@fungi.computer/shiitake 0.3.1 → 0.5.0

package/dist/cloudflare.js

@@ -333,10 +333,10 @@ export function makeCloudflareShiitake(unnamed, options) {
         return Object.freeze({
             ...handle,
             readSettlement: (sessionId, commandId) => runShiitakePromise(readSettlement(sessionId, commandId)),
-            acceptMail: (mail, meta, reply) => {
+            acceptMail: (mail, meta, reply, stageAcceptedNotice, sessionGrantDelivery) => {
                 if (options.mailRoom === undefined)
                     return Promise.reject(runtimeFailure("unavailable", "Addressed mail is unavailable"));
-                return runShiitakePromise(acceptMail(mail, meta, reply));
+                return runShiitakePromise(acceptMail(mail, meta, reply, stageAcceptedNotice, sessionGrantDelivery));
             },
             alarm: host.alarm,
             activeSessions: () => runShiitakePromise(activeSessions),

package/dist/delegation.d.ts

@@ -1,9 +1,9 @@
 import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
 import * as Schema from "effect/Schema";
 import { type BirdDogEffect } from "@fungi.computer/bird-dog/effect";
-import type { BirdDogMail } from "@fungi.computer/bird-dog";
+import { type BirdDogMail } from "@fungi.computer/bird-dog";
 import { type PostRoute, type PostRuntime, type PostEnvelope, type PostDeliveryResult } from "@fungi.computer/carrier/post";
-import { type Accepted, type CancelResult } from "./client.js";
+import { type Accepted, type DelegationReceipt, type CancelResult } from "./client.js";
 import type { CommandSettlement, ShiitakeHost, VerifiedAgentReply } from "./index.js";
 import type { AgentControlDirectory, AgentDelegationInput, AgentDelegationInvocation, AgentRecallInput } from "./agent-control.js";
 /** Shiitake host-pack identity; core consumes OysterAgents, never this engine. */
@@ -19,30 +19,39 @@ export declare class AgentDelegation {
         expiresAt: () => number;
         identity: () => DelegationIdentity | null | Promise<DelegationIdentity | null>;
         directory: () => AgentControlDirectory;
-        deliver: (mail: BirdDogMail) => Promise<Accepted>;
+        deliver: (mail: BirdDogMail) => Promise<DelegationReceipt>;
         prepare: (mail: BirdDogMail) => Promise<void>;
+        /**
+         * Synchronously stage the accepted notice in this recipient's durable
+         * outbox, in the same transaction as acceptance.
+         */
+        stageAcceptedNotice: (mail: BirdDogMail, scopeId: string) => void;
         /** Admit mail; `reply` is present only for an authenticated reply. */
-        accept: (mail: BirdDogMail, reply?: VerifiedAgentReply) => Promise<Accepted>;
+        accept: (mail: BirdDogMail, reply: VerifiedAgentReply | undefined, stageAcceptedNotice: (mail: BirdDogMail) => void) => Promise<Accepted>;
     }>);
     private fleetOwner;
     private fleet;
     private scope;
-    private requestKey;
     /** Recipient-local disclosure through the public host, never another Agent's RPC. */
     settlement(sender: DelegationIdentity, sessionId: string, commandId: string, host: Pick<ShiitakeHost, "readSettlement">): Promise<CommandSettlement | undefined>;
     /** Delegate work to an in-scope Agent: steer its Session, or start fleet correspondence. */
-    send(input: AgentDelegationInput, sourceSessionId: string, signal: AbortSignal, invocation?: AgentDelegationInvocation): Promise<Accepted>;
+    send(input: AgentDelegationInput, sourceSessionId: string, signal: AbortSignal, invocation?: AgentDelegationInvocation): Promise<DelegationReceipt>;
     /** Resolve this sender's exact request, then let the recipient guard pending work. */
     recall(input: AgentRecallInput, sourceSessionId: string, signal: AbortSignal): Promise<CancelResult>;
     /**
      * A reply-less envelope is only ever BirdDog's reply to work this Agent
      * sent. Admit it only after the fleet authenticates it against that frozen
-     * mail; the line is then authored by the replying Agent, never by whoever
-     * settled or cancelled the work, and its meta carries the verified reply.
+     * mail. A recipient-left reply remains Agent-authored; a recipient-offline
+     * reply is Hub-authored. Its meta carries only the authenticated reply.
      */
     private authenticatedReply;
+    private parseAddressedMail;
     /** Admit one addressed Agent mail for this Agent, or refuse it. */
     receive(raw: PostEnvelope): Promise<PostDeliveryResult>;
+    private recordAcceptedNotice;
+    private acceptAdmitted;
+    /** Admit local outbox exhaustion through the same Fleet/system reply gate. */
+    localUndeliverable(original: BirdDogMail): Promise<PostDeliveryResult>;
 }
 /** A current correspondent no longer has disclosure authority. */
 export declare class AgentDisclosureRefused extends Error {
@@ -63,7 +72,7 @@ export declare function agentMailRoute(namespace: PostRoute<never, never>["names
     readonly to: {
         readonly kind: "agent";
         readonly agentId: string;
-        readonly sessionId: string;
+        readonly sessionId?: string;
     };
     readonly replyTo: readonly {
         readonly kind: "agent";
@@ -75,7 +84,36 @@ export declare function agentMailRoute(namespace: PostRoute<never, never>["names
         readonly commandId: string;
         readonly outcome: "completed" | "failed" | "cancelled" | "interrupted" | "outcome_unknown";
         readonly diagnostic?: string;
+    } | {
+        readonly outcome: "accepted";
+        readonly commandId: string;
+    } | {
+        readonly outcome: "undeliverable";
+        readonly reason: "recipient_left";
+    };
+} | {
+    readonly key: string;
+    readonly reply: {
+        readonly outcome: "undeliverable";
+        readonly reason: "recipient_offline";
+    };
+    readonly content: string;
+    readonly createdAt: number;
+    readonly from: {
+        readonly kind: "system";
+        readonly systemId: "hub";
     };
+    readonly to: {
+        readonly kind: "agent";
+        readonly agentId: string;
+        readonly sessionId?: string;
+    };
+    readonly replyTo: readonly {
+        readonly kind: "agent";
+        readonly agentId: string;
+        readonly sessionId: string;
+    }[];
+    readonly meta?: Schema.Json;
 }, {
     readonly key: string;
     readonly content: string;
@@ -88,7 +126,7 @@ export declare function agentMailRoute(namespace: PostRoute<never, never>["names
     readonly to: {
         readonly kind: "agent";
         readonly agentId: string;
-        readonly sessionId: string;
+        readonly sessionId?: string;
     };
     readonly replyTo: readonly {
         readonly kind: "agent";
@@ -100,7 +138,36 @@ export declare function agentMailRoute(namespace: PostRoute<never, never>["names
         readonly commandId: string;
         readonly outcome: "completed" | "failed" | "cancelled" | "interrupted" | "outcome_unknown";
         readonly diagnostic?: string;
+    } | {
+        readonly outcome: "accepted";
+        readonly commandId: string;
+    } | {
+        readonly outcome: "undeliverable";
+        readonly reason: "recipient_left";
+    };
+} | {
+    readonly key: string;
+    readonly reply: {
+        readonly outcome: "undeliverable";
+        readonly reason: "recipient_offline";
+    };
+    readonly content: string;
+    readonly createdAt: number;
+    readonly from: {
+        readonly kind: "system";
+        readonly systemId: "hub";
+    };
+    readonly to: {
+        readonly kind: "agent";
+        readonly agentId: string;
+        readonly sessionId?: string;
     };
+    readonly replyTo: readonly {
+        readonly kind: "agent";
+        readonly agentId: string;
+        readonly sessionId: string;
+    }[];
+    readonly meta?: Schema.Json;
 }, import("@fungi.computer/seam/machine-link-protocol").AgentMailAddress, {
     readonly key: string;
     readonly content: string;
@@ -113,7 +180,7 @@ export declare function agentMailRoute(namespace: PostRoute<never, never>["names
     readonly to: {
         readonly kind: "agent";
         readonly agentId: string;
-        readonly sessionId: string;
+        readonly sessionId?: string;
     };
     readonly replyTo: readonly {
         readonly kind: "agent";
@@ -125,7 +192,36 @@ export declare function agentMailRoute(namespace: PostRoute<never, never>["names
         readonly commandId: string;
         readonly outcome: "completed" | "failed" | "cancelled" | "interrupted" | "outcome_unknown";
         readonly diagnostic?: string;
+    } | {
+        readonly outcome: "accepted";
+        readonly commandId: string;
+    } | {
+        readonly outcome: "undeliverable";
+        readonly reason: "recipient_left";
+    };
+} | {
+    readonly key: string;
+    readonly reply: {
+        readonly outcome: "undeliverable";
+        readonly reason: "recipient_offline";
+    };
+    readonly content: string;
+    readonly createdAt: number;
+    readonly from: {
+        readonly kind: "system";
+        readonly systemId: "hub";
+    };
+    readonly to: {
+        readonly kind: "agent";
+        readonly agentId: string;
+        readonly sessionId?: string;
     };
+    readonly replyTo: readonly {
+        readonly kind: "agent";
+        readonly agentId: string;
+        readonly sessionId: string;
+    }[];
+    readonly meta?: Schema.Json;
 }, {
     readonly key: string;
     readonly content: string;
@@ -138,7 +234,7 @@ export declare function agentMailRoute(namespace: PostRoute<never, never>["names
     readonly to: {
         readonly kind: "agent";
         readonly agentId: string;
-        readonly sessionId: string;
+        readonly sessionId?: string;
     };
     readonly replyTo: readonly {
         readonly kind: "agent";
@@ -150,9 +246,39 @@ export declare function agentMailRoute(namespace: PostRoute<never, never>["names
         readonly commandId: string;
         readonly outcome: "completed" | "failed" | "cancelled" | "interrupted" | "outcome_unknown";
         readonly diagnostic?: string;
+    } | {
+        readonly outcome: "accepted";
+        readonly commandId: string;
+    } | {
+        readonly outcome: "undeliverable";
+        readonly reason: "recipient_left";
+    };
+} | {
+    readonly key: string;
+    readonly reply: {
+        readonly outcome: "undeliverable";
+        readonly reason: "recipient_offline";
+    };
+    readonly content: string;
+    readonly createdAt: number;
+    readonly from: {
+        readonly kind: "system";
+        readonly systemId: "hub";
+    };
+    readonly to: {
+        readonly kind: "agent";
+        readonly agentId: string;
+        readonly sessionId?: string;
     };
+    readonly replyTo: readonly {
+        readonly kind: "agent";
+        readonly agentId: string;
+        readonly sessionId: string;
+    }[];
+    readonly meta?: Schema.Json;
 }> & Omit<Readonly<{
     addressKind: string;
+    deadlineMs?: number | undefined;
     address: Schema.Codec<unknown, unknown>;
     event: Schema.Codec<unknown, unknown>;
     encodeEnvelope: (envelope: PostEnvelope) => PostEnvelope;
@@ -167,7 +293,7 @@ export declare function agentMailRoute(namespace: PostRoute<never, never>["names
 /** The host's one Post lane, as Agent mail borrows it. */
 export type AgentMailPost = Pick<PostRuntime<{
     agentMail: ReturnType<typeof agentMailRoute>;
-}>, "send" | "read" | "nextWake">;
+}>, "send" | "read" | "nextWake" | "deadLetters">;
 /** Recipient-owned replies and receipt-bearing submissions over the host's one Post lane. */
 export declare class AgentMail {
     private readonly deps;
@@ -177,14 +303,22 @@ export declare class AgentMail {
         identity: () => DelegationIdentity | null | Promise<DelegationIdentity | null>;
         /** Only a typed disclosure refusal becomes undefined; missing settled facts must fail. */
         replySettlement: AgentReplySettlement;
+        /** Route a terminal reply for this sender through its Fleet admission. */
+        onUndeliverable: (original: BirdDogMail, reply: BirdDogMail) => Promise<PostDeliveryResult>;
         drain: () => Promise<void>;
         wake: () => Promise<void>;
     }>);
     private envelope;
-    /** Submit one mail and return the recipient's Accepted receipt. */
-    send(mail: BirdDogMail): Promise<Accepted>;
+    /** Submit one mail and return recipient acceptance or relay-held custody. */
+    send(mail: BirdDogMail): Promise<DelegationReceipt>;
+    /** Reconcile exhausted original outbox mail into one local system reply. */
+    stageUndeliverableReplies(): Promise<void>;
+    /** Stage the acceptance reply through this Post owner without leaving the transaction. */
+    stageAcceptedNotice(mail: BirdDogMail, scopeId: string): void;
     /** BirdDog's mail room: disclosed settlement replies fan out over Post. */
-    mailRoom(): BirdDogEffect;
+    mailRoom(): BirdDogEffect & {
+        stageAcceptedNotice: (mail: BirdDogMail, scopeId: string) => void;
+    };
 }
 /**
  * The Agent wire decoders a host lends Oyster's machine-link client, so the
@@ -197,7 +331,7 @@ export declare const machineAgentCodecs: {
     }> | null;
     /** One serialized settlement from a hosted or machine-homed Agent. */
     readonly settlement: (encoded: string) => CommandSettlement;
-    /** Throws unless an acknowledgment carries a well-formed Accepted receipt. */
+    /** Throws unless an acknowledgment carries a valid acceptance or Held result. */
     readonly accepted: (receipt: Schema.Json) => void;
 };
 /**

package/dist/delegation.js

@@ -3,15 +3,15 @@
  * addressed Agent mail over Carrier Post, and the Agent grammar a host hands
  * to Oyster's machine link as ports. Oyster core never imports this engine.
  */
-import { commandSettlementSchema, createAgentDirectory, createFleetCorrespondence, delegationProvenance, delegationReplyMeta, delegationSendMeta, } from "./fleet.js";
-import { deterministicReplayKey } from "@fungi.computer/cairn";
+import { commandSettlementSchema, createAgentDirectory, createFleetCorrespondence, agentDelegationRequestKey, delegationProvenance, delegationReplyMeta, delegationSendMeta, } from "./fleet.js";
 import * as Schema from "effect/Schema";
 import { agentMailAddressSchema } from "@fungi.computer/seam/machine-link-protocol";
 import { BirdDogMailSchema, BirdDogError, settlementReplies, } from "@fungi.computer/bird-dog/effect";
 import * as Effect from "effect/Effect";
 import { messageAuthor } from "@fungi.computer/agar/agents";
+import { undeliverableReply } from "@fungi.computer/bird-dog";
 import { PostEnvelopeSchema, definePostRoute, } from "@fungi.computer/carrier/post";
-import { parseAccepted } from "./client.js";
+import { parseDelegationReceipt, } from "./client.js";
 import { decodeClientSessionCreationRequest } from "./internal/client-boundary.js";
 /** Host-owned identity and admission around BirdDog's ordinary envelope. */
 export class AgentDelegation {
@@ -37,16 +37,6 @@ export class AgentDelegation {
             throw new Error("Agent is outside this scope");
         return { ...identity, agents, source };
     }
-    requestKey(scope, input, sourceSessionId) {
-        return deterministicReplayKey("oyster-agent-delegation", [
-            scope.scopeId,
-            scope.agentId,
-            sourceSessionId,
-            input.agentId,
-            input.sessionId,
-            input.requestId,
-        ]);
-    }
     /** Recipient-local disclosure through the public host, never another Agent's RPC. */
     async settlement(sender, sessionId, commandId, host) {
         const scope = await this.scope(new AbortController().signal);
@@ -65,7 +55,16 @@ export class AgentDelegation {
         const scope = await this.scope(signal);
         if (!scope.agents.some(({ agentId }) => agentId === input.agentId))
             throw new Error("Agent is outside this scope");
-        const requestId = await this.requestKey(scope, input, sourceSessionId);
+        const requestId = await agentDelegationRequestKey({
+            owner: {
+                kind: "hosted",
+                scopeId: scope.scopeId,
+                agentId: scope.agentId,
+            },
+            sourceSessionId,
+            targetAgentId: input.agentId,
+            requestId: input.requestId,
+        });
         signal.throwIfAborted();
         if (input.delivery === "steer") {
             const opened = await this.deps.directory().open(input.agentId, signal);
@@ -104,12 +103,25 @@ export class AgentDelegation {
         const scope = await this.scope(signal);
         if (!scope.agents.some(({ agentId }) => agentId === input.agentId))
             throw new Error("Agent is outside this scope");
-        const requestId = await this.requestKey(scope, input, sourceSessionId);
+        const requestId = await agentDelegationRequestKey({
+            owner: {
+                kind: "hosted",
+                scopeId: scope.scopeId,
+                agentId: scope.agentId,
+            },
+            sourceSessionId,
+            targetAgentId: input.agentId,
+            requestId: input.requestId,
+        });
         signal.throwIfAborted();
         const opened = await this.deps.directory().open(input.agentId, signal);
         try {
-            const session = opened.agent.session(input.sessionId);
-            const admitted = this.fleet().receipt(requestId) ?? (await session.withdraw(requestId));
+            const receipt = this.fleet().receipt(requestId);
+            if (receipt?.sessionId !== undefined &&
+                receipt.sessionId !== input.sessionId)
+                return { status: "unknown" };
+            const session = opened.agent.session(receipt?.sessionId ?? input.sessionId);
+            const admitted = receipt ?? (await session.withdraw(requestId));
             return admitted.status === "accepted"
                 ? await session.cancel({
                     commandId: admitted.commandId,
@@ -124,8 +136,8 @@ export class AgentDelegation {
     /**
      * A reply-less envelope is only ever BirdDog's reply to work this Agent
      * sent. Admit it only after the fleet authenticates it against that frozen
-     * mail; the line is then authored by the replying Agent, never by whoever
-     * settled or cancelled the work, and its meta carries the verified reply.
+     * mail. A recipient-left reply remains Agent-authored; a recipient-offline
+     * reply is Hub-authored. Its meta carries only the authenticated reply.
      */
     async authenticatedReply(mail) {
         const delegation = this.fleet().authenticateReply(mail);
@@ -133,48 +145,110 @@ export class AgentDelegation {
             return undefined;
         const scope = await this.scope(new AbortController().signal);
         const replier = scope.agents.find(({ agentId }) => agentId === delegation.reply.agentId);
-        if (replier === undefined)
+        const undeliverable = delegation.reply.outcome === "undeliverable";
+        if (replier === undefined && !undeliverable)
             return undefined;
-        const meta = delegationReplyMeta(delegation, replier.name);
+        const meta = delegationReplyMeta(delegation, replier?.name ?? delegation.reply.agentId);
         return { mail: { ...mail, meta }, reply: delegation.reply };
     }
-    /** Admit one addressed Agent mail for this Agent, or refuse it. */
-    async receive(raw) {
+    parseAddressedMail(raw) {
         const envelope = Schema.decodeUnknownOption(PostEnvelopeSchema)(raw);
         if (envelope._tag === "None" || envelope.value.kind !== "agentMail")
-            return "refused";
+            return undefined;
         const address = Schema.decodeUnknownOption(agentMailAddressSchema)(envelope.value.address);
-        const parsed = Schema.decodeUnknownOption(BirdDogMailSchema)(envelope.value.event);
-        if (address._tag === "None" || parsed._tag === "None")
+        const mail = Schema.decodeUnknownOption(BirdDogMailSchema)(envelope.value.event);
+        if (address._tag === "None" || mail._tag === "None")
+            return undefined;
+        return {
+            envelope: envelope.value,
+            address: address.value,
+            mail: mail.value,
+        };
+    }
+    /** Admit one addressed Agent mail for this Agent, or refuse it. */
+    async receive(raw) {
+        const addressed = this.parseAddressedMail(raw);
+        if (addressed === undefined)
             return "refused";
-        const mail = parsed.value;
+        const { envelope, address, mail } = addressed;
+        let authenticated;
         const valid = async () => {
             const scope = await this.scope(new AbortController().signal);
-            return (address.value.scopeId === scope.scopeId &&
-                address.value.agentId === scope.agentId &&
+            const sender = mail.from;
+            const authenticatedUndeliverable = authenticated?.reply.outcome === "undeliverable";
+            return (address.scopeId === scope.scopeId &&
+                address.agentId === scope.agentId &&
                 mail.to.agentId === scope.agentId &&
-                envelope.value.key === mail.key &&
-                [mail.from, ...mail.replyTo].every((ref) => scope.agents.some(({ agentId }) => agentId === ref.agentId)) &&
+                envelope.key === mail.key &&
+                (authenticatedUndeliverable ||
+                    (sender.kind === "agent" &&
+                        scope.agents.some(({ agentId }) => agentId === sender.agentId))) &&
+                mail.replyTo.every(({ agentId }) => scope.agents.some((agent) => agent.agentId === agentId)) &&
                 (mail.replyTo.length === 0 ||
                     (mail.replyTo.length === 1 &&
-                        mail.replyTo[0]?.agentId === mail.from.agentId &&
-                        mail.replyTo[0].sessionId === mail.from.sessionId)));
+                        sender.kind === "agent" &&
+                        mail.replyTo[0]?.agentId === sender.agentId &&
+                        mail.replyTo[0].sessionId === sender.sessionId)));
         };
+        if (mail.replyTo.length === 0)
+            authenticated = await this.authenticatedReply(mail);
         if (!(await valid()))
             return "refused";
-        const admitted = mail.replyTo.length > 0
-            ? { mail, reply: undefined }
-            : await this.authenticatedReply(mail);
+        if (mail.reply?.outcome === "accepted")
+            return this.recordAcceptedNotice(mail, valid);
+        const admitted = mail.replyTo.length > 0 ? { mail, reply: undefined } : authenticated;
         if (admitted === undefined)
             return "refused";
+        return this.acceptAdmitted(admitted, address.scopeId, valid);
+    }
+    async recordAcceptedNotice(mail, valid) {
+        if (mail.to.sessionId === undefined)
+            return "refused";
+        await this.deps.prepare(mail);
+        if (!(await valid()))
+            return "refused";
+        const receipt = this.fleet().recordAcceptedNotice(mail);
+        return receipt === undefined ? "refused" : { status: "accepted", receipt };
+    }
+    async acceptAdmitted(admitted, scopeId, valid) {
         await this.deps.prepare(admitted.mail);
         if (!(await valid()))
             return "refused";
+        const stageAcceptedNotice = (notice) => {
+            this.deps.stageAcceptedNotice(notice, scopeId);
+        };
+        const receipt = await this.deps.accept(admitted.mail, admitted.reply, stageAcceptedNotice);
+        if (admitted.reply?.outcome === "undeliverable" &&
+            admitted.mail.from.kind === "system") {
+            this.fleet().recordUndeliverableReply(admitted.mail.key.slice(0, -":reply:0".length));
+        }
+        const sessionId = admitted.mail.to.sessionId ?? receipt.sessionId;
         return {
             status: "accepted",
-            receipt: await this.deps.accept(admitted.mail, admitted.reply),
+            receipt: sessionId === undefined ? receipt : { ...receipt, sessionId },
         };
     }
+    /** Admit local outbox exhaustion through the same Fleet/system reply gate. */
+    async localUndeliverable(original) {
+        const identity = await this.deps.identity();
+        if (identity === null)
+            return "refused";
+        let reply;
+        try {
+            reply = undeliverableReply(original, Date.now());
+        }
+        catch {
+            return "refused";
+        }
+        if (!this.fleet().recordLocalUndeliverable(original, reply))
+            return "refused";
+        return await this.receive({
+            key: reply.key,
+            kind: "agentMail",
+            address: { scopeId: identity.scopeId, agentId: identity.agentId },
+            event: reply,
+        });
+    }
 }
 /** A current correspondent no longer has disclosure authority. */
 export class AgentDisclosureRefused extends Error {
@@ -194,6 +268,13 @@ export function agentMailRoute(namespace, replySettlement) {
                 deliver: async (envelope) => {
                     const mail = Schema.decodeUnknownSync(BirdDogMailSchema)(envelope.event);
                     if (mail.reply !== undefined &&
+                        mail.reply.outcome !== "accepted" &&
+                        mail.reply.outcome !== "undeliverable" &&
+                        mail.to.sessionId === undefined)
+                        return "refused";
+                    if (mail.reply !== undefined &&
+                        mail.reply.outcome !== "undeliverable" &&
+                        mail.reply.outcome !== "accepted" &&
                         (await replySettlement(mail)) === undefined)
                         return "refused";
                     return namespace.getByName(name).deliver(envelope);
@@ -219,18 +300,60 @@ export class AgentMail {
             event: mail,
         };
     }
-    /** Submit one mail and return the recipient's Accepted receipt. */
+    /** Submit one mail and return recipient acceptance or relay-held custody. */
     async send(mail) {
         this.deps.post().send(await this.envelope(mail));
         // Borrow the existing Post lane once, not a new waiter, loop or supervisor.
         await this.deps.drain();
         const row = this.deps.post().read(mail.key);
         if (row?.state === "delivered" && row.receipt !== undefined)
-            return parseAccepted(JSON.stringify(row.receipt));
+            return parseDelegationReceipt(JSON.stringify(row.receipt));
         if (row?.state === "dead")
             throw new Error(`Agent delivery ${row.reason}`);
         throw new Error("Agent did not return a delegated work receipt");
     }
+    /** Reconcile exhausted original outbox mail into one local system reply. */
+    async stageUndeliverableReplies() {
+        const identity = await this.deps.identity();
+        if (identity === null)
+            return;
+        const post = this.deps.post();
+        let cursor;
+        do {
+            const page = post.deadLetters(64, cursor);
+            for (const letter of page.letters) {
+                if (letter.reason !== "exhausted" ||
+                    letter.envelope.kind !== "agentMail")
+                    continue;
+                const envelope = Schema.decodeUnknownOption(PostEnvelopeSchema)(letter.envelope);
+                if (envelope._tag === "None" || envelope.value.kind !== "agentMail")
+                    continue;
+                const original = Schema.decodeUnknownOption(BirdDogMailSchema)(envelope.value.event);
+                const address = Schema.decodeUnknownOption(agentMailAddressSchema)(envelope.value.address);
+                if (original._tag === "None" ||
+                    address._tag === "None" ||
+                    original.value.key !== envelope.value.key ||
+                    original.value.reply !== undefined ||
+                    original.value.from.kind !== "agent" ||
+                    original.value.from.agentId !== identity.agentId ||
+                    address.value.scopeId !== identity.scopeId ||
+                    address.value.agentId !== original.value.to.agentId)
+                    continue;
+                const reply = undeliverableReply(original.value, Date.now());
+                await this.deps.onUndeliverable(original.value, reply);
+            }
+            cursor = page.nextCursor;
+        } while (cursor !== undefined);
+    }
+    /** Stage the acceptance reply through this Post owner without leaving the transaction. */
+    stageAcceptedNotice(mail, scopeId) {
+        this.deps.post().send({
+            key: mail.key,
+            kind: "agentMail",
+            address: { scopeId, agentId: mail.to.agentId },
+            event: mail,
+        });
+    }
     /** BirdDog's mail room: disclosed settlement replies fan out over Post. */
     mailRoom() {
         return {
@@ -268,6 +391,16 @@ export class AgentMail {
                 },
                 catch: (cause) => new BirdDogError("Agent reply fan-out is unavailable", { cause }),
             }),
+            postMail: (mail) => Effect.tryPromise({
+                try: async () => {
+                    this.deps.post().send(await this.envelope(mail));
+                    await this.deps.wake();
+                },
+                catch: (cause) => new BirdDogError("Agent mail staging is unavailable", { cause }),
+            }),
+            stageAcceptedNotice: (mail, scopeId) => {
+                this.stageAcceptedNotice(mail, scopeId);
+            },
             drainOutbox: () => Effect.void,
             nextWakeAt: () => Effect.try({
                 try: () => this.deps.post().nextWake() ?? undefined,
@@ -290,9 +423,9 @@ export const machineAgentCodecs = {
     settlement(encoded) {
         return Schema.decodeUnknownSync(Schema.fromJsonString(commandSettlementSchema))(encoded);
     },
-    /** Throws unless an acknowledgment carries a well-formed Accepted receipt. */
+    /** Throws unless an acknowledgment carries a valid acceptance or Held result. */
     accepted(receipt) {
-        parseAccepted(JSON.stringify(receipt));
+        parseDelegationReceipt(JSON.stringify(receipt));
     },
 };
 /**

package/dist/effect.d.ts

@@ -22,7 +22,7 @@ export type ShiitakeEffectHost = Readonly<{
     readSettlement: (sessionId: string, commandId: string) => Effect.Effect<CommandSettlement | undefined, ShiitakeError>;
     agent: ShiitakeEffectOwner;
     /** Durably admit one addressed mail item through the host owner. */
-    acceptMail: (mail: BirdDogMail, meta?: HostJson, reply?: VerifiedAgentReply) => Effect.Effect<Accepted, ShiitakeError>;
+    acceptMail: (mail: BirdDogMail, meta?: HostJson, reply?: VerifiedAgentReply, stageAcceptedNotice?: (mail: BirdDogMail) => void) => Effect.Effect<Accepted, ShiitakeError>;
 }>;
 /** Open the Effect-native host composition with addressed mail. */
 export declare function openHost(options: ShiitakeEffectOptions, mailRoom: BirdDogEffect): Effect.Effect<ShiitakeEffectHost, ShiitakeError>;