@openrig/cli 0.5.4 → 0.5.5

package/node_modules/@openrig/daemon/dist/domain/queue-repository.js

@@ -3,11 +3,14 @@ import { loadHumanRegistry } from "./gateway/human-registry.js";
 import { resolveExternal } from "./gateway/external-admission.js";
 import { QueueTransitionLog } from "./queue-transition-log.js";
 import { WAKE_INTENT_PREFIX } from "./outbox-handler.js";
+import { derivePickup } from "./queue-pickup.js";
 import { wrapPaneEnvelope } from "../lib/pane-envelope.js";
 import { getSelfHostId } from "./hosts/fanout-contract.js";
 import { parseSessionName } from "./session-name.js";
 import { computeClosureRequiredAt, validateClosure, } from "./hot-potato-enforcer.js";
 import { isHumanSeatSession, validateHumanPark, validateHumanRoute } from "./human-route-enforcer.js";
+import { QueueWakeRepository } from "./queue-wake-repository.js";
+import { WatchdogJobsRepository } from "./watchdog-jobs-repository.js";
 export const QUEUE_STATES = [
     "pending",
     "in-progress",
@@ -37,6 +40,8 @@ export const ACTIVE_QUEUE_STATES = ["pending", "in-progress", "blocked"];
 export function isBlockerLive(state) {
     return ACTIVE_QUEUE_STATES.includes(state);
 }
+const AUTO_UNPARK_WAKE_TAG = "queue:auto-unpark:blocker";
+const AUTO_UNPARK_BLOCKER_TAG_PREFIX = "queue:auto-unpark:blocker-ref:";
 /** 0.5.1-53 Atom 1a — typed non-qitem gate blocker prefixes. A park may be gated on a fold / auth /
  *  external condition that is NOT a qitem and NOT a human seat; these prefixes make such a gate a
  *  first-class, compact-visible, downstream-classifiable blocker (the ruling detail rides a transition). */
@@ -267,6 +272,8 @@ export class QueueRepository {
      *     fallback real code rather than a promise in a comment). */
     outbox;
     resolveOccupantGeneration;
+    wakeRepo;
+    watchdogJobsRepo;
     /** PL-007 Workspace Primitive — true when migration 038 has applied the
      *  queue_items.target_repo column. Older test fixtures that bypass the
      *  canonical migration list don't have the column; INSERTs degrade to
@@ -284,6 +291,7 @@ export class QueueRepository {
         this.db = db;
         this.eventBus = eventBus;
         this.transitionLog = new QueueTransitionLog(db);
+        this.wakeRepo = new QueueWakeRepository(db);
         this.validateRig = opts?.validateRig ?? (() => true);
         this.transport = opts?.transport;
         this.workflowFrontierPredicate = opts?.workflowFrontierPredicate;
@@ -308,6 +316,11 @@ export class QueueRepository {
         // checks cannot drift.
         db.function("is_human_seat_session", { deterministic: true }, (value) => isHumanSeatSession(value) ? 1 : 0);
     }
+    /** Startup attaches the generation-aware shared repository. Isolated domain
+     *  fixtures fall back to a repository on this same SQLite connection. */
+    attachWatchdogJobsRepository(repo) {
+        this.watchdogJobsRepo = repo;
+    }
     /**
      * Attach the wake-path transport AFTER construction. Used by daemon
      * startup, where SessionTransport is constructed later in the dep graph
@@ -358,24 +371,50 @@ export class QueueRepository {
         // defect only when a wake WAS intended.
         if (nudge === false)
             return;
+        this.recordWakeIntent({
+            outboxId: `${WAKE_INTENT_PREFIX}${successorQitemId}`,
+            auditPointer: successorQitemId,
+            fromSession,
+            toSession,
+            identityProvenance,
+            bareBody: `Queue handoff: ${successorQitemId} - check your queue.`,
+        });
+    }
+    recordWakeIntent(input) {
         if (!this.outbox)
-            return;
-        // MF4: FREEZE the emitting envelope at stage time. Resolve the source occupant
-        // generation and build the full pane envelope NOW, and store it verbatim as the
-        // intent body. Delivery (immediate or crash-recovery) replays this exact text,
-        // so a recovery after a tenure swap can never relabel the wake with the CURRENT
-        // occupant's generation — it carries the generation that actually emitted it.
-        const bareBody = `Queue handoff: ${successorQitemId} - check your queue.`;
+            return null;
+        // MF4: freeze the emitting envelope at stage time. Delivery and crash
+        // recovery replay these exact bytes without re-resolving the occupant.
         const stampISO = new Date().toISOString();
-        const genUuid = this.resolveOccupantGeneration?.(fromSession) ?? undefined;
-        const frozenEnvelope = wrapPaneEnvelope(fromSession, toSession, bareBody, getSelfHostId(), { stampISO, genUuid });
+        const genUuid = this.resolveOccupantGeneration?.(input.fromSession) ?? undefined;
+        const frozenEnvelope = wrapPaneEnvelope(input.fromSession, input.toSession, input.bareBody, { stampISO, genUuid });
         this.outbox.record({
-            outboxId: `${WAKE_INTENT_PREFIX}${successorQitemId}`,
-            senderSession: fromSession,
-            destinationSession: toSession,
+            outboxId: input.outboxId,
+            senderSession: input.fromSession,
+            destinationSession: input.toSession,
             body: frozenEnvelope,
-            auditPointer: successorQitemId,
-            identityProvenance: identityProvenance ?? null,
+            tags: input.tags,
+            auditPointer: input.auditPointer,
+            identityProvenance: input.identityProvenance,
+        });
+        return input.outboxId;
+    }
+    stageAutoUnparkWakeIntent(input) {
+        return this.recordWakeIntent({
+            outboxId: `${WAKE_INTENT_PREFIX}blocker-${input.resumeTransitionId}`,
+            auditPointer: input.qitemId,
+            fromSession: input.fromSession,
+            toSession: input.destinationSession,
+            identityProvenance: input.identityProvenance,
+            bareBody: `Blocker ${input.blockerQitemId} resolved; parked qitem ${input.qitemId} is pending. Resume the recorded continuation and update the row.`,
+            tags: [AUTO_UNPARK_WAKE_TAG, `${AUTO_UNPARK_BLOCKER_TAG_PREFIX}${input.blockerQitemId}`],
+        });
+    }
+    deliverWakeIntentAfterCommit(outboxId) {
+        queueMicrotask(() => {
+            void this.deliverWakeIntent(outboxId).catch((err) => {
+                console.error(`Auto-unpark wake delivery failed for ${outboxId}:`, err);
+            });
         });
     }
     /**
@@ -448,9 +487,45 @@ export class QueueRepository {
         const qitemId = intent.auditPointer ?? outboxId;
         // MF4: send the FROZEN envelope stored on the intent verbatim (no re-resolution).
         const outcome = await this.performWakeSend(qitemId, intent.destinationSession, intent.senderSession, undefined, intent.body);
-        this.recordNudgeAttempt(qitemId, outcome.nudgeResult);
         const finalState = outcome.classified === "verified" ? "delivered" : outcome.classified;
-        this.outbox.finalizeDelivery(outboxId, finalState);
+        const blockerRef = intent.tags?.includes(AUTO_UNPARK_WAKE_TAG)
+            ? intent.tags
+                .find((tag) => tag.startsWith(AUTO_UNPARK_BLOCKER_TAG_PREFIX))
+                ?.slice(AUTO_UNPARK_BLOCKER_TAG_PREFIX.length)
+            : undefined;
+        const wakeEvent = this.db.transaction(() => {
+            this.recordNudgeAttempt(qitemId, outcome.nudgeResult);
+            this.outbox.finalizeDelivery(outboxId, finalState);
+            if (!blockerRef)
+                return null;
+            const item = this.getByIdOrThrow(qitemId);
+            const transition = this.transitionLog.append({
+                qitemId,
+                state: item.state,
+                actorSession: "queue@system",
+                transitionNote: `blocker ${blockerRef} wake attempted; delivery=${outcome.nudgeResult}`,
+            });
+            this.wakeRepo.record({
+                transitionId: transition.transitionId,
+                qitemId,
+                phase: "fired",
+                kind: "blocker",
+                ref: blockerRef,
+                deliveryStatus: outcome.nudgeResult,
+            });
+            return this.eventBus.persistWithinTransaction({
+                type: "queue.updated",
+                qitemId,
+                fromState: item.state,
+                toState: item.state,
+                closureReason: null,
+                closureTarget: null,
+                actorSession: "queue@system",
+                summary: item.summary ?? null,
+            });
+        })();
+        if (wakeEvent)
+            this.eventBus.notifySubscribers(wakeEvent);
         return finalState;
     }
     /**
@@ -597,6 +672,23 @@ export class QueueRepository {
      * delivered nor demoted to failed.
      */
     async performWakeSend(qitemId, destinationSession, sourceSession, bodyOverride, prebuiltText) {
+        // DEFECT FIX qitem-20260827065907-b9ae334c (S1-class, 3 live specimens): a virtual
+        // @external destination has NO pane — the queue row ITSELF is the gateway
+        // subsystem's input (the Slack connector polls human-destined rows and its own
+        // ledger is the delivery record). Falling through to tmux here recorded
+        // "failed: … tmux reports no session" while the founder verifiably received the
+        // message, and that failed: literal poisoned the undelivered surface. So: the
+        // wake for this class is GATEWAY-OWNED — tmux is never consulted, and the
+        // recorded wording claims exactly what was (and was not) checked. Classified
+        // indeterminate (landed with the owning subsystem; render unconfirmable here) —
+        // never verified, never failed. Human-CLASS seats with real panes
+        // (human-*@kernel) are NOT this class and keep tmux transport.
+        if (parseSessionName(destinationSession).kind === "external") {
+            return {
+                classified: "indeterminate",
+                nudgeResult: `gateway-owned: '${destinationSession}' is a virtual @external destination — delivery rides the gateway subsystem (Slack connector), whose own ledger is the delivery record; tmux was not consulted (it can never hold this address class)`,
+            };
+        }
         const stampISO = new Date().toISOString();
         let text;
         if (prebuiltText !== undefined) {
@@ -617,7 +709,7 @@ export class QueueRepository {
             const genUuid = sourceSession
                 ? (this.resolveOccupantGeneration?.(sourceSession) ?? undefined)
                 : undefined;
-            text = wrapPaneEnvelope(sourceSession, destinationSession, bareBody, getSelfHostId(), { stampISO, genUuid });
+            text = wrapPaneEnvelope(sourceSession, destinationSession, bareBody, { stampISO, genUuid });
         }
         try {
             const res = await this.transport.send(destinationSession, text, { verify: true, stampISO });
@@ -653,10 +745,11 @@ export class QueueRepository {
         }
     }
     async create(input) {
-        // 51-09 incr 4 — stamp the origin host onto the STORED sender identity once,
-        // before validation/insert/idempotency, so the row's source_session IS the
-        // triple (fail-open to 2-part when no self-id / not a bare member@rig).
-        input = { ...input, sourceSession: stampSelfHostSuffix(input.sourceSession) };
+        // FOUNDER ROOT INVARIANT (2026-08-27, supersedes 51-09 incr 4 / ruling cb19867f Q2):
+        // a LOCAL write stores the bare transport identity — no self-host suffix inside one
+        // instance. Host identity is added only at the cross-host forwarding boundary
+        // (routes/queue.ts stamp-at-FORWARD), and a genuine origin triple arriving from a
+        // forward is stored verbatim (never re-stamped, never stripped).
         if (!this.validateRig(input.destinationSession)) {
             throw new QueueRepositoryError("unknown_destination_rig", `destination_session ${input.destinationSession} references an unknown rig`, destinationRefusalTeaching(input.destinationSession));
         }
@@ -1273,8 +1366,9 @@ export class QueueRepository {
      */
     update(input) {
         const txn = this.db.transaction(() => this.updateInTransactionalContext(input));
-        const persistedEvent = txn();
-        this.eventBus.notifySubscribers(persistedEvent);
+        const result = txn();
+        for (const event of result.persistedEvents)
+            this.eventBus.notifySubscribers(event);
         return this.getByIdOrThrow(input.qitemId);
     }
     /**
@@ -1298,8 +1392,8 @@ export class QueueRepository {
      * therefore applies to workflow projection unchanged.
      */
     updateWithinTransaction(input) {
-        const persistedEvent = this.updateInTransactionalContext(input);
-        return { qitemId: input.qitemId, persistedEvent };
+        const result = this.updateInTransactionalContext(input);
+        return { qitemId: input.qitemId, ...result };
     }
     /**
      * Internal: closure validation + UPDATE + transition log + emit
@@ -1324,6 +1418,8 @@ export class QueueRepository {
                 || input.closureTarget != null
                 || input.handedOffTo != null
                 || input.blockedOn != null
+                || input.wakeWatchdogId != null
+                || input.wakeAfterSeconds != null
                 || input.summary != null
                 || input.evidenceRef != null;
             if (disallowed) {
@@ -1336,7 +1432,7 @@ export class QueueRepository {
                 transitionNote: input.transitionNote,
                 identityProvenance: input.identityProvenance ?? null,
             });
-            return this.eventBus.persistWithinTransaction({
+            const persistedEvent = this.eventBus.persistWithinTransaction({
                 type: "queue.updated",
                 qitemId: input.qitemId,
                 fromState: qitem.state,
@@ -1346,10 +1442,20 @@ export class QueueRepository {
                 actorSession: input.actorSession,
                 summary: qitem.summary ?? null,
             });
+            return { persistedEvent, persistedEvents: [persistedEvent] };
         }
         if (!isQueueState(input.state)) {
             throw new QueueRepositoryError("invalid_state", `state=${input.state} not valid; valid: ${QUEUE_STATES.join(", ")}`);
         }
+        if ((input.wakeWatchdogId != null || input.wakeAfterSeconds != null) && input.state !== "blocked") {
+            throw new QueueRepositoryError("wake_not_admitted", "a park wake persists only with state=blocked; park the row or drop the wake option");
+        }
+        if (input.wakeWatchdogId != null && input.wakeAfterSeconds != null) {
+            throw new QueueRepositoryError("wake_ambiguous", "choose one explicit park wake: an existing watchdog id or an atomic timer");
+        }
+        if (input.wakeAfterSeconds != null && (!Number.isInteger(input.wakeAfterSeconds) || input.wakeAfterSeconds <= 0)) {
+            throw new QueueRepositoryError("wake_after_invalid", `wakeAfterSeconds must be a positive integer (got ${input.wakeAfterSeconds})`);
+        }
         const isReopen = isGuardedTerminal && input.state !== qitem.state;
         if (isReopen && !input.reopen) {
             throw new QueueRepositoryError("terminal_reopen_requires_ack", `qitem ${input.qitemId} is currently '${qitem.state}'; state='${input.state}' would reopen a terminal row. Re-run deliberately with --reopen --note <reason>.`, { currentState: qitem.state, requestedState: input.state });
@@ -1451,16 +1557,19 @@ export class QueueRepository {
             if (effectiveBlockedOn.startsWith("qitem-")) {
                 const blocker = this.getById(effectiveBlockedOn);
                 if (!blocker) {
-                    throw new QueueRepositoryError("blocker_not_found", `blocked_on names a qitem that does not exist: ${effectiveBlockedOn}. A park must name a real, live blocker — a nonexistent blocker can never complete, so the row could never unpark.`, { blockedOn: effectiveBlockedOn });
+                    throw new QueueRepositoryError("blocker_not_found", `blocked_on names a qitem that does not exist: ${effectiveBlockedOn}. A park must name a real, live blocker — a nonexistent blocker can never complete, so the row could never unpark.`, 
+                    // F1 (error-honesty): the rejected value is named rejectedBlocker — an error payload
+                    // never carries the success-shaped blockedOn field (the field-filtered-misread class).
+                    { rejectedBlocker: effectiveBlockedOn });
                 }
                 if (!isBlockerLive(blocker.state)) {
-                    throw new QueueRepositoryError("blocker_not_live", `blocked_on names a resolved qitem: ${effectiveBlockedOn} is '${blocker.state}'. A park must name a LIVE blocker — parking on a completed/closed row is a dead-blocker park that never self-clears.`, { blockedOn: effectiveBlockedOn, blockerState: blocker.state });
+                    throw new QueueRepositoryError("blocker_not_live", `blocked_on names a resolved qitem: ${effectiveBlockedOn} is '${blocker.state}'. A park must name a LIVE blocker — parking on a completed/closed row is a dead-blocker park that never self-clears.`, { rejectedBlocker: effectiveBlockedOn, blockerState: blocker.state });
                 }
             }
             else {
                 const typedPrefix = typedGateBlockerPrefix(effectiveBlockedOn);
                 if (typedPrefix && !isTypedGateBlocker(effectiveBlockedOn)) {
-                    throw new QueueRepositoryError("blocker_malformed", `blocked_on '${effectiveBlockedOn}' is a bare '${typedPrefix}' prefix with no gate body. A typed gate blocker must name its gate (e.g. fold:one-home+attestation).`, { blockedOn: effectiveBlockedOn });
+                    throw new QueueRepositoryError("blocker_malformed", `blocked_on '${effectiveBlockedOn}' is a bare '${typedPrefix}' prefix with no gate body. A typed gate blocker must name its gate (e.g. fold:one-home+attestation).`, { rejectedBlocker: effectiveBlockedOn });
                 }
             }
         }
@@ -1480,6 +1589,37 @@ export class QueueRepository {
                 });
             }
         }
+        let parkWake = null;
+        const jobsRepo = this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db);
+        if (input.wakeWatchdogId != null) {
+            const job = jobsRepo.getById(input.wakeWatchdogId);
+            if (!job || job.state !== "active") {
+                throw new QueueRepositoryError("wake_watchdog_not_live", `watchdog ${input.wakeWatchdogId} is not an active job; attach a live watchdog or arm an atomic timer`, { wakeWatchdogId: input.wakeWatchdogId });
+            }
+            if (job.targetSession !== qitem.destinationSession) {
+                throw new QueueRepositoryError("wake_watchdog_target_mismatch", `watchdog ${job.jobId} targets ${job.targetSession}, not parked owner ${qitem.destinationSession}`, { wakeWatchdogId: job.jobId, targetSession: job.targetSession, destinationSession: qitem.destinationSession });
+            }
+            parkWake = { kind: "watchdog", ref: job.jobId };
+        }
+        else if (input.wakeAfterSeconds != null) {
+            const job = jobsRepo.register({
+                policy: "periodic-reminder",
+                specYaml: [
+                    "policy: periodic-reminder",
+                    "target:",
+                    `  session: ${JSON.stringify(qitem.destinationSession)}`,
+                    `message: ${JSON.stringify(`Wake timer fired for parked qitem ${qitem.qitemId}. Resume the recorded continuation and update the row.`)}`,
+                    "",
+                ].join("\n"),
+                targetSession: qitem.destinationSession,
+                intervalSeconds: input.wakeAfterSeconds,
+                registeredBySession: input.actorSession,
+            });
+            parkWake = { kind: "timer", ref: job.jobId };
+        }
+        else if (input.state === "blocked" && effectiveBlockedOn?.startsWith("qitem-")) {
+            parkWake = { kind: "blocker", ref: effectiveBlockedOn };
+        }
         const ts = new Date().toISOString();
         const fromState = qitem.state;
         // 0.5.1-53 Atom 1b(i) — clear-on-exit. blocked_on is set EXPLICITLY, not COALESCE'd:
@@ -1505,7 +1645,7 @@ export class QueueRepository {
             this.persistSummary(input.qitemId, input.summary ?? null);
             this.persistEvidenceRef(input.qitemId, input.evidenceRef ?? null);
         }
-        this.transitionLog.append({
+        const transition = this.transitionLog.append({
             qitemId: input.qitemId,
             state: input.state,
             actorSession: input.actorSession,
@@ -1514,26 +1654,47 @@ export class QueueRepository {
             closureTarget: validation.closureTarget ?? undefined,
             identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
         });
+        if (parkWake) {
+            this.wakeRepo.record({
+                transitionId: transition.transitionId,
+                qitemId: input.qitemId,
+                phase: "armed",
+                kind: parkWake.kind,
+                ref: parkWake.ref,
+                deliveryStatus: null,
+            });
+        }
         // 0.5.1-53 Atom 1b(iii) — propagate-completion. blocked_on PROMISES "A waits until B completes";
         // that promise never fired on this runtime (rows sat blocked on done/canceled blockers for days).
         // When THIS qitem reaches a terminal state, auto-unpark every row parked on it (blocked_on = this,
         // state='blocked') to pending, clear its (now-resolved) blocker, log the transition, and emit an
         // event so watchers/sweeps see the unblock without a fetch.
+        const dependentEvents = [];
         if (!isBlockerLive(input.state)) {
             const blockedRows = this.db
-                .prepare("SELECT qitem_id FROM queue_items WHERE blocked_on = ? AND state = 'blocked'")
+                .prepare("SELECT qitem_id, destination_session FROM queue_items WHERE blocked_on = ? AND state = 'blocked'")
                 .all(input.qitemId);
             for (const r of blockedRows) {
                 this.db
                     .prepare("UPDATE queue_items SET state = 'pending', blocked_on = NULL, ts_updated = ? WHERE qitem_id = ?")
                     .run(ts, r.qitem_id);
-                this.transitionLog.append({
+                const resumeTransition = this.transitionLog.append({
                     qitemId: r.qitem_id,
                     state: "pending",
                     actorSession: input.actorSession,
                     transitionNote: `auto-unparked: blocker ${input.qitemId} reached terminal state '${input.state}'`,
                 });
-                this.eventBus.persistWithinTransaction({
+                const wakeIntentId = this.stageAutoUnparkWakeIntent({
+                    qitemId: r.qitem_id,
+                    destinationSession: r.destination_session,
+                    fromSession: input.actorSession,
+                    identityProvenance: input.identityProvenance ?? null,
+                    blockerQitemId: input.qitemId,
+                    resumeTransitionId: resumeTransition.transitionId,
+                });
+                if (wakeIntentId)
+                    this.deliverWakeIntentAfterCommit(wakeIntentId);
+                const dependentEvent = this.eventBus.persistWithinTransaction({
                     type: "queue.updated",
                     qitemId: r.qitem_id,
                     fromState: "blocked",
@@ -1541,11 +1702,13 @@ export class QueueRepository {
                     closureReason: null,
                     closureTarget: null,
                     actorSession: input.actorSession,
-                    summary: null,
+                    summary: this.getById(r.qitem_id)?.summary ?? null,
                 });
+                this.eventBus.registerPersistedWithinActiveEnvelope(dependentEvent);
+                dependentEvents.push(dependentEvent);
             }
         }
-        return this.eventBus.persistWithinTransaction({
+        const persistedEvent = this.eventBus.persistWithinTransaction({
             type: "queue.updated",
             qitemId: input.qitemId,
             fromState,
@@ -1557,6 +1720,52 @@ export class QueueRepository {
             // (park-time summary included) so surfaces refresh without a fetch.
             summary: effectiveSummary ?? null,
         });
+        return { persistedEvent, persistedEvents: [...dependentEvents, persistedEvent] };
+    }
+    getParkWakeStatus(qitemId) {
+        return this.wakeRepo.getStatus(qitemId);
+    }
+    listTransitions(qitemId) {
+        return this.transitionLog.listForQitem(qitemId).map((transition) => {
+            const wake = this.wakeRepo.getForTransition(transition.transitionId);
+            return wake ? { ...transition, wake } : transition;
+        });
+    }
+    /** Called by the watchdog engine after the delivery attempt is durably
+     *  audited. The queue transition records that attempt independently of
+     *  whether the HELD row's owner consumed it. */
+    recordWatchdogWakeAttempt(jobId, deliveryStatus) {
+        const targets = this.wakeRepo.findBlockedQitemsByWatchdog(jobId);
+        if (targets.length === 0)
+            return;
+        const events = this.db.transaction(() => targets.map(({ qitemId, kind }) => {
+            const transition = this.transitionLog.append({
+                qitemId,
+                state: "blocked",
+                actorSession: "watchdog@system",
+                transitionNote: `park wake fired: watchdog ${jobId}; delivery=${deliveryStatus}; awaiting owner consumption`,
+            });
+            this.wakeRepo.record({
+                transitionId: transition.transitionId,
+                qitemId,
+                phase: "fired",
+                kind,
+                ref: jobId,
+                deliveryStatus,
+            });
+            return this.eventBus.persistWithinTransaction({
+                type: "queue.updated",
+                qitemId,
+                fromState: "blocked",
+                toState: "blocked",
+                closureReason: null,
+                closureTarget: null,
+                actorSession: "watchdog@system",
+                summary: this.getById(qitemId)?.summary ?? null,
+            });
+        }))();
+        for (const event of events)
+            this.eventBus.notifySubscribers(event);
     }
     getById(qitemId) {
         const row = this.db
@@ -1881,8 +2090,31 @@ export class QueueRepository {
         txn();
         return rows.length;
     }
+    /** S04 — substantive post-claim motion: transitions strictly after the claim, excluding the
+     *  claim's own 'claimed' transition. Lazily prepared; indexed on qitem_id. */
+    postClaimMotionStmt;
+    postClaimMotionCount(qitemId, claimedAt) {
+        this.postClaimMotionStmt ??= this.db.prepare("SELECT COUNT(*) AS n FROM queue_transitions WHERE qitem_id = ? AND ts > ? AND transition_note IS NOT 'claimed'");
+        try {
+            return this.postClaimMotionStmt.get(qitemId, claimedAt).n;
+        }
+        catch {
+            return 0; // minimal fixture DBs without the transitions table: degrade, never throw
+        }
+    }
     rowToItem(row) {
+        // S04 — derive the pickup receipt at the ONE shared projection point (list/show/overdue
+        // all flow through here), so the park-vs-strand question is answered by the row face.
+        const pickup = derivePickup({
+            state: row.state,
+            claimedAt: row.claimed_at,
+            lastHeartbeat: row.last_heartbeat,
+            postClaimMotionCount: row.claimed_at && row.state !== "blocked"
+                ? this.postClaimMotionCount(row.qitem_id, row.claimed_at)
+                : 0,
+        });
         return {
+            pickup,
             qitemId: row.qitem_id,
             tsCreated: row.ts_created,
             tsUpdated: row.ts_updated,