@fedify/fedify 2.5.0-dev.2609 → 2.5.0-dev.2614

package/dist/{federation-DzMdu4zU.cjs → federation-DRl81KbJ.cjs}

@@ -1,15 +1,15 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-BdTJujR0.cjs");
+const require_http = require("./http-DHSIMipE.cjs");
 const require_types = require("./types-hKCCjii0.cjs");
-const require_portable_collection = require("./portable-collection-Ci6vIhbR.cjs");
-const require_kv_cache = require("./kv-cache-B0o18_Ni.cjs");
+const require_portable_collection = require("./portable-collection-CmLjeKsP.cjs");
+const require_kv_cache = require("./kv-cache-CHR_BVyM.cjs");
 let _logtape_logtape = require("@logtape/logtape");
+let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
-let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _fedify_vocab_runtime_internal_portable_dereference = require("@fedify/vocab-runtime/internal/portable-dereference");
 let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
@@ -23,6 +23,500 @@ let _fedify_webfinger = require("@fedify/webfinger");
 let _opentelemetry_sdk_metrics = require("@opentelemetry/sdk-metrics");
 let devalue = require("devalue");
 let node_url = require("node:url");
+//#region src/federation/outbound-document.ts
+const asContext = "https://www.w3.org/ns/activitystreams";
+const asNamespace = `${asContext}#`;
+const blind = /* @__PURE__ */ new Set([
+	"bto",
+	"bcc",
+	"as:bto",
+	"as:bcc",
+	`${asNamespace}bto`,
+	`${asNamespace}bcc`
+]);
+const contextCandidates = [
+	asContext,
+	"https://w3id.org/security/v1",
+	"https://w3id.org/identity/v1",
+	"https://gotosocial.org/ns",
+	"https://w3id.org/security/data-integrity/v1",
+	"https://w3id.org/security/data-integrity/v2"
+];
+function safeContext(context) {
+	if (Array.isArray(context)) return context.every(safeContext);
+	if (context == null || typeof context !== "object") return false;
+	for (const [name, definition] of Object.entries(context)) {
+		if (name === "@import") return false;
+		const mapping = typeof definition === "string" ? definition : definition != null && typeof definition === "object" ? definition["@id"] : void 0;
+		if (name === "as" && mapping !== asNamespace) return false;
+		if (name !== "as" && typeof mapping === "string" && mapping.startsWith(asNamespace) && (mapping.endsWith("#") || mapping.endsWith("/") || typeof definition === "object" && definition["@prefix"] === true)) return false;
+		if (typeof mapping === "string" && blind.has(mapping) && name !== "bto" && name !== "bcc") return false;
+		if ((name === "bto" || name === "bcc") && mapping !== `as:${name}` && mapping !== `${asNamespace}${name}`) return false;
+		if (name === "@vocab" && typeof mapping === "string" && mapping.startsWith(asNamespace)) return false;
+		if (definition != null && typeof definition === "object" && "@context" in definition && !safeContext(definition["@context"])) return false;
+	}
+	return true;
+}
+const contexts = new Set(contextCandidates.filter((url) => {
+	const document = _fedify_vocab_runtime.preloadedContexts[url];
+	return document != null && typeof document === "object" && safeContext(document["@context"]);
+}));
+const generatedTerms = {
+	toot: "http://joinmastodon.org/ns#",
+	misskey: "https://misskey-hub.net/ns#",
+	fedibird: "http://fedibird.com/ns#",
+	sensitive: "as:sensitive",
+	votersCount: {
+		"@id": "toot:votersCount",
+		"@type": "http://www.w3.org/2001/XMLSchema#nonNegativeInteger"
+	},
+	Emoji: "toot:Emoji",
+	Hashtag: "as:Hashtag",
+	ChatMessage: "http://litepub.social/ns#ChatMessage",
+	quote: {
+		"@id": "https://w3id.org/fep/044f#quote",
+		"@type": "@id"
+	},
+	quoteUrl: "as:quoteUrl",
+	_misskey_quote: "misskey:_misskey_quote",
+	quoteUri: "fedibird:quoteUri",
+	QuoteAuthorization: "https://w3id.org/fep/044f#QuoteAuthorization",
+	QuoteRequest: "https://w3id.org/fep/044f#QuoteRequest",
+	quoteAuthorization: {
+		"@id": "https://w3id.org/fep/044f#quoteAuthorization",
+		"@type": "@id"
+	},
+	emojiReactions: {
+		"@id": "fedibird:emojiReactions",
+		"@type": "@id"
+	}
+};
+function sameDefinition(value, expected) {
+	if (value === expected) return true;
+	if (value == null || expected == null || typeof value !== "object" || typeof expected !== "object" || Array.isArray(value)) return false;
+	const actual = value;
+	const reference = expected;
+	return Object.keys(actual).length === Object.keys(reference).length && Object.keys(actual).every((name) => Object.hasOwn(reference, name) && sameDefinition(actual[name], reference[name]));
+}
+function generatedContext(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.entries(value).every(([name, definition]) => Object.hasOwn(generatedTerms, name) && sameDefinition(definition, generatedTerms[name]));
+}
+const keywords = /* @__PURE__ */ new Set([
+	"@id",
+	"@type",
+	"@value",
+	"@language",
+	"@direction",
+	"@index",
+	"@list",
+	"@set",
+	"@graph",
+	"@reverse",
+	"@included",
+	"@nest"
+]);
+/** Validate the explicit opt-in before replacing observer registration. */
+function snapshotSenderPayloadOption(value) {
+	if (value === void 0) return false;
+	if (typeof value !== "boolean") throw new TypeError("Outbound senderPayload must be a boolean.");
+	return value;
+}
+/** Project existing plain JSON only; no getters, JSON-LD processing or serializers. */
+function projectSenderPayload(input) {
+	try {
+		let compact = false;
+		let redacted = false;
+		const seen = /* @__PURE__ */ new WeakSet();
+		const copy = (value, depth, contextData = false) => {
+			if (depth >= 64) throw new TypeError("Unsafe document depth.");
+			if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+			if (typeof value === "number" && Number.isFinite(value)) return value;
+			if (typeof value !== "object" || value == null || seen.has(value)) throw new TypeError("Not independent JSON data.");
+			const array = Array.isArray(value);
+			const prototype = Object.getPrototypeOf(value);
+			if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) throw new TypeError("Unsupported document object.");
+			seen.add(value);
+			try {
+				const descriptors = Object.getOwnPropertyDescriptors(value);
+				if (Object.hasOwn(descriptors, "toJSON")) throw new TypeError("Custom JSON conversion is not projected.");
+				const names = Reflect.ownKeys(descriptors).filter((name) => descriptors[name].enumerable);
+				if (names.some((name) => typeof name !== "string" || !("value" in descriptors[name]))) throw new TypeError("Not plain JSON properties.");
+				let contextValue;
+				if (!contextData && !array && descriptors["@context"]?.enumerable) {
+					const context = copy(descriptors["@context"].value, depth + 1, true);
+					contextValue = context;
+					const urls = typeof context === "string" ? [context] : context;
+					if (!Array.isArray(urls) || urls.length === 0 || (depth === 0 ? !urls.includes(asContext) : !compact) || !urls.every((url) => typeof url === "string" ? contexts.has(url) : depth === 0 && generatedContext(url))) throw new TypeError("Unsupported document context.");
+					compact = true;
+				}
+				if (array) {
+					const length = descriptors.length.value;
+					if (names.length !== length || names.some((name, index) => name !== String(index))) throw new TypeError("Not a JSON array.");
+					return Object.freeze(names.map((name) => copy(descriptors[name].value, depth + 1, contextData)));
+				}
+				const result = Object.create(null);
+				for (const name of names) {
+					if (contextData) {
+						result[name] = copy(descriptors[name].value, depth + 1, true);
+						continue;
+					}
+					if (name === "@context") {
+						if (contextValue === void 0 || !compact) throw new TypeError("Scoped context not supported.");
+						result[name] = contextValue;
+						continue;
+					}
+					if (!compact && !keywords.has(name) && !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(name)) throw new TypeError("Unresolved document property.");
+					const next = copy(descriptors[name].value, depth + 1);
+					if (blind.has(name)) {
+						redacted = true;
+						continue;
+					}
+					result[name] = next;
+				}
+				return Object.freeze(result);
+			} finally {
+				seen.delete(value);
+			}
+		};
+		if (input == null || typeof input !== "object") throw new TypeError("Not an outgoing document.");
+		const value = copy(input, 0);
+		return Object.freeze({
+			stage: "sender-payload",
+			type: "available",
+			representation: "privacy-projection",
+			redacted,
+			value
+		});
+	} catch {
+		return Object.freeze({
+			stage: "sender-payload",
+			type: "unavailable",
+			reason: "privacy-filter-unavailable"
+		});
+	}
+}
+//#endregion
+//#region src/federation/outbound-body.ts
+/** One pull-driven response reader with an absolute lifetime and no extra queue. */
+var ResponseBodyPump = class {
+	#reader;
+	#expiresAt;
+	#deadline;
+	#timer;
+	#expireDeadline;
+	#pending;
+	#timedOut = false;
+	#closed = false;
+	#ended = false;
+	constructor(body, timeoutMs) {
+		this.#reader = body.getReader();
+		this.#expiresAt = performance.now() + timeoutMs;
+		this.#deadline = new Promise((resolve) => {
+			this.#expireDeadline = () => resolve(void 0);
+		});
+		this.#timer = setTimeout(() => this.#expire(), timeoutMs);
+	}
+	/** Undefined means the absolute lifetime expired, independently of EOF. */
+	read() {
+		if (this.#closed) return Promise.resolve(this.#timedOut ? void 0 : {
+			done: true,
+			value: void 0
+		});
+		if (performance.now() >= this.#expiresAt) {
+			this.#expire();
+			return Promise.resolve(void 0);
+		}
+		this.#pending ??= Promise.race([this.#reader.read(), this.#deadline]).then((result) => {
+			this.#pending = void 0;
+			if (this.#timedOut || performance.now() >= this.#expiresAt) {
+				this.#expire();
+				return;
+			}
+			if (this.#closed) return {
+				done: true,
+				value: void 0
+			};
+			if (result?.done) {
+				this.#ended = true;
+				this.close();
+			}
+			return result;
+		}, (error) => {
+			this.#pending = void 0;
+			this.close();
+			throw error;
+		});
+		return this.#pending;
+	}
+	/** Shorten the remaining lifetime when ownership passes to diagnostic cleanup. */
+	limitLifetime(timeoutMs) {
+		if (this.#closed) return;
+		this.#expiresAt = Math.min(this.#expiresAt, performance.now() + Math.max(0, timeoutMs));
+		clearTimeout(this.#timer);
+		if (performance.now() >= this.#expiresAt) this.#expire();
+		else this.#timer = setTimeout(() => this.#expire(), this.#expiresAt - performance.now());
+	}
+	/** Stop pulling and release ownership without awaiting arbitrary cancellation. */
+	close() {
+		if (this.#closed) return;
+		this.#closed = true;
+		clearTimeout(this.#timer);
+		try {
+			if (!this.#ended) this.#reader.cancel().catch(() => {});
+		} finally {
+			this.#reader.releaseLock();
+		}
+	}
+	#expire() {
+		if (this.#timedOut) return;
+		this.#timedOut = true;
+		this.#expireDeadline();
+		this.close();
+	}
+};
+//#endregion
+//#region src/federation/outbound-capture.ts
+const diagnosticTimeoutMs = 1e3;
+const diagnosticMaxBytes = 1024;
+const diagnostics = /* @__PURE__ */ new WeakMap();
+/** Reuse a selected capture's diagnostic preview instead of acquiring a second reader. */
+function takeCapturedDiagnostic(response) {
+	const value = diagnostics.get(response);
+	diagnostics.delete(response);
+	return value;
+}
+/** Validate and copy before replacing the current observer registration. */
+function snapshotBodyCapture(value) {
+	if (value === void 0) return void 0;
+	if (value == null || typeof value !== "object" || typeof value.onBody !== "function") throw new TypeError("Response body capture requires an onBody callback.");
+	const { maxBytes, timeoutMs, responses = "all", onBody } = value;
+	if (typeof maxBytes !== "number" || typeof timeoutMs !== "number") throw new TypeError("Response body capture requires numeric maxBytes and timeoutMs.");
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("Response body capture maxBytes must be a positive safe integer.");
+	if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || Math.ceil(timeoutMs) > 2147483647) throw new RangeError("Response body capture timeoutMs is outside the timer range.");
+	if (responses !== "all" && responses !== "non-success-http-responses") throw new TypeError("Invalid response body capture selector.");
+	return Object.freeze({
+		maxBytes,
+		timeoutMs: Math.ceil(timeoutMs),
+		responses,
+		onBody
+	});
+}
+/** One source reader feeds both the revocable application view and bounded diagnostics. */
+async function captureResponseBody(response, options, onBody) {
+	if (options.responses === "non-success-http-responses" && response.ok) return Object.freeze({
+		type: "filtered",
+		bytesExposed: 0
+	});
+	if (response.body == null) return Object.freeze({
+		type: "no-body",
+		bytesExposed: 0
+	});
+	const start = performance.now();
+	const expires = start + options.timeoutMs;
+	let pump;
+	try {
+		pump = new ResponseBodyPump(response.body, Math.max(options.timeoutMs, response.ok ? 0 : diagnosticTimeoutMs));
+	} catch (error) {
+		return Object.freeze({
+			type: "failed",
+			phase: "body",
+			error,
+			bytesExposed: 0
+		});
+	}
+	const signal = new AbortController();
+	let controller;
+	let active = true;
+	let bytesExposed = 0;
+	let result;
+	let eof = false;
+	let diagnosticBytes = 0;
+	let diagnosticTruncated = false;
+	let diagnosticFailed = false;
+	const preview = [];
+	const decoder = new TextDecoder();
+	let pending;
+	const read = () => pending ??= pump.read().then((value) => {
+		pending = void 0;
+		if (value?.done) eof = true;
+		if (!response.ok && value != null && !value.done && performance.now() - start < diagnosticTimeoutMs) {
+			const remaining = diagnosticMaxBytes - diagnosticBytes;
+			const chunk = value.value;
+			if (chunk.length > remaining) diagnosticTruncated = true;
+			if (remaining > 0 && chunk.length > 0) {
+				const selected = chunk.subarray(0, remaining);
+				preview.push(decoder.decode(selected, { stream: true }));
+				diagnosticBytes += selected.length;
+			}
+		}
+		return value;
+	}, (error) => {
+		pending = void 0;
+		diagnosticFailed = true;
+		throw error;
+	});
+	const revoke = (reason) => {
+		active = false;
+		if (!signal.signal.aborted) signal.abort(reason);
+		try {
+			controller.error(reason);
+		} catch {}
+	};
+	const body = new ReadableStream({
+		start(value) {
+			controller = value;
+		},
+		async pull() {
+			try {
+				while (active) {
+					if (performance.now() >= expires) {
+						result = { type: "deadline" };
+						revoke(new DOMException("Response body capture deadline exceeded.", "TimeoutError"));
+						return;
+					}
+					const value = await read();
+					if (!active) return;
+					if (performance.now() >= expires || value == null) {
+						result = { type: "deadline" };
+						revoke(new DOMException("Response body capture deadline exceeded.", "TimeoutError"));
+						return;
+					}
+					if (value.done) {
+						result = { type: "complete" };
+						active = false;
+						controller.close();
+						return;
+					}
+					if (value.value.length === 0) continue;
+					const chunk = value.value.slice(0, options.maxBytes - bytesExposed);
+					bytesExposed += chunk.length;
+					controller.enqueue(chunk);
+					if (bytesExposed === options.maxBytes) {
+						result = { type: "limit-reached" };
+						revoke(new DOMException("Response body capture byte limit reached.", "QuotaExceededError"));
+					}
+					return;
+				}
+			} catch (error) {
+				if (active) {
+					result = {
+						type: "failed",
+						phase: "body",
+						error
+					};
+					revoke(error);
+				}
+			}
+		},
+		cancel(reason) {
+			result = {
+				type: "consumer-stopped",
+				reason
+			};
+			revoke(reason);
+		}
+	}, { highWaterMark: 0 });
+	let timer;
+	const deadline = new Promise((resolve) => {
+		timer = setTimeout(() => {
+			result = { type: "deadline" };
+			revoke(new DOMException("Response body capture deadline exceeded.", "TimeoutError"));
+			resolve();
+		}, Math.max(0, expires - performance.now()));
+	});
+	const callback = Promise.resolve().then(() => onBody(body, signal.signal)).then(() => {}, (error) => {
+		if (result == null || result.type === "complete") result = {
+			type: "failed",
+			phase: "observer",
+			error
+		};
+	});
+	try {
+		await Promise.race([callback, deadline]);
+		clearTimeout(timer);
+		if (performance.now() >= expires) result = { type: "deadline" };
+		result ??= { type: "callback-returned" };
+		revoke(new DOMException("Response body capture finished.", "AbortError"));
+		if (!response.ok) {
+			pump.limitLifetime(diagnosticTimeoutMs - (performance.now() - start));
+			try {
+				while (!eof && !diagnosticTruncated && performance.now() - start < diagnosticTimeoutMs) if (await read() == null) break;
+			} catch {}
+			diagnostics.set(response, preview.join("") + (diagnosticTruncated ? "… (truncated)" : !eof && !diagnosticFailed ? "… (timed out)" : ""));
+		}
+		return Object.freeze({
+			...result,
+			bytesExposed
+		});
+	} finally {
+		clearTimeout(timer);
+		pump.close();
+	}
+}
+//#endregion
+//#region src/federation/outbound-headers.ts
+const protectedHeaders = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"set-cookie",
+	"signature",
+	"signature-input",
+	"authentication-info",
+	"proxy-authentication-info",
+	"x-api-key",
+	"x-auth-token"
+]);
+function snapshotNames(names) {
+	if (!Array.isArray(names)) throw new TypeError("Outbound header names must be an array.");
+	const normalized = /* @__PURE__ */ new Set();
+	for (const name of names) {
+		if (typeof name !== "string" || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name) || name.includes("*")) throw new TypeError("Outbound header names must be literal HTTP tokens.");
+		normalized.add(name.toLowerCase());
+	}
+	return Object.freeze([...normalized].sort());
+}
+/** Validate/copy policy before registration replaces the selected observers. */
+function snapshotHeaderPolicy(policy) {
+	if (policy === void 0) return void 0;
+	if (policy == null || typeof policy !== "object") throw new TypeError("Outbound header policy must be an object.");
+	const { allow, redact, maxBytes } = policy;
+	if (typeof maxBytes !== "number") throw new TypeError("Outbound header maxBytes must be a number.");
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("Outbound header maxBytes must be a positive safe integer.");
+	return Object.freeze({
+		allow: snapshotNames(allow),
+		...redact === void 0 ? {} : { redact: snapshotNames(redact) },
+		maxBytes
+	});
+}
+/** Copy only selected/redacted entries; budgets never truncate a header value. */
+function snapshotHeaders(headers, policy) {
+	const redact = /* @__PURE__ */ new Set([...protectedHeaders, ...policy.redact ?? []]);
+	const entries = [];
+	const encoder = new TextEncoder();
+	let bytes = 0;
+	let limitReached = false;
+	for (const name of policy.allow) {
+		if (!headers.has(name)) continue;
+		for (const [key, rawValue] of headers) {
+			if (key !== name) continue;
+			const value = redact.has(name) ? "[redacted]" : rawValue;
+			const size = encoder.encode(`${name}: ${value}\r\n`).byteLength;
+			if (size > policy.maxBytes - bytes) {
+				limitReached = true;
+				continue;
+			}
+			entries.push(Object.freeze([name, value]));
+			bytes += size;
+		}
+	}
+	return Object.freeze({
+		entries: Object.freeze(entries),
+		limitReached
+	});
+}
+//#endregion
 //#region src/federation/activity-listener.ts
 var ActivityListenerSet = class {
 	#listeners;
@@ -108,6 +602,7 @@ var FederationBuilderImpl = class {
 	inboxListeners;
 	outboxListeners;
 	inboxRequestFinishedHandler;
+	outboundObservers = globalThis.Object.freeze({});
 	inboxErrorHandler;
 	outboxListenerErrorHandler;
 	outboxAuthorizePredicate;
@@ -170,6 +665,7 @@ var FederationBuilderImpl = class {
 		f.inboxListeners = this.inboxListeners?.clone();
 		f.outboxListeners = this.outboxListeners?.clone();
 		f.inboxRequestFinishedHandler = this.inboxRequestFinishedHandler;
+		f.setOutboundObservers(this.outboundObservers);
 		f.inboxErrorHandler = this.inboxErrorHandler;
 		f.outboxListenerErrorHandler = this.outboxListenerErrorHandler;
 		f.outboxAuthorizePredicate = this.outboxAuthorizePredicate;
@@ -317,6 +813,19 @@ var FederationBuilderImpl = class {
 		};
 		return setters;
 	}
+	setOutboundObservers(observers) {
+		this.outboundObservers = globalThis.Object.freeze({
+			senderPayload: snapshotSenderPayloadOption(observers.senderPayload),
+			responseBodyCapture: snapshotBodyCapture(observers.responseBodyCapture),
+			requestHeaders: snapshotHeaderPolicy(observers.requestHeaders),
+			responseHeaders: snapshotHeaderPolicy(observers.responseHeaders),
+			onBroadcast: observers.onBroadcast,
+			onDelivery: observers.onDelivery,
+			onAttempt: observers.onAttempt,
+			onHttpExchange: observers.onHttpExchange,
+			onWorker: observers.onWorker
+		});
+	}
 	setNodeInfoDispatcher(path, dispatcher) {
 		if (this.router.has("nodeInfo")) throw new _fedify_uri_template.RouterError("NodeInfo dispatcher already set.");
 		if (_fedify_uri_template.Router.variables(path).size !== 0) throw new _fedify_uri_template.RouterError("Path for NodeInfo dispatcher must have no variables.");
@@ -882,13 +1391,13 @@ function warnCompatibleActorId(actorId, gateway) {
 }
 //#endregion
 //#region src/federation/circuit-breaker.ts
-const Temporal$11 = require_http.Temporal;
+const Temporal$12 = require_http.Temporal;
 const LEGACY_SWEEP_MARKER = ["__fedify_meta", "circuit_breaker_state_ttl_sweep_v2"];
 const LEGACY_SWEEP_DELETING_MARKER = { __fedifyDeletingCircuitBreakerLegacyState: true };
 const CIRCUIT_BREAKER_STATE_VERSION = 1;
-const LEGACY_SWEEP_LOCK_TTL = Temporal$11.Duration.from({ minutes: 5 });
-const LEGACY_SWEEP_RENEW_INTERVAL = Temporal$11.Duration.from({ minutes: 1 });
-const LEGACY_SWEEP_RETRY_WINDOW = Temporal$11.Duration.from({ hours: 168 });
+const LEGACY_SWEEP_LOCK_TTL = Temporal$12.Duration.from({ minutes: 5 });
+const LEGACY_SWEEP_RENEW_INTERVAL = Temporal$12.Duration.from({ minutes: 1 });
+const LEGACY_SWEEP_RETRY_WINDOW = Temporal$12.Duration.from({ hours: 168 });
 const LEGACY_SWEEP_WAIT_INTERVAL = 10;
 const LEGACY_SWEEP_CAS_ATTEMPTS = 3;
 /**
@@ -907,7 +1416,7 @@ var CircuitBreaker = class {
 		this.#kv = options.kv;
 		this.#prefix = options.prefix;
 		this.#options = normalizeCircuitBreakerOptions(options.options ?? {});
-		this.#now = options.now ?? (() => Temporal$11.Now.instant());
+		this.#now = options.now ?? (() => Temporal$12.Now.instant());
 		this.#stateChangeObserver = options.stateChangeObserver;
 	}
 	get options() {
@@ -921,7 +1430,7 @@ var CircuitBreaker = class {
 		this.#sweepLegacyStates();
 		const heldSince = parseHeldSince(message.circuitHeldSince);
 		const now = this.#now();
-		if (heldSince != null && Temporal$11.Instant.compare(heldSince.add(this.#options.heldActivityTtl), now) <= 0) return {
+		if (heldSince != null && Temporal$12.Instant.compare(heldSince.add(this.#options.heldActivityTtl), now) <= 0) return {
 			type: "drop",
 			heldSince
 		};
@@ -933,12 +1442,12 @@ var CircuitBreaker = class {
 				probe: false
 			};
 			if (oldState.state === "half-open") {
-				const halfOpened = oldState.halfOpened == null ? void 0 : Temporal$11.Instant.from(oldState.halfOpened);
+				const halfOpened = oldState.halfOpened == null ? void 0 : Temporal$12.Instant.from(oldState.halfOpened);
 				if (halfOpened != null) {
 					const staleAt = halfOpened.add(this.#options.recoveryDelay);
-					if (Temporal$11.Instant.compare(now, staleAt) < 0) {
+					if (Temporal$12.Instant.compare(now, staleAt) < 0) {
 						const releaseAt = now.add(this.#options.releaseInterval);
-						const retryAt = Temporal$11.Instant.compare(releaseAt, staleAt) < 0 ? releaseAt : staleAt;
+						const retryAt = Temporal$12.Instant.compare(releaseAt, staleAt) < 0 ? releaseAt : staleAt;
 						const cappedRetryAt = this.#capHeldRetryAt(now, heldSince, retryAt);
 						return {
 							type: "hold",
@@ -960,8 +1469,8 @@ var CircuitBreaker = class {
 				lastConflictingState = "half-open";
 				continue;
 			}
-			const probeAt = (oldState.opened == null ? now : Temporal$11.Instant.from(oldState.opened)).add(this.#options.recoveryDelay);
-			if (Temporal$11.Instant.compare(now, probeAt) < 0) {
+			const probeAt = (oldState.opened == null ? now : Temporal$12.Instant.from(oldState.opened)).add(this.#options.recoveryDelay);
+			if (Temporal$12.Instant.compare(now, probeAt) < 0) {
 				const retryAt = this.#capHeldRetryAt(now, heldSince, probeAt);
 				return {
 					type: "hold",
@@ -1026,7 +1535,7 @@ var CircuitBreaker = class {
 		for (let attempt = 0; attempt < 10; attempt++) {
 			const { state: oldState, raw: oldValue } = await this.#get(remoteHost);
 			if (oldState?.state === "open") return void 0;
-			const oldFailures = oldState?.failures.map(Temporal$11.Instant.from) ?? [];
+			const oldFailures = oldState?.failures.map(Temporal$12.Instant.from) ?? [];
 			const failures = this.#options.pruneFailures([...oldFailures, now], now);
 			let newState;
 			let transition;
@@ -1110,7 +1619,7 @@ var CircuitBreaker = class {
 			for await (const { key, value } of this.#kv.list(this.#prefix)) {
 				if (key.length !== this.#prefix.length + 1) continue;
 				await this.#migrateLegacyState(key, value);
-				if (Temporal$11.Instant.compare(this.#now(), leaseRenewedAt.add(LEGACY_SWEEP_RENEW_INTERVAL)) >= 0) {
+				if (Temporal$12.Instant.compare(this.#now(), leaseRenewedAt.add(LEGACY_SWEEP_RENEW_INTERVAL)) >= 0) {
 					const renewed = await this.#renewLegacySweep(markerKey, marker);
 					if (renewed == null) return;
 					marker = renewed;
@@ -1134,7 +1643,7 @@ var CircuitBreaker = class {
 	}
 	#finishLegacySweepMarker(marker) {
 		const retryUntil = getLegacySweepRetryUntil(marker);
-		if (retryUntil != null && Temporal$11.Instant.compare(this.#now(), Temporal$11.Instant.from(retryUntil)) < 0) return {
+		if (retryUntil != null && Temporal$12.Instant.compare(this.#now(), Temporal$12.Instant.from(retryUntil)) < 0) return {
 			state: "done",
 			retryUntil
 		};
@@ -1177,7 +1686,7 @@ var CircuitBreaker = class {
 	#isLegacySweepDone() {
 		if (this.#legacySweepDone === "final") return true;
 		if (this.#legacySweepDone == null) return false;
-		if (Temporal$11.Instant.compare(this.#now(), this.#legacySweepDone) < 0) return true;
+		if (Temporal$12.Instant.compare(this.#now(), this.#legacySweepDone) < 0) return true;
 		this.#legacySweepDone = void 0;
 		return false;
 	}
@@ -1187,7 +1696,7 @@ var CircuitBreaker = class {
 	}
 	#capHeldRetryAt(now, heldSince, retryAt) {
 		const expiresAt = (heldSince ?? now).add(this.#options.heldActivityTtl);
-		return Temporal$11.Instant.compare(expiresAt, retryAt) < 0 ? expiresAt : retryAt;
+		return Temporal$12.Instant.compare(expiresAt, retryAt) < 0 ? expiresAt : retryAt;
 	}
 	async #get(remoteHost) {
 		const value = await this.#kv.get(this.#key(remoteHost));
@@ -1262,7 +1771,7 @@ function normalizeCircuitBreakerOptions(options) {
 	assertPositiveDuration(releaseInterval, "releaseInterval");
 	if (configuredStateTtl != null) {
 		assertPositiveDuration(configuredStateTtl, "stateTtl");
-		if (Temporal$11.Duration.compare(configuredStateTtl, recoveryDelay) < 0) throw new RangeError("stateTtl must be at least recoveryDelay.");
+		if (Temporal$12.Duration.compare(configuredStateTtl, recoveryDelay) < 0) throw new RangeError("stateTtl must be at least recoveryDelay.");
 	}
 	let failure;
 	let pruneFailures;
@@ -1274,13 +1783,13 @@ function normalizeCircuitBreakerOptions(options) {
 		assertPositiveDuration(failureWindow, "failureWindow");
 		pruneFailures = (timestamps, now) => {
 			const earliest = now.subtract(failureWindow);
-			return timestamps.filter((timestamp) => Temporal$11.Instant.compare(timestamp, earliest) >= 0).slice(-failureThreshold);
+			return timestamps.filter((timestamp) => Temporal$12.Instant.compare(timestamp, earliest) >= 0).slice(-failureThreshold);
 		};
 		failure = (timestamps) => {
 			if (timestamps.length < failureThreshold) return false;
 			const first = timestamps[timestamps.length - failureThreshold];
 			const last = timestamps[timestamps.length - 1];
-			return Temporal$11.Duration.compare(first.until(last), failureWindow) <= 0;
+			return Temporal$12.Duration.compare(first.until(last), failureWindow) <= 0;
 		};
 		stateTtl = configuredStateTtl ?? maxDuration(recoveryDelay.add(failureWindow), recoveryDelay.add(heldActivityTtl));
 	} else {
@@ -1300,7 +1809,7 @@ function normalizeCircuitBreakerOptions(options) {
 	};
 }
 function maxDuration(duration, ...durations) {
-	return durations.reduce((max, candidate) => Temporal$11.Duration.compare(candidate, max) > 0 ? candidate : max, duration);
+	return durations.reduce((max, candidate) => Temporal$12.Duration.compare(candidate, max) > 0 ? candidate : max, duration);
 }
 function isLegacySweepDone(value, now) {
 	return getLegacySweepDoneUntil(value, now) != null;
@@ -1309,8 +1818,8 @@ function getLegacySweepDoneUntil(value, now) {
 	if (typeof value !== "object" || value == null || !("state" in value)) return;
 	if (value.state === "final") return "final";
 	if (value.state === "done" && "retryUntil" in value && typeof value.retryUntil === "string") try {
-		const retryUntil = Temporal$11.Instant.from(value.retryUntil);
-		return Temporal$11.Instant.compare(now, retryUntil) < 0 ? retryUntil : void 0;
+		const retryUntil = Temporal$12.Instant.from(value.retryUntil);
+		return Temporal$12.Instant.compare(now, retryUntil) < 0 ? retryUntil : void 0;
 	} catch {
 		return;
 	}
@@ -1318,7 +1827,7 @@ function getLegacySweepDoneUntil(value, now) {
 function isLegacySweepRetryDue(value, now) {
 	if (typeof value !== "object" || value == null || !("state" in value) || value.state !== "done" || !("retryUntil" in value) || typeof value.retryUntil !== "string") return false;
 	try {
-		return Temporal$11.Instant.compare(now, Temporal$11.Instant.from(value.retryUntil)) >= 0;
+		return Temporal$12.Instant.compare(now, Temporal$12.Instant.from(value.retryUntil)) >= 0;
 	} catch {
 		return false;
 	}
@@ -1329,7 +1838,7 @@ function isLegacySweepActive(value, now) {
 function isLegacySweepInProgress(value, now) {
 	if (typeof value !== "object" || value == null || !("state" in value) || value.state !== "sweeping" || !("started" in value) || typeof value.started !== "string") return false;
 	try {
-		return Temporal$11.Instant.compare(now, Temporal$11.Instant.from(value.started).add(LEGACY_SWEEP_LOCK_TTL)) < 0;
+		return Temporal$12.Instant.compare(now, Temporal$12.Instant.from(value.started).add(LEGACY_SWEEP_LOCK_TTL)) < 0;
 	} catch {
 		return false;
 	}
@@ -1337,7 +1846,7 @@ function isLegacySweepInProgress(value, now) {
 function getLegacySweepRetryUntil(value) {
 	if (typeof value !== "object" || value == null || !("retryUntil" in value) || typeof value.retryUntil !== "string") return;
 	try {
-		Temporal$11.Instant.from(value.retryUntil);
+		Temporal$12.Instant.from(value.retryUntil);
 		return value.retryUntil;
 	} catch {
 		return;
@@ -1361,19 +1870,19 @@ function delay(milliseconds) {
 	return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 function toInstantDuration(duration) {
-	const parsed = Temporal$11.Duration.from(duration);
-	return Temporal$11.Duration.from({ milliseconds: Math.trunc(parsed.total({
+	const parsed = Temporal$12.Duration.from(duration);
+	return Temporal$12.Duration.from({ milliseconds: Math.trunc(parsed.total({
 		unit: "millisecond",
-		relativeTo: Temporal$11.PlainDateTime.from("2026-01-01T00:00:00")
+		relativeTo: Temporal$12.PlainDateTime.from("2026-01-01T00:00:00")
 	})) });
 }
 function assertPositiveDuration(duration, name) {
-	if (Temporal$11.Duration.compare(duration, { seconds: 0 }) <= 0) throw new RangeError(`${name} must be a positive duration.`);
+	if (Temporal$12.Duration.compare(duration, { seconds: 0 }) <= 0) throw new RangeError(`${name} must be a positive duration.`);
 }
 function parseHeldSince(value) {
 	if (value == null) return void 0;
 	try {
-		return Temporal$11.Instant.from(value);
+		return Temporal$12.Instant.from(value);
 	} catch (error) {
 		(0, _logtape_logtape.getLogger)([
 			"fedify",
@@ -1400,7 +1909,7 @@ function parseStoredCircuitBreakerKvState(value) {
 	const isInstantString = (v) => {
 		if (typeof v !== "string") return false;
 		try {
-			Temporal$11.Instant.from(v);
+			Temporal$12.Instant.from(v);
 			return true;
 		} catch {
 			return false;
@@ -1464,6 +1973,7 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 /** Internal state owned by the ingress boundary, never serialized into queues. */
 var InboxObservation = class {
 	inbox;
+	source;
 	payload = { status: "unavailable" };
 	activity = null;
 	authentication = { status: "notDetermined" };
@@ -1486,8 +1996,9 @@ var InboxObservation = class {
 			}
 		}
 	};
-	constructor(inbox) {
+	constructor(inbox, source = void 0) {
 		this.inbox = inbox;
+		this.source = source;
 	}
 	/** Run an ingress operation and project telemetry; fetch owns completion. */
 	async run(operation, span) {
@@ -1543,7 +2054,18 @@ var InboxObservation = class {
 	}
 	async finish(context, handler, outcome) {
 		if (handler == null) return;
+		const signal = context.request.signal;
+		const requestCancellation = signal.aborted ? Object.freeze({
+			type: "aborted",
+			reason: signal.reason
+		}) : Object.freeze({ type: "not-aborted" });
 		const report = {
+			...this.source == null ? {} : {
+				inboxRequestId: this.source.inboxRequestId,
+				requestId: this.source.requestId,
+				local: Object.freeze({ ...this.source.context })
+			},
+			requestCancellation,
 			inbox: this.inbox,
 			payload: this.payload,
 			activity: this.activity,
@@ -1552,7 +2074,7 @@ var InboxObservation = class {
 			outcome
 		};
 		try {
-			await handler(context, report);
+			await (0, _logtape_logtape.withContext)(this.source == null ? {} : { inboxRequestId: this.source.inboxRequestId }, () => handler(context, report));
 		} catch (error) {
 			try {
 				(0, _logtape_logtape.getLogger)([
@@ -2814,6 +3336,92 @@ async function isInAudience(object, actor, options = {}) {
 	return false;
 }
 //#endregion
+//#region src/federation/outbound-provenance.ts
+const outboundProvenance = Symbol("outboundProvenance");
+const emptyProvenance = Object.freeze({});
+function getOutboundProvenance(context) {
+	return context[outboundProvenance] ?? emptyProvenance;
+}
+function snapshotLocalContext(context) {
+	return Object.freeze({
+		origin: context.origin,
+		host: context.host,
+		hostname: context.hostname,
+		canonicalOrigin: context.canonicalOrigin
+	});
+}
+function createInboxRequestSource(request, requestId, canonicalOrigin) {
+	const url = new URL(request.url);
+	return Object.freeze({
+		inboxRequestId: crypto.randomUUID(),
+		requestId,
+		context: snapshotLocalContext({
+			origin: url.origin,
+			host: url.host,
+			hostname: url.hostname,
+			canonicalOrigin: canonicalOrigin ?? url.origin
+		})
+	});
+}
+/** The same exact-string budget applies to public input and queued metadata. */
+function validateDispatchId(value) {
+	if (value === void 0) return;
+	if (typeof value !== "string") throw new TypeError("dispatchId must be a string.");
+	if (value.length > 1024 || new TextEncoder().encode(value).byteLength > 1024) throw new RangeError("dispatchId must not exceed 1,024 UTF-8 bytes.");
+}
+/** A new public invocation keeps its HTTP source, with its own dispatch ID. */
+function invocationProvenance(context, dispatchId) {
+	validateDispatchId(dispatchId);
+	const { dispatchId: _previous, ...source } = getOutboundProvenance(context);
+	return Object.freeze({
+		...source,
+		...dispatchId === void 0 ? {} : { dispatchId }
+	});
+}
+/** Restore only explicit source facts; never infer them from queue/trace IDs. */
+function restoreProvenance(value) {
+	if (value === void 0) return emptyProvenance;
+	const record = (v) => v != null && typeof v === "object" && !Array.isArray(v);
+	const invalid = () => /* @__PURE__ */ new TypeError("Invalid provenance in queue metadata.");
+	if (!record(value)) throw invalid();
+	validateDispatchId(value.dispatchId);
+	if (value.originatingRequestId !== void 0 && typeof value.originatingRequestId !== "string") throw invalid();
+	let inboxRequest;
+	if (value.inboxRequest !== void 0) {
+		const source = value.inboxRequest;
+		if (!record(source) || typeof source.inboxRequestId !== "string" || source.inboxRequestId.length < 1 || typeof source.requestId !== "string" || !record(source.context)) throw invalid();
+		const facts = source.context;
+		if (typeof facts.origin !== "string" || typeof facts.host !== "string" || typeof facts.hostname !== "string" || typeof facts.canonicalOrigin !== "string") throw invalid();
+		inboxRequest = Object.freeze({
+			inboxRequestId: source.inboxRequestId,
+			requestId: source.requestId,
+			context: Object.freeze({
+				origin: facts.origin,
+				host: facts.host,
+				hostname: facts.hostname,
+				canonicalOrigin: facts.canonicalOrigin
+			})
+		});
+	}
+	return Object.freeze({
+		...value.dispatchId === void 0 ? {} : { dispatchId: value.dispatchId },
+		...inboxRequest == null ? {} : { inboxRequest },
+		...value.originatingRequestId === void 0 ? {} : { originatingRequestId: value.originatingRequestId }
+	});
+}
+/** Omit absent provenance on legacy and independent producers. */
+function serializeProvenance(value) {
+	const provenance = restoreProvenance(value);
+	return provenance.dispatchId === void 0 && provenance.inboxRequest == null && provenance.originatingRequestId == null ? {} : { provenance };
+}
+function sourceLogContext(source) {
+	return {
+		dispatchId: source.dispatchId,
+		sourceInboxRequestId: source.inboxRequest?.inboxRequestId,
+		sourceRequestId: source.inboxRequest?.requestId ?? source.originatingRequestId
+	};
+}
+//#endregion
 //#region src/federation/inbox-authentication.ts
 /**
 * The evidence of an activity that has not been authenticated by Fedify.
@@ -3008,7 +3616,7 @@ function createAuthenticationEvidence(evidence) {
 }
 //#endregion
 //#region src/federation/inbox.ts
-const Temporal$10 = require_http.Temporal;
+const Temporal$11 = require_http.Temporal;
 /**
 * Checks whether an activity's ID and all of its actor IDs have the same
 * [FEP-fe34] origin.  Activities without an ID have no origin to authenticate.
@@ -3188,6 +3796,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 		_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
 		message = {
 			type: "inbox",
+			...serializeProvenance(getOutboundProvenance(ctx)),
 			id: crypto.randomUUID(),
 			baseUrl: ctx.origin,
 			activity: originalJson ?? json,
@@ -3298,7 +3907,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			return "error";
 		}
 		require_http.recordInboxActivity(meterProvider, "processed", (0, _fedify_vocab.getTypeId)(activity).href);
-		if (cacheKey != null) await kv.set(cacheKey, true, { ttl: Temporal$10.Duration.from({ days: 1 }) });
+		if (cacheKey != null) await kv.set(cacheKey, true, { ttl: Temporal$11.Duration.from({ days: 1 }) });
 		logger.info("Activity {activityId} has been processed.", {
 			activityId: activity.id?.href,
 			activity: json,
@@ -3686,7 +4295,7 @@ async function restoreVerifiedActivityView(view, message) {
 }
 //#endregion
 //#region src/federation/keycache.ts
-const Temporal$9 = require_http.Temporal;
+const Temporal$10 = require_http.Temporal;
 const KEY_CACHE_GENERATION = "3";
 const COMPATIBLE_KEY_SEGMENT = "__compatible";
 const MAX_OWNER_BYTES = 32 * 1024;
@@ -3707,8 +4316,8 @@ var KvKeyCache = class {
 		this.kv = kv;
 		this.prefix = prefix;
 		this.options = options;
-		this.unavailableKeyTtl = options.unavailableKeyTtl ?? Temporal$9.Duration.from({ minutes: 10 });
-		this.keyTtl = options.keyTtl ?? Temporal$9.Duration.from({ days: 30 });
+		this.unavailableKeyTtl = options.unavailableKeyTtl ?? Temporal$10.Duration.from({ minutes: 10 });
+		this.keyTtl = options.keyTtl ?? Temporal$10.Duration.from({ days: 30 });
 		this.nullKeys = /* @__PURE__ */ new Map();
 	}
 	#getFetchErrorKey(keyId) {
@@ -3728,13 +4337,13 @@ var KvKeyCache = class {
 	async get(keyId) {
 		const negativeExpiration = this.nullKeys.get(keyId.href);
 		if (negativeExpiration != null) {
-			if (Temporal$9.Now.instant().until(negativeExpiration).sign >= 0) return null;
+			if (Temporal$10.Now.instant().until(negativeExpiration).sign >= 0) return null;
 			this.nullKeys.delete(keyId.href);
 		}
 		const serialized = await this.kv.get(this.#entryKey(keyId));
 		if (serialized === void 0) return void 0;
 		if (serialized === null) {
-			this.nullKeys.set(keyId.href, Temporal$9.Now.instant().add(this.unavailableKeyTtl));
+			this.nullKeys.set(keyId.href, Temporal$10.Now.instant().add(this.unavailableKeyTtl));
 			return null;
 		}
 		try {
@@ -3750,7 +4359,7 @@ var KvKeyCache = class {
 	}
 	async set(keyId, key) {
 		if (key == null) {
-			this.nullKeys.set(keyId.href, Temporal$9.Now.instant().add(this.unavailableKeyTtl));
+			this.nullKeys.set(keyId.href, Temporal$10.Now.instant().add(this.unavailableKeyTtl));
 			await this.kv.set(this.#entryKey(keyId), null, { ttl: this.unavailableKeyTtl });
 			return;
 		}
@@ -3769,7 +4378,7 @@ var KvKeyCache = class {
 	* @internal
 	*/
 	compatibleKeyScope(scope) {
-		const now = this.options.now ?? (() => Temporal$9.Now.instant());
+		const now = this.options.now ?? (() => Temporal$10.Now.instant());
 		const entryKey = (keyId) => [
 			...this.prefix,
 			COMPATIBLE_KEY_SEGMENT,
@@ -3789,7 +4398,7 @@ var KvKeyCache = class {
 			if (entry.key === null) return null;
 			let expires;
 			try {
-				expires = Temporal$9.Instant.fromEpochMilliseconds(entry.expires);
+				expires = Temporal$10.Instant.fromEpochMilliseconds(entry.expires);
 			} catch (error) {
 				if (!(error instanceof RangeError)) throw error;
 				await this.kv.delete(entryKey(keyId));
@@ -3834,8 +4443,8 @@ var KvKeyCache = class {
 					key: serialized,
 					expires,
 					...owner == null ? {} : { owner }
-				}, { ttl: Temporal$9.Duration.from({ milliseconds: ttl }) });
-				return key == null ? void 0 : Temporal$9.Instant.fromEpochMilliseconds(expires);
+				}, { ttl: Temporal$10.Duration.from({ milliseconds: ttl }) });
+				return key == null ? void 0 : Temporal$10.Instant.fromEpochMilliseconds(expires);
 			},
 			delete: async (keyId) => {
 				await this.kv.delete(entryKey(keyId));
@@ -4353,11 +4962,15 @@ function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
 * @throws {Error} If the activity fails to send.
 */
 function sendActivity(options, deps = {}) {
+	options.attemptStarted?.(options.inbox.href);
+	const attempt = options.observation?.startAttempt(options.inbox.href);
+	const parentSpanContext = _opentelemetry_api.trace.getSpanContext(_opentelemetry_api.context.active());
 	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	return tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan("activitypub.send_activity", {
 		kind: _opentelemetry_api.SpanKind.CLIENT,
 		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
 	}, async (span) => {
+		attempt?.setSpan(span, parentSpanContext);
 		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
 		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
 		const spanContext = span.spanContext();
@@ -4368,12 +4981,14 @@ function sendActivity(options, deps = {}) {
 			}, () => sendActivityInternal({
 				...options,
 				tracerProvider
-			}, span, deps));
+			}, span, deps, attempt));
+			await attempt?.succeeded();
 		} catch (e) {
 			span.setStatus({
 				code: _opentelemetry_api.SpanStatusCode.ERROR,
 				message: String(e)
 			});
+			await attempt?.failed(e);
 			throw e;
 		} finally {
 			span.end();
@@ -4413,6 +5028,7 @@ async function sendActivityThroughGateways(parameters, inboxes) {
 	throw lastError;
 }
 const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
+const ERROR_RESPONSE_BODY_TIMEOUT_MS = 1e3;
 function getActivityActorId(activity) {
 	if (!isRecord(activity)) return void 0;
 	return getIdValue(activity.actor);
@@ -4433,16 +5049,25 @@ function isRecord(value) {
 	return typeof value === "object" && value != null;
 }
 async function readLimitedResponseBody(response, maxBytes) {
+	const captured = takeCapturedDiagnostic(response);
+	if (captured !== void 0) return captured;
 	if (response.body == null) return "";
-	const reader = response.body.getReader();
+	const pump = new ResponseBodyPump(response.body, ERROR_RESPONSE_BODY_TIMEOUT_MS);
 	const decoder = new TextDecoder();
 	const chunks = [];
 	let totalBytes = 0;
 	let truncated = false;
+	let timedOut = false;
 	try {
 		while (true) {
-			const { done, value } = await reader.read();
+			const result = await pump.read();
+			if (result == null) {
+				timedOut = true;
+				break;
+			}
+			const { done, value } = result;
 			if (done) break;
+			if (value.length === 0) continue;
 			if (totalBytes + value.length > maxBytes) {
 				const remaining = maxBytes - totalBytes;
 				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
@@ -4453,14 +5078,14 @@ async function readLimitedResponseBody(response, maxBytes) {
 			totalBytes += value.length;
 		}
 	} finally {
-		if (truncated) reader.cancel().catch(() => {});
-		reader.releaseLock();
+		pump.close();
 	}
 	let result = chunks.join("");
 	if (truncated) result += "… (truncated)";
+	else if (timedOut) result += "… (timed out)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span, deps) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span, deps, attempt) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -4476,6 +5101,11 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 			session = await openUnvalidatedHop(url);
 		} catch (error) {
 			if (error instanceof _fedify_vocab_runtime.UrlError && error.reason === "dns") {
+				attempt?.failure({
+					kind: "transport",
+					phase: "validation",
+					error
+				});
 				logger.error("DNS resolution failed for URL: {url}", {
 					url,
 					error
@@ -4484,13 +5114,47 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 				failure.cause = error;
 				throw failure;
 			}
-			if (error instanceof _fedify_vocab_runtime.UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
-				error
-			});
+			if (error instanceof _fedify_vocab_runtime.UrlError) {
+				if (error.reason === "disallowed") attempt?.failure({
+					kind: "policy",
+					phase: "validation",
+					error
+				});
+				logger.error("Disallowed private URL: {url}", {
+					url,
+					error
+				});
+			}
 			throw error;
 		}
-		return session;
+		if (attempt == null) return session;
+		return {
+			url: session.url,
+			async fetch(input, init) {
+				try {
+					return await session.fetch(input, init);
+				} catch (error) {
+					attempt.failure({
+						kind: "transport",
+						phase: "request",
+						error
+					});
+					throw error;
+				}
+			},
+			async close() {
+				try {
+					await session.close();
+				} catch (error) {
+					attempt.failure({
+						kind: "local",
+						phase: "cleanup",
+						error
+					});
+					throw error;
+				}
+			}
+		};
 	}
 	let initialSession;
 	try {
@@ -4508,14 +5172,45 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 		return openHop(url);
 	};
 	try {
-		headers = new Headers(headers);
-		headers.set("Content-Type", "application/activity+json");
-		const request = new Request(inbox, {
-			method: "POST",
-			headers,
-			body: JSON.stringify(activity),
-			redirect: "manual"
-		});
+		let request;
+		let body;
+		try {
+			headers = new Headers(headers);
+			headers.set("Content-Type", "application/activity+json");
+		} catch (error) {
+			attempt?.failure({
+				kind: "local",
+				phase: "request-preparation",
+				error
+			});
+			throw error;
+		}
+		try {
+			attempt?.snapshotSenderPayload(activity);
+			body = JSON.stringify(activity);
+		} catch (error) {
+			attempt?.failure({
+				kind: "local",
+				phase: "serialization",
+				error
+			});
+			throw error;
+		}
+		try {
+			request = new Request(inbox, {
+				method: "POST",
+				headers,
+				body,
+				redirect: "manual"
+			});
+		} catch (error) {
+			attempt?.failure({
+				kind: "local",
+				phase: "request-preparation",
+				error
+			});
+			throw error;
+		}
 		let rsaKey = null;
 		for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
 			rsaKey = key;
@@ -4532,13 +5227,25 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 				privateKey: pair.privateKey
 			}))
 		});
+		const consume = (response) => {
+			return consumeSendActivityResponse(response, inbox);
+		};
 		let outcome;
 		try {
-			outcome = rsaKey == null ? await fetchWithValidatedRedirects(request, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox)) : await require_http.doubleKnockScoped(request, rsaKey, {
+			outcome = rsaKey == null ? await fetchWithValidatedRedirects(request, openDeliveryHop, consume, attempt) : await require_http.doubleKnockScoped(request, rsaKey, {
 				tracerProvider,
 				specDeterminer
-			}, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox));
+			}, openDeliveryHop, consume, attempt == null ? void 0 : {
+				fetch: (request, submit) => attempt.fetch(request, submit),
+				response: (response, disposition) => attempt.response(response, disposition),
+				error: (phase, error) => attempt.failure({
+					kind: "local",
+					phase,
+					error
+				})
+			});
 		} catch (error) {
+			attempt?.unknown(error);
 			const failure = error instanceof _fedify_vocab_runtime.FetchError || error instanceof _fedify_vocab_runtime.UrlError ? error : createFetchError(inbox.href, error);
 			logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 				activityId,
@@ -4558,7 +5265,13 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 					statusText,
 					error
 				});
-				throw new SendActivityError(inbox, status, `Failed to send activity ${activityId} to ${inbox.href} (${status} ${statusText}):\n${error}`, error, responseHeaders);
+				const failure = new SendActivityError(inbox, status, `Failed to send activity ${activityId} to ${inbox.href} (${status} ${statusText}):\n${error}`, error, responseHeaders);
+				attempt?.failure({
+					kind: "http",
+					phase: "response",
+					error: failure
+				});
+				throw failure;
 			}
 			deliverySuccess = true;
 			const eventAttributes = {
@@ -4602,7 +5315,7 @@ function cancelResponseBody(response, url) {
 /**
 * Reads what is needed from the final response of a delivery while its
 * session is open: the body of a successful response is cancelled, and at
-* most 1 KiB of an error response body is read.
+* most 1 KiB of an error response body is read within its diagnostic budget.
 */
 async function consumeSendActivityResponse(response, inbox) {
 	if (response.ok) {
@@ -4632,9 +5345,10 @@ async function consumeSendActivityResponse(response, inbox) {
 * @param request The request to send.
 * @param openHop The function to open a session for each hop.
 * @param consume The function to consume the final response.
+* @param attempt The in-process attempt observation, if registered.
 * @returns The value returned by `consume`.
 */
-async function fetchWithValidatedRedirects(request, openHop, consume) {
+async function fetchWithValidatedRedirects(request, openHop, consume, attempt) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -4645,7 +5359,7 @@ async function fetchWithValidatedRedirects(request, openHop, consume) {
 		const session = await openHop(request.url);
 		let response;
 		try {
-			response = await session.fetch(request, { redirect: "manual" });
+			response = await (attempt == null ? session.fetch(request, { redirect: "manual" }) : attempt.fetch(request, () => session.fetch(request, { redirect: "manual" })));
 		} catch (error) {
 			await closeAfterError(session, logger);
 			throw error;
@@ -4657,17 +5371,21 @@ async function fetchWithValidatedRedirects(request, openHop, consume) {
 			303,
 			307,
 			308
-		].includes(response.status) || location == null) try {
-			return await consume(response);
-		} catch (error) {
-			logger.debug("Failed to consume the response from {url}; closing the session: {error}", {
-				url: request.url,
-				error
-			});
-			throw error;
-		} finally {
-			await session.close();
+		].includes(response.status) || location == null) {
+			attempt?.response(response, "final");
+			try {
+				return await consume(response);
+			} catch (error) {
+				logger.debug("Failed to consume the response from {url}; closing the session: {error}", {
+					url: request.url,
+					error
+				});
+				throw error;
+			} finally {
+				await session.close();
+			}
 		}
+		attempt?.response(response, "intermediate");
 		cancelResponseBody(response, request.url);
 		await session.close();
 		if (redirects >= 20) throw new TypeError("Too many redirects");
@@ -4728,7 +5446,9 @@ var SendActivityError = class extends Error {
 	* The response body from the inbox, if any.  Note that this may be
 	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
 	* when remote servers return large error pages (e.g., Cloudflare error pages).
-	* If truncated, the string will end with `"… (truncated)"`.
+	* If truncated, the string will end with `"… (truncated)"`. Diagnostic reading
+	* has a separate one-second budget; a deadline retains any partial preview and
+	* appends `"… (timed out)"`. This is independent of application body capture.
 	*/
 	responseBody;
 	/**
@@ -4755,7 +5475,7 @@ var SendActivityError = class extends Error {
 };
 //#endregion
 //#region src/federation/portable-inbox.ts
-const Temporal$8 = require_http.Temporal;
+const Temporal$9 = require_http.Temporal;
 const MAX_TIMEOUT_MS = 2 ** 31 - 1;
 /**
 * Fills in the defaults of {@link PortableInboxForwardingOptions} and
@@ -4771,9 +5491,9 @@ const MAX_TIMEOUT_MS = 2 ** 31 - 1;
 function resolvePortableInboxForwardingOptions(options = {}) {
 	const maxTargets = options.maxTargets ?? 10;
 	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
-	const ttl = Temporal$8.Duration.from(options.ttl ?? { days: 30 });
+	const ttl = Temporal$9.Duration.from(options.ttl ?? { days: 30 });
 	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
-	const deadline = Temporal$8.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadline = Temporal$9.Duration.from(options.deadline ?? { seconds: 10 });
 	const deadlineMs = deadline.total("millisecond");
 	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
 	return {
@@ -4883,9 +5603,10 @@ function coversDelivery(signature) {
 * other gateways, that gateway has the activity already, so it is claimed
 * without forwarding the activity to it.  See {@link identifySendingGateway}.
 * @param parameters The parameters.
+* @param observation The in-process producer observation, if registered.
 * @returns The target inbox URLs that the activity was handed off to.
 */
-async function forwardPortableInboxActivity(parameters) {
+async function forwardPortableInboxActivity(parameters, observation) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -4894,8 +5615,16 @@ async function forwardPortableInboxActivity(parameters) {
 	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
 	const options = parameters.options ?? resolvePortableInboxForwardingOptions();
 	const { maxTargets, ttl } = options;
-	if (kv.cas == null || maxTargets < 1) return [];
+	if (kv.cas == null) {
+		if (observation != null) await observation.skipped("forwarding-unavailable");
+		return [];
+	}
+	if (maxTargets < 1) {
+		if (observation != null) await observation.skipped("forwarding-disabled");
+		return [];
+	}
 	const deadline = Date.now() + options.deadline.total("millisecond");
+	observation?.setPhase("destination-planning");
 	const canonicalActivityId = require_http.getCanonicalPortableId(activityId) ?? activityId.href;
 	const claimKey = (gateway) => [
 		...kvPrefix,
@@ -4923,15 +5652,27 @@ async function forwardPortableInboxActivity(parameters) {
 		targets.length = maxTargets;
 	}
 	const claimed = [];
-	for (const { gateway, inbox } of targets) if (await kv.cas(claimKey(gateway), void 0, true, { ttl })) claimed.push(inbox);
-	if (claimed.length < 1) return [];
+	for (const { gateway, inbox } of targets) if (await kv.cas(claimKey(gateway), void 0, true, { ttl })) {
+		claimed.push(inbox);
+		if (observation != null) await observation.planDestination(inbox.href, {
+			actorIds: [recipient.actorId.href],
+			sharedInbox: false,
+			portableInbox: recipient.canonicalInboxId,
+			mode: "portable-replication"
+		});
+	}
+	observation?.planned(claimed.length);
+	if (claimed.length < 1) {
+		if (observation != null) await observation.skipped("no-forwarding-targets");
+		return [];
+	}
 	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
 		activityId: activityId.href,
 		inbox: recipient.canonicalInboxId,
 		targets: claimed.map((t) => t.href)
 	});
-	if (outboxQueue == null) await forwardImmediately(parameters, claimed, deadline);
-	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed, deadline, observation);
+	else await enqueueForwarding(parameters, outboxQueue, claimed, observation);
 	return claimed;
 }
 /**
@@ -5074,7 +5815,7 @@ async function resolveForwardingKey({ getKeys, activityId }) {
 	}
 	return key;
 }
-async function forwardImmediately(parameters, inboxes, deadlineAt) {
+async function forwardImmediately(parameters, inboxes, deadlineAt, observation) {
 	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, meterProvider, tracerProvider } = parameters;
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
@@ -5082,23 +5823,50 @@ async function forwardImmediately(parameters, inboxes, deadlineAt) {
 		"inbox"
 	]);
 	const deadline = Math.max(0, deadlineAt - Date.now());
-	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
-		activity,
-		activityId: activityId.href,
-		activityType,
-		keys: key == null ? [] : [key],
-		inbox,
-		allowPrivateAddress,
-		specDeterminer,
-		meterProvider,
-		tracerProvider
-	}).catch((error) => {
-		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-			activityId: activityId.href,
-			inbox: inbox.href,
-			error
-		});
-	}))));
+	observation?.setPhase("key-resolution");
+	const forwarding = (async () => {
+		try {
+			const key = await resolveForwardingKey(parameters);
+			observation?.setPhase("request-preparation");
+			const sending = [];
+			for (const inbox of inboxes) {
+				const delivery = observation?.delivery(inbox.href);
+				let pending;
+				try {
+					pending = sendActivity({
+						observation: delivery,
+						activity,
+						activityId: activityId.href,
+						activityType,
+						keys: key == null ? [] : [key],
+						inbox,
+						allowPrivateAddress,
+						specDeterminer,
+						meterProvider,
+						tracerProvider
+					});
+				} catch (error) {
+					if (delivery != null) await delivery.failed(error);
+					throw error;
+				}
+				const settled = pending.catch((error) => {
+					logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+						activityId: activityId.href,
+						inbox: inbox.href,
+						error
+					});
+				});
+				if (observation != null) settled.catch(() => {});
+				sending.push(settled);
+				if (delivery != null) await delivery.handoff({ type: "direct" });
+			}
+			if (observation != null) await observation.prepared("delivery");
+			await Promise.all(sending);
+		} catch (error) {
+			if (observation != null) await observation.failed(error);
+			throw error;
+		}
+	})();
 	let timer;
 	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
 		timer = setTimeout(() => resolve(true), deadline);
@@ -5109,13 +5877,14 @@ async function forwardImmediately(parameters, inboxes, deadlineAt) {
 		deadline
 	});
 }
-async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+async function enqueueForwarding(parameters, outboxQueue, inboxes, observation) {
 	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	observation?.setPhase("key-resolution");
 	const key = await resolveForwardingKey(parameters);
 	const keys = [];
 	if (key != null) try {
@@ -5130,28 +5899,43 @@ async function enqueueForwarding(parameters, outboxQueue, inboxes) {
 			error
 		});
 	}
+	observation?.setPhase("request-preparation");
 	startQueue?.();
 	const started = (/* @__PURE__ */ new Date()).toISOString();
 	const traceContext = {};
 	_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), traceContext);
+	let preparedCount = 0;
 	await Promise.all(inboxes.map(async (inbox) => {
-		const message = {
-			type: "outbox",
-			id: crypto.randomUUID(),
-			baseUrl,
-			keys,
-			activity,
-			activityId: activityId.href,
-			activityType,
-			inbox: inbox.href,
-			sharedInbox: false,
-			started,
-			attempt: 0,
-			headers: {},
-			traceContext
-		};
+		const delivery = observation?.delivery(inbox.href);
+		let message;
 		try {
-			await outboxQueue.enqueue(message);
+			message = {
+				type: "outbox",
+				...serializeProvenance(parameters.provenance),
+				id: crypto.randomUUID(),
+				baseUrl,
+				keys,
+				activity,
+				activityId: activityId.href,
+				activityType,
+				inbox: inbox.href,
+				...observation?.continuation(inbox.href),
+				sharedInbox: false,
+				started,
+				attempt: 0,
+				headers: {},
+				traceContext
+			};
+		} catch (error) {
+			if (delivery != null) await delivery.failed(error);
+			throw error;
+		}
+		if (observation != null && ++preparedCount === inboxes.length) await observation.prepared("delivery");
+		try {
+			await (observation == null ? outboxQueue.enqueue(message) : observation.enqueue([{
+				inbox: inbox.href,
+				queueMessageId: message.id
+			}], "outbox", () => outboxQueue.enqueue(message)));
 		} catch (error) {
 			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
 				activityId: activityId.href,
@@ -5165,7 +5949,7 @@ async function enqueueForwarding(parameters, outboxQueue, inboxes) {
 }
 //#endregion
 //#region src/federation/temporal.ts
-const Temporal$7 = require_http.Temporal;
+const Temporal$8 = require_http.Temporal;
 function isPlainObject$1(value) {
 	return typeof value === "object" && value != null && !Array.isArray(value);
 }
@@ -5175,7 +5959,7 @@ function normalizeDateTimeLiteral(value) {
 function isMalformedDateTimeLiteral(value) {
 	if (typeof value !== "string") return false;
 	try {
-		Temporal$7.Instant.from(normalizeDateTimeLiteral(value));
+		Temporal$8.Instant.from(normalizeDateTimeLiteral(value));
 		return false;
 	} catch {
 		return true;
@@ -5184,7 +5968,7 @@ function isMalformedDateTimeLiteral(value) {
 function isMalformedDurationLiteral(value) {
 	if (typeof value !== "string") return false;
 	try {
-		Temporal$7.Duration.from(value);
+		Temporal$8.Duration.from(value);
 		return false;
 	} catch {
 		return true;
@@ -5255,7 +6039,7 @@ async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
 }
 //#endregion
 //#region src/federation/handler.ts
-const Temporal$6 = require_http.Temporal;
+const Temporal$7 = require_http.Temporal;
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
 const INBOX_COMPOUND_PROOF_LIMITS = {
 	maxDepth: 64,
@@ -7781,7 +8565,7 @@ async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
 }
 async function setKey(kv, key, policy) {
 	const seconds = policy.nonceTtlSeconds ?? 300;
-	const ttl = Temporal$6.Duration.from({ seconds });
+	const ttl = Temporal$7.Duration.from({ seconds });
 	await kv.set(key, true, { ttl });
 }
 const DEF_COMPONENTS = [
@@ -7871,7 +8655,7 @@ async function verifyPortableActivityId(activityId, jsonLd, options) {
 }
 //#endregion
 //#region src/federation/kv.ts
-const Temporal$5 = require_http.Temporal;
+const Temporal$6 = require_http.Temporal;
 /**
 * A key–value store that stores values in memory.
 * Do not use this in production as it does not persist values.
@@ -7891,7 +8675,7 @@ var MemoryKvStore = class {
 		const entry = this.#values[encodedKey];
 		if (entry == null) return Promise.resolve(void 0);
 		const [value, expiration] = entry;
-		if (expiration != null && Temporal$5.Now.instant().until(expiration).sign < 0) {
+		if (expiration != null && Temporal$6.Now.instant().until(expiration).sign < 0) {
 			delete this.#values[encodedKey];
 			return Promise.resolve(void 0);
 		}
@@ -7902,7 +8686,7 @@ var MemoryKvStore = class {
 	*/
 	set(key, value, options) {
 		const encodedKey = this.#encodeKey(key);
-		const expiration = options?.ttl == null ? null : Temporal$5.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
+		const expiration = options?.ttl == null ? null : Temporal$6.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
 		this.#values[encodedKey] = [value, expiration];
 		return Promise.resolve();
 	}
@@ -7924,13 +8708,13 @@ var MemoryKvStore = class {
 		if (entry == null) currentValue = void 0;
 		else {
 			const [value, expiration] = entry;
-			if (expiration != null && Temporal$5.Now.instant().until(expiration).sign < 0) {
+			if (expiration != null && Temporal$6.Now.instant().until(expiration).sign < 0) {
 				delete this.#values[encodedKey];
 				currentValue = void 0;
 			} else currentValue = value;
 		}
 		if (!(0, es_toolkit.isEqual)(currentValue, expectedValue)) return Promise.resolve(false);
-		const expiration = options?.ttl == null ? null : Temporal$5.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
+		const expiration = options?.ttl == null ? null : Temporal$6.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
 		this.#values[encodedKey] = [newValue, expiration];
 		return Promise.resolve(true);
 	}
@@ -7938,7 +8722,7 @@ var MemoryKvStore = class {
 	* {@inheritDoc KvStore.list}
 	*/
 	async *list(prefix) {
-		const now = Temporal$5.Now.instant();
+		const now = Temporal$6.Now.instant();
 		for (const [encodedKey, entry] of Object.entries(this.#values)) {
 			const key = JSON.parse(encodedKey);
 			if (prefix != null) {
@@ -7958,6 +8742,787 @@ var MemoryKvStore = class {
 	}
 };
 //#endregion
+//#region src/federation/outbound-observation.ts
+const Temporal$5 = require_http.Temporal;
+function snapshotDeliveryIdentity(identity) {
+	if (identity == null || typeof identity.deliveryId !== "string" || identity.deliveryId.length < 1 || typeof identity.destinationInbox !== "string" || identity.destinationInbox.length < 1 || identity.broadcast == null || !(identity.broadcast.type === "unknown" || identity.broadcast.type === "known" && typeof identity.broadcast.id === "string" && identity.broadcast.id.length > 0) || !(identity.portableInbox == null || typeof identity.portableInbox === "string")) throw new TypeError("Invalid outbound delivery identity in queue metadata.");
+	return Object.freeze({
+		broadcast: Object.freeze(identity.broadcast.type === "known" ? {
+			type: "known",
+			id: identity.broadcast.id
+		} : { type: "unknown" }),
+		deliveryId: identity.deliveryId,
+		destinationInbox: identity.destinationInbox,
+		...identity.portableInbox == null ? {} : { portableInbox: identity.portableInbox }
+	});
+}
+async function legacyFanoutIdentity(taskId, inbox, portableInbox) {
+	const bytes = new TextEncoder().encode(JSON.stringify([
+		"fedify-legacy-fanout-delivery",
+		taskId,
+		inbox
+	]));
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return {
+		broadcast: { type: "unknown" },
+		deliveryId: `legacy-fanout:${(0, byte_encodings_hex.encodeHex)(new Uint8Array(digest))}`,
+		destinationInbox: inbox,
+		...portableInbox == null ? {} : { portableInbox }
+	};
+}
+async function notifyObserver(context, callback, event, unit) {
+	if (callback == null) return;
+	try {
+		await (0, _logtape_logtape.withContext)(sourceLogContext(event.provenance), () => callback(context, event));
+	} catch (error) {
+		logObserverFailure(unit, error);
+	}
+}
+function logObserverFailure(unit, error) {
+	try {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"federation",
+			"outbox"
+		]).error("An unexpected error occurred in outbound {unit} observer:\n{error}", {
+			unit,
+			error
+		});
+	} catch {}
+}
+function warnInvalidDeliveryIdentity(messageId, error) {
+	try {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"federation",
+			"outbox"
+		]).warn("Ignoring invalid outbound delivery identity in queue message {messageId}: {error}", {
+			messageId,
+			error
+		});
+	} catch {}
+}
+function snapshotTrace(span, parentSpanContext) {
+	const spanContext = span.spanContext();
+	if (!(0, _opentelemetry_api.isSpanContextValid)(spanContext) || spanContext.isRemote || spanContext.traceId === parentSpanContext?.traceId && spanContext.spanId === parentSpanContext.spanId) return void 0;
+	return Object.freeze({
+		traceId: spanContext.traceId,
+		spanId: spanContext.spanId
+	});
+}
+/** State owned by one concrete send, never persisted in queue metadata. */
+var OutboundAttemptObservation = class {
+	inboxUrl;
+	report;
+	reportExchange;
+	headerPolicies;
+	bodyCapture;
+	senderPayload;
+	#attemptId = crypto.randomUUID();
+	#failures = [];
+	#response = Object.freeze({ type: "not-observed" });
+	#finalResponse;
+	#responses = /* @__PURE__ */ new WeakMap();
+	#trace;
+	#finished = false;
+	#exchangeCount = 0;
+	#senderPayload;
+	constructor(inboxUrl, report, reportExchange = void 0, headerPolicies = {}, bodyCapture = void 0, senderPayload = false) {
+		this.inboxUrl = inboxUrl;
+		this.report = report;
+		this.reportExchange = reportExchange;
+		this.headerPolicies = headerPolicies;
+		this.bodyCapture = bodyCapture;
+		this.senderPayload = senderPayload;
+		this.#senderPayload = Object.freeze({
+			stage: "sender-payload",
+			type: "unavailable",
+			reason: senderPayload ? "not-materialized" : "disabled"
+		});
+	}
+	snapshotSenderPayload(input) {
+		if (this.senderPayload) this.#senderPayload = projectSenderPayload(input);
+	}
+	setSpan(span, parentSpanContext) {
+		this.#trace = snapshotTrace(span, parentSpanContext);
+	}
+	async fetch(request, submit) {
+		const exchangeIndex = this.#exchangeCount++;
+		const snapshot = Object.freeze({
+			url: request.url,
+			method: request.method,
+			...this.headerPolicies.requestHeaders == null ? {} : { headers: snapshotHeaders(request.headers, this.headerPolicies.requestHeaders) }
+		});
+		let response;
+		try {
+			response = await submit();
+		} catch (error) {
+			await this.#exchange(exchangeIndex, snapshot, {
+				type: "failed",
+				error
+			});
+			throw error;
+		}
+		const metadata = Object.freeze({
+			status: response.status,
+			statusText: response.statusText,
+			...response.url === "" ? {} : { url: response.url }
+		});
+		const observed = Object.freeze({
+			exchangeIndex,
+			metadata
+		});
+		this.#responses.set(response, observed);
+		this.#response = Object.freeze({
+			type: "undetermined",
+			lastObserved: observed
+		});
+		const responseSnapshot = Object.freeze({
+			...metadata,
+			...this.headerPolicies.responseHeaders == null ? {} : { headers: snapshotHeaders(response.headers, this.headerPolicies.responseHeaders) }
+		});
+		const bodyCapture = this.bodyCapture == null ? void 0 : await captureResponseBody(response, this.bodyCapture, (body, signal) => this.bodyCapture.onBody({
+			attemptId: this.#attemptId,
+			inboxUrl: this.inboxUrl,
+			exchangeIndex,
+			observedAt: Temporal$5.Now.instant().epochMilliseconds,
+			request: snapshot,
+			response: responseSnapshot,
+			body,
+			signal
+		}));
+		if (bodyCapture?.type === "failed" && bodyCapture.phase === "observer") logObserverFailure("response-body", bodyCapture.error);
+		await this.#exchange(exchangeIndex, snapshot, {
+			type: "response",
+			response: responseSnapshot
+		}, bodyCapture);
+		return response;
+	}
+	#exchange(exchangeIndex, request, outcome, bodyCapture) {
+		return this.reportExchange?.({
+			attemptId: this.#attemptId,
+			inboxUrl: this.inboxUrl,
+			exchangeIndex,
+			observedAt: Temporal$5.Now.instant().epochMilliseconds,
+			request,
+			outcome: Object.freeze(outcome),
+			...bodyCapture == null ? {} : { bodyCapture }
+		}) ?? Promise.resolve();
+	}
+	response(response, disposition) {
+		const observed = this.#responses.get(response);
+		if (observed == null) return;
+		if (disposition === "final") {
+			this.#finalResponse = Object.freeze({
+				type: "final",
+				...observed
+			});
+			this.#response = this.#finalResponse;
+		} else this.#response = Object.freeze({
+			type: "intermediate-only",
+			lastObserved: observed
+		});
+	}
+	failure(failure) {
+		this.#failures.push(Object.freeze(failure));
+	}
+	unknown(error) {
+		if (!this.#failures.some((failure) => failure.error === error || failure.phase !== "cleanup")) this.failure({
+			kind: "unknown",
+			phase: "unknown",
+			error
+		});
+	}
+	succeeded() {
+		if (this.#finished) return Promise.resolve();
+		if (this.#finalResponse == null) throw new Error("A successful outbound attempt must have an observed final response.");
+		return this.#finish({
+			type: "succeeded",
+			response: this.#finalResponse
+		});
+	}
+	failed(error) {
+		let failure;
+		let diagnostics;
+		if (this.#response.type === "final" && (this.#response.metadata.status < 200 || this.#response.metadata.status >= 300)) {
+			failure = this.#failures.find((failure) => failure.kind === "http") ?? Object.freeze({
+				kind: "http",
+				phase: "response"
+			});
+			diagnostics = this.#failures.filter((failure) => failure.kind !== "http");
+		} else {
+			failure = this.#failures.find((failure) => failure.phase !== "cleanup") ?? this.#failures[0] ?? Object.freeze({
+				kind: "unknown",
+				phase: "unknown",
+				error
+			});
+			diagnostics = this.#failures.filter((item) => item !== failure);
+		}
+		return this.#finish({
+			type: "failed",
+			failure,
+			error,
+			response: this.#response,
+			...diagnostics.length === 0 ? {} : { diagnostics: Object.freeze(diagnostics) }
+		});
+	}
+	#finish(outcome) {
+		if (this.#finished) return Promise.resolve();
+		this.#finished = true;
+		return this.report({
+			attemptId: this.#attemptId,
+			inboxUrl: this.inboxUrl,
+			httpExchangeCount: this.#exchangeCount,
+			senderPayload: this.#senderPayload,
+			observedAt: Temporal$5.Now.instant().epochMilliseconds,
+			...this.#trace == null ? {} : { trace: this.#trace },
+			outcome: Object.freeze(outcome)
+		});
+	}
+};
+function snapshotOutboxIdentity(message) {
+	if (message.outbound != null) try {
+		return snapshotDeliveryIdentity(message.outbound);
+	} catch (error) {
+		warnInvalidDeliveryIdentity(message.id, error);
+	}
+	return Object.freeze({
+		broadcast: Object.freeze({ type: "unknown" }),
+		deliveryId: message.id,
+		...message.portableInbox == null ? {} : { portableInbox: message.portableInbox }
+	});
+}
+/** Per-execution state, independent of concrete attempt/exchange callbacks. */
+var OutboundWorkerObservation = class {
+	context;
+	callback;
+	provenance;
+	#attemptsStarted = 0;
+	#actions;
+	#trace;
+	#preparationFailure;
+	#preparationFailures = [];
+	#queue;
+	#delivery;
+	#role;
+	#currentContext;
+	constructor(context, callback, message, provenance) {
+		this.context = context;
+		this.callback = callback;
+		this.provenance = provenance;
+		this.#role = message.type;
+		this.#queue = Object.freeze({
+			queueMessageId: message.id,
+			...message.type === "outbox" ? { queueAttempt: message.attempt } : {}
+		});
+		if (message.type === "outbox") this.#delivery = snapshotOutboxIdentity(message);
+	}
+	attemptStarted = () => {
+		this.#attemptsStarted++;
+	};
+	enableActions() {
+		this.#actions ??= [];
+	}
+	directAttemptStarted(inboxUrl, identity) {
+		this.attemptStarted();
+		this.#actions?.push(Object.freeze({
+			type: "handoff",
+			action: "direct",
+			inboxUrls: Object.freeze([inboxUrl]),
+			...identity == null ? {} : { delivery: snapshotDeliveryIdentity(identity) }
+		}));
+	}
+	async enqueueChildren(messages, enqueue) {
+		if (this.#actions == null) return await enqueue();
+		const facts = messages.map((message) => ({
+			action: "enqueue",
+			queue: Object.freeze({
+				queueMessageId: message.id,
+				queueAttempt: message.attempt
+			}),
+			inboxUrls: Object.freeze(message.gatewayInboxes != null && message.gatewayInboxes.length > 1 ? [...message.gatewayInboxes] : [message.inbox]),
+			...message.outbound == null ? {} : { delivery: snapshotDeliveryIdentity(message.outbound) }
+		}));
+		try {
+			await enqueue();
+		} catch (error) {
+			for (const fact of facts) this.#actions.push(Object.freeze({
+				type: "action-failed",
+				...fact,
+				acceptance: "unknown",
+				error
+			}));
+			throw error;
+		}
+		for (const fact of facts) this.#actions.push(Object.freeze({
+			type: "scheduled",
+			...fact
+		}));
+	}
+	async enqueue(action, message, delay, enqueue, preparationFailures) {
+		if (this.#actions == null) return await enqueue();
+		const facts = {
+			action,
+			queue: Object.freeze({
+				queueMessageId: message.id,
+				queueAttempt: message.attempt
+			}),
+			inboxUrls: Object.freeze(message.gatewayInboxes != null && message.gatewayInboxes.length > 1 ? [...message.gatewayInboxes] : [message.inbox]),
+			delay: delay.toString(),
+			...preparationFailures == null || preparationFailures.length === 0 ? {} : { preparationFailures: Object.freeze([...preparationFailures]) },
+			...message.gatewayNotBefore == null ? {} : { notBefore: Object.freeze({ ...message.gatewayNotBefore }) }
+		};
+		try {
+			await enqueue();
+		} catch (error) {
+			this.#actions.push(Object.freeze({
+				type: "action-failed",
+				...facts,
+				acceptance: "unknown",
+				error
+			}));
+			throw error;
+		}
+		this.#actions.push(Object.freeze({
+			type: "scheduled",
+			...facts
+		}));
+	}
+	abandon(reason, inboxUrls, preparationFailures) {
+		this.#actions?.push(Object.freeze({
+			type: "abandoned",
+			reason,
+			inboxUrls: Object.freeze([...inboxUrls]),
+			...preparationFailures == null || preparationFailures.length === 0 ? {} : { preparationFailures: Object.freeze([...preparationFailures]) }
+		}));
+	}
+	dropFailure(inboxUrls, error) {
+		this.#actions?.push(Object.freeze({
+			type: "action-failed",
+			action: "drop",
+			inboxUrls: Object.freeze([...inboxUrls]),
+			error
+		}));
+	}
+	async drop(inboxUrls, operation) {
+		try {
+			await operation();
+		} catch (error) {
+			this.dropFailure(inboxUrls, error);
+			throw error;
+		}
+	}
+	getContext() {
+		return this.#currentContext ??= this.context();
+	}
+	useContext(context) {
+		this.#currentContext = context;
+	}
+	setSpan(span, parentSpanContext) {
+		this.#trace = snapshotTrace(span, parentSpanContext);
+	}
+	async prepare(phase, operation) {
+		try {
+			const result = await operation();
+			this.#preparationFailure = void 0;
+			return result;
+		} catch (error) {
+			this.#preparationFailure = Object.freeze({
+				kind: "local",
+				phase,
+				error
+			});
+			throw error;
+		}
+	}
+	recordPreparationFailure(error, inboxUrl) {
+		const failure = this.#preparationFailure;
+		if (failure == null || !Object.is(failure.error, error)) return [];
+		const diagnostic = Object.freeze({
+			inboxUrl,
+			failure
+		});
+		this.#preparationFailures.push(diagnostic);
+		return [diagnostic];
+	}
+	async run(operation) {
+		try {
+			await operation();
+		} catch (error) {
+			await this.#notify(this.#preparationFailure == null || !Object.is(this.#preparationFailure.error, error) ? {
+				type: "failed",
+				error
+			} : {
+				type: "preparation-failed",
+				failure: this.#preparationFailure,
+				error
+			});
+			throw error;
+		}
+		await this.#notify({ type: "completed" });
+	}
+	async #notify(result) {
+		const observedAt = Temporal$5.Now.instant().epochMilliseconds;
+		try {
+			const context = this.getContext();
+			await notifyObserver(context, this.callback, Object.freeze({
+				role: this.#role,
+				queue: this.#queue,
+				...this.#delivery == null ? {} : { delivery: this.#delivery },
+				attemptsStarted: this.#attemptsStarted,
+				actions: Object.freeze([...this.#actions ?? []]),
+				...this.#preparationFailures.length === 0 ? {} : { preparationFailures: Object.freeze([...this.#preparationFailures]) },
+				observedAt,
+				...this.#trace == null ? {} : { trace: this.#trace },
+				provenance: this.provenance,
+				local: snapshotLocalContext(context),
+				result: Object.freeze(result)
+			}), "worker");
+		} catch (error) {
+			logObserverFailure("worker", error);
+		}
+	}
+};
+/** Selected callback and restored grouping, shared by concrete gateway attempts. */
+var OutboundAttemptObserver = class OutboundAttemptObserver {
+	context;
+	callback;
+	identity;
+	provenance;
+	onHttpExchange;
+	headerPolicies;
+	bodyCapture;
+	#queue;
+	constructor(context, callback, identity, provenance, queue, onHttpExchange = void 0, headerPolicies = {}, bodyCapture = void 0) {
+		this.context = context;
+		this.callback = callback;
+		this.identity = identity;
+		this.provenance = provenance;
+		this.onHttpExchange = onHttpExchange;
+		this.headerPolicies = headerPolicies;
+		this.bodyCapture = bodyCapture;
+		this.#queue = queue == null ? void 0 : Object.freeze({ ...queue });
+	}
+	static resumeOutbox(context, callback, message, provenance, onHttpExchange, headerPolicies = {}, bodyCapture) {
+		if (callback == null && onHttpExchange == null && bodyCapture == null) return;
+		const identity = snapshotOutboxIdentity(message);
+		return new OutboundAttemptObserver(context, callback, identity, provenance, {
+			queueMessageId: message.id,
+			queueAttempt: message.attempt
+		}, onHttpExchange, headerPolicies, bodyCapture);
+	}
+	startAttempt(inboxUrl) {
+		if (this.callback == null && this.onHttpExchange == null && this.bodyCapture == null) return void 0;
+		const context = this.context();
+		return new OutboundAttemptObservation(inboxUrl, (facts) => notifyObserver(context, this.callback, Object.freeze({
+			...this.identity,
+			...facts,
+			...this.#queue == null ? {} : { queue: this.#queue },
+			provenance: this.provenance,
+			local: snapshotLocalContext(context)
+		}), "attempt"), (facts) => notifyObserver(context, this.onHttpExchange, Object.freeze({
+			...this.identity,
+			...facts,
+			...this.#queue == null ? {} : { queue: this.#queue },
+			provenance: this.provenance,
+			local: snapshotLocalContext(context)
+		}), "http-exchange"), this.onHttpExchange == null && this.bodyCapture == null ? {} : this.headerPolicies, this.bodyCapture == null ? void 0 : {
+			...this.bodyCapture,
+			onBody: (event) => (0, _logtape_logtape.withContext)(sourceLogContext(this.provenance), () => this.bodyCapture.onBody(context, Object.freeze({
+				...this.identity,
+				...event,
+				...this.#queue == null ? {} : { queue: this.#queue },
+				provenance: this.provenance,
+				local: snapshotLocalContext(context)
+			})))
+		}, this.callback != null && this.headerPolicies.senderPayload === true);
+	}
+};
+/** One producer's destination, without callbacks or live inputs in queues. */
+var OutboundDeliveryObservation = class {
+	context;
+	observer;
+	provenance;
+	trace;
+	#finished = false;
+	#reference;
+	#plan;
+	#attempts;
+	constructor(context, observer, identity, destination, provenance, trace, onAttempt, onHttpExchange, queue, headerPolicies = {}, bodyCapture) {
+		this.context = context;
+		this.observer = observer;
+		this.provenance = provenance;
+		this.trace = trace;
+		this.#reference = snapshotDeliveryIdentity(identity);
+		this.#attempts = new OutboundAttemptObserver(() => this.context, onAttempt, this.#reference, this.provenance, queue, onHttpExchange, headerPolicies, bodyCapture);
+		this.#plan = Object.freeze({
+			actorIds: Object.freeze(Array.from(destination.actorIds)),
+			sharedInbox: destination.sharedInbox,
+			mode: destination.mode ?? (destination.portableInbox == null ? "ordinary" : "portable-fallback")
+		});
+	}
+	startAttempt(inboxUrl) {
+		return this.#attempts.startAttempt(inboxUrl);
+	}
+	get identity() {
+		return this.#reference;
+	}
+	planned() {
+		return notifyObserver(this.context, this.observer, Object.freeze({
+			...this.trace == null ? {} : { trace: this.trace },
+			observedAt: Temporal$5.Now.instant().epochMilliseconds,
+			provenance: this.provenance,
+			local: snapshotLocalContext(this.context),
+			...this.#reference,
+			...this.#plan,
+			stage: "planned"
+		}), "delivery");
+	}
+	handoff(result) {
+		if (this.#finished) return Promise.resolve();
+		this.#finished = true;
+		return notifyObserver(this.context, this.observer, Object.freeze({
+			...this.trace == null ? {} : { trace: this.trace },
+			observedAt: Temporal$5.Now.instant().epochMilliseconds,
+			provenance: this.provenance,
+			local: snapshotLocalContext(this.context),
+			...this.#reference,
+			stage: "handoff",
+			result: Object.freeze(result)
+		}), "delivery");
+	}
+	failed(error) {
+		if (this.#finished) return Promise.resolve();
+		this.#finished = true;
+		return notifyObserver(this.context, this.observer, Object.freeze({
+			...this.trace == null ? {} : { trace: this.trace },
+			observedAt: Temporal$5.Now.instant().epochMilliseconds,
+			provenance: this.provenance,
+			local: snapshotLocalContext(this.context),
+			...this.#reference,
+			stage: "preparation-failed",
+			failure: Object.freeze({
+				kind: "local",
+				phase: "request-preparation",
+				error
+			})
+		}), "delivery");
+	}
+};
+/** State owned by one outgoing invocation, never serialized into queues. */
+var OutboundBroadcastObservation = class OutboundBroadcastObservation {
+	context;
+	operation;
+	provenance;
+	queue;
+	#broadcast;
+	#finished = false;
+	#phase = "unknown";
+	#planning = "not-started";
+	#destinationCount = 0;
+	#trace;
+	#activity = Object.freeze({});
+	#onBroadcast;
+	#onDelivery;
+	#onAttempt;
+	#onHttpExchange;
+	#headerPolicies;
+	#bodyCapture;
+	#deliveries = /* @__PURE__ */ new Map();
+	constructor(context, observers, operation, provenance = getOutboundProvenance(context), broadcast = {
+		type: "known",
+		id: crypto.randomUUID()
+	}, queue = void 0) {
+		this.context = context;
+		this.operation = operation;
+		this.provenance = provenance;
+		this.queue = queue;
+		this.#broadcast = broadcast;
+		this.#onBroadcast = observers.onBroadcast;
+		this.#onDelivery = observers.onDelivery;
+		this.#onAttempt = observers.onAttempt;
+		this.#onHttpExchange = observers.onHttpExchange;
+		this.#bodyCapture = observers.responseBodyCapture;
+		this.#headerPolicies = {
+			requestHeaders: observers.requestHeaders,
+			responseHeaders: observers.responseHeaders,
+			senderPayload: observers.senderPayload
+		};
+	}
+	/** Continue an existing fanout; do not emit a new broadcast invocation. */
+	static async resumeFanout(context, observers, message, span, parentSpanContext) {
+		if (observers.onDelivery == null && observers.onAttempt == null && observers.onHttpExchange == null && observers.responseBodyCapture == null && observers.onWorker == null && !Object.values(message.inboxes).some((entry) => entry.outbound != null)) return;
+		const observation = new OutboundBroadcastObservation(context, {
+			onDelivery: observers.onDelivery,
+			onAttempt: observers.onAttempt,
+			onHttpExchange: observers.onHttpExchange,
+			requestHeaders: observers.requestHeaders,
+			responseHeaders: observers.responseHeaders,
+			responseBodyCapture: observers.responseBodyCapture,
+			senderPayload: observers.senderPayload
+		}, "send", getOutboundProvenance(context), { type: "unknown" }, { queueMessageId: message.id });
+		if (span != null) observation.setSpan(span, parentSpanContext);
+		observation.#finished = true;
+		observation.planned(Object.keys(message.inboxes).length);
+		for (const [inbox, destination] of Object.entries(message.inboxes)) {
+			let identity;
+			if (destination.outbound != null) try {
+				const snapshot = snapshotDeliveryIdentity(destination.outbound);
+				if (snapshot.destinationInbox !== inbox) throw new TypeError("Outbound delivery identity does not match its fanout destination.");
+				identity = snapshot;
+			} catch (error) {
+				warnInvalidDeliveryIdentity(message.id, error);
+			}
+			identity ??= await legacyFanoutIdentity(message.id, inbox, destination.portableInbox);
+			observation.#deliveries.set(inbox, observation.#createDelivery(inbox, destination, identity));
+		}
+		return observation;
+	}
+	#createDelivery(inbox, destination, identity) {
+		return new OutboundDeliveryObservation(this.context, this.#onDelivery, identity ?? {
+			broadcast: this.#broadcast,
+			deliveryId: crypto.randomUUID(),
+			destinationInbox: inbox,
+			...destination.portableInbox == null ? {} : { portableInbox: destination.portableInbox }
+		}, destination, this.provenance, this.#trace, this.#onAttempt, this.#onHttpExchange, this.queue, this.#headerPolicies, this.#bodyCapture);
+	}
+	continuation(inbox) {
+		const delivery = this.delivery(inbox);
+		return delivery == null ? void 0 : { outbound: delivery.identity };
+	}
+	async planDestinations(inboxes) {
+		this.planned(Object.keys(inboxes).length);
+		for (const [inbox, destination] of Object.entries(inboxes)) if (!this.#deliveries.has(inbox)) this.#deliveries.set(inbox, this.#createDelivery(inbox, destination));
+		for (const delivery of this.#deliveries.values()) await delivery.planned();
+	}
+	delivery(inbox) {
+		return this.#deliveries.get(inbox);
+	}
+	async enqueue(entries, queue, enqueue) {
+		let result;
+		try {
+			result = await enqueue();
+		} catch (error) {
+			await Promise.all(entries.map(({ inbox }) => this.delivery(inbox)?.handoff({
+				type: "enqueue-failed",
+				acceptance: "unknown",
+				error
+			})));
+			throw error;
+		}
+		await Promise.all(entries.map(({ inbox, queueMessageId }) => this.delivery(inbox)?.handoff({
+			type: "enqueued",
+			queue,
+			queueMessageId
+		})));
+		return result;
+	}
+	/** Attach only the span supplied by this execution, never an ambient fallback. */
+	setSpan(span, parentSpanContext) {
+		this.#trace = snapshotTrace(span, parentSpanContext);
+	}
+	setPhase(phase) {
+		this.#phase = phase;
+		if (phase === "destination-planning") this.#planning = "incomplete";
+	}
+	/** Replace the Activity facts captured by the producer path. */
+	setActivity(reference) {
+		this.#activity = Object.freeze({ ...reference });
+	}
+	planned(destinationCount) {
+		this.#planning = "complete";
+		this.#destinationCount = destinationCount;
+	}
+	async planDestination(inbox, destination) {
+		this.#destinationCount++;
+		const delivery = this.#createDelivery(inbox, destination);
+		this.#deliveries.set(inbox, delivery);
+		await delivery.planned();
+	}
+	prepared(preparedFor) {
+		return this.#finish(Object.freeze({
+			type: "prepared",
+			preparedFor,
+			destinationCount: this.#destinationCount
+		}));
+	}
+	skipped(reason = "no-destinations") {
+		return this.#finish(Object.freeze({
+			type: "skipped",
+			reason
+		}));
+	}
+	async run(send) {
+		if (this.#broadcast.type === "known") await this.#notify(Object.freeze({
+			broadcastId: this.#broadcast.id,
+			operation: this.operation,
+			stage: "started",
+			activity: this.#activity
+		}));
+		try {
+			return await send(this, this.provenance);
+		} catch (error) {
+			await this.failed(error);
+			throw error;
+		}
+	}
+	failed(error) {
+		const failure = {
+			kind: this.#phase === "unknown" ? "unknown" : "local",
+			phase: this.#phase,
+			error
+		};
+		return this.#finish(Object.freeze({
+			type: "failed",
+			failure: Object.freeze(failure),
+			planning: this.#planning,
+			plannedDestinationCount: this.#destinationCount
+		}));
+	}
+	async #finish(result) {
+		if (this.#finished) return;
+		this.#finished = true;
+		if (this.#broadcast.type === "known") await this.#notify(Object.freeze({
+			broadcastId: this.#broadcast.id,
+			operation: this.operation,
+			stage: "preparation-finished",
+			result,
+			activity: this.#activity
+		}));
+	}
+	#notify(event) {
+		return notifyObserver(this.context, this.#onBroadcast, Object.freeze({
+			...event,
+			...this.#trace == null ? {} : { trace: this.#trace },
+			observedAt: Temporal$5.Now.instant().epochMilliseconds,
+			provenance: this.provenance,
+			local: snapshotLocalContext(this.context)
+		}), "broadcast");
+	}
+};
+/** Observe preparation without changing the unobserved send's execution path. */
+function observeOutboundBroadcast(context, observers, send, operation = "send", dispatchId) {
+	let provenance;
+	let invalid;
+	try {
+		provenance = invocationProvenance(context, dispatchId);
+	} catch (error) {
+		provenance = invocationProvenance(context, void 0);
+		invalid = { error };
+	}
+	const execute = async (observation) => {
+		if (invalid != null) {
+			observation?.setPhase("validation");
+			throw invalid.error;
+		}
+		return await send(observation, provenance);
+	};
+	return (0, _logtape_logtape.withContext)(sourceLogContext(provenance), () => {
+		if (observers.onBroadcast == null && observers.onDelivery == null && observers.onAttempt == null && observers.onHttpExchange == null && observers.responseBodyCapture == null) return execute();
+		return new OutboundBroadcastObservation(context, observers, operation, provenance).run(execute);
+	});
+}
+//#endregion
 //#region src/nodeinfo/handler.ts
 /**
 * Handles a NodeInfo request.  You would not typically call this function
@@ -9541,41 +11106,70 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		await Promise.all(promises);
 	}
-	processQueuedTask(contextData, message) {
+	async processQueuedTask(contextData, message) {
 		const extractedContext = _opentelemetry_api.propagation.extract(_opentelemetry_api.context.active(), message.traceContext);
-		return (0, _logtape_logtape.withContext)({ messageId: message.id }, async () => {
+		let provenance = emptyProvenance;
+		if (message.type !== "task") try {
+			provenance = restoreProvenance(message.provenance);
+		} catch (error) {
+			try {
+				(0, _logtape_logtape.getLogger)([
+					"fedify",
+					"federation",
+					"queue"
+				]).warn("Ignoring invalid provenance in queue message {messageId}: {error}", {
+					messageId: message.id,
+					error
+				});
+			} catch {}
+		}
+		if (message.type !== "task" && message.provenance !== void 0) message = {
+			...message,
+			provenance
+		};
+		return await (0, _logtape_logtape.withContext)({
+			messageId: message.id,
+			inboxRequestId: void 0,
+			...sourceLogContext(provenance)
+		}, async () => {
 			if (message.type === "fanout") {
+				const observers = this.outboundObservers;
+				const worker = this.#createOutboundWorkerObservation(contextData, message, provenance, observers.onWorker);
 				const common = {
 					role: "fanout",
 					queue: this.fanoutQueue,
 					activityType: message.activityType
 				};
-				await this.#runWorkerSpan("activitypub.fanout", { "activitypub.activity.type": message.activityType }, extractedContext, this.#instrumentWorkerBody(common, async (span) => {
+				const execute = () => this.#runWorkerSpan("activitypub.fanout", { "activitypub.activity.type": message.activityType }, extractedContext, this.#instrumentWorkerBody(common, async (span) => {
 					if (message.activityId != null) span.setAttribute("activitypub.activity.id", message.activityId);
-					await this.#listenFanoutMessage(contextData, message);
+					await this.#listenFanoutMessage(contextData, message, provenance, span, _opentelemetry_api.trace.getSpanContext(extractedContext), observers, worker);
 					return { outcome: "completed" };
-				}, classifyAbortableError));
+				}, classifyAbortableError), worker);
+				await (worker == null ? execute() : worker.run(execute));
 			} else if (message.type === "outbox") {
+				const observers = this.outboundObservers;
+				const worker = this.#createOutboundWorkerObservation(contextData, message, provenance, observers.onWorker);
 				const common = {
 					role: "outbox",
 					queue: this.outboxQueue,
 					activityType: message.activityType
 				};
-				await this.#runWorkerSpan("activitypub.outbox", {
+				const execute = () => this.#runWorkerSpan("activitypub.outbox", {
 					"activitypub.activity.type": message.activityType,
 					"activitypub.activity.retries": message.attempt
 				}, extractedContext, this.#instrumentWorkerBody(common, async (span) => {
 					if (message.activityId != null) span.setAttribute("activitypub.activity.id", message.activityId);
-					await this.#listenOutboxMessage(contextData, message, span);
+					await this.#listenOutboxMessage(contextData, message, span, provenance, observers, worker);
 					return { outcome: "completed" };
-				}, classifyAbortableError));
+				}, classifyAbortableError), worker);
+				await (worker == null ? execute() : worker.run(execute));
 			} else if (message.type === "inbox") {
 				const common = {
 					role: "inbox",
 					queue: this.inboxQueue
 				};
 				await this.#runWorkerSpan("activitypub.inbox", { "activitypub.shared_inbox": message.identifier == null }, extractedContext, this.#instrumentWorkerBody(common, async (span) => {
-					await this.#listenInboxMessage(contextData, message, span, (activityType) => {
+					await this.#listenInboxMessage(contextData, message, span, provenance, (activityType) => {
 						common.activityType = activityType;
 					});
 					return { outcome: "completed" };
@@ -9594,6 +11188,22 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		});
 	}
+	#createOutboundWorkerObservation(contextData, message, provenance, callback) {
+		if (callback == null) return void 0;
+		let documentLoader;
+		let contextLoader;
+		return new OutboundWorkerObservation(() => {
+			const loaderOptions = this.#getLoaderOptions(message.baseUrl);
+			return new ContextImpl({
+				[outboundProvenance]: provenance,
+				federation: this,
+				url: new URL("/", message.baseUrl),
+				data: contextData,
+				documentLoader: (...args) => (documentLoader ??= this.documentLoaderFactory(loaderOptions))(...args),
+				contextLoader: (...args) => (contextLoader ??= this.contextLoaderFactory(loaderOptions))(...args)
+			});
+		}, callback, message, provenance);
+	}
 	/**
 	* Opens a CONSUMER span for a queue worker and scopes the extracted trace
 	* context around its body.  The body—typically built by
@@ -9605,11 +11215,12 @@ var FederationImpl = class extends FederationBuilderImpl {
 	* @param instrumentedBody Builds the context-scoped worker callback for the
 	*                         opened span.
 	*/
-	async #runWorkerSpan(spanName, spanAttributes, extractedContext, instrumentedBody) {
+	async #runWorkerSpan(spanName, spanAttributes, extractedContext, instrumentedBody, worker) {
 		await this._getTracer().startActiveSpan(spanName, {
 			kind: _opentelemetry_api.SpanKind.CONSUMER,
 			attributes: spanAttributes
 		}, extractedContext, async (span) => {
+			worker?.setSpan(span, _opentelemetry_api.trace.getSpanContext(extractedContext));
 			const spanCtx = span.spanContext();
 			return await (0, _logtape_logtape.withContext)({
 				traceId: spanCtx.traceId,
@@ -9652,7 +11263,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			span.end();
 		}
 	};
-	async #listenFanoutMessage(data, message) {
+	async #listenFanoutMessage(data, message, provenance, span, parentSpanContext, observers, worker) {
+		worker?.enableActions();
 		(0, _logtape_logtape.getLogger)([
 			"fedify",
 			"federation",
@@ -9661,11 +11273,12 @@ var FederationImpl = class extends FederationBuilderImpl {
 			activityId: message.activityId,
 			inboxes: globalThis.Object.keys(message.inboxes).length
 		});
-		const keys = await Promise.all(message.keys.map(async ({ keyId, privateKey }) => ({
+		const importKeys = () => Promise.all(message.keys.map(async ({ keyId, privateKey }) => ({
 			keyId: new URL(keyId),
 			privateKey: await require_http.importJwk(privateKey, "private")
 		})));
-		const activity = await _fedify_vocab.Activity.fromJsonLd(message.activity, {
+		const keys = worker == null ? await importKeys() : await worker.prepare("key-import", importKeys);
+		const parseActivity = () => _fedify_vocab.Activity.fromJsonLd(message.activity, {
 			contextLoader: this.contextLoaderFactory({
 				allowPrivateAddress: this.allowPrivateAddress,
 				userAgent: this.userAgent
@@ -9676,19 +11289,30 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}),
 			tracerProvider: this.tracerProvider
 		});
-		const context = this.#createContext(new URL(message.baseUrl), data, { documentLoader: this.documentLoaderFactory({
-			allowPrivateAddress: this.allowPrivateAddress,
-			userAgent: this.userAgent
-		}) });
+		const activity = worker == null ? await parseActivity() : await worker.prepare("activity-parsing", parseActivity);
+		const createContext = () => this.#createContext(new URL(message.baseUrl), data, {
+			[outboundProvenance]: provenance,
+			documentLoader: this.documentLoaderFactory({
+				allowPrivateAddress: this.allowPrivateAddress,
+				userAgent: this.userAgent
+			})
+		});
+		const context = worker == null ? createContext() : await worker.prepare("context-preparation", createContext);
+		worker?.useContext(context);
+		const observation = await OutboundBroadcastObservation.resumeFanout(context, observers, message, span, parentSpanContext);
 		await this.sendActivity(keys, message.inboxes, activity, {
 			collectionSync: message.collectionSync,
 			orderingKey: message.orderingKey,
 			normalizeExistingProofs: message.normalizeExistingProofs,
 			activityJsonLd: message.activity,
+			observation,
+			worker,
 			context
 		});
 	}
-	async #listenOutboxMessage(_, message, span) {
+	async #listenOutboxMessage(contextData, message, span, provenance, observers, worker) {
+		const { onAttempt, onHttpExchange } = observers;
+		worker?.enableActions();
 		const logger = (0, _logtape_logtape.getLogger)([
 			"fedify",
 			"federation",
@@ -9705,14 +11329,26 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const keys = [];
 		let rsaKeyPair = null;
 		for (const { keyId, privateKey } of message.keys) {
-			const pair = {
+			const importPair = async () => ({
 				keyId: new URL(keyId),
 				privateKey: await require_http.importJwk(privateKey, "private")
-			};
+			});
+			const pair = worker == null ? await importPair() : await worker.prepare("key-import", importPair);
 			if (rsaKeyPair == null && pair.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") rsaKeyPair = pair;
 			keys.push(pair);
 		}
 		const loaderOptions = this.#getLoaderOptions(message.baseUrl);
+		let observationContext;
+		let observationDocumentLoader;
+		let observationContextLoader;
+		const observation = OutboundAttemptObserver.resumeOutbox(() => worker?.getContext() ?? (observationContext ??= new ContextImpl({
+			[outboundProvenance]: provenance,
+			federation: this,
+			url: new URL("/", message.baseUrl),
+			data: contextData,
+			documentLoader: (...args) => (observationDocumentLoader ??= this.documentLoaderFactory(loaderOptions))(...args),
+			contextLoader: (...args) => (observationContextLoader ??= this.contextLoaderFactory(loaderOptions))(...args)
+		})), onAttempt, message, provenance, onHttpExchange, observers, observers.responseBodyCapture);
 		let parsedActorIds;
 		const getActorIds = () => {
 			parsedActorIds ??= (message.actorIds ?? []).flatMap((id) => {
@@ -9735,7 +11371,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				verifyPortableObject: createPortableObjectVerifier(documentLoader, contextLoader, this)
 			});
 		};
-		const enqueueHeldOutboxMessage = async (delay, heldSince) => {
+		const enqueueHeldOutboxMessage = async (delay, heldSince, preparationFailures) => {
 			const { outboxQueue } = this;
 			if (outboxQueue == null) return;
 			const heldMessage = {
@@ -9743,10 +11379,11 @@ var FederationImpl = class extends FederationBuilderImpl {
 				circuitHeld: true,
 				circuitHeldSince: heldSince.toString()
 			};
-			await outboxQueue.enqueue(heldMessage, {
+			const enqueueOptions = {
 				delay: clampNegativeDelay(delay),
 				orderingKey: message.orderingKey
-			});
+			};
+			await (worker == null ? outboxQueue.enqueue(heldMessage, enqueueOptions) : worker.enqueue("defer", heldMessage, enqueueOptions.delay, () => outboxQueue.enqueue(heldMessage, enqueueOptions), preparationFailures));
 			this.metrics.recordQueueTaskEnqueued({
 				role: "outbox",
 				queue: outboxQueue,
@@ -9763,7 +11400,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 				heldSince
 			});
 			if (this.outboxPermanentFailureHandler != null) {
-				const ctx = this.#createContext(new URL(message.baseUrl), _, { documentLoader: this.documentLoaderFactory(loaderOptions) });
+				const ctx = this.#createContext(new URL(message.baseUrl), contextData, {
+					[outboundProvenance]: provenance,
+					documentLoader: this.documentLoaderFactory(loaderOptions)
+				});
 				try {
 					await this.outboxPermanentFailureHandler(ctx, {
 						reason: "circuit-breaker-ttl",
@@ -9775,6 +11415,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 						actorIds: getActorIds()
 					});
 				} catch (handlerError) {
+					worker?.dropFailure([inbox.href], handlerError);
 					logger.error("An unexpected error occurred in outboxPermanentFailureHandler:\n{error}", {
 						...logData,
 						error: handlerError
@@ -9785,10 +11426,13 @@ var FederationImpl = class extends FederationBuilderImpl {
 		};
 		const { gatewayInboxes } = message;
 		if (gatewayInboxes != null && gatewayInboxes.length > 1) {
-			await this.#listenGatewayOutboxMessage(_, {
+			await this.#listenGatewayOutboxMessage(contextData, {
 				...message,
 				gatewayInboxes
 			}, span, {
+				observation,
+				worker,
+				provenance,
 				keys,
 				logData,
 				getActorIds,
@@ -9798,7 +11442,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			return;
 		}
 		try {
-			const inbox = new URL(message.inbox);
+			const parseInbox = () => new URL(message.inbox);
+			const inbox = worker == null ? parseInbox() : await worker.prepare("validation", parseInbox);
 			const circuit = this.outboxQueue == null ? void 0 : this.circuitBreaker;
 			const remoteHost = require_http.getRemoteHost(inbox);
 			let decision;
@@ -9822,13 +11467,19 @@ var FederationImpl = class extends FederationBuilderImpl {
 					return;
 				}
 				if (decision.type === "drop") {
-					const activity = await parseActivity();
-					await dropHeldOutboxMessage(circuit, remoteHost, inbox, decision.heldSince, activity);
+					worker?.abandon("held-ttl-expired", [inbox.href]);
+					const drop = async () => {
+						const activity = await parseActivity();
+						await dropHeldOutboxMessage(circuit, remoteHost, inbox, decision.heldSince, activity);
+					};
+					await (worker == null ? drop() : worker.drop([inbox.href], drop));
 					return;
 				}
 				if (decision.stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, decision.stateChange);
 			}
 			await sendActivity({
+				attemptStarted: worker?.attemptStarted,
+				observation,
 				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: message.activity,
@@ -9836,7 +11487,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activityType: message.activityType,
 				inbox,
 				sharedInbox: message.sharedInbox,
-				headers: new Headers(message.headers),
+				headers: worker == null ? new Headers(message.headers) : await worker.prepare("request-preparation", () => new Headers(message.headers)),
 				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
@@ -9856,6 +11507,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				});
 			}
 		} catch (error) {
+			const preparationFailures = worker?.recordPreparationFailure(error, message.inbox) ?? [];
 			span.setStatus({
 				code: _opentelemetry_api.SpanStatusCode.ERROR,
 				message: String(error)
@@ -9864,7 +11516,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				if (error instanceof SendActivityError) return require_http.getRemoteHost(error.inbox);
 				try {
 					return require_http.getRemoteHost(new URL(message.inbox));
-				} catch (_) {
+				} catch {
 					logger.warn("Invalid inbox URL in queued outbox message: {inbox}", logData);
 					return;
 				}
@@ -9937,32 +11589,42 @@ var FederationImpl = class extends FederationBuilderImpl {
 				});
 			}
 			if (circuitDrop != null) {
-				await dropHeldOutboxMessage(circuitDrop.circuit, circuitDrop.remoteHost, circuitDrop.inbox, circuitDrop.heldSince, activity);
+				worker?.abandon("held-ttl-expired", [circuitDrop.inbox.href], preparationFailures);
+				const drop = () => dropHeldOutboxMessage(circuitDrop.circuit, circuitDrop.remoteHost, circuitDrop.inbox, circuitDrop.heldSince, activity);
+				await (worker == null ? drop() : worker.drop([circuitDrop.inbox.href], drop));
 				return;
 			}
 			if (isPermanentFailure) {
+				worker?.abandon("permanent-failure", [message.inbox], preparationFailures);
 				this.metrics.recordPermanentFailure(error.inbox, error.statusCode);
 				logger.warn("Permanent delivery failure for activity {activityId} to {inbox} ({status}); not retrying.", {
 					...logData,
 					status: error.statusCode
 				});
 				if (this.outboxPermanentFailureHandler != null) {
-					const ctx = this.#createContext(new URL(message.baseUrl), _, { documentLoader: this.documentLoaderFactory(loaderOptions) });
-					try {
-						await this.outboxPermanentFailureHandler(ctx, {
-							reason: "http",
-							inbox: new URL(message.inbox),
-							activity,
-							error,
-							statusCode: error.statusCode,
-							actorIds: getActorIds()
+					const drop = async () => {
+						const ctx = this.#createContext(new URL(message.baseUrl), contextData, {
+							[outboundProvenance]: provenance,
+							documentLoader: this.documentLoaderFactory(loaderOptions)
 						});
-					} catch (handlerError) {
-						logger.error("An unexpected error occurred in outboxPermanentFailureHandler:\n{error}", {
-							...logData,
-							error: handlerError
-						});
-					}
+						try {
+							await this.outboxPermanentFailureHandler(ctx, {
+								reason: "http",
+								inbox: new URL(message.inbox),
+								activity,
+								error,
+								statusCode: error.statusCode,
+								actorIds: getActorIds()
+							});
+						} catch (handlerError) {
+							worker?.dropFailure([message.inbox], handlerError);
+							logger.error("An unexpected error occurred in outboxPermanentFailureHandler:\n{error}", {
+								...logData,
+								error: handlerError
+							});
+						}
+					};
+					await (worker == null ? drop() : worker.drop([message.inbox], drop));
 				}
 				require_http.recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
 				return;
@@ -9974,7 +11636,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				});
 				recordCircuitBreakerHeldSpanEvent(span, circuitHold.remoteHost, circuitHold.state);
 				const circuit = this.circuitBreaker;
-				await enqueueHeldOutboxMessage(retryAfterDelay == null || circuit == null ? circuitHold.delay : circuit.capHeldDelay(circuitHold.heldSince, maxDelay(circuitHold.delay, retryAfterDelay)), circuitHold.heldSince);
+				await enqueueHeldOutboxMessage(retryAfterDelay == null || circuit == null ? circuitHold.delay : circuit.capHeldDelay(circuitHold.heldSince, maxDelay(circuitHold.delay, retryAfterDelay)), circuitHold.heldSince, preparationFailures);
 				return;
 			}
 			if (this.outboxQueue?.nativeRetrial && retryAfterDelay == null) {
@@ -9997,18 +11659,20 @@ var FederationImpl = class extends FederationBuilderImpl {
 				};
 				const { outboxQueue } = this;
 				if (outboxQueue != null) {
-					await outboxQueue.enqueue(retryMessage, {
+					const enqueueOptions = {
 						delay: clampNegativeDelay(delay),
 						orderingKey: message.orderingKey
-					});
+					};
+					await (worker == null ? outboxQueue.enqueue(retryMessage, enqueueOptions) : worker.enqueue("retry", retryMessage, enqueueOptions.delay, () => outboxQueue.enqueue(retryMessage, enqueueOptions), preparationFailures));
 					this.metrics.recordQueueTaskEnqueued({
 						role: "outbox",
 						queue: outboxQueue,
 						activityType: retryMessage.activityType
 					}, retryMessage.attempt);
 					require_http.recordOutboxActivity(this.meterProvider, "retried", retryMessage.activityType);
-				}
+				} else worker?.abandon("queue-unavailable", [message.inbox], preparationFailures);
 			} else {
+				worker?.abandon("retry-policy-declined", [message.inbox], preparationFailures);
 				logger.error("Failed to send activity {activityId} to {inbox} after {attempt} attempts; giving up:\n{error}", {
 					...logData,
 					error
@@ -10043,25 +11707,32 @@ var FederationImpl = class extends FederationBuilderImpl {
 			"federation",
 			"circuit"
 		]);
-		const { keys, logData, getActorIds, parseActivity, dropHeldOutboxMessage } = helpers;
+		const { observation, worker, provenance, keys, logData, getActorIds, parseActivity, dropHeldOutboxMessage } = helpers;
 		const circuit = this.outboxQueue == null ? void 0 : this.circuitBreaker;
 		const specDeterminer = new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl });
 		const survivors = [];
+		const preparationFailuresByRoute = /* @__PURE__ */ new Map();
+		const permanentRoutes = /* @__PURE__ */ new Set();
 		let lastError;
 		let lastPermanent;
 		let activity;
 		const getActivity = async () => activity ??= await parseActivity();
 		const drop = async (circuit, remoteHost, inbox, heldSince) => {
-			await dropHeldOutboxMessage(circuit, remoteHost, inbox, heldSince, await getActivity());
+			const routes = message.gatewayInboxes.filter((route) => !permanentRoutes.has(route));
+			worker?.abandon("held-ttl-expired", routes, routes.flatMap((route) => preparationFailuresByRoute.get(route) ?? []));
+			const execute = async () => dropHeldOutboxMessage(circuit, remoteHost, inbox, heldSince, await getActivity());
+			await (worker == null ? execute() : worker.drop(routes, execute));
 		};
 		const heldSince = parseInstant(message.circuitHeldSince);
 		if (circuit != null && heldSince != null && Temporal$2.Instant.compare(heldSince.add(circuit.options.heldActivityTtl), Temporal$2.Now.instant()) <= 0) {
-			const inbox = new URL(message.gatewayInboxes[0]);
+			const parseInbox = () => new URL(message.gatewayInboxes[0]);
+			const inbox = worker == null ? parseInbox() : await worker.prepare("validation", parseInbox);
 			await drop(circuit, require_http.getRemoteHost(inbox), inbox, heldSince);
 			return;
 		}
 		for (const inboxHref of message.gatewayInboxes) {
-			const inbox = new URL(inboxHref);
+			const parseInbox = () => new URL(inboxHref);
+			const inbox = worker == null ? parseInbox() : await worker.prepare("validation", parseInbox);
 			const remoteHost = require_http.getRemoteHost(inbox);
 			const now = Temporal$2.Now.instant();
 			const notBefore = parseInstant(message.gatewayNotBefore?.[inboxHref]);
@@ -10099,6 +11770,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 			try {
 				await sendActivity({
+					attemptStarted: worker?.attemptStarted,
+					observation,
 					allowPrivateAddress: this.allowPrivateAddress,
 					keys,
 					activity: message.activity,
@@ -10106,12 +11779,14 @@ var FederationImpl = class extends FederationBuilderImpl {
 					activityType: message.activityType,
 					inbox,
 					sharedInbox: message.sharedInbox,
-					headers: new Headers(message.headers),
+					headers: worker == null ? new Headers(message.headers) : await worker.prepare("request-preparation", () => new Headers(message.headers)),
 					specDeterminer,
 					meterProvider: this.meterProvider,
 					tracerProvider: this.tracerProvider
 				});
 			} catch (error) {
+				const preparationFailures = worker?.recordPreparationFailure(error, inboxHref) ?? [];
+				if (preparationFailures.length > 0) preparationFailuresByRoute.set(inboxHref, preparationFailures);
 				lastError = error;
 				const isPermanentFailure = error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode);
 				let retryAfter = !isPermanentFailure && error instanceof SendActivityError && (error.statusCode === 429 || error.statusCode === 503) ? parseRetryAfter(error.responseHeaders) : void 0;
@@ -10156,6 +11831,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 					});
 				}
 				if (isPermanentFailure) {
+					permanentRoutes.add(inboxHref);
+					worker?.abandon("permanent-failure", [inboxHref], preparationFailures);
 					logger.warn("Permanent delivery failure for activity {activityId} to {inbox} ({status}); not trying the gateway again.", {
 						...logData,
 						inbox: inboxHref,
@@ -10220,22 +11897,29 @@ var FederationImpl = class extends FederationBuilderImpl {
 				portableInbox: message.portableInbox
 			});
 			if (this.outboxPermanentFailureHandler != null) {
-				const ctx = this.#createContext(new URL(message.baseUrl), contextData, { documentLoader: this.documentLoaderFactory(this.#getLoaderOptions(message.baseUrl)) });
-				try {
-					await this.outboxPermanentFailureHandler(ctx, {
-						reason: "http",
-						inbox,
-						activity: await getActivity(),
-						error,
-						statusCode: error.statusCode,
-						actorIds: getActorIds()
-					});
-				} catch (handlerError) {
-					logger.error("An unexpected error occurred in outboxPermanentFailureHandler:\n{error}", {
-						...logData,
-						error: handlerError
+				const drop = async () => {
+					const ctx = this.#createContext(new URL(message.baseUrl), contextData, {
+						[outboundProvenance]: provenance,
+						documentLoader: this.documentLoaderFactory(this.#getLoaderOptions(message.baseUrl))
 					});
-				}
+					try {
+						await this.outboxPermanentFailureHandler(ctx, {
+							reason: "http",
+							inbox,
+							activity: await getActivity(),
+							error,
+							statusCode: error.statusCode,
+							actorIds: getActorIds()
+						});
+					} catch (handlerError) {
+						worker?.dropFailure(message.gatewayInboxes, handlerError);
+						logger.error("An unexpected error occurred in outboxPermanentFailureHandler:\n{error}", {
+							...logData,
+							error: handlerError
+						});
+					}
+				};
+				await (worker == null ? drop() : worker.drop(message.gatewayInboxes, drop));
 			}
 			require_http.recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
 			return;
@@ -10271,10 +11955,11 @@ var FederationImpl = class extends FederationBuilderImpl {
 				...logData,
 				portableInbox: message.portableInbox
 			});
-			await outboxQueue.enqueue(heldMessage, {
+			const enqueueOptions = {
 				delay: clampNegativeDelay(delay),
 				orderingKey: message.orderingKey
-			});
+			};
+			await (worker == null ? outboxQueue.enqueue(heldMessage, enqueueOptions) : worker.enqueue("defer", heldMessage, enqueueOptions.delay, () => outboxQueue.enqueue(heldMessage, enqueueOptions), survivors.flatMap((route) => preparationFailuresByRoute.get(route.inbox) ?? [])));
 			this.metrics.recordQueueTaskEnqueued({
 				role: "outbox",
 				queue: outboxQueue,
@@ -10292,6 +11977,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			throw lastError;
 		}
 		if (policyDelay == null || outboxQueue == null) {
+			worker?.abandon(outboxQueue == null ? "queue-unavailable" : "retry-policy-declined", survivors.map((route) => route.inbox), survivors.flatMap((route) => preparationFailuresByRoute.get(route.inbox) ?? []));
 			logger.error("Failed to send activity {activityId} to every gateway of {portableInbox} after {attempt} attempts; giving up:\n{error}", {
 				...logData,
 				portableInbox: message.portableInbox,
@@ -10310,10 +11996,11 @@ var FederationImpl = class extends FederationBuilderImpl {
 			portableInbox: message.portableInbox,
 			error: lastError
 		});
-		await outboxQueue.enqueue(retryMessage, {
+		const enqueueOptions = {
 			delay: clampNegativeDelay(delay),
 			orderingKey: message.orderingKey
-		});
+		};
+		await (worker == null ? outboxQueue.enqueue(retryMessage, enqueueOptions) : worker.enqueue("retry", retryMessage, enqueueOptions.delay, () => outboxQueue.enqueue(retryMessage, enqueueOptions), survivors.flatMap((route) => preparationFailuresByRoute.get(route.inbox) ?? [])));
 		this.metrics.recordQueueTaskEnqueued({
 			role: "outbox",
 			queue: outboxQueue,
@@ -10321,18 +12008,24 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}, retryMessage.attempt);
 		require_http.recordOutboxActivity(this.meterProvider, "retried", retryMessage.activityType);
 	}
-	async #listenInboxMessage(ctxData, message, span, onActivityType) {
+	async #listenInboxMessage(ctxData, message, span, provenance, onActivityType) {
 		const logger = (0, _logtape_logtape.getLogger)([
 			"fedify",
 			"federation",
 			"inbox"
 		]);
 		const baseUrl = new URL(message.baseUrl);
-		let context = this.#createContext(baseUrl, ctxData);
-		if (message.identifier != null && this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: await context.getDocumentLoader({ identifier: message.identifier }) });
+		let context = this.#createContext(baseUrl, ctxData, { [outboundProvenance]: provenance });
+		if (message.identifier != null && this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(baseUrl, ctxData, {
+			[outboundProvenance]: provenance,
+			documentLoader: await context.getDocumentLoader({ identifier: message.identifier })
+		});
 		else if (message.identifier == null && this.sharedInboxKeyDispatcher != null) {
 			const identity = await this.sharedInboxKeyDispatcher(context);
-			if (identity != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
+			if (identity != null) context = this.#createContext(baseUrl, ctxData, {
+				[outboundProvenance]: provenance,
+				documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity)
+			});
 		}
 		await this._getTracer().startActiveSpan("activitypub.dispatch_inbox_listener", { kind: _opentelemetry_api.SpanKind.INTERNAL }, async (listenerSpan) => {
 			let activity = null;
@@ -10755,6 +12448,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		const loaderOptions = this.#getLoaderOptions(url.origin);
 		const ctxOptions = {
+			[outboundProvenance]: opts[outboundProvenance],
 			url,
 			federation: this,
 			data: contextData,
@@ -10786,22 +12480,37 @@ var FederationImpl = class extends FederationBuilderImpl {
 			"federation",
 			"outbox"
 		]);
-		const { immediate, collectionSync, orderingKey, context: ctx } = options;
-		if (activity.id == null) throw new TypeError("The activity to send must have an id.");
-		if (activity.actorId == null) throw new TypeError("The activity to send must have at least one actor property.");
-		else if (keys.length < 1) throw new TypeError("The keys must not be empty.");
-		const contextLoader = this.contextLoaderFactory(this.#getLoaderOptions(ctx.origin));
-		const activityId = activity.id.href;
-		let rsaKey = null;
-		const ldSignable = !require_http.hasPortableActor(activity);
-		for (const { keyId, privateKey } of keys) {
-			require_http.validateCryptoKey(privateKey, "private");
-			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !require_http.isPortableKeyId(keyId)) rsaKey = {
-				keyId,
-				privateKey
+		const { immediate, collectionSync, orderingKey, context: ctx, observation, worker, provenance = getOutboundProvenance(ctx) } = options;
+		observation?.setPhase("validation");
+		const validateActivity = () => {
+			if (activity.id == null) throw new TypeError("The activity to send must have an id.");
+			if (activity.actorId == null) throw new TypeError("The activity to send must have at least one actor property.");
+			else if (keys.length < 1) throw new TypeError("The keys must not be empty.");
+			return activity.id.href;
+		};
+		const activityId = worker == null ? validateActivity() : await worker.prepare("validation", validateActivity);
+		observation?.setPhase("serialization");
+		const createContextLoader = () => this.contextLoaderFactory(this.#getLoaderOptions(ctx.origin));
+		const contextLoader = worker == null ? createContextLoader() : await worker.prepare("serialization", createContextLoader);
+		const resolveRsaKey = () => {
+			const ldSignable = !require_http.hasPortableActor(activity);
+			let rsaKey = null;
+			for (const { keyId, privateKey } of keys) {
+				require_http.validateCryptoKey(privateKey, "private");
+				if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !require_http.isPortableKeyId(keyId)) rsaKey = {
+					keyId,
+					privateKey
+				};
+			}
+			return {
+				rsaKey,
+				ldSignable
 			};
-		}
-		const signed = await signOutgoingActivity(activity, keys.map(({ keyId, privateKey }) => ({
+		};
+		observation?.setPhase("key-resolution");
+		const { rsaKey, ldSignable } = worker == null ? resolveRsaKey() : await worker.prepare("key-resolution", resolveRsaKey);
+		observation?.setPhase("signing");
+		const signActivity = () => signOutgoingActivity(activity, keys.map(({ keyId, privateKey }) => ({
 			verificationMethod: keyId,
 			privateKey
 		})), {
@@ -10809,14 +12518,23 @@ var FederationImpl = class extends FederationBuilderImpl {
 			tracerProvider: this.tracerProvider,
 			appendToExistingProofs: false
 		});
+		const signed = worker == null ? await signActivity() : await worker.prepare("signing", signActivity);
 		activity = signed.activity;
 		const { hasProof, proofCreated } = signed;
-		let jsonLd = !proofCreated && options.activityJsonLd != null ? options.activityJsonLd : await activity.toJsonLd({
-			format: "compact",
-			contextLoader
-		});
-		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await require_http.normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, { preserveNestedSecuredDocuments: true });
-		assertSupportedCompoundProofShape(jsonLd, activityId);
+		observation?.setPhase("serialization");
+		const serializeActivity = async () => {
+			let result = !proofCreated && options.activityJsonLd != null ? options.activityJsonLd : await activity.toJsonLd({
+				format: "compact",
+				contextLoader
+			});
+			if (proofCreated || !hasProof || options.normalizeExistingProofs) result = await require_http.normalizeOutgoingActivityJsonLd(result, contextLoader, { preserveNestedSecuredDocuments: true });
+			return result;
+		};
+		let jsonLd = worker == null ? await serializeActivity() : await worker.prepare("serialization", serializeActivity);
+		observation?.setPhase("validation");
+		const validateProofShape = () => assertSupportedCompoundProofShape(jsonLd, activityId);
+		if (worker == null) validateProofShape();
+		else await worker.prepare("validation", validateProofShape);
 		if (rsaKey == null && !ldSignable) logger.debug("The activity {activityId} is performed by a portable actor, so it is sent without a Linked Data signature.", { activityId });
 		else if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			activityId,
@@ -10825,17 +12543,24 @@ var FederationImpl = class extends FederationBuilderImpl {
 				privateKey: pair.privateKey
 			}))
 		});
-		else try {
-			jsonLd = await require_http.signJsonLd(jsonLd, rsaKey.privateKey, rsaKey.keyId, {
-				contextLoader,
-				tracerProvider: this.tracerProvider
-			});
-		} catch (error) {
-			if (!isLinkedDataSignatureJsonLdProcessingError(error)) throw error;
-			logger.warn("Failed to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.", {
-				activityId,
-				error
-			});
+		else {
+			const signLinkedData = async () => {
+				try {
+					observation?.setPhase("signing");
+					return await require_http.signJsonLd(jsonLd, rsaKey.privateKey, rsaKey.keyId, {
+						contextLoader,
+						tracerProvider: this.tracerProvider
+					});
+				} catch (error) {
+					if (!isLinkedDataSignatureJsonLdProcessingError(error)) throw error;
+					logger.warn("Failed to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.", {
+						activityId,
+						error
+					});
+					return jsonLd;
+				}
+			};
+			jsonLd = worker == null ? await signLinkedData() : await worker.prepare("signing", signLinkedData);
 		}
 		if (!hasProof) logger.warn("No supported key found to create a proof for the activity {activityId}.  The activity will be sent without a proof.  In order to create a proof, at least one Ed25519 key must be provided.", {
 			activityId,
@@ -10844,6 +12569,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				privateKey: pair.privateKey
 			}))
 		});
+		observation?.setPhase("request-preparation");
 		if (immediate || this.outboxQueue == null) {
 			if (immediate) logger.debug("Sending activity immediately without queue since immediate option is set.", {
 				activityId: activity.id.href,
@@ -10854,18 +12580,40 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity: jsonLd
 			});
 			const promises = [];
-			for (const inbox in inboxes) promises.push(sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
-				allowPrivateAddress: this.allowPrivateAddress,
-				keys,
-				activity: jsonLd,
-				activityId: activity.id?.href,
-				activityType: (0, _fedify_vocab.getTypeId)(activity).href,
-				sharedInbox: inboxes[inbox].sharedInbox,
-				headers: collectionSync == null ? void 0 : new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) }),
-				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
-				meterProvider: this.meterProvider,
-				tracerProvider: this.tracerProvider
-			}));
+			for (const inbox in inboxes) {
+				const delivery = observation?.delivery(inbox);
+				let sending;
+				try {
+					const createHeaders = collectionSync == null ? void 0 : async () => new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) });
+					const sendActivityId = activity.id?.href;
+					const activityType = (0, _fedify_vocab.getTypeId)(activity).href;
+					observation?.setActivity({
+						...sendActivityId == null ? {} : { id: sendActivityId },
+						type: activityType
+					});
+					sending = sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
+						attemptStarted: worker == null ? void 0 : (target) => worker.directAttemptStarted(target, observation?.continuation(inbox)?.outbound),
+						observation: delivery,
+						allowPrivateAddress: this.allowPrivateAddress,
+						keys,
+						activity: jsonLd,
+						activityId: sendActivityId,
+						activityType,
+						sharedInbox: inboxes[inbox].sharedInbox,
+						headers: createHeaders == null ? void 0 : await (worker == null ? createHeaders() : worker.prepare("request-preparation", createHeaders)),
+						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
+						meterProvider: this.meterProvider,
+						tracerProvider: this.tracerProvider
+					});
+				} catch (error) {
+					if (delivery != null) await delivery.failed(error);
+					throw error;
+				}
+				if (observation != null) sending.catch(() => {});
+				if (delivery != null) await delivery.handoff({ type: "direct" });
+				promises.push(sending);
+			}
+			if (observation != null) await observation.prepared("delivery");
 			await Promise.all(promises);
 			return;
 		}
@@ -10873,48 +12621,71 @@ var FederationImpl = class extends FederationBuilderImpl {
 			activityId: activity.id.href,
 			activity: jsonLd
 		});
+		observation?.setPhase("key-resolution");
 		const keyJwkPairs = [];
 		for (const { keyId, privateKey } of keys) {
-			const privateKeyJwk = await require_http.exportJwk(privateKey);
+			const exportPrivateKey = () => require_http.exportJwk(privateKey);
+			const privateKeyJwk = worker == null ? await exportPrivateKey() : await worker.prepare("key-export", exportPrivateKey);
 			keyJwkPairs.push({
 				keyId: keyId.href,
 				privateKey: privateKeyJwk
 			});
 		}
 		if (!this.manuallyStartQueue) this._startQueueInternal(ctx.data);
+		observation?.setPhase("request-preparation");
 		const carrier = {};
-		_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
+		const injectTraceContext = () => _opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
+		if (worker == null) injectTraceContext();
+		else await worker.prepare("request-preparation", injectTraceContext);
 		const messages = [];
-		for (const inbox in inboxes) {
-			const { portableInbox, gatewayInboxes } = inboxes[inbox];
-			const messageOrderingKey = orderingKey == null ? void 0 : `${orderingKey}\n${getOrderingDestination(inbox, portableInbox)}`;
-			const message = {
-				type: "outbox",
-				id: crypto.randomUUID(),
-				baseUrl: ctx.origin,
-				keys: keyJwkPairs,
-				activity: jsonLd,
-				activityId: activity.id?.href,
-				activityType: (0, _fedify_vocab.getTypeId)(activity).href,
-				inbox,
-				sharedInbox: inboxes[inbox].sharedInbox,
-				actorIds: [...inboxes[inbox].actorIds],
-				started: (/* @__PURE__ */ new Date()).toISOString(),
-				attempt: 0,
-				headers: collectionSync == null ? {} : { "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) },
-				orderingKey: messageOrderingKey,
-				...getPortableMessageFields(portableInbox, gatewayInboxes),
-				traceContext: carrier
+		for (const inbox in inboxes) try {
+			const prepareMessage = async () => {
+				const { portableInbox, gatewayInboxes } = inboxes[inbox];
+				const messageOrderingKey = orderingKey == null ? void 0 : `${orderingKey}\n${getOrderingDestination(inbox, portableInbox)}`;
+				const messageActivityId = activity.id?.href;
+				const messageActivityType = (0, _fedify_vocab.getTypeId)(activity).href;
+				observation?.setActivity({
+					...messageActivityId == null ? {} : { id: messageActivityId },
+					type: messageActivityType
+				});
+				return {
+					message: {
+						type: "outbox",
+						...serializeProvenance(provenance),
+						id: crypto.randomUUID(),
+						baseUrl: ctx.origin,
+						keys: keyJwkPairs,
+						activity: jsonLd,
+						activityId: messageActivityId,
+						activityType: messageActivityType,
+						inbox,
+						...observation?.continuation(inbox),
+						sharedInbox: inboxes[inbox].sharedInbox,
+						actorIds: [...inboxes[inbox].actorIds],
+						started: (/* @__PURE__ */ new Date()).toISOString(),
+						attempt: 0,
+						headers: collectionSync == null ? {} : { "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) },
+						orderingKey: messageOrderingKey,
+						...getPortableMessageFields(portableInbox, gatewayInboxes),
+						traceContext: carrier
+					},
+					orderingKey: messageOrderingKey
+				};
 			};
-			messages.push({
-				message,
-				orderingKey: messageOrderingKey
-			});
+			messages.push(await (worker == null ? prepareMessage() : worker.prepare("request-preparation", prepareMessage)));
+		} catch (error) {
+			if (observation != null) await observation.delivery(inbox)?.failed(error);
+			throw error;
 		}
+		if (observation != null) await observation.prepared("delivery");
 		const { outboxQueue } = this;
 		if (outboxQueue.enqueueMany == null || orderingKey != null) {
 			const errors = (await Promise.allSettled(messages.map(async (m) => {
-				await outboxQueue.enqueue(m.message, { orderingKey: m.orderingKey });
+				const enqueue = () => worker == null ? outboxQueue.enqueue(m.message, { orderingKey: m.orderingKey }) : worker.enqueueChildren([m.message], () => outboxQueue.enqueue(m.message, { orderingKey: m.orderingKey }));
+				await (observation == null ? enqueue() : observation.enqueue([{
+					inbox: m.message.inbox,
+					queueMessageId: m.message.id
+				}], "outbox", enqueue));
 				require_http.recordOutboxEnqueue(this.meterProvider, outboxQueue, m.message);
 			}))).filter((r) => r.status === "rejected").map((r) => r.reason);
 			if (errors.length > 0) {
@@ -10927,7 +12698,11 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		} else {
 			try {
-				await outboxQueue.enqueueMany(messages.map((m) => m.message));
+				const enqueue = () => worker == null ? outboxQueue.enqueueMany(messages.map((m) => m.message)) : worker.enqueueChildren(messages.map((m) => m.message), () => outboxQueue.enqueueMany(messages.map((m) => m.message)));
+				await (observation == null ? enqueue() : observation.enqueue(messages.map(({ message }) => ({
+					inbox: message.inbox,
+					queueMessageId: message.id
+				})), "outbox", enqueue));
 			} catch (error) {
 				logger.error("Failed to enqueue activity {activityId} to send later: {error}", {
 					activityId: activity.id.href,
@@ -10939,9 +12714,16 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 	}
 	fetch(request, options) {
-		return (0, _logtape_logtape.withContext)({ requestId: getRequestId(request) }, async () => {
+		const requestId = getRequestId(request);
+		return (0, _logtape_logtape.withContext)({
+			requestId,
+			inboxRequestId: void 0,
+			dispatchId: void 0,
+			sourceInboxRequestId: void 0,
+			sourceRequestId: void 0
+		}, async () => {
 			const tracer = this._getTracer();
-			const metricState = {};
+			const metricState = { requestId };
 			const metricStart = performance.now();
 			return await tracer.startActiveSpan(request.method, {
 				kind: _opentelemetry_api.SpanKind.SERVER,
@@ -10986,7 +12768,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 						logger.error("An error occurred while serving request {method} {url}: {error}", {
 							method: request.method,
 							url: request.url,
-							error
+							error,
+							...metricState.inboxRequest == null ? {} : { inboxRequestId: metricState.inboxRequest.inboxRequestId }
 						});
 						throw error;
 					}
@@ -11006,6 +12789,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					const url = new URL(request.url);
 					const logTpl = "{method} {path}: {status}";
 					const values = {
+						...metricState.inboxRequest == null ? {} : { inboxRequestId: metricState.inboxRequest.inboxRequestId },
 						method: request.method,
 						path: `${url.pathname}${url.search}`,
 						url: request.url,
@@ -11058,9 +12842,11 @@ var FederationImpl = class extends FederationBuilderImpl {
 		metricState.endpoint = getEndpointCategory(route.name);
 		span.updateName(`${request.method} ${route.template}`);
 		const routeName = route.name.replace(/:.*$/, "");
+		const source = request.method === "POST" && (routeName === "inbox" || routeName === "sharedInbox") ? this.#createInboxRequestSource(request, metricState) : void 0;
+		const provenance = globalThis.Object.freeze(source == null ? { originatingRequestId: metricState.requestId } : { inboxRequest: source });
 		let context;
 		try {
-			context = this.#createContext(request, contextData);
+			context = (0, _logtape_logtape.withContext)(source == null ? {} : { inboxRequestId: source.inboxRequestId }, () => this.#createContext(request, contextData, { [outboundProvenance]: provenance }));
 		} catch (error) {
 			if (request.method !== "POST" || routeName !== "inbox" && routeName !== "sharedInbox") throw error;
 			return await this.#reportInboxPreparationError(request, contextData, {
@@ -11131,13 +12917,19 @@ var FederationImpl = class extends FederationBuilderImpl {
 			const observation = new InboxObservation({
 				kind: routeName === "inbox" ? "personal" : "shared",
 				recipient
-			});
+			}, source);
 			this.#setInboxCompletion(metricState, observation, () => context);
-			return await observation.run(async () => {
-				if (routeName === "inbox") context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier: recipient }) });
+			return await (0, _logtape_logtape.withContext)({ inboxRequestId: source.inboxRequestId }, () => observation.run(async () => {
+				if (routeName === "inbox") context = this.#createContext(request, contextData, {
+					[outboundProvenance]: getOutboundProvenance(context),
+					documentLoader: await context.getDocumentLoader({ identifier: recipient })
+				});
 				else if (this.sharedInboxKeyDispatcher != null) {
 					const identity = await this.sharedInboxKeyDispatcher(context);
-					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
+					if (identity != null) context = this.#createContext(request, contextData, {
+						[outboundProvenance]: getOutboundProvenance(context),
+						documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity)
+					});
 				}
 				return await this.#handleInbox(request, {
 					recipient,
@@ -11146,13 +12938,16 @@ var FederationImpl = class extends FederationBuilderImpl {
 					onNotFound,
 					observation
 				});
-			}, span);
+			}, span));
 		}
 		switch (routeName) {
 			case "actor":
 			case "actorAlias": {
 				const identifier = route.name.startsWith("actorAlias:") ? route.name.substring(11) : route.values.identifier;
-				context = this.#createContext(request, contextData, { invokedFromActorDispatcher: { identifier } });
+				context = this.#createContext(request, contextData, {
+					[outboundProvenance]: getOutboundProvenance(context),
+					invokedFromActorDispatcher: { identifier }
+				});
 				return await handleActor(request, {
 					identifier,
 					context,
@@ -11166,10 +12961,13 @@ var FederationImpl = class extends FederationBuilderImpl {
 				const typeId = route.name.replace(/^object:/, "");
 				const callbacks = this.objectCallbacks[typeId];
 				const cls = this.objectTypeIds[typeId];
-				context = this.#createContext(request, contextData, { invokedFromObjectDispatcher: {
-					cls,
-					values: route.values
-				} });
+				context = this.#createContext(request, contextData, {
+					[outboundProvenance]: getOutboundProvenance(context),
+					invokedFromObjectDispatcher: {
+						cls,
+						values: route.values
+					}
+				});
 				return await handleObject(request, {
 					values: route.values,
 					context,
@@ -11227,7 +13025,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 			case "sharedInbox":
 				if (this.sharedInboxKeyDispatcher != null) {
 					const identity = await this.sharedInboxKeyDispatcher(context);
-					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
+					if (identity != null) context = this.#createContext(request, contextData, {
+						[outboundProvenance]: getOutboundProvenance(context),
+						documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity)
+					});
 				}
 				return await this.#handleInbox(request, {
 					recipient: route.values.identifier ?? null,
@@ -11371,14 +13172,17 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return response;
 		}
+		const provenance = globalThis.Object.freeze({ originatingRequestId: metricState.requestId });
 		if (collectionRoute != null) return await this.#fetchPortableCollection(request, portable, route, {
 			onNotFound,
 			onUnauthorized,
-			contextData
+			contextData,
+			provenance
 		});
 		if (isActor) {
 			const identifier = route.name.startsWith("actorAlias:") ? route.name.substring(11) : route.values.identifier;
 			const context = this.#createContext(request, contextData, {
+				[outboundProvenance]: provenance,
 				invokedFromActorDispatcher: { identifier },
 				portableRequest: portable.portableRequest
 			});
@@ -11399,6 +13203,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const callbacks = this.objectCallbacks[typeId];
 		const cls = this.objectTypeIds[typeId];
 		const context = this.#createContext(request, contextData, {
+			[outboundProvenance]: provenance,
 			invokedFromObjectDispatcher: {
 				cls,
 				values: route.values
@@ -11416,7 +13221,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound
 		});
 	}
-	async #fetchPortableCollection(request, portable, route, { onNotFound, onUnauthorized, contextData }) {
+	async #fetchPortableCollection(request, portable, route, { onNotFound, onUnauthorized, contextData, provenance }) {
 		const logger = (0, _logtape_logtape.getLogger)([
 			"fedify",
 			"federation",
@@ -11424,8 +13229,11 @@ var FederationImpl = class extends FederationBuilderImpl {
 		]);
 		const url = new URL(request.url);
 		const { authority } = portable.portableRequest;
-		const ownerContext = this.#createContext(request, contextData);
-		const context = this.#createContext(request, contextData, { portableRequest: portable.portableRequest });
+		const ownerContext = this.#createContext(request, contextData, { [outboundProvenance]: provenance });
+		const context = this.#createContext(request, contextData, {
+			[outboundProvenance]: provenance,
+			portableRequest: portable.portableRequest
+		});
 		const reject = async (reason, identifier) => {
 			logger.debug("Not serving the portable collection {collection} of the actor {identifier}: {reason}.", {
 				collection: portable.canonicalId,
@@ -11518,6 +13326,11 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		return await onNotFound(request);
 	}
+	#createInboxRequestSource(request, metricState) {
+		const source = createInboxRequestSource(request, metricState.requestId ?? getRequestId(request), this.origin?.webOrigin);
+		metricState.inboxRequest = source;
+		return source;
+	}
 	#setInboxCompletion(metricState, observation, getContext) {
 		const handler = this.inboxRequestFinishedHandler;
 		metricState.inboxCompletion = {
@@ -11549,6 +13362,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	async #reportInboxPreparationError(request, contextData, inbox, error, span, metricState) {
 		const unavailableLoader = () => Promise.reject(error);
 		const context = new RequestContextImpl({
+			[outboundProvenance]: globalThis.Object.freeze({ inboxRequest: metricState.inboxRequest }),
 			url: new URL(request.url),
 			request,
 			federation: this,
@@ -11556,7 +13370,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			documentLoader: unavailableLoader,
 			contextLoader: unavailableLoader
 		});
-		const observation = new InboxObservation(inbox);
+		const observation = new InboxObservation(inbox, metricState.inboxRequest);
 		this.#setInboxCompletion(metricState, observation, () => context);
 		return await observation.run(() => Promise.reject(error), span);
 	}
@@ -11614,9 +13428,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 		metricState.endpoint = "inbox";
 		span.updateName(`${request.method} ${metricState.routeTemplate}`);
 		const identifier = route.values.identifier;
+		const source = this.#createInboxRequestSource(request, metricState);
 		let context;
 		try {
-			context = this.#createContext(request, contextData);
+			context = (0, _logtape_logtape.withContext)({ inboxRequestId: source.inboxRequestId }, () => this.#createContext(request, contextData, { [outboundProvenance]: globalThis.Object.freeze({ inboxRequest: source }) }));
 		} catch (error) {
 			return await this.#reportInboxPreparationError(request, contextData, {
 				kind: "portable",
@@ -11626,9 +13441,9 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const observation = new InboxObservation({
 			kind: "portable",
 			recipient: identifier
-		});
+		}, source);
 		this.#setInboxCompletion(metricState, observation, () => context);
-		return await observation.run(async () => {
+		return await (0, _logtape_logtape.withContext)({ inboxRequestId: source.inboxRequestId }, () => observation.run(async () => {
 			const actor = this.actorCallbacks?.dispatcher == null ? null : await this.actorCallbacks.dispatcher(context, identifier);
 			const localOrigin = context.canonicalOrigin;
 			const resolution = resolvePortableInboxRecipient(actor == null || actor instanceof _fedify_vocab.Tombstone ? null : actor, {
@@ -11645,7 +13460,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 				return await onNotFound(request);
 			}
 			const { recipient } = resolution;
-			if (this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier }) });
+			if (this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(request, contextData, {
+				[outboundProvenance]: getOutboundProvenance(context),
+				documentLoader: await context.getDocumentLoader({ identifier })
+			});
 			const excludedOrigins = [localOrigin, new URL(request.url).origin];
 			return await this.#handleInbox(request, {
 				recipient: identifier,
@@ -11655,16 +13473,25 @@ var FederationImpl = class extends FederationBuilderImpl {
 				onNotFound,
 				portableInbox: {
 					recipient,
-					forward: async (activity, activityId, activityType, signatures) => {
-						if (this.portableInboxForwarding.maxTargets < 1) return;
+					forward: (activity, activityId, activityType, signatures) => observeOutboundBroadcast(context, this.outboundObservers, async (observation) => {
+						observation?.setActivity({
+							...activityId == null ? {} : { id: activityId.href },
+							type: activityType
+						});
+						if (this.portableInboxForwarding.maxTargets < 1) {
+							if (observation != null) await observation.skipped("forwarding-disabled");
+							return;
+						}
 						if (this.kv.cas == null) {
 							if (!this.#portableInboxForwardingWarned) {
 								this.#portableInboxForwardingWarned = true;
 								logger.warn("Activities delivered to FEP-ef61 portable inboxes are not forwarded to the other gateways, as the key–value store does not support compare-and-swap (KvStore.cas()), which is needed to forward each activity at most once.");
 							}
+							if (observation != null) await observation.skipped("forwarding-unavailable");
 							return;
 						}
 						await forwardPortableInboxActivity({
+							provenance: getOutboundProvenance(context),
 							recipient,
 							activity,
 							activityId,
@@ -11682,11 +13509,11 @@ var FederationImpl = class extends FederationBuilderImpl {
 							options: this.portableInboxForwarding,
 							meterProvider: this.meterProvider,
 							tracerProvider: this.tracerProvider
-						});
-					}
+						}, observation);
+					}, "portable-replication")
 				}
 			});
-		}, span);
+		}, span));
 	}
 	/**
 	* Gets this server's gateway key pairs for the portable actor that owns
@@ -11756,7 +13583,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				headers: { "Content-Type": "text/plain; charset=utf-8" }
 			});
 		}
-		const context = this.#createContext(request, contextData);
+		const context = this.#createContext(request, contextData, { [outboundProvenance]: globalThis.Object.freeze({ originatingRequestId: metricState.requestId }) });
 		const response = await this.hashlinkMediaDispatcher(context, media.media);
 		if (response == null) return await onNotFound(request);
 		return await discardBodyForHead(request, response, false);
@@ -11898,8 +13725,9 @@ var ContextImpl = class ContextImpl {
 	verifyPortableObject;
 	invokedFromActorKeyPairsDispatcher;
 	#codec;
-	constructor({ url, federation, data, documentLoader, contextLoader, invokedFromActorKeyPairsDispatcher }) {
+	constructor({ url, federation, data, documentLoader, contextLoader, invokedFromActorKeyPairsDispatcher, [outboundProvenance]: provenance = emptyProvenance }) {
 		this.url = url;
+		globalThis.Object.assign(this, { [outboundProvenance]: provenance });
 		this.federation = federation;
 		this.data = data;
 		this.documentLoader = documentLoader;
@@ -11921,6 +13749,7 @@ var ContextImpl = class ContextImpl {
 	}
 	clone(data) {
 		return new ContextImpl({
+			[outboundProvenance]: getOutboundProvenance(this),
 			url: this.url,
 			federation: this.federation,
 			data,
@@ -11931,6 +13760,7 @@ var ContextImpl = class ContextImpl {
 	}
 	toInboxContext(recipient, activity, activityId, activityType, metadata) {
 		return new InboxContextImpl(recipient, activity, activityId, activityType, {
+			[outboundProvenance]: getOutboundProvenance(this),
 			url: this.url,
 			federation: this.federation,
 			data: this.data,
@@ -11941,6 +13771,7 @@ var ContextImpl = class ContextImpl {
 	}
 	toOutboxContext(identifier, activity, activityId, activityType) {
 		return new OutboxContextImpl(identifier, activity, activityId, activityType, {
+			[outboundProvenance]: getOutboundProvenance(this),
 			url: this.url,
 			federation: this.federation,
 			data: this.data,
@@ -12330,36 +14161,49 @@ var ContextImpl = class ContextImpl {
 		await this.#enqueueTasks(task, payloads, options);
 	}
 	sendActivity(sender, recipients, activity, options = {}) {
-		return this.tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan(this.federation.outboxQueue == null || options.immediate ? "activitypub.outbox" : "activitypub.fanout", {
-			kind: this.federation.outboxQueue == null || options.immediate ? _opentelemetry_api.SpanKind.CLIENT : _opentelemetry_api.SpanKind.PRODUCER,
-			attributes: {
-				"activitypub.activity.type": (0, _fedify_vocab.getTypeId)(activity).href,
-				"activitypub.activity.to": activity.toIds.map((to) => to.href),
-				"activitypub.activity.cc": activity.ccIds.map((cc) => cc.href),
-				"activitypub.activity.bto": activity.btoIds.map((bto) => bto.href),
-				"activitypub.activity.bcc": activity.bccIds.map((bcc) => bcc.href)
-			}
-		}, async (span) => {
-			try {
-				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
-				await this.sendActivityInternal(sender, recipients, activity, options, span);
-			} catch (e) {
-				span.setStatus({
-					code: _opentelemetry_api.SpanStatusCode.ERROR,
-					message: String(e)
-				});
-				throw e;
-			} finally {
-				span.end();
-			}
-		});
+		return observeOutboundBroadcast(this, this.federation.outboundObservers, (observation, provenance) => {
+			const tracer = this.tracerProvider.getTracer(require_http.name, require_http.version);
+			const parentSpanContext = _opentelemetry_api.trace.getSpanContext(_opentelemetry_api.context.active());
+			const activityType = (0, _fedify_vocab.getTypeId)(activity).href;
+			observation?.setActivity({ type: activityType });
+			return tracer.startActiveSpan(this.federation.outboxQueue == null || options.immediate ? "activitypub.outbox" : "activitypub.fanout", {
+				kind: this.federation.outboxQueue == null || options.immediate ? _opentelemetry_api.SpanKind.CLIENT : _opentelemetry_api.SpanKind.PRODUCER,
+				attributes: {
+					"activitypub.activity.type": activityType,
+					"activitypub.activity.to": activity.toIds.map((to) => to.href),
+					"activitypub.activity.cc": activity.ccIds.map((cc) => cc.href),
+					"activitypub.activity.bto": activity.btoIds.map((bto) => bto.href),
+					"activitypub.activity.bcc": activity.bccIds.map((bcc) => bcc.href)
+				}
+			}, async (span) => {
+				observation?.setSpan(span, parentSpanContext);
+				try {
+					const activityId = activity.id?.href;
+					if (activityId != null) span.setAttribute("activitypub.activity.id", activityId);
+					observation?.setActivity({
+						type: activityType,
+						...activityId == null ? {} : { id: activityId }
+					});
+					await this.sendActivityInternal(sender, recipients, activity, options, span, observation, provenance);
+				} catch (e) {
+					span.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: String(e)
+					});
+					throw e;
+				} finally {
+					span.end();
+				}
+			});
+		}, "send", options.dispatchId);
 	}
-	async sendActivityInternal(sender, recipients, activity, options, span) {
+	async sendActivityInternal(sender, recipients, activity, options, span, observation, provenance = getOutboundProvenance(this)) {
 		const logger = (0, _logtape_logtape.getLogger)([
 			"fedify",
 			"federation",
 			"outbox"
 		]);
+		observation?.setPhase("sender-resolution");
 		let keys;
 		let identifier = null;
 		let actorKeyPairs = null;
@@ -12375,6 +14219,7 @@ var ContextImpl = class ContextImpl {
 				}
 			}
 			span.setAttribute("fedify.actor.identifier", identifier);
+			observation?.setPhase("key-resolution");
 			if (this.federation.actorCallbacks?.keyPairsDispatcher == null) throw new Error("No actor key pairs dispatcher registered.");
 			actorKeyPairs = await this.getActorKeyPairs(identifier);
 			if (actorKeyPairs.length < 1) throw new Error(`No key pair found for actor ${JSON.stringify(identifier)}.`);
@@ -12383,11 +14228,14 @@ var ContextImpl = class ContextImpl {
 				privateKey: kp.privateKey
 			}));
 		} else if (Array.isArray(sender)) {
+			observation?.setPhase("key-resolution");
 			if (sender.length < 1) throw new Error("The sender's key pairs are empty.");
 			keys = sender;
 		} else keys = [sender];
 		if (keys.length < 1) throw new TypeError("The sender's keys must not be empty.");
+		observation?.setPhase("key-resolution");
 		for (const { privateKey } of keys) require_http.validateCryptoKey(privateKey, "private");
+		observation?.setPhase("recipient-resolution");
 		let expandedRecipients;
 		let collectionSync;
 		if (Array.isArray(recipients)) expandedRecipients = recipients;
@@ -12403,14 +14251,34 @@ var ContextImpl = class ContextImpl {
 		} else expandedRecipients = [recipients];
 		const opts = {
 			context: this,
+			observation,
+			provenance,
 			orderingKey: options.orderingKey,
 			collectionSync,
 			immediate: options.immediate,
 			normalizeExistingProofs: options.normalizeExistingProofs
 		};
 		span.setAttribute("activitypub.inboxes", expandedRecipients.length);
+		observation?.setPhase("transformation");
+		if (this.federation.activityTransformers.length > 0) observation?.setActivity({});
 		for (const activityTransformer of this.federation.activityTransformers) activity = activityTransformer(activity, this);
-		span?.setAttribute("activitypub.activity.id", activity?.id?.href ?? "");
+		let transformedActivityId;
+		try {
+			transformedActivityId = activity?.id?.href;
+		} finally {
+			if (observation != null) {
+				let activityType;
+				try {
+					activityType = (0, _fedify_vocab.getTypeId)(activity)?.href;
+				} catch {}
+				observation.setActivity({
+					...transformedActivityId == null ? {} : { id: transformedActivityId },
+					...activityType == null ? {} : { type: activityType }
+				});
+			}
+		}
+		span?.setAttribute("activitypub.activity.id", transformedActivityId ?? "");
+		observation?.setPhase("validation");
 		if (activity.actorId == null) {
 			logger.error("Activity {activityId} to send does not have an actor.", {
 				activity,
@@ -12418,6 +14286,7 @@ var ContextImpl = class ContextImpl {
 			});
 			throw new TypeError("The activity to send must have at least one actor property.");
 		}
+		observation?.setPhase("signing");
 		const { activity: signedActivity, proofCreated } = await signOutgoingActivity(activity, actorKeyPairs == null ? keys.map(({ keyId, privateKey }) => ({
 			verificationMethod: keyId,
 			privateKey
@@ -12430,16 +14299,19 @@ var ContextImpl = class ContextImpl {
 			appendToExistingProofs: actorKeyPairs != null
 		});
 		activity = signedActivity;
+		observation?.setPhase("destination-planning");
 		const inboxes = extractInboxes({
 			recipients: expandedRecipients,
 			preferSharedInbox: options.preferSharedInbox,
 			excludeBaseUris: options.excludeBaseUris
 		});
+		if (observation != null) await observation.planDestinations(inboxes);
 		if (globalThis.Object.keys(inboxes).length < 1) {
 			logger.debug("No inboxes found for activity {activityId}.", {
 				activityId: activity.id?.href,
 				activity
 			});
+			if (observation != null) await observation.skipped();
 			return false;
 		}
 		logger.debug("Sending activity {activityId} to inboxes:\n{inboxes}", {
@@ -12447,6 +14319,7 @@ var ContextImpl = class ContextImpl {
 			activityId: activity.id?.href,
 			activity
 		});
+		observation?.setPhase("serialization");
 		const activityJsonLd = await activity.toJsonLd({
 			format: "compact",
 			contextLoader: this.contextLoader
@@ -12467,33 +14340,48 @@ var ContextImpl = class ContextImpl {
 			});
 			return true;
 		}
+		observation?.setPhase("validation");
 		assertSupportedCompoundProofShape(activityJsonLd, activity.id?.href);
+		observation?.setPhase("key-resolution");
 		const keyJwkPairs = await Promise.all(keys.map(async ({ keyId, privateKey }) => ({
 			keyId: keyId.href,
 			privateKey: await require_http.exportJwk(privateKey)
 		})));
+		observation?.setPhase("request-preparation");
 		const carrier = {};
 		_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
+		const activityId = activity.id?.href;
+		const activityType = (0, _fedify_vocab.getTypeId)(activity).href;
+		observation?.setActivity({
+			...activityId == null ? {} : { id: activityId },
+			type: activityType
+		});
 		const message = {
 			type: "fanout",
+			...serializeProvenance(provenance),
 			id: crypto.randomUUID(),
 			baseUrl: this.origin,
 			keys: keyJwkPairs,
 			inboxes: globalThis.Object.fromEntries(globalThis.Object.entries(inboxes).map(([k, { actorIds, sharedInbox, portableInbox, gatewayInboxes }]) => [k, {
 				actorIds: [...actorIds],
+				...observation?.continuation(k),
 				sharedInbox,
 				...getPortableMessageFields(portableInbox, gatewayInboxes)
 			}])),
 			activity: activityJsonLd,
-			activityId: activity.id?.href,
-			activityType: (0, _fedify_vocab.getTypeId)(activity).href,
+			activityId,
+			activityType,
 			collectionSync: opts.collectionSync,
 			orderingKey: options.orderingKey,
 			normalizeExistingProofs: proofCreated || options.normalizeExistingProofs,
 			traceContext: carrier
 		};
 		if (!this.federation.manuallyStartQueue) this.federation._startQueueInternal(this.data);
-		await this.federation.fanoutQueue.enqueue(message, { orderingKey: options.orderingKey });
+		if (observation != null) await observation.prepared("fanout");
+		await (observation == null ? this.federation.fanoutQueue.enqueue(message, { orderingKey: options.orderingKey }) : observation.enqueue(globalThis.Object.keys(inboxes).map((inbox) => ({
+			inbox,
+			queueMessageId: message.id
+		})), "fanout", () => this.federation.fanoutQueue.enqueue(message, { orderingKey: options.orderingKey })));
 		require_http.getFederationMetrics(this.federation.meterProvider).recordQueueTaskEnqueued({
 			role: "fanout",
 			queue: this.federation.fanoutQueue,
@@ -12754,6 +14642,7 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	}
 	clone(data) {
 		return new RequestContextImpl({
+			[outboundProvenance]: getOutboundProvenance(this),
 			url: this.url,
 			federation: this.federation,
 			data,
@@ -12925,30 +14814,40 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	}
 };
 function forwardActivity(ctx, loggerCategory, forwarder, recipients, options) {
-	return ctx.tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan(ctx.federation.outboxQueue == null || options?.immediate ? `activitypub.${loggerCategory}` : "activitypub.fanout", {
-		kind: ctx.federation.outboxQueue == null || options?.immediate ? _opentelemetry_api.SpanKind.CLIENT : _opentelemetry_api.SpanKind.PRODUCER,
-		attributes: { "activitypub.activity.type": ctx.activityType }
-	}, async (span) => {
-		try {
-			if (ctx.activityId != null) span.setAttribute("activitypub.activity.id", ctx.activityId);
-			return await forwardActivityInternal(ctx, loggerCategory, forwarder, recipients, options);
-		} catch (e) {
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(e)
-			});
-			throw e;
-		} finally {
-			span.end();
-		}
-	});
+	return observeOutboundBroadcast(ctx, ctx.federation.outboundObservers, (observation, provenance) => {
+		observation?.setActivity({
+			...ctx.activityId == null ? {} : { id: ctx.activityId },
+			type: ctx.activityType
+		});
+		const tracer = ctx.tracerProvider.getTracer(require_http.name, require_http.version);
+		const parentSpanContext = _opentelemetry_api.trace.getSpanContext(_opentelemetry_api.context.active());
+		return tracer.startActiveSpan(ctx.federation.outboxQueue == null || options?.immediate ? `activitypub.${loggerCategory}` : "activitypub.fanout", {
+			kind: ctx.federation.outboxQueue == null || options?.immediate ? _opentelemetry_api.SpanKind.CLIENT : _opentelemetry_api.SpanKind.PRODUCER,
+			attributes: { "activitypub.activity.type": ctx.activityType }
+		}, async (span) => {
+			observation?.setSpan(span, parentSpanContext);
+			try {
+				if (ctx.activityId != null) span.setAttribute("activitypub.activity.id", ctx.activityId);
+				return await forwardActivityInternal(ctx, loggerCategory, forwarder, recipients, options, observation, provenance);
+			} catch (e) {
+				span.setStatus({
+					code: _opentelemetry_api.SpanStatusCode.ERROR,
+					message: String(e)
+				});
+				throw e;
+			} finally {
+				span.end();
+			}
+		});
+	}, "forward", options?.dispatchId);
 }
-async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipients, options) {
+async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipients, options, observation, provenance = getOutboundProvenance(ctx)) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		loggerCategory
 	]);
+	observation?.setPhase("sender-resolution");
 	let keys;
 	let identifier = null;
 	if ("identifier" in forwarder || "username" in forwarder) {
@@ -12962,6 +14861,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 				identifier = mapped;
 			}
 		}
+		observation?.setPhase("key-resolution");
 		const actorKeyPairs = await ctx.getActorKeyPairs(identifier);
 		if (actorKeyPairs.length < 1) throw new Error(`No key pair found for actor ${JSON.stringify(identifier)}.`);
 		keys = actorKeyPairs.map((kp) => ({
@@ -12969,12 +14869,17 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			privateKey: kp.privateKey
 		}));
 	} else if (Array.isArray(forwarder)) {
+		observation?.setPhase("key-resolution");
 		if (forwarder.length < 1) throw new Error("The forwarder's key pairs are empty.");
 		keys = forwarder;
 	} else keys = [forwarder];
+	observation?.setPhase("validation");
 	if (!require_http.hasSignatureLike(ctx.activity)) {
 		if (!require_http.hasProofLike(ctx.activity)) {
-			if (options?.skipIfUnsigned) return false;
+			if (options?.skipIfUnsigned) {
+				if (observation != null) await observation.skipped("unsigned");
+				return false;
+			}
 			logger.warn("The activity {activityId} is not signed; even if it is forwarded to other servers as is, it may not be accepted by them due to the lack of a signature/proof.", {
 				activityId: ctx.activityId,
 				activityType: ctx.activityType,
@@ -12982,23 +14887,27 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			});
 		}
 	}
+	observation?.setPhase("recipient-resolution");
 	if (recipients === "followers") {
 		if (identifier == null) throw new Error("If recipients is \"followers\", forwarder must be an actor identifier or username.");
 		const followers = [];
 		for await (const recipient of ctx.getFollowers(identifier)) followers.push(recipient);
 		recipients = followers;
 	}
+	observation?.setPhase("destination-planning");
 	const inboxes = extractInboxes({
 		recipients: Array.isArray(recipients) ? recipients : [recipients],
 		preferSharedInbox: options?.preferSharedInbox,
 		excludeBaseUris: options?.excludeBaseUris
 	});
+	if (observation != null) await observation.planDestinations(inboxes);
 	if (globalThis.Object.keys(inboxes).length < 1) {
 		logger.debug("No inboxes found for activity {activityId}.", {
 			activityId: ctx.activityId,
 			activityType: ctx.activityType,
 			identifier: identifier ?? void 0
 		});
+		if (observation != null) await observation.skipped();
 		return false;
 	}
 	logger.debug("Forwarding activity {activityId} to inboxes:\n{inboxes}", {
@@ -13009,18 +14918,33 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 	if (options?.immediate || ctx.federation.outboxQueue == null) {
 		if (options?.immediate) logger.debug("Forwarding activity immediately without queue since immediate option is set.");
 		else logger.debug("Forwarding activity immediately without queue since queue is not set.");
+		observation?.setPhase("request-preparation");
 		const promises = [];
-		for (const inbox in inboxes) promises.push(sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
-			allowPrivateAddress: ctx.federation.allowPrivateAddress,
-			keys,
-			activity: ctx.activity,
-			activityId: ctx.activityId,
-			activityType: ctx.activityType,
-			sharedInbox: inboxes[inbox].sharedInbox,
-			meterProvider: ctx.meterProvider,
-			tracerProvider: ctx.tracerProvider,
-			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock, { specTtl: ctx.federation.httpMessageSignaturesSpecTtl })
-		}));
+		for (const inbox in inboxes) {
+			const delivery = observation?.delivery(inbox);
+			let sending;
+			try {
+				sending = sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
+					observation: delivery,
+					allowPrivateAddress: ctx.federation.allowPrivateAddress,
+					keys,
+					activity: ctx.activity,
+					activityId: ctx.activityId,
+					activityType: ctx.activityType,
+					sharedInbox: inboxes[inbox].sharedInbox,
+					meterProvider: ctx.meterProvider,
+					tracerProvider: ctx.tracerProvider,
+					specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock, { specTtl: ctx.federation.httpMessageSignaturesSpecTtl })
+				});
+			} catch (error) {
+				if (delivery != null) await delivery.failed(error);
+				throw error;
+			}
+			if (observation != null) sending.catch(() => {});
+			if (delivery != null) await delivery.handoff({ type: "direct" });
+			promises.push(sending);
+		}
+		if (observation != null) await observation.prepared("delivery");
 		await Promise.all(promises);
 		return true;
 	}
@@ -13028,7 +14952,9 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		activityId: ctx.activityId,
 		activity: ctx.activity
 	});
+	observation?.setPhase("request-preparation");
 	if (!ctx.federation.manuallyStartQueue) ctx.federation._startQueueInternal(ctx.data);
+	observation?.setPhase("key-resolution");
 	const keyJwkPairs = [];
 	for (const { keyId, privateKey } of keys) {
 		const privateKeyJwk = await require_http.exportJwk(privateKey);
@@ -13037,15 +14963,17 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			privateKey: privateKeyJwk
 		});
 	}
+	observation?.setPhase("request-preparation");
 	const carrier = {};
 	_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
 	const orderingKey = options?.orderingKey;
 	const started = (/* @__PURE__ */ new Date()).toISOString();
 	const messages = [];
-	for (const inbox in inboxes) {
+	for (const inbox in inboxes) try {
 		const { portableInbox, gatewayInboxes } = inboxes[inbox];
 		const message = {
 			type: "outbox",
+			...serializeProvenance(provenance),
 			id: crypto.randomUUID(),
 			baseUrl: ctx.origin,
 			keys: keyJwkPairs,
@@ -13053,6 +14981,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			activityId: ctx.activityId,
 			activityType: ctx.activityType,
 			inbox,
+			...observation?.continuation(inbox),
 			sharedInbox: inboxes[inbox].sharedInbox,
 			actorIds: [...inboxes[inbox].actorIds],
 			started,
@@ -13066,11 +14995,18 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			message,
 			orderingKey: message.orderingKey
 		});
+	} catch (error) {
+		if (observation != null) await observation.delivery(inbox)?.failed(error);
+		throw error;
 	}
+	if (observation != null) await observation.prepared("delivery");
 	const { outboxQueue } = ctx.federation;
 	if (outboxQueue.enqueueMany == null || orderingKey != null) {
 		const errors = (await Promise.allSettled(messages.map(async (m) => {
-			await outboxQueue.enqueue(m.message, { orderingKey: m.orderingKey });
+			await (observation == null ? outboxQueue.enqueue(m.message, { orderingKey: m.orderingKey }) : observation.enqueue([{
+				inbox: m.message.inbox,
+				queueMessageId: m.message.id
+			}], "outbox", () => outboxQueue.enqueue(m.message, { orderingKey: m.orderingKey })));
 			require_http.recordOutboxEnqueue(ctx.federation.meterProvider, outboxQueue, m.message);
 		}))).filter((r) => r.status === "rejected").map((r) => r.reason);
 		if (errors.length > 0) {
@@ -13083,7 +15019,10 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		}
 	} else {
 		try {
-			await outboxQueue.enqueueMany(messages.map((m) => m.message));
+			await (observation == null ? outboxQueue.enqueueMany(messages.map((m) => m.message)) : observation.enqueue(messages.map(({ message }) => ({
+				inbox: message.inbox,
+				queueMessageId: message.id
+			})), "outbox", () => outboxQueue.enqueueMany(messages.map((m) => m.message))));
 		} catch (error) {
 			logger.error("Failed to enqueue activity {activityId} to forward later:\n{error}", {
 				activityId: ctx.activityId,
@@ -13119,6 +15058,7 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 	}
 	clone(data) {
 		return new InboxContextImpl(this.recipient, this.activity, this.activityId, this.activityType, {
+			[outboundProvenance]: getOutboundProvenance(this),
 			url: this.url,
 			federation: this.federation,
 			data,
@@ -13149,29 +15089,41 @@ var OutboxContextImpl = class OutboxContextImpl extends ContextImpl {
 		return this.#deliveryState.delivered;
 	}
 	sendActivity(sender, recipients, activity, options = {}) {
-		return this.tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan(this.federation.outboxQueue == null || options.immediate ? "activitypub.outbox" : "activitypub.fanout", {
-			kind: this.federation.outboxQueue == null || options.immediate ? _opentelemetry_api.SpanKind.CLIENT : _opentelemetry_api.SpanKind.PRODUCER,
-			attributes: {
-				"activitypub.activity.type": (0, _fedify_vocab.getTypeId)(activity).href,
-				"activitypub.activity.to": activity.toIds.map((to) => to.href),
-				"activitypub.activity.cc": activity.ccIds.map((cc) => cc.href),
-				"activitypub.activity.bto": activity.btoIds.map((bto) => bto.href),
-				"activitypub.activity.bcc": activity.bccIds.map((bcc) => bcc.href)
-			}
-		}, async (span) => {
-			try {
-				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
-				if (await this.sendActivityInternal(sender, recipients, activity, options, span)) this.#deliveryState.delivered = true;
-			} catch (e) {
-				span.setStatus({
-					code: _opentelemetry_api.SpanStatusCode.ERROR,
-					message: String(e)
-				});
-				throw e;
-			} finally {
-				span.end();
-			}
-		});
+		return observeOutboundBroadcast(this, this.federation.outboundObservers, (observation, provenance) => {
+			const tracer = this.tracerProvider.getTracer(require_http.name, require_http.version);
+			const parentSpanContext = _opentelemetry_api.trace.getSpanContext(_opentelemetry_api.context.active());
+			const activityType = (0, _fedify_vocab.getTypeId)(activity).href;
+			observation?.setActivity({ type: activityType });
+			return tracer.startActiveSpan(this.federation.outboxQueue == null || options.immediate ? "activitypub.outbox" : "activitypub.fanout", {
+				kind: this.federation.outboxQueue == null || options.immediate ? _opentelemetry_api.SpanKind.CLIENT : _opentelemetry_api.SpanKind.PRODUCER,
+				attributes: {
+					"activitypub.activity.type": activityType,
+					"activitypub.activity.to": activity.toIds.map((to) => to.href),
+					"activitypub.activity.cc": activity.ccIds.map((cc) => cc.href),
+					"activitypub.activity.bto": activity.btoIds.map((bto) => bto.href),
+					"activitypub.activity.bcc": activity.bccIds.map((bcc) => bcc.href)
+				}
+			}, async (span) => {
+				observation?.setSpan(span, parentSpanContext);
+				try {
+					const activityId = activity.id?.href;
+					if (activityId != null) span.setAttribute("activitypub.activity.id", activityId);
+					observation?.setActivity({
+						type: activityType,
+						...activityId == null ? {} : { id: activityId }
+					});
+					if (await this.sendActivityInternal(sender, recipients, activity, options, span, observation, provenance)) this.#deliveryState.delivered = true;
+				} catch (e) {
+					span.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: String(e)
+					});
+					throw e;
+				} finally {
+					span.end();
+				}
+			});
+		}, "send", options.dispatchId);
 	}
 	forwardActivity(forwarder, recipients, options) {
 		return forwardActivity(this, "outbox", forwarder, recipients, options).then((delivered) => {
@@ -13180,6 +15132,7 @@ var OutboxContextImpl = class OutboxContextImpl extends ContextImpl {
 	}
 	clone(data) {
 		return new OutboxContextImpl(this.identifier, this.activity, this.activityId, this.activityType, {
+			[outboundProvenance]: getOutboundProvenance(this),
 			url: this.url,
 			federation: this.federation,
 			data,