its completion changed');
         }
@@ -3643,7 +3939,13 @@ export class DeliveryStore {
         return { authority, authorityHash, scopeKey };
     }
     foregroundSource(row, input, fence) {
-        const inbox = this.getInbox(row.inbox_id);
+        let inbox;
+        try {
+            inbox = this.getInbox(row.inbox_id);
+        }
+        catch {
+            return undefined;
+        }
         const binding = this.getBinding(row.binding_id);
         if (!inbox || !binding || inbox.bindingId !== row.binding_id
             || row.workspace !== input.workspace || row.preset !== input.agentPreset
@@ -3658,8 +3960,15 @@ export class DeliveryStore {
             || !Number.isSafeInteger(row.completion_sequence) || row.completion_sequence < 1)
             return undefined;
         try {
-            const envelope = canonicalEnvelope(inbox.envelope, this.maxTextBytes);
-            if (digest(JSON.stringify(envelope)) !== inbox.envelopeHash
+            const raw = this.database.prepare(`SELECT CAST(envelope_json AS BLOB) AS envelope_bytes,
+        CAST(envelope_hash AS BLOB) AS hash_bytes FROM inbox_messages WHERE id = ?`).get(row.inbox_id);
+            if (!raw || !(raw.envelope_bytes instanceof Uint8Array) || !(raw.hash_bytes instanceof Uint8Array))
+                return undefined;
+            const text = new TextDecoder('utf-8', { fatal: true }).decode(raw.envelope_bytes);
+            const envelope = canonicalEnvelope(JSON.parse(text), this.maxTextBytes);
+            const canonical = JSON.stringify(envelope), envelopeHash = digest(canonical);
+            if (!Buffer.from(canonical).equals(raw.envelope_bytes) || !Buffer.from(envelopeHash).equals(raw.hash_bytes)
+                || envelopeHash !== inbox.envelopeHash
                 || envelope.kind !== 'text' || parseDeliveryCommand({ ...envelope, kind: 'command' }) !== undefined
                 || JSON.stringify(envelope.principal) !== JSON.stringify(binding.principal)
                 || JSON.stringify(envelope.conversation) !== JSON.stringify(binding.conversation))
@@ -3668,6 +3977,17 @@ export class DeliveryStore {
         catch {
             return undefined;
         }
+        let termination;
+        try {
+            termination = foregroundTerminationFromBytes(row.termination_bytes);
+            if (termination !== undefined && (termination.kind === 'completed'
+                ? row.status !== 'succeeded' || row.quiescent !== 1 || !termination.handleDisposed
+                : row.status === 'succeeded'))
+                return undefined;
+        }
+        catch {
+            return undefined;
+        }
         const execution = Object.freeze({ dispatchedAt: row.dispatched_at,
             status: row.status, quiescent: row.quiescent === 1, completedAt: row.completed_at,
             executionRef: row.execution_ref, modelSelectionState: row.model_selection_state,
@@ -3681,7 +4001,8 @@ export class DeliveryStore {
             owner: Object.freeze({ principalRecordId: row.principal_record_id, principalVersion: row.principal_version }),
             scope: Object.freeze({ workspace: row.workspace, preset: row.preset }),
             binding: Object.freeze({ id: row.binding_id, version: row.binding_version,
-                generation: row.binding_generation, sessionId: binding.sessionId }), execution };
+                generation: row.binding_generation, sessionId: binding.sessionId }), execution,
+            ...(termination === undefined ? {} : { termination }) };
         return Object.freeze({ ...content, sourceDigest: digest(acceptanceCanonicalJson({ ...content, envelopeHash: inbox.envelopeHash })) });
     }
     /** Host-only durable completion feed. Mutable delivery state never hides a completion. */
@@ -3701,7 +4022,7 @@ export class DeliveryStore {
                 || !Number.isSafeInteger(after.sequence) || after.sequence < 0 || after.sequence > watermark)) {
                 throw new DeliveryStoreError('invalid-binding', 'foreground source cursor is not bound to this owner and watermark');
             }
-            const rows = this.database.prepare(`SELECT * FROM delivery_foreground_executions
+            const rows = this.database.prepare(`SELECT *, CAST(termination_json AS BLOB) AS termination_bytes FROM delivery_foreground_executions
         WHERE principal_record_id = ? AND principal_version = ? AND workspace = ? AND preset = ?
           AND status != 'pending' AND completion_sequence > ? AND completion_sequence <= ?
         ORDER BY completion_sequence LIMIT ?`).all(input.expectedOwner.principalRecordId, input.expectedOwner.principalVersion, input.workspace, input.agentPreset, after?.sequence ?? 0, watermark, limit + 1);
@@ -3725,7 +4046,7 @@ export class DeliveryStore {
         }
         const inspect = () => {
             const fence = this.foregroundSourceFence(input, authority);
-            const row = this.database.prepare(`SELECT * FROM delivery_foreground_executions
+            const row = this.database.prepare(`SELECT *, CAST(termination_json AS BLOB) AS termination_bytes FROM delivery_foreground_executions
         WHERE inbox_id = ? AND status != 'pending'`).get(input.inboxId);
             return row === undefined ? undefined : this.foregroundSource(row, input, fence);
         };
@@ -3746,6 +4067,36 @@ export class DeliveryStore {
         // its owner check and snapshot without starting a nested BEGIN.
         return this.writerTransactionActive ? read() : this.transaction(read);
     }
+    /** Original canonical input for new Host-observed terminal executions; never a replay grant. */
+    readOwnerForegroundTaskInput(input, authority) {
+        this.assertOpen();
+        const offset = input.offset ?? 0, limit = input.maxBytes ?? 4096;
+        if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(limit) || limit < 4 || limit > 8192) {
+            throw new DeliveryStoreError('invalid-binding', 'foreground input byte page is invalid');
+        }
+        const read = () => {
+            const fence = this.foregroundSourceFence(input, authority);
+            const row = this.database.prepare(`SELECT *, CAST(termination_json AS BLOB) AS termination_bytes FROM delivery_foreground_executions
+        WHERE inbox_id = ? AND status != 'pending'`).get(input.inboxId);
+            const source = row === undefined ? undefined : this.foregroundSource(row, input, fence);
+            if (!source?.termination || source.sourceDigest !== input.expectedSourceDigest)
+                return undefined;
+            const bytes = Buffer.from(this.getInbox(source.inboxId).envelope.text, 'utf8');
+            if (offset > bytes.length || offset < bytes.length && (bytes[offset] & 0xc0) === 0x80) {
+                throw new DeliveryStoreError('invalid-binding', 'foreground input offset is not a UTF-8 boundary');
+            }
+            let end = Math.min(bytes.length, offset + limit);
+            while (end > offset && end < bytes.length && (bytes[end] & 0xc0) === 0x80)
+                end--;
+            const fullTextDigest = createHash('sha256').update(bytes).digest('hex');
+            const contentDigest = digest(acceptanceCanonicalJson({ protocol: 'assistant-delivery/owner-foreground-input/v1',
+                sourceDigest: source.sourceDigest, inputDigest: fullTextDigest }));
+            return Object.freeze({ source, sourceDigest: source.sourceDigest, contentDigest,
+                input: Object.freeze({ text: bytes.subarray(offset, end).toString('utf8'), fullTextDigest,
+                    fullBytes: bytes.length, returnedBytes: end - offset, offset, ...(end < bytes.length ? { nextOffset: end } : {}) }) });
+        };
+        return this.writerTransactionActive ? read() : this.transaction(read);
+    }
     /** Lock order: Delivery, then downstream Evaluation/Memory writer fences. */
     withOwnerForegroundTaskSourceFence(input, authority, callback) {
         if (typeof callback !== 'function')
@@ -3783,6 +4134,18 @@ export class DeliveryStore {
             return result;
         });
     }
+    /** Internal Host composition seam. Keeps one Delivery transaction across mixed source locks. */
+    withOwnerLearningSourceFence(input, authority, callback) {
+        this.assertOpen();
+        if (typeof callback !== 'function')
+            throw new DeliveryStoreError('invalid-binding', 'learning source callback is invalid');
+        return this.transaction(() => {
+            this.foregroundSourceFence(input, authority);
+            const result = callback();
+            this.assertForegroundSourceSyncResult(result);
+            return result;
+        });
+    }
     assertForegroundSourceSyncResult(result) {
         if (result !== null && (typeof result === 'object' || typeof result === 'function') && 'then' in result) {
             // The native method consumes a real rejected Promise without invoking an
@@ -3804,7 +4167,7 @@ export class DeliveryStore {
         });
     }
     foregroundSourceContent(input, fence, inputLimit, replyLimit) {
-        const row = this.database.prepare(`SELECT * FROM delivery_foreground_executions
+        const row = this.database.prepare(`SELECT *, CAST(termination_json AS BLOB) AS termination_bytes FROM delivery_foreground_executions
       WHERE inbox_id = ? AND status != 'pending'`).get(input.inboxId);
         const source = row === undefined ? undefined : this.foregroundSource(row, input, fence);
         if (!source || source.sourceDigest !== input.expectedSourceDigest || source.execution.status !== 'succeeded'
@@ -4206,6 +4569,7 @@ export class DeliveryStore {
                 text: input.text,
                 format: input.format ?? 'plain',
                 metadata: receiptMetadata,
+                ...(input.attachment === undefined ? {} : { attachment: input.attachment }),
             }, binding, this.maxTextBytes);
             if (winner !== undefined) {
                 if (winner.intentHash !== digest(JSON.stringify(expected))) {
@@ -4395,6 +4759,21 @@ export class DeliveryStore {
             .get(channel, account, providerMessageId);
         return row === undefined ? undefined : outboxFromRow(row);
     }
+    /**
+     * Exact provider-addressed lookup that refuses ambiguity. The schema's
+     * unique index already prevents duplicates; this is defense in depth for a
+     * reply binding that must never attach to the wrong message.
+     */
+    getUniqueOutboxByProviderMessage(channelInput, accountInput, providerMessageIdInput) {
+        this.assertOpen();
+        const channel = validateBindingText(channelInput, 'channel', 256);
+        const account = validateBindingText(accountInput, 'account', 256);
+        const providerMessageId = validateBindingText(providerMessageIdInput, 'providerMessageId', 512);
+        const rows = this.database.prepare(`${outboxSelect}
+      WHERE channel = ? AND account = ? AND provider_message_id = ? LIMIT 2`)
+            .all(channel, account, providerMessageId);
+        return rows.length === 1 ? outboxFromRow(rows[0]) : undefined;
+    }
     getApprovalIntent(operationId, bindingId) {
         this.assertOpen();
         const operation = validateBindingText(operationId, 'operationId', 256);
@@ -5075,32 +5454,50 @@ export class DeliveryStore {
         SELECT id, principal_json, role, status, linked_to_id, created_at, updated_at, version
         FROM delivery_principals WHERE id = ?
       `).get(id);
+            if (row.role === 'owner') {
+                // A link is bound to the owner's activation epoch. Revoking the owner
+                // detaches every still-active link rooted in it, so reactivating the
+                // same owner record (a new row version) never silently restores an
+                // alias: the owner must re-link. Detached principals stay active
+                // ordinary principals, exactly like a freshly paired, unlinked one.
+                this.database.prepare(`
+          UPDATE delivery_principals SET linked_to_id = NULL, updated_at = ?, version = version + 1
+          WHERE role = 'linked' AND status = 'active' AND linked_to_id = ?
+        `).run(now, id);
+            }
             return principalFromRow(row);
         });
     }
     linkPrincipal(input) {
         this.assertOpen();
-        const owner = this.getPrincipal(input.owner);
-        const linked = this.getPrincipal(input.linked);
-        if (owner?.status !== 'active' || owner.role !== 'owner') {
-            throw new DeliveryStoreError('unauthorized-principal', 'principal link requires an active owner');
-        }
-        if (linked?.status !== 'active' || linked.id === owner.id) {
-            throw new DeliveryStoreError('unauthorized-principal', 'linked principal must be a distinct active principal');
-        }
-        if (linked.version !== input.expectedLinkedVersion) {
-            throw new DeliveryStoreError('version-conflict', 'linked principal version changed');
-        }
-        if (linked.linkedToId === owner.id)
-            return linked;
         const now = this.now();
-        const changed = this.database.prepare(`
-      UPDATE delivery_principals SET role = 'linked', linked_to_id = ?, updated_at = ?, version = version + 1
-      WHERE id = ? AND version = ? AND status = 'active'
-    `).run(owner.id, now, linked.id, input.expectedLinkedVersion);
-        if (changed.changes !== 1)
-            throw new DeliveryStoreError('version-conflict', 'linked principal version changed');
-        return this.getPrincipal(input.linked);
+        // One writer transaction: a concurrent owner revoke (possibly from another
+        // process on the same database) must either detach this link or make the
+        // link fail, never leave a link rooted in a revoked owner that a later
+        // reactivation of the same record would silently restore.
+        return this.transaction(() => {
+            const owner = this.getPrincipal(input.owner);
+            const linked = this.getPrincipal(input.linked);
+            if (owner?.status !== 'active' || owner.role !== 'owner') {
+                throw new DeliveryStoreError('unauthorized-principal', 'principal link requires an active owner');
+            }
+            if (linked?.status !== 'active' || linked.id === owner.id) {
+                throw new DeliveryStoreError('unauthorized-principal', 'linked principal must be a distinct active principal');
+            }
+            if (linked.version !== input.expectedLinkedVersion) {
+                throw new DeliveryStoreError('version-conflict', 'linked principal version changed');
+            }
+            if (linked.linkedToId === owner.id)
+                return linked;
+            const changed = this.database.prepare(`
+        UPDATE delivery_principals SET role = 'linked', linked_to_id = ?, updated_at = ?, version = version + 1
+        WHERE id = ? AND version = ? AND status = 'active'
+          AND EXISTS (SELECT 1 FROM delivery_principals WHERE id = ? AND role = 'owner' AND status = 'active')
+      `).run(owner.id, now, linked.id, input.expectedLinkedVersion, owner.id);
+            if (changed.changes !== 1)
+                throw new DeliveryStoreError('version-conflict', 'linked principal version changed');
+            return this.getPrincipal(input.linked);
+        });
     }
     resolveInbox(input) {
         this.assertOpen();
@@ -5696,6 +6093,20 @@ export class DeliveryStore {
             return Object.freeze({ revision, ...(template === undefined ? {} : { template }), replayed: false });
         });
     }
+    /**
+     * Atomically admit one authenticated owner work-item result and the explicit
+     * continuation requested in the same reply. The result insert owns the single
+     * Inbox handoff; the continuation insert reuses that processed Inbox in the
+     * same transaction. A failure in either lane leaves neither row behind, so a
+     * provider retry can attempt both again instead of losing one silently.
+     */
+    admitOwnerWorkItemFeedbackWithReply(input) {
+        this.assertOpen();
+        return this.transaction(() => Object.freeze({
+            feedback: this.workItemFeedback.admitInTransaction(input.feedback, input.fence),
+            reply: this.workItemReplies.admitInTransaction(input.feedback.inboxId, input.binding, input.report, { handoff: false }),
+        }));
+    }
     getNaturalObjectiveIntent(inboxId) {
         this.assertOpen();
         const row = this.database.prepare('SELECT * FROM delivery_natural_objective_intents WHERE inbox_id = ?')
@@ -5770,7 +6181,7 @@ export class DeliveryStore {
                 || binding.conversation.kind !== 'dm' || owner?.status !== 'active' || owner.role !== 'owner'
                 || inbox?.status !== 'claimed' || inbox.bindingId !== binding.id || inbox.envelope.kind !== 'text'
                 || (inbox.envelope.attachments?.length ?? 0) !== 0
-                || parseNaturalObjectiveFeedback(inbox.envelope.text) !== input.selection
+                || parseNaturalOwnerReply(inbox.envelope.text)?.status !== input.selection
                 || !this.isVerifiedForegroundObjectiveTarget(binding, input.sourceInboxId, input.sourceOutboxId)
                 || source === undefined || outbox === undefined
                 || inbox.envelope.metadata?.replyToProviderMessageId !== outbox.providerMessageId
@@ -5904,7 +6315,7 @@ export class DeliveryStore {
             if (derived !== operationId)
                 continue;
             const envelope = JSON.parse(candidate.envelope_json);
-            if (envelope.kind !== 'text' || parseNaturalObjectiveFeedback(envelope.text) === undefined)
+            if (envelope.kind !== 'text' || parseNaturalOwnerReply(envelope.text) === undefined)
                 continue;
             return Object.freeze({ inboxId: candidate.inbox_id, text: envelope.text.slice(0, 4096), truncated: envelope.text.length > 4096 });
         }
@@ -5971,7 +6382,7 @@ export class DeliveryStore {
                 && naturalIntent.principalRecordId === owner.id && naturalIntent.principalVersion === owner.version
                 && naturalIntent.admissionEpoch === feedbackInbox.admissionCursor.epoch
                 && naturalIntent.admissionSequence === feedbackInbox.admissionCursor.sequence
-                && parseNaturalObjectiveFeedback(feedbackInbox.envelope.text) === naturalIntent.selection);
+                && parseNaturalOwnerReply(feedbackInbox.envelope.text)?.status === naturalIntent.selection);
             if ((feedbackInbox?.status !== 'claimed' && !(naturalIntent !== undefined
                 && (feedbackInbox?.status === 'processed' || feedbackInbox?.status === 'dead_letter')))
                 || feedbackInbox?.bindingId !== binding.id || !naturalMatches