@north-light/crouter 0.3.180 → 0.3.182

package/dist/core/memory-resolver.js

@@ -6,7 +6,7 @@ import { parseFrontmatterGeneric } from './frontmatter.js';
 import { listInstalledPlugins, listInstalledPluginsInRoot, parseSkillQualifier } from './resolver.js';
 import { ambiguous, notFound, usage } from './errors.js';
 import { warn } from './output.js';
-import { pluginMemoryDir, projectScopeRoot, projectScopeRoots, scopeMemoryDir } from './scope.js';
+import { pluginMemoryDir, projectScopeRoots, scopeMemoryDir } from './scope.js';
 import { effectiveDocKind, normalizeDocName, normalizeNameSegment, resolveDocName } from './substrate/schema.js';
 import { loadProfileManifest, profileMemoryDir } from './profiles/manifest.js';
 import { memoryDir as nodeMemoryDir } from './runtime/memory.js';
@@ -14,33 +14,35 @@ import { memoryDir as nodeMemoryDir } from './runtime/memory.js';
 export function memoryDocId(doc) {
     return `${doc.scope}/${doc.name}`;
 }
-/** The selected profile id from the process env, or '' when none. The single
- *  seam every profile-aware memory/config path reads through — see the plan's
- *  synthesis decision on why this is process env, not a threaded parameter. */
-function selectedProfileId() {
-    return process.env['CRTR_PROFILE_ID'] || '';
+/** The target the ambient process describes: cwd + the two env seams every
+ *  profile/node-aware memory path reads through (`CRTR_PROFILE_ID`,
+ *  `CRTR_NODE_ID`). */
+function ambientTarget() {
+    return {
+        cwd: process.cwd(),
+        profileId: process.env['CRTR_PROFILE_ID'] || null,
+        nodeId: process.env['CRTR_NODE_ID'] || null,
+    };
 }
-/** The current node id from the process env, or '' when not running inside a
- *  node. The seam the `node` scope resolves through — its memory dir is
- *  `nodeMemoryDir(id)` (`nodes/<id>/context/memory/`). */
-function selectedNodeId() {
-    return process.env['CRTR_NODE_ID'] || '';
+/** The selected profile id from the process env, or '' when none. */
+function selectedProfileId() {
+    return ambientTarget().profileId ?? '';
 }
 /** The memory scopes in resolution precedence: node > project stack > profile >
- *  user > builtin. Node is included only inside a running node (`CRTR_NODE_ID`)
- *  and ranks NEAREST — a node doc overrides any wider scope. Project is included
- *  only when a project scope exists for the cwd (or the selected profile's
- *  project stack); profile is included only when a profile is selected. A single
- *  `scope` narrows to just that scope. */
-function scopesInPrecedence(scope) {
+ *  user > builtin. Node is included only when the target names one and ranks
+ *  NEAREST — a node doc overrides any wider scope. Project is included only when
+ *  a project scope exists for the target's cwd (or its profile's project stack);
+ *  profile is included only when the target has one. A single `scope` narrows to
+ *  just that scope. */
+function scopesInPrecedence(target, scope) {
     if (scope)
         return [scope];
     const out = [];
-    if (selectedNodeId() !== '')
+    if (target.nodeId)
         out.push('node');
-    if (projectScopeRoot())
+    if (projectScopeRoots(target.cwd, target.profileId).length > 0)
         out.push('project');
-    if (selectedProfileId() !== '')
+    if (target.profileId)
         out.push('profile');
     out.push('user');
     out.push('builtin');
@@ -53,11 +55,11 @@ function scopesInPrecedence(scope) {
  *  join — and drops out silently (never throws the resolver) when the
  *  selected profile id no longer resolves to a manifest. User and builtin
  *  remain singleton scopes after that. */
-function memorySourcesInPrecedence(scope) {
+function memorySourcesInPrecedence(target, scope) {
     const out = [];
-    for (const s of scopesInPrecedence(scope)) {
+    for (const s of scopesInPrecedence(target, scope)) {
         if (s === 'project') {
-            for (const root of projectScopeRoots()) {
+            for (const root of projectScopeRoots(target.cwd, target.profileId)) {
                 out.push({
                     scope: 'project',
                     memoryDir: join(root, 'memory'),
@@ -66,7 +68,7 @@ function memorySourcesInPrecedence(scope) {
             }
         }
         else if (s === 'profile') {
-            const profileId = selectedProfileId();
+            const profileId = target.profileId ?? '';
             if (profileId !== '') {
                 try {
                     const { profileId: resolvedId } = loadProfileManifest(profileId);
@@ -79,8 +81,8 @@ function memorySourcesInPrecedence(scope) {
         }
         else if (s === 'node') {
             // The this-node store — a singleton dir in the node's context, no plugins.
-            // Silently absent when not running inside a node (CRTR_NODE_ID unset).
-            const nodeId = selectedNodeId();
+            // Silently absent when the target names no node.
+            const nodeId = target.nodeId ?? '';
             if (nodeId !== '')
                 out.push({ scope: 'node', memoryDir: nodeMemoryDir(nodeId), plugins: [] });
         }
@@ -157,11 +159,12 @@ function listMemoryDocsInDir(scope, dir, quiet = false) {
  *  stack); profile is the selected profile's own singleton store, resolved
  *  through `loadProfileManifest`; user and builtin are singleton stores. */
 export function listMemoryDocs(scope, quiet = false) {
+    const target = ambientTarget();
     if (scope === 'project') {
-        return listProjectMemoryDocs(process.cwd(), selectedProfileId() || null, quiet);
+        return listProjectMemoryDocs(target.cwd, target.profileId, quiet);
     }
     if (scope === 'profile') {
-        const profileId = selectedProfileId();
+        const profileId = target.profileId ?? '';
         if (profileId === '')
             return [];
         try {
@@ -173,7 +176,7 @@ export function listMemoryDocs(scope, quiet = false) {
         }
     }
     if (scope === 'node') {
-        const nodeId = selectedNodeId();
+        const nodeId = target.nodeId ?? '';
         if (nodeId === '')
             return [];
         return listMemoryDocsInDir('node', nodeMemoryDir(nodeId), quiet);
@@ -215,10 +218,10 @@ function sourceMemoryDocs(source, quiet = false) {
         ...source.plugins.flatMap((p) => listPluginMemoryDocs(p, source.scope, quiet)),
     ];
 }
-/** All project-scoped docs visible from an explicit node workspace/profile.
- *  This target-addressed form is used when one process serves several nodes
- *  (notably warm-spare claims), where ambient cwd/profile belong to the host
- *  process rather than the node whose first-message context is being built. */
+/** All project-scoped docs visible from an explicit node workspace/profile — the
+ *  project-only slice of a `MemoryTarget` view, used where only workspace docs
+ *  are wanted (a workspace-open render). For a full-precedence target-addressed
+ *  lookup, use `resolveMemoryDocForTarget`. */
 export function listProjectMemoryDocs(startDir = process.cwd(), profileId = selectedProfileId() || null, quiet = false) {
     return projectScopeRoots(startDir, profileId).flatMap((root) => sourceMemoryDocs({
         scope: 'project',
@@ -232,7 +235,7 @@ export function listProjectMemoryDocs(startDir = process.cwd(), profileId = sele
  *  native docs are emitted before enabled-plugin docs, so native wins on the
  *  caller's first-wins dedup. */
 export function listAllMemoryDocs(scope, quiet = false) {
-    return memorySourcesInPrecedence(scope).flatMap((source) => sourceMemoryDocs(source, quiet));
+    return memorySourcesInPrecedence(ambientTarget(), scope).flatMap((source) => sourceMemoryDocs(source, quiet));
 }
 /** Find the direct child of `dir` — a `.md` file (matched on name minus
  *  extension) or a directory — whose NORMALIZED display name equals
@@ -356,21 +359,22 @@ function formatLeafAmbiguous(leaf, matches) {
     const ids = matches.map(memoryDocId).join(', ');
     return `ambiguous memory document: ${leaf} matches multiple documents: ${ids}`;
 }
-function loadMemorySources(scope) {
+function loadMemorySources(target, scope) {
     // Quiet: a targeted read must not spew other docs' frontmatter warnings
     // before its own result (esp. a not_found) — corpus health is `lint`'s job.
-    return memorySourcesInPrecedence(scope).map((source) => ({
+    return memorySourcesInPrecedence(target, scope).map((source) => ({
         source,
         docs: sourceMemoryDocs(source, true),
     }));
 }
 export function createMemoryDocSnapshot() {
-    const defaultSources = loadMemorySources();
+    const target = ambientTarget();
+    const defaultSources = loadMemorySources(target);
     const sourcesByScope = new Map([[undefined, defaultSources]]);
     const sourceFor = (scope) => {
         let sources = sourcesByScope.get(scope);
         if (sources === undefined) {
-            sources = loadMemorySources(scope);
+            sources = loadMemorySources(target, scope);
             sourcesByScope.set(scope, sources);
         }
         return sources;
@@ -448,10 +452,18 @@ export function resolveMemoryDocs(names) {
     return createMemoryDocSnapshot().resolve(names);
 }
 export function resolveMemoryDoc(rawName, opts = {}) {
+    return resolveMemoryDocForTarget(rawName, ambientTarget(), opts);
+}
+/** Resolve a memory document as ANOTHER node would see it — the same precedence
+ *  chain (node-local > project stack > profile > user > builtin), read from the
+ *  target's cwd/profile/node rather than the host process's. This is what crtrd
+ *  resolves a `[[name]]` link through: the daemon's own cwd and env name no
+ *  node, and the same name can be a different document for two nodes. */
+export function resolveMemoryDocForTarget(rawName, target, opts = {}) {
     const parsed = parseSkillQualifier(rawName);
     if (parsed.scope && opts.scope && parsed.scope !== opts.scope) {
         throw usage(`scope conflict: identifier "${rawName}" uses scope "${parsed.scope}" but --scope is "${opts.scope}"`);
     }
     const effectiveScope = opts.scope ?? parsed.scope;
-    return resolveMemoryDocFromSources(rawName, opts, loadMemorySources(effectiveScope));
+    return resolveMemoryDocFromSources(rawName, opts, loadMemorySources(target, effectiveScope));
 }

package/dist/core/review/stage.js

@@ -157,6 +157,7 @@ export async function stageReview(args) {
                 created,
                 captured_at: capturedAt,
                 opened_at: null,
+                submit_requested_at: null,
                 output_path: args.output_path ?? null,
                 subtitle: args.subtitle ?? null,
                 approved_at: null,

package/dist/core/review/store.d.ts

@@ -29,9 +29,14 @@ export declare function listReviews(filter: {
     file?: string;
 }): ReviewRecord[];
 export declare function listBindingReviews(): ReviewRecord[];
+/** Open reviews the human has already submitted, still waiting on their companion. */
+export declare function listSubmitRequestedReviews(): ReviewRecord[];
 export declare function listUnprojectedTerminalReviews(): ReviewRecord[];
 export declare function bindBridgeNode(reviewId: string, bridgeNodeId: string): boolean;
 export declare function openReviewRow(reviewId: string, openedAt: string): boolean;
+/** Record the human's submit intent on a review that stays open meanwhile.
+ *  False when the review already left `open` or already carries an intent. */
+export declare function requestReviewSubmit(reviewId: string, at: string): boolean;
 export declare function approveReviewLocked(db: DatabaseSync, args: ApproveReviewArgs): boolean;
 export declare function cancelReviewRow(reviewId: string, args: {
     at: string;

package/dist/core/review/store.js

@@ -24,6 +24,7 @@ function recordFromRow(raw) {
         created: raw['created'],
         captured_at: raw['captured_at'],
         opened_at: raw['opened_at'] ?? null,
+        submit_requested_at: raw['submit_requested_at'] ?? null,
         output_path: raw['output_path'] ?? null,
         subtitle: raw['subtitle'] ?? null,
         approved_at: raw['approved_at'] ?? null,
@@ -118,6 +119,10 @@ export function listReviews(filter) {
 export function listBindingReviews() {
     return readRecords(openDb(), "state = 'binding'");
 }
+/** Open reviews the human has already submitted, still waiting on their companion. */
+export function listSubmitRequestedReviews() {
+    return readRecords(openDb(), "state = 'open' AND submit_requested_at IS NOT NULL");
+}
 export function listUnprojectedTerminalReviews() {
     return readRecords(openDb(), "state IN ('approved', 'canceled') AND projected_at IS NULL");
 }
@@ -127,6 +132,11 @@ export function bindBridgeNode(reviewId, bridgeNodeId) {
 export function openReviewRow(reviewId, openedAt) {
     return withCanvasWrite((db) => db.prepare("UPDATE reviews SET state = 'open', opened_at = ? WHERE review_id = ? AND state = 'binding'").run(openedAt, reviewId).changes > 0);
 }
+/** Record the human's submit intent on a review that stays open meanwhile.
+ *  False when the review already left `open` or already carries an intent. */
+export function requestReviewSubmit(reviewId, at) {
+    return withCanvasWrite((db) => db.prepare("UPDATE reviews SET submit_requested_at = ? WHERE review_id = ? AND state = 'open' AND submit_requested_at IS NULL").run(at, reviewId).changes > 0);
+}
 export function approveReviewLocked(db, args) {
     return db.prepare(`
     UPDATE reviews SET

package/dist/core/review/types.d.ts

@@ -47,6 +47,10 @@ export interface ReviewRow {
     created: string;
     captured_at: string;
     opened_at: string | null;
+    /** When the human pressed submit on a review whose companion was still
+     *  working. The review stays `open` — comments still land and still remap —
+     *  until the companion goes quiet and the daemon completes the approval. */
+    submit_requested_at: string | null;
     output_path: string | null;
     subtitle: string | null;
     approved_at: string | null;

package/dist/core/runtime/broker/event-projection.d.ts

@@ -1,11 +1,13 @@
 import type { BrokerToClient } from '../broker-protocol.js';
 import type { BrokerSession } from './read-ops.js';
 import type { BrokerClientRegistry } from './client-registry.js';
+import type { MessageIdLedger } from './message-ledger.js';
 import type { SubscriptionGeneration } from './rebind.js';
 import type { FaultRetry } from './fault-retry.js';
 type EventProjectionDeps = {
     registry: BrokerClientRegistry;
     faultRetry: FaultRetry;
+    ledger: MessageIdLedger;
     installedGeneration: () => SubscriptionGeneration | undefined;
     currentSession: () => BrokerSession;
     notifyTurnAccepted: () => void;
@@ -31,7 +33,12 @@ export declare class EventProjection {
     reset(): void;
     dispose(): void;
     knownStreamWait(deadlineMs: number): () => void;
-    relayEvent(event: BrokerToClient, generation: SubscriptionGeneration): void;
+    /** Message-identity enrichment (see MessageIdLedger): fold pi's queue state
+     *  into the ledger and relay id arrays parallel to the texts; attach the
+     *  retired/dispatched id to the user message that carries it. Both are
+     *  additive fields on the verbatim pi event — consumers read or ignore them. */
+    private withMessageIdentity;
+    relayEvent(rawEvent: BrokerToClient, generation: SubscriptionGeneration): void;
     private clearPendingUpdate;
     private flushPendingUpdate;
     private invalidatePendingBroadcasts;

package/dist/core/runtime/broker/event-projection.js

@@ -1,3 +1,4 @@
+import { contentText } from '@earendil-works/pi-ai';
 import { readConfig } from '../../config.js';
 import { emitEvent } from '../../events/emit.js';
 import { releaseKnownStreamWait, resolveStreamWatchdogMs, StreamWatchdog } from '../stream-watchdog.js';
@@ -64,7 +65,30 @@ export class EventProjection {
             releaseKnownStreamWait(this.streamWatchdog, generation.id, waitingSession.isStreaming, generation.executingTools.size > 0);
         };
     }
-    relayEvent(event, generation) {
+    /** Message-identity enrichment (see MessageIdLedger): fold pi's queue state
+     *  into the ledger and relay id arrays parallel to the texts; attach the
+     *  retired/dispatched id to the user message that carries it. Both are
+     *  additive fields on the verbatim pi event — consumers read or ignore them. */
+    withMessageIdentity(event) {
+        if (event.type === 'queue_update') {
+            const ids = this.deps.ledger.reconcileQueueUpdate(event.steering, event.followUp);
+            const enriched = { ...event, steeringIds: ids.steeringIds, followUpIds: ids.followUpIds };
+            return enriched;
+        }
+        if (event.type === 'message_start' && event.message.role === 'user') {
+            // contentText(content, '') is pi's OWN retirement text extraction
+            // (agent-session.js _handleAgentEvent) — the same function, so the
+            // ledger's text matching cannot diverge from pi's queue splice.
+            const crtrMessageId = this.deps.ledger.takeUserMessageId(contentText(event.message.content, ''));
+            if (crtrMessageId === undefined)
+                return event;
+            const enriched = { ...event, crtrMessageId };
+            return enriched;
+        }
+        return event;
+    }
+    relayEvent(rawEvent, generation) {
+        const event = this.withMessageIdentity(rawEvent);
         this.deps.faultRetry.onEvent(event);
         const type = event.type;
         if (type === 'message_start' && event.message.role === 'user') {

package/dist/core/runtime/broker/frame-dispatch.d.ts

@@ -6,6 +6,7 @@ import type { BrokerClient, BrokerClientRegistry } from './client-registry.js';
 import { type BrokerSession } from './read-ops.js';
 import type { ToolGroupTracker } from './tool-groups.js';
 import type { EventProjection } from './event-projection.js';
+import type { MessageIdLedger } from './message-ledger.js';
 import type { RebindDriver } from './rebind.js';
 export declare const REVIEW_BOUNDARY_NAVIGATION_CODE = "review_boundary_navigation";
 export declare class ReviewBoundaryNavigationError extends Error {
@@ -180,6 +181,7 @@ export type FrameDispatchDeps = {
     registry: BrokerClientRegistry;
     toolGroups: ToolGroupTracker;
     projection: EventProjection;
+    ledger: MessageIdLedger;
     rebind: RebindDriver;
     reviewCompanion: boolean;
     pendingDialogs: Map<string, PendingDialog>;

package/dist/core/runtime/broker/frame-dispatch.js

@@ -279,7 +279,7 @@ export function stripHiddenEntriesFromJsonlExport(filePath) {
 }
 /** Owns frame-local input state while dispatching through explicit broker collaborators. */
 export function createFrameDispatchContext(deps) {
-    const { nodeId, cfg, registry, toolGroups, projection, rebind, reviewCompanion, pendingDialogs, sendWelcome, replayExtraPendingDialogsTo, reWelcomeAll, disposeAndExit, persistModelChoice, broadcastModelChanged, registryOf, formatModelSpec, formatExactModelSpec, resolveLaunchModel, } = deps;
+    const { nodeId, cfg, registry, toolGroups, projection, ledger, rebind, reviewCompanion, pendingDialogs, sendWelcome, replayExtraPendingDialogsTo, reWelcomeAll, disposeAndExit, persistModelChoice, broadcastModelChanged, registryOf, formatModelSpec, formatExactModelSpec, resolveLaunchModel, } = deps;
     const currentSession = () => rebind.session();
     const currentServices = () => rebind.services();
     let kickoffPending;
@@ -301,9 +301,14 @@ export function createFrameDispatchContext(deps) {
         const prompt = kickoffPending;
         kickoffPending = undefined;
         kickoffInFlight = true;
+        // The kickoff prompt is a broker-originated dispatch — mint its identity
+        // here so its relayed user message_start carries an id like any other.
+        const kickoffMessageId = randomUUID();
+        ledger.noteDispatch(kickoffMessageId, prompt);
         trackPromptDispatch(operationIdContext.fresh(() => currentSession()
             .prompt(prompt)
             .catch((err) => {
+            ledger.dropIntent(kickoffMessageId);
             emitEvent({
                 level: 'error',
                 event: 'broker.prompt.first_failed',
@@ -392,6 +397,7 @@ export function createFrameDispatchContext(deps) {
         // is producing now, then start this as a new turn. A normal mid-stream
         // prompt deliberately steers into pi's queue; the whip must not.
         if (frame.type === 'prompt' && frame.interrupt === true) {
+            const whipMessageId = frame.message_id;
             return (async () => {
                 if (currentSession().isBashRunning) {
                     currentSession().abortBash();
@@ -414,6 +420,7 @@ export function createFrameDispatchContext(deps) {
                     type: 'prompt',
                     text: frame.text,
                     ...(frame.images !== undefined ? { images: frame.images } : {}),
+                    ...(whipMessageId !== undefined ? { message_id: whipMessageId } : {}),
                 });
             })().catch((err) => {
                 relayError(err);
@@ -444,6 +451,19 @@ export function createFrameDispatchContext(deps) {
                 const dispatch = () => {
                     const route = resolveEngineRoute(frame, currentSession().isStreaming);
                     const guidance = resolveFrameGuidance(frame.text);
+                    // Message identity (see MessageIdLedger): note the dispatch intent
+                    // before the engine call so pi's synchronous queue_update/message_start
+                    // can adopt it. A leading engine command never produces a matching
+                    // user message — no intent. On rejection the intent is dropped.
+                    let noteFailure = relayError;
+                    if (!isLeadingEngineCommand(frame.text, currentSession())) {
+                        const messageId = frame.message_id ?? randomUUID();
+                        ledger.noteDispatch(messageId, frame.text);
+                        noteFailure = (err) => {
+                            ledger.dropIntent(messageId);
+                            relayError(err);
+                        };
+                    }
                     if (guidance === null) {
                         if (route.call === 'prompt') {
                             // A routed prompt STARTS a turn — including an idle follow_up
@@ -452,12 +472,12 @@ export function createFrameDispatchContext(deps) {
                             // steer.
                             return settle(trackPromptDispatch(operationIdContext.fresh(() => currentSession()
                                 .prompt(frame.text, route.options)
-                                .catch(relayError))));
+                                .catch(noteFailure))));
                         }
                         // C1: pi's followUp() takes images as a POSITIONAL 2nd arg (`followUp(text, images?)`).
                         return settle(currentSession()
                             .followUp(frame.text, frame.images)
-                            .catch(relayError));
+                            .catch(noteFailure));
                     }
                     const deliverAs = chooseGuidanceDeliveryMode(frame.type, route.call, currentSession().isStreaming);
                     if (route.call === 'prompt') {
@@ -469,18 +489,18 @@ export function createFrameDispatchContext(deps) {
                             // ATOMICALLY clears its own pending entry if prompt() settles
                             // without ever reaching that drain (an early throw/return leaves
                             // nothing stranded to leak into a later, unrelated turn).
-                            return settle(trackPromptDispatch(promptWithNextTurnGuidance(currentSession(), guidance, () => operationIdContext.fresh(() => currentSession().prompt(frame.text, route.options))).catch(relayError)));
+                            return settle(trackPromptDispatch(promptWithNextTurnGuidance(currentSession(), guidance, () => operationIdContext.fresh(() => currentSession().prompt(frame.text, route.options))).catch(noteFailure)));
                         }
                         return settle(trackPromptDispatch(operationIdContext.fresh(() => currentSession()
                             .prompt(frame.text, route.options)
-                            .catch(relayError)
+                            .catch(noteFailure)
                             .then(() => sendGuidance(guidance, deliverAs)))));
                     }
                     // deliverAs is always 'followUp' here per chooseGuidanceDeliveryMode's
                     // contract (a followUp routeCall never yields 'nextTurn').
                     return settle(currentSession()
                         .followUp(frame.text, frame.images)
-                        .catch(relayError)
+                        .catch(noteFailure)
                         .then(() => sendGuidance(guidance, deliverAs)));
                 };
                 // /login acknowledges before its asynchronous local refresh completes.
@@ -510,6 +530,8 @@ export function createFrameDispatchContext(deps) {
                 // and executes it immediately even while streaming. It also expands a
                 // matching skill/template before applying the same steer behavior.
                 if (resolveSteerCall(frame.text, currentSession()) === 'prompt') {
+                    // The steer→prompt leading-command path never yields a matching user
+                    // message — no ledger intent (see MessageIdLedger).
                     void currentSession()
                         .prompt(frame.text, {
                         images: frame.images,
@@ -518,17 +540,25 @@ export function createFrameDispatchContext(deps) {
                         .catch(relayError);
                     break;
                 }
+                // Message identity: note the intent before steer() so pi's synchronous
+                // enqueue queue_update can adopt it; drop it if the call rejects.
+                const steerMessageId = frame.message_id ?? randomUUID();
+                ledger.noteDispatch(steerMessageId, frame.text);
+                const steerFailure = (err) => {
+                    ledger.dropIntent(steerMessageId);
+                    relayError(err);
+                };
                 const guidance = resolveFrameGuidance(frame.text);
                 // C1: pi's steer() takes images as a POSITIONAL 2nd arg (`steer(text, images?)`).
                 if (guidance === null) {
                     void currentSession()
                         .steer(frame.text, frame.images)
-                        .catch(relayError);
+                        .catch(steerFailure);
                     break;
                 }
                 void currentSession()
                     .steer(frame.text, frame.images)
-                    .catch(relayError)
+                    .catch(steerFailure)
                     .then(() => sendGuidance(guidance, 'steer'));
                 break;
             }
@@ -806,6 +836,9 @@ export function createFrameDispatchContext(deps) {
             type: 'prompt',
             text: frame.text,
             ...(frame.images !== undefined ? { images: frame.images } : {}),
+            // Carry the sender-minted message identity onto the synthesized prompt
+            // frame so a gateway/Core deliver retires its optimistic entry by id.
+            ...(frame.message_id !== undefined ? { message_id: frame.message_id } : {}),
         });
         if (via === 'steer' || outcome === undefined) {
             turnAcceptedWaiters.delete(ackAccepted);
@@ -1203,6 +1236,15 @@ export function createFrameDispatchContext(deps) {
                 void currentSession()
                     .reload()
                     .then(() => {
+                    // pi's reload() re-syncs queue modes from the shared settings.json
+                    // (its ONE post-bind syncQueueModesFromSettings call site) —
+                    // re-apply the broker's 'all' modes so a reload cannot silently
+                    // restore one-at-a-time draining (see rebind.enqueueRebind).
+                    const agent = currentSession().agent;
+                    if (agent) {
+                        agent.steeringMode = 'all';
+                        agent.followUpMode = 'all';
+                    }
                     memoizedRefInventory = null;
                     clearSessionCache();
                     ackTo(client, 'reload');

package/dist/core/runtime/broker/inbox.d.ts

@@ -18,5 +18,9 @@ export declare function readBrokerCursor(nodeId: string): BrokerInboxEntryId | u
 export declare function readBrokerInboxSince(nodeId: string, cursor?: string): BrokerInboxEntry[];
 export declare function readBrokerInboxRange(nodeId: string, after: string | undefined, through: string): BrokerInboxEntry[];
 export declare function readBrokerCanceledEntryIds(nodeId: string): Set<BrokerInboxEntryId>;
+/** The node id a canonical report ref points at, or undefined when the ref is
+ *  absent, absolute, or not a report path. Callers use it to tell whether the
+ *  report-node projection they hold can still resolve the ref. */
+export declare function reportRefNodeId(ref: string | undefined): string | undefined;
 /** Render the existing inbox digest wording with daemon-projected report existence. */
 export declare function coalesceBrokerInbox(entries: readonly BrokerInboxEntry[], reportNodes: ReadonlyMap<string, BrokerReportNodeDTO>): string;

package/dist/core/runtime/broker/inbox.js

@@ -101,16 +101,25 @@ function clipBody(body) {
     }
     return { text: text.trimEnd(), clipped };
 }
-function inlineReport(entry, reportNodes) {
-    if (entry.ref === undefined || entry.ref.startsWith('/'))
-        return null;
-    const separator = entry.ref.indexOf(':');
+/** The node id a canonical report ref points at, or undefined when the ref is
+ *  absent, absolute, or not a report path. Callers use it to tell whether the
+ *  report-node projection they hold can still resolve the ref. */
+export function reportRefNodeId(ref) {
+    if (ref === undefined || ref.startsWith('/'))
+        return undefined;
+    const separator = ref.indexOf(':');
     if (separator <= 0)
+        return undefined;
+    const relpath = ref.slice(separator + 1);
+    if (!relpath.startsWith('reports/') || relpath.includes('..') || relpath.startsWith('/'))
+        return undefined;
+    return ref.slice(0, separator);
+}
+function inlineReport(entry, reportNodes) {
+    const nodeId = reportRefNodeId(entry.ref);
+    if (nodeId === undefined || !reportNodes.has(nodeId))
         return null;
-    const nodeId = entry.ref.slice(0, separator);
-    const relpath = entry.ref.slice(separator + 1);
-    if (!reportNodes.has(nodeId) || !relpath.startsWith('reports/') || relpath.includes('..') || relpath.startsWith('/'))
-        return null;
+    const relpath = entry.ref.slice(entry.ref.indexOf(':') + 1);
     const path = `${nodeDir(nodeId)}/${relpath}`;
     try {
         const body = readFileSync(path, 'utf8');

package/dist/core/runtime/broker/message-ledger.d.ts

@@ -0,0 +1,53 @@
+/** One id-bearing message the ledger tracks. */
+export interface LedgerEntry {
+    id: string;
+    text: string;
+}
+export declare class MessageIdLedger {
+    private steering;
+    private followUp;
+    private pendingIntents;
+    private stagedRetirementId;
+    private recent;
+    /** Record an accepted client frame's identity before its engine call runs.
+     *  `id` is the sender's `message_id` when it minted one, else broker-minted. */
+    noteDispatch(id: string, text: string): void;
+    /** Remove a noted intent whose engine call rejected — the message will never
+     *  appear in a queue or as a user message. No-op if already adopted. */
+    dropIntent(id: string): void;
+    /**
+     * Fold one pi `queue_update` into the ledger and return the id arrays
+     * parallel to its text arrays (total: every position gets an id).
+     *
+     * Per-queue positional diff against the mirrored entries: a text matching an
+     * old entry at-or-after the cursor keeps its id (everything skipped is
+     * removed); an unmatched text ADOPTS the first pending intent with equal
+     * text, else mints a fresh id. Exactly ONE removal across both queues is
+     * pi's per-message retirement (its queue_update precedes the user
+     * `message_start` it belongs to) and is staged for `takeUserMessageId`;
+     * 0 or >1 removals (an enqueue, clearQueue/dequeue, abort) stage nothing.
+     */
+    reconcileQueueUpdate(steering: readonly string[], followUp: readonly string[]): {
+        steeringIds: string[];
+        followUpIds: string[];
+    };
+    /**
+     * The id for a relayed user `message_start`, or undefined when this message
+     * carries none (an engine-command expansion, a text pi transformed, or a
+     * pre-ledger replay). A staged retirement wins — pi emitted its queue_update
+     * synchronously right before this message; otherwise the first pending
+     * intent with equal text (the idle-prompt case, which never touches a
+     * queue). Id-bearing results are remembered for `recentUserMessages`.
+     */
+    takeUserMessageId(messageText: string): string | undefined;
+    /** The last {@link MAX_RECENT} id-bearing user-message dispatches, oldest
+     *  first — the `welcome.recentUserMessages` payload. */
+    recentUserMessages(): Array<{
+        id: string;
+        text: string;
+    }>;
+    /** Session rebind/replacement: the mirrored queues, staged retirement, and
+     *  recent list all described the OLD session — drop everything. */
+    reset(): void;
+    private remember;
+}