@openrig/cli 0.5.4 → 0.5.6

package/daemon/dist/domain/queue-repository.js

@@ -1,13 +1,17 @@
 import { createHash } from "node:crypto";
-import { loadHumanRegistry } from "./gateway/human-registry.js";
+import { loadHumanRegistry, resolveRegisteredHumanAddress } from "./gateway/human-registry.js";
 import { resolveExternal } from "./gateway/external-admission.js";
 import { QueueTransitionLog } from "./queue-transition-log.js";
 import { WAKE_INTENT_PREFIX } from "./outbox-handler.js";
+import { derivePickup } from "./queue-pickup.js";
 import { wrapPaneEnvelope } from "../lib/pane-envelope.js";
 import { getSelfHostId } from "./hosts/fanout-contract.js";
 import { parseSessionName } from "./session-name.js";
+import { classifyDestination } from "./gateway/destination-resolver.js";
 import { computeClosureRequiredAt, validateClosure, } from "./hot-potato-enforcer.js";
 import { isHumanSeatSession, validateHumanPark, validateHumanRoute } from "./human-route-enforcer.js";
+import { QueueWakeRepository, USAGE_LIMIT_BLOCKER_TAG, } from "./queue-wake-repository.js";
+import { WatchdogJobsRepository } from "./watchdog-jobs-repository.js";
 export const QUEUE_STATES = [
     "pending",
     "in-progress",
@@ -37,6 +41,8 @@ export const ACTIVE_QUEUE_STATES = ["pending", "in-progress", "blocked"];
 export function isBlockerLive(state) {
     return ACTIVE_QUEUE_STATES.includes(state);
 }
+const AUTO_UNPARK_WAKE_TAG = "queue:auto-unpark:blocker";
+const AUTO_UNPARK_BLOCKER_TAG_PREFIX = "queue:auto-unpark:blocker-ref:";
 /** 0.5.1-53 Atom 1a — typed non-qitem gate blocker prefixes. A park may be gated on a fold / auth /
  *  external condition that is NOT a qitem and NOT a human seat; these prefixes make such a gate a
  *  first-class, compact-visible, downstream-classifiable blocker (the ruling detail rides a transition). */
@@ -159,6 +165,14 @@ function detectQueueColumn(db, columnName) {
         return false;
     }
 }
+function detectTable(db, tableName) {
+    try {
+        return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(tableName);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * L3 — Queue repository. Owns CRUD over `queue_items` plus the wired-in
  * append-only transition log and hot-potato strict-rejection contract.
@@ -267,6 +281,8 @@ export class QueueRepository {
      *     fallback real code rather than a promise in a comment). */
     outbox;
     resolveOccupantGeneration;
+    wakeRepo;
+    watchdogJobsRepo;
     /** PL-007 Workspace Primitive — true when migration 038 has applied the
      *  queue_items.target_repo column. Older test fixtures that bypass the
      *  canonical migration list don't have the column; INSERTs degrade to
@@ -277,6 +293,9 @@ export class QueueRepository {
     hasEvidenceRefColumn;
     hasMintingGenColumn;
     hasClaimedGenColumn;
+    hasQueueTransitionsTable;
+    hasOwnerNotificationColumns;
+    loadHumanRegistryFn;
     /** OPR.0.4.6.WF3 FR-6 — injected by startup (never imported): the
      *  workflow domain's is-live-frontier-packet predicate. */
     workflowFrontierPredicate;
@@ -284,13 +303,21 @@ export class QueueRepository {
         this.db = db;
         this.eventBus = eventBus;
         this.transitionLog = new QueueTransitionLog(db);
+        this.wakeRepo = new QueueWakeRepository(db);
         this.validateRig = opts?.validateRig ?? (() => true);
         this.transport = opts?.transport;
         this.workflowFrontierPredicate = opts?.workflowFrontierPredicate;
         this.resolveOccupantGeneration = opts?.resolveOccupantGeneration;
+        this.loadHumanRegistryFn = opts?.loadHumanRegistry ?? (() => loadHumanRegistry());
         this.hasTargetRepoColumn = detectQueueColumn(db, "target_repo");
         this.hasSummaryColumn = detectQueueColumn(db, "summary");
         this.hasEvidenceRefColumn = detectQueueColumn(db, "evidence_ref");
+        this.hasQueueTransitionsTable = detectTable(db, "queue_transitions");
+        const transitionColumns = this.hasQueueTransitionsTable
+            ? new Set(db.prepare("PRAGMA table_info(queue_transitions)").all().map((column) => column.name))
+            : new Set();
+        this.hasOwnerNotificationColumns = transitionColumns.has("owner_notification_kind")
+            && transitionColumns.has("owner_notification_level");
         // GHOST-STAGE (e/Class-B): generation stamps (migration 063). Defensive detect so a pre-063
         // harness degrades (writers skip the columns; the release predicate never matches unstamped rows).
         this.hasMintingGenColumn = detectQueueColumn(db, "minting_generation_uuid");
@@ -308,6 +335,11 @@ export class QueueRepository {
         // checks cannot drift.
         db.function("is_human_seat_session", { deterministic: true }, (value) => isHumanSeatSession(value) ? 1 : 0);
     }
+    /** Startup attaches the generation-aware shared repository. Isolated domain
+     *  fixtures fall back to a repository on this same SQLite connection. */
+    attachWatchdogJobsRepository(repo) {
+        this.watchdogJobsRepo = repo;
+    }
     /**
      * Attach the wake-path transport AFTER construction. Used by daemon
      * startup, where SessionTransport is constructed later in the dep graph
@@ -334,6 +366,26 @@ export class QueueRepository {
         }
         this.outbox = outbox;
     }
+    /** The one transition-write classifier. It consumes structured state/action facts only. */
+    classifyOwnerNotification(input) {
+        if (input.explicitKind === "human-decision-resolved") {
+            return { kind: input.explicitKind, level: "NOTICE" };
+        }
+        const registry = this.loadHumanRegistryFn();
+        if (!registry.ok)
+            return null;
+        const blockedHuman = resolveRegisteredHumanAddress(input.nextBlockedOn, registry.entities);
+        const previousBlockedHuman = resolveRegisteredHumanAddress(input.previousBlockedOn, registry.entities);
+        const enteredHumanPark = input.nextState === "blocked" && blockedHuman !== null &&
+            (input.previousState !== "blocked" || previousBlockedHuman !== blockedHuman);
+        if (enteredHumanPark)
+            return { kind: "human-required", level: "ALERT" };
+        const destinationHuman = resolveRegisteredHumanAddress(input.destinationSession, registry.entities);
+        if (input.action === "create" && destinationHuman !== null) {
+            return { kind: "human-required", level: "ALERT" };
+        }
+        return null;
+    }
     /**
      * W1 (transactional closure) — the PUBLIC composable primitive (stage half).
      * Stage the durable WAKE INTENT for a successor qitem from INSIDE a terminal
@@ -358,24 +410,50 @@ export class QueueRepository {
         // defect only when a wake WAS intended.
         if (nudge === false)
             return;
+        this.recordWakeIntent({
+            outboxId: `${WAKE_INTENT_PREFIX}${successorQitemId}`,
+            auditPointer: successorQitemId,
+            fromSession,
+            toSession,
+            identityProvenance,
+            bareBody: `Queue handoff: ${successorQitemId} - check your queue.`,
+        });
+    }
+    recordWakeIntent(input) {
         if (!this.outbox)
-            return;
-        // MF4: FREEZE the emitting envelope at stage time. Resolve the source occupant
-        // generation and build the full pane envelope NOW, and store it verbatim as the
-        // intent body. Delivery (immediate or crash-recovery) replays this exact text,
-        // so a recovery after a tenure swap can never relabel the wake with the CURRENT
-        // occupant's generation — it carries the generation that actually emitted it.
-        const bareBody = `Queue handoff: ${successorQitemId} - check your queue.`;
+            return null;
+        // MF4: freeze the emitting envelope at stage time. Delivery and crash
+        // recovery replay these exact bytes without re-resolving the occupant.
         const stampISO = new Date().toISOString();
-        const genUuid = this.resolveOccupantGeneration?.(fromSession) ?? undefined;
-        const frozenEnvelope = wrapPaneEnvelope(fromSession, toSession, bareBody, getSelfHostId(), { stampISO, genUuid });
+        const genUuid = this.resolveOccupantGeneration?.(input.fromSession) ?? undefined;
+        const frozenEnvelope = wrapPaneEnvelope(input.fromSession, input.toSession, input.bareBody, { stampISO, genUuid });
         this.outbox.record({
-            outboxId: `${WAKE_INTENT_PREFIX}${successorQitemId}`,
-            senderSession: fromSession,
-            destinationSession: toSession,
+            outboxId: input.outboxId,
+            senderSession: input.fromSession,
+            destinationSession: input.toSession,
             body: frozenEnvelope,
-            auditPointer: successorQitemId,
-            identityProvenance: identityProvenance ?? null,
+            tags: input.tags,
+            auditPointer: input.auditPointer,
+            identityProvenance: input.identityProvenance,
+        });
+        return input.outboxId;
+    }
+    stageAutoUnparkWakeIntent(input) {
+        return this.recordWakeIntent({
+            outboxId: `${WAKE_INTENT_PREFIX}blocker-${input.resumeTransitionId}`,
+            auditPointer: input.qitemId,
+            fromSession: input.fromSession,
+            toSession: input.destinationSession,
+            identityProvenance: input.identityProvenance,
+            bareBody: `Blocker ${input.blockerQitemId} resolved; parked qitem ${input.qitemId} is pending. Resume the recorded continuation and update the row.`,
+            tags: [AUTO_UNPARK_WAKE_TAG, `${AUTO_UNPARK_BLOCKER_TAG_PREFIX}${input.blockerQitemId}`],
+        });
+    }
+    deliverWakeIntentAfterCommit(outboxId) {
+        queueMicrotask(() => {
+            void this.deliverWakeIntent(outboxId).catch((err) => {
+                console.error(`Auto-unpark wake delivery failed for ${outboxId}:`, err);
+            });
         });
     }
     /**
@@ -448,9 +526,45 @@ export class QueueRepository {
         const qitemId = intent.auditPointer ?? outboxId;
         // MF4: send the FROZEN envelope stored on the intent verbatim (no re-resolution).
         const outcome = await this.performWakeSend(qitemId, intent.destinationSession, intent.senderSession, undefined, intent.body);
-        this.recordNudgeAttempt(qitemId, outcome.nudgeResult);
         const finalState = outcome.classified === "verified" ? "delivered" : outcome.classified;
-        this.outbox.finalizeDelivery(outboxId, finalState);
+        const blockerRef = intent.tags?.includes(AUTO_UNPARK_WAKE_TAG)
+            ? intent.tags
+                .find((tag) => tag.startsWith(AUTO_UNPARK_BLOCKER_TAG_PREFIX))
+                ?.slice(AUTO_UNPARK_BLOCKER_TAG_PREFIX.length)
+            : undefined;
+        const wakeEvent = this.db.transaction(() => {
+            this.recordNudgeAttempt(qitemId, outcome.nudgeResult);
+            this.outbox.finalizeDelivery(outboxId, finalState);
+            if (!blockerRef)
+                return null;
+            const item = this.getByIdOrThrow(qitemId);
+            const transition = this.transitionLog.append({
+                qitemId,
+                state: item.state,
+                actorSession: "queue@system",
+                transitionNote: `blocker ${blockerRef} wake attempted; delivery=${outcome.nudgeResult}`,
+            });
+            this.wakeRepo.record({
+                transitionId: transition.transitionId,
+                qitemId,
+                phase: "fired",
+                kind: "blocker",
+                ref: blockerRef,
+                deliveryStatus: outcome.nudgeResult,
+            });
+            return this.eventBus.persistWithinTransaction({
+                type: "queue.updated",
+                qitemId,
+                fromState: item.state,
+                toState: item.state,
+                closureReason: null,
+                closureTarget: null,
+                actorSession: "queue@system",
+                summary: item.summary ?? null,
+            });
+        })();
+        if (wakeEvent)
+            this.eventBus.notifySubscribers(wakeEvent);
         return finalState;
     }
     /**
@@ -597,6 +711,41 @@ export class QueueRepository {
      * delivered nor demoted to failed.
      */
     async performWakeSend(qitemId, destinationSession, sourceSession, bodyOverride, prebuiltText) {
+        // DEFECT FIX qitem-20260827065907-b9ae334c (S1-class, 3 live specimens): a virtual
+        // @external destination has NO pane — the queue row ITSELF is the gateway
+        // subsystem's input (the Slack connector polls human-destined rows and its own
+        // ledger is the delivery record). Falling through to tmux here recorded
+        // "failed: … tmux reports no session" while the founder verifiably received the
+        // message, and that failed: literal poisoned the undelivered surface.
+        // OPR.0.5.6.14 — the inline @external branch became THE ONE RESOLVER SEAM
+        // (gateway/destination-resolver.ts): pane-bound keeps terminal transport;
+        // gateway-routable (@external AND registry-resolved aliases like the
+        // paneless human-*@kernel virtual identities — the live 4-row specimen
+        // class) is GATEWAY-OWNED (tmux never consulted; the connector's row-poll
+        // is the dispatch and its ledger the delivery record); neither is an
+        // honest structured teaching refusal (tmux is not consulted for an
+        // address it can never hold). Classified indeterminate for gateway
+        // (landed with the owning subsystem; render unconfirmable here) — never
+        // verified, never failed.
+        const destClass = classifyDestination(destinationSession, {
+            entities: (() => {
+                const loaded = this.loadHumanRegistryFn();
+                return loaded.ok ? loaded.entities : null;
+            })(),
+            hasTerminalTransport: (dest) => this.hasTerminalTransport(dest),
+        });
+        if (destClass.class === "gateway-routable") {
+            const resolvedNote = destClass.via === "registry-alias" && destClass.resolvedHuman
+                ? ` — the human registry resolves it to registered human '${destClass.resolvedHuman}'`
+                : "";
+            return {
+                classified: "indeterminate",
+                nudgeResult: `gateway-owned: '${destinationSession}' is a virtual ${destClass.via === "registry-alias" ? "paneless human" : "@external"} destination${resolvedNote} — delivery rides the gateway subsystem (Slack connector), whose own ledger is the delivery record; tmux was not consulted (it can never hold this address class)`,
+            };
+        }
+        if (destClass.class === "unroutable") {
+            return { classified: "failed", nudgeResult: destClass.teaching };
+        }
         const stampISO = new Date().toISOString();
         let text;
         if (prebuiltText !== undefined) {
@@ -617,7 +766,7 @@ export class QueueRepository {
             const genUuid = sourceSession
                 ? (this.resolveOccupantGeneration?.(sourceSession) ?? undefined)
                 : undefined;
-            text = wrapPaneEnvelope(sourceSession, destinationSession, bareBody, getSelfHostId(), { stampISO, genUuid });
+            text = wrapPaneEnvelope(sourceSession, destinationSession, bareBody, { stampISO, genUuid });
         }
         try {
             const res = await this.transport.send(destinationSession, text, { verify: true, stampISO });
@@ -653,10 +802,11 @@ export class QueueRepository {
         }
     }
     async create(input) {
-        // 51-09 incr 4 — stamp the origin host onto the STORED sender identity once,
-        // before validation/insert/idempotency, so the row's source_session IS the
-        // triple (fail-open to 2-part when no self-id / not a bare member@rig).
-        input = { ...input, sourceSession: stampSelfHostSuffix(input.sourceSession) };
+        // FOUNDER ROOT INVARIANT (2026-08-27, supersedes 51-09 incr 4 / ruling cb19867f Q2):
+        // a LOCAL write stores the bare transport identity — no self-host suffix inside one
+        // instance. Host identity is added only at the cross-host forwarding boundary
+        // (routes/queue.ts stamp-at-FORWARD), and a genuine origin triple arriving from a
+        // forward is stored verbatim (never re-stamped, never stripped).
         if (!this.validateRig(input.destinationSession)) {
             throw new QueueRepositoryError("unknown_destination_rig", `destination_session ${input.destinationSession} references an unknown rig`, destinationRefusalTeaching(input.destinationSession));
         }
@@ -780,12 +930,19 @@ export class QueueRepository {
         this.persistSummary(id, input.summary ?? null);
         this.persistEvidenceRef(id, input.evidenceRef ?? null);
         this.persistMintingGeneration(id, input.sourceSession);
+        const notification = this.classifyOwnerNotification({
+            action: "create",
+            destinationSession: input.destinationSession,
+            nextState: "pending",
+        });
         this.transitionLog.append({
             qitemId: id,
             state: "pending",
             actorSession: input.sourceSession,
             transitionNote: "created",
             identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
+            ownerNotificationKind: notification?.kind,
+            ownerNotificationLevel: notification?.level,
         });
         const persistedEvent = this.eventBus.persistWithinTransaction({
             type: "queue.created",
@@ -875,12 +1032,19 @@ export class QueueRepository {
             this.persistSummary(newId, input.summary ?? null);
             this.persistEvidenceRef(newId, input.evidenceRef ?? null);
             this.persistMintingGeneration(newId, input.fromSession);
+            const successorNotification = this.classifyOwnerNotification({
+                action: "create",
+                destinationSession: input.toSession,
+                nextState: "pending",
+            });
             this.transitionLog.append({
                 qitemId: newId,
                 state: "pending",
                 actorSession: input.fromSession,
                 transitionNote: `handoff from ${source.qitemId}`,
                 identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
+                ownerNotificationKind: successorNotification?.kind,
+                ownerNotificationLevel: successorNotification?.level,
             });
             // W1-a: the durable wake intent joins the SAME transaction as the close +
             // successor create. If this (or anything above) throws, the whole act rolls
@@ -895,6 +1059,17 @@ export class QueueRepository {
                 summary: source.summary ?? null,
             });
             events.push({ name: "queue.handed_off", payload: handoffEvent });
+            // OPR.0.5.6.26 — a handed-off blocker actuates its attached rows through the one
+            // propagation site, with the update path's exact effect set.
+            for (const dependentEvent of this.propagateBlockerCompletion({
+                qitemId: source.qitemId,
+                terminalState: "handed-off",
+                actorSession: input.fromSession,
+                identityProvenance: input.identityProvenance ?? null,
+                ts,
+            })) {
+                events.push({ name: "queue.updated", payload: dependentEvent });
+            }
             const createdEvent = this.eventBus.persistWithinTransaction({
                 type: "queue.created",
                 qitemId: newId,
@@ -999,11 +1174,18 @@ export class QueueRepository {
             this.persistSummary(newId, input.summary ?? null);
             this.persistEvidenceRef(newId, input.evidenceRef ?? null);
             this.persistMintingGeneration(newId, input.fromSession);
+            const successorNotification = this.classifyOwnerNotification({
+                action: "create",
+                destinationSession: input.toSession,
+                nextState: "pending",
+            });
             this.transitionLog.append({
                 qitemId: newId,
                 state: "pending",
                 actorSession: input.fromSession,
                 transitionNote: `handoff-and-complete from ${source.qitemId}`,
+                ownerNotificationKind: successorNotification?.kind,
+                ownerNotificationLevel: successorNotification?.level,
             });
             // W1-a: the durable wake intent joins the SAME transaction as the close +
             // successor create — one act or none (symmetric with handoff()).
@@ -1017,6 +1199,17 @@ export class QueueRepository {
                 summary: source.summary ?? null,
             });
             events.push({ name: "queue.handed_off", payload: handoffEvent });
+            // OPR.0.5.6.26 — a done-via-handoff-and-complete blocker actuates its attached rows through the one
+            // propagation site, with the update path's exact effect set (the confirmed R-2 prediction).
+            for (const dependentEvent of this.propagateBlockerCompletion({
+                qitemId: source.qitemId,
+                terminalState: "done",
+                actorSession: input.fromSession,
+                identityProvenance: input.identityProvenance ?? null,
+                ts,
+            })) {
+                events.push({ name: "queue.updated", payload: dependentEvent });
+            }
             const createdEvent = this.eventBus.persistWithinTransaction({
                 type: "queue.created",
                 qitemId: newId,
@@ -1062,9 +1255,9 @@ export class QueueRepository {
      *     `cross_host_close_conflict` (someone else closed it meanwhile —
      *     surface, never overwrite).
      *   - otherwise → close exactly like the local handoff's close leg:
-     *     `closure_reason=handed_off_to`; `closure_target` carries the OPAQUE
-     *     three-part `<member@rig>@<host>` form (arch R1 — presence-checked
-     *     display/audit metadata, NEVER parsed for routing); `handed_off_to`
+     *     `closure_reason=handed_off_to`; `closure_target` carries the
+     *     host-qualified successor key `<qitem-id>@<host>` (custody metadata,
+     *     never a local lookup key); `handed_off_to`
      *     stays the two-part `member@rig` (BR-1 — session-string carriers
      *     never gain `@host`).
      */
@@ -1100,7 +1293,7 @@ export class QueueRepository {
                 state: input.terminalState,
                 actorSession: input.fromSession,
                 // BR-1: the minted note carries the TWO-PART toSession only — the
-                // host-qualified 3-part form is allowed in closure_target and nowhere
+                // host-qualified successor key is allowed in closure_target and nowhere
                 // else, and transition_note is a durable carrier.
                 transitionNote: input.transitionNote ?? `cross-host handoff to ${input.toSession}`,
                 closureReason: "handed_off_to",
@@ -1116,6 +1309,19 @@ export class QueueRepository {
                 summary: source.summary ?? null,
             });
             events.push(handoffEvent);
+            // OPR.0.5.6.26 (R2 B-1) — the cross-host terminal close is the third
+            // handoff-family caller of the one propagation site: attached rows actuate
+            // with the update path's exact effect set, at this close's actual terminal
+            // state. Absorbed redrives return above this transaction and never re-run it.
+            for (const dependentEvent of this.propagateBlockerCompletion({
+                qitemId: input.qitemId,
+                terminalState: input.terminalState,
+                actorSession: input.fromSession,
+                identityProvenance: null,
+                ts,
+            })) {
+                events.push(dependentEvent);
+            }
         });
         txn();
         for (const e of events) {
@@ -1273,8 +1479,9 @@ export class QueueRepository {
      */
     update(input) {
         const txn = this.db.transaction(() => this.updateInTransactionalContext(input));
-        const persistedEvent = txn();
-        this.eventBus.notifySubscribers(persistedEvent);
+        const result = txn();
+        for (const event of result.persistedEvents)
+            this.eventBus.notifySubscribers(event);
         return this.getByIdOrThrow(input.qitemId);
     }
     /**
@@ -1298,8 +1505,8 @@ export class QueueRepository {
      * therefore applies to workflow projection unchanged.
      */
     updateWithinTransaction(input) {
-        const persistedEvent = this.updateInTransactionalContext(input);
-        return { qitemId: input.qitemId, persistedEvent };
+        const result = this.updateInTransactionalContext(input);
+        return { qitemId: input.qitemId, ...result };
     }
     /**
      * Internal: closure validation + UPDATE + transition log + emit
@@ -1324,6 +1531,8 @@ export class QueueRepository {
                 || input.closureTarget != null
                 || input.handedOffTo != null
                 || input.blockedOn != null
+                || input.wakeWatchdogId != null
+                || input.wakeAfterSeconds != null
                 || input.summary != null
                 || input.evidenceRef != null;
             if (disallowed) {
@@ -1336,7 +1545,7 @@ export class QueueRepository {
                 transitionNote: input.transitionNote,
                 identityProvenance: input.identityProvenance ?? null,
             });
-            return this.eventBus.persistWithinTransaction({
+            const persistedEvent = this.eventBus.persistWithinTransaction({
                 type: "queue.updated",
                 qitemId: input.qitemId,
                 fromState: qitem.state,
@@ -1346,10 +1555,20 @@ export class QueueRepository {
                 actorSession: input.actorSession,
                 summary: qitem.summary ?? null,
             });
+            return { persistedEvent, persistedEvents: [persistedEvent] };
         }
         if (!isQueueState(input.state)) {
             throw new QueueRepositoryError("invalid_state", `state=${input.state} not valid; valid: ${QUEUE_STATES.join(", ")}`);
         }
+        if ((input.wakeWatchdogId != null || input.wakeAfterSeconds != null) && input.state !== "blocked") {
+            throw new QueueRepositoryError("wake_not_admitted", "a park wake persists only with state=blocked; park the row or drop the wake option");
+        }
+        if (input.wakeWatchdogId != null && input.wakeAfterSeconds != null) {
+            throw new QueueRepositoryError("wake_ambiguous", "choose one explicit park wake: an existing watchdog id or an atomic timer");
+        }
+        if (input.wakeAfterSeconds != null && (!Number.isInteger(input.wakeAfterSeconds) || input.wakeAfterSeconds <= 0)) {
+            throw new QueueRepositoryError("wake_after_invalid", `wakeAfterSeconds must be a positive integer (got ${input.wakeAfterSeconds})`);
+        }
         const isReopen = isGuardedTerminal && input.state !== qitem.state;
         if (isReopen && !input.reopen) {
             throw new QueueRepositoryError("terminal_reopen_requires_ack", `qitem ${input.qitemId} is currently '${qitem.state}'; state='${input.state}' would reopen a terminal row. Re-run deliberately with --reopen --note <reason>.`, { currentState: qitem.state, requestedState: input.state });
@@ -1451,16 +1670,19 @@ export class QueueRepository {
             if (effectiveBlockedOn.startsWith("qitem-")) {
                 const blocker = this.getById(effectiveBlockedOn);
                 if (!blocker) {
-                    throw new QueueRepositoryError("blocker_not_found", `blocked_on names a qitem that does not exist: ${effectiveBlockedOn}. A park must name a real, live blocker — a nonexistent blocker can never complete, so the row could never unpark.`, { blockedOn: effectiveBlockedOn });
+                    throw new QueueRepositoryError("blocker_not_found", `blocked_on names a qitem that does not exist: ${effectiveBlockedOn}. A park must name a real, live blocker — a nonexistent blocker can never complete, so the row could never unpark.`, 
+                    // F1 (error-honesty): the rejected value is named rejectedBlocker — an error payload
+                    // never carries the success-shaped blockedOn field (the field-filtered-misread class).
+                    { rejectedBlocker: effectiveBlockedOn });
                 }
                 if (!isBlockerLive(blocker.state)) {
-                    throw new QueueRepositoryError("blocker_not_live", `blocked_on names a resolved qitem: ${effectiveBlockedOn} is '${blocker.state}'. A park must name a LIVE blocker — parking on a completed/closed row is a dead-blocker park that never self-clears.`, { blockedOn: effectiveBlockedOn, blockerState: blocker.state });
+                    throw new QueueRepositoryError("blocker_not_live", `blocked_on names a resolved qitem: ${effectiveBlockedOn} is '${blocker.state}'. A park must name a LIVE blocker — parking on a completed/closed row is a dead-blocker park that never self-clears.`, { rejectedBlocker: effectiveBlockedOn, blockerState: blocker.state });
                 }
             }
             else {
                 const typedPrefix = typedGateBlockerPrefix(effectiveBlockedOn);
                 if (typedPrefix && !isTypedGateBlocker(effectiveBlockedOn)) {
-                    throw new QueueRepositoryError("blocker_malformed", `blocked_on '${effectiveBlockedOn}' is a bare '${typedPrefix}' prefix with no gate body. A typed gate blocker must name its gate (e.g. fold:one-home+attestation).`, { blockedOn: effectiveBlockedOn });
+                    throw new QueueRepositoryError("blocker_malformed", `blocked_on '${effectiveBlockedOn}' is a bare '${typedPrefix}' prefix with no gate body. A typed gate blocker must name its gate (e.g. fold:one-home+attestation).`, { rejectedBlocker: effectiveBlockedOn });
                 }
             }
         }
@@ -1480,6 +1702,43 @@ export class QueueRepository {
                 });
             }
         }
+        let parkWake = null;
+        const jobsRepo = this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db);
+        if (input.wakeWatchdogId != null) {
+            const job = jobsRepo.getById(input.wakeWatchdogId);
+            if (!job || job.state !== "active") {
+                throw new QueueRepositoryError("wake_watchdog_not_live", `watchdog ${input.wakeWatchdogId} is not an active job; attach a live watchdog or arm an atomic timer`, { wakeWatchdogId: input.wakeWatchdogId });
+            }
+            if (job.targetSession !== qitem.destinationSession) {
+                throw new QueueRepositoryError("wake_watchdog_target_mismatch", `watchdog ${job.jobId} targets ${job.targetSession}, not parked owner ${qitem.destinationSession}`, { wakeWatchdogId: job.jobId, targetSession: job.targetSession, destinationSession: qitem.destinationSession });
+            }
+            parkWake = { kind: "watchdog", ref: job.jobId };
+        }
+        else if (input.wakeAfterSeconds != null) {
+            const job = jobsRepo.register({
+                policy: "periodic-reminder",
+                specYaml: [
+                    "policy: periodic-reminder",
+                    "target:",
+                    `  session: ${JSON.stringify(qitem.destinationSession)}`,
+                    `message: ${JSON.stringify(`Wake timer fired for parked qitem ${qitem.qitemId}. Resume the recorded continuation and update the row.`)}`,
+                    "",
+                ].join("\n"),
+                targetSession: qitem.destinationSession,
+                intervalSeconds: input.wakeAfterSeconds,
+                registeredBySession: input.actorSession,
+            });
+            // S16 only: ordinary periodic reminders intentionally evaluate immediately.
+            // A provider-limit timer instead starts its interval at registration so the
+            // existing scheduler's due boundary is registeredAt + intervalSeconds.
+            if (qitem.tags?.includes(USAGE_LIMIT_BLOCKER_TAG)) {
+                jobsRepo.recordEvaluation(job.jobId, job.registeredAt, false);
+            }
+            parkWake = { kind: "timer", ref: job.jobId };
+        }
+        else if (input.state === "blocked" && effectiveBlockedOn?.startsWith("qitem-")) {
+            parkWake = { kind: "blocker", ref: effectiveBlockedOn };
+        }
         const ts = new Date().toISOString();
         const fromState = qitem.state;
         // 0.5.1-53 Atom 1b(i) — clear-on-exit. blocked_on is set EXPLICITLY, not COALESCE'd:
@@ -1488,6 +1747,15 @@ export class QueueRepository {
         // NULL. The prior `COALESCE(?, blocked_on)` preserved the blocker on every non-blocked
         // transition, leaving dead blockers that nothing audits (the root-cause strand).
         const nextBlockedOn = input.state === "blocked" ? effectiveBlockedOn : null;
+        const notification = this.classifyOwnerNotification({
+            action: "update",
+            destinationSession: qitem.destinationSession,
+            previousState: qitem.state,
+            previousBlockedOn: qitem.blockedOn,
+            nextState: input.state,
+            nextBlockedOn,
+            explicitKind: input.ownerNotificationKind,
+        });
         this.db
             .prepare(`UPDATE queue_items
            SET state = ?,
@@ -1505,7 +1773,7 @@ export class QueueRepository {
             this.persistSummary(input.qitemId, input.summary ?? null);
             this.persistEvidenceRef(input.qitemId, input.evidenceRef ?? null);
         }
-        this.transitionLog.append({
+        const transition = this.transitionLog.append({
             qitemId: input.qitemId,
             state: input.state,
             actorSession: input.actorSession,
@@ -1513,39 +1781,34 @@ export class QueueRepository {
             closureReason: validation.closureReason ?? undefined,
             closureTarget: validation.closureTarget ?? undefined,
             identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
+            ownerNotificationKind: notification?.kind,
+            ownerNotificationLevel: notification?.level,
         });
+        if (parkWake) {
+            this.wakeRepo.record({
+                transitionId: transition.transitionId,
+                qitemId: input.qitemId,
+                phase: "armed",
+                kind: parkWake.kind,
+                ref: parkWake.ref,
+                deliveryStatus: null,
+            });
+        }
         // 0.5.1-53 Atom 1b(iii) — propagate-completion. blocked_on PROMISES "A waits until B completes";
         // that promise never fired on this runtime (rows sat blocked on done/canceled blockers for days).
         // When THIS qitem reaches a terminal state, auto-unpark every row parked on it (blocked_on = this,
         // state='blocked') to pending, clear its (now-resolved) blocker, log the transition, and emit an
         // event so watchers/sweeps see the unblock without a fetch.
-        if (!isBlockerLive(input.state)) {
-            const blockedRows = this.db
-                .prepare("SELECT qitem_id FROM queue_items WHERE blocked_on = ? AND state = 'blocked'")
-                .all(input.qitemId);
-            for (const r of blockedRows) {
-                this.db
-                    .prepare("UPDATE queue_items SET state = 'pending', blocked_on = NULL, ts_updated = ? WHERE qitem_id = ?")
-                    .run(ts, r.qitem_id);
-                this.transitionLog.append({
-                    qitemId: r.qitem_id,
-                    state: "pending",
-                    actorSession: input.actorSession,
-                    transitionNote: `auto-unparked: blocker ${input.qitemId} reached terminal state '${input.state}'`,
-                });
-                this.eventBus.persistWithinTransaction({
-                    type: "queue.updated",
-                    qitemId: r.qitem_id,
-                    fromState: "blocked",
-                    toState: "pending",
-                    closureReason: null,
-                    closureTarget: null,
-                    actorSession: input.actorSession,
-                    summary: null,
-                });
-            }
-        }
-        return this.eventBus.persistWithinTransaction({
+        const dependentEvents = !isBlockerLive(input.state)
+            ? this.propagateBlockerCompletion({
+                qitemId: input.qitemId,
+                terminalState: input.state,
+                actorSession: input.actorSession,
+                identityProvenance: input.identityProvenance ?? null,
+                ts,
+            })
+            : [];
+        const persistedEvent = this.eventBus.persistWithinTransaction({
             type: "queue.updated",
             qitemId: input.qitemId,
             fromState,
@@ -1557,12 +1820,125 @@ export class QueueRepository {
             // (park-time summary included) so surfaces refresh without a fetch.
             summary: effectiveSummary ?? null,
         });
+        return { persistedEvent, persistedEvents: [...dependentEvents, persistedEvent] };
+    }
+    /** OPR.0.5.6.26 — THE ONE PROPAGATION SITE. blocked_on promises "A waits until B
+     *  completes"; every terminal closure of a blocker actuates the attached rows'
+     *  auto-unpark through THIS helper — the update path and the handoff family both
+     *  call it inside their own transactions. The class this unifies away was
+     *  per-code-path: the handoff verbs wrote terminal states via direct SQL and the
+     *  promise never fired for them. Never a second copy of this logic. */
+    propagateBlockerCompletion(input) {
+        const dependentEvents = [];
+        const blockedRows = this.db
+            .prepare("SELECT qitem_id, destination_session FROM queue_items WHERE blocked_on = ? AND state = 'blocked'")
+            .all(input.qitemId);
+        for (const r of blockedRows) {
+            this.db
+                .prepare("UPDATE queue_items SET state = 'pending', blocked_on = NULL, ts_updated = ? WHERE qitem_id = ?")
+                .run(input.ts, r.qitem_id);
+            const resumeTransition = this.transitionLog.append({
+                qitemId: r.qitem_id,
+                state: "pending",
+                actorSession: input.actorSession,
+                transitionNote: `auto-unparked: blocker ${input.qitemId} reached terminal state '${input.terminalState}'`,
+            });
+            const wakeIntentId = this.stageAutoUnparkWakeIntent({
+                qitemId: r.qitem_id,
+                destinationSession: r.destination_session,
+                fromSession: input.actorSession,
+                identityProvenance: input.identityProvenance,
+                blockerQitemId: input.qitemId,
+                resumeTransitionId: resumeTransition.transitionId,
+            });
+            if (wakeIntentId)
+                this.deliverWakeIntentAfterCommit(wakeIntentId);
+            const dependentEvent = this.eventBus.persistWithinTransaction({
+                type: "queue.updated",
+                qitemId: r.qitem_id,
+                fromState: "blocked",
+                toState: "pending",
+                closureReason: null,
+                closureTarget: null,
+                actorSession: input.actorSession,
+                summary: this.getById(r.qitem_id)?.summary ?? null,
+            });
+            this.eventBus.registerPersistedWithinActiveEnvelope(dependentEvent);
+            dependentEvents.push(dependentEvent);
+        }
+        return dependentEvents;
+    }
+    getParkWakeStatus(qitemId) {
+        return this.wakeRepo.getStatus(qitemId);
+    }
+    listTransitions(qitemId) {
+        return this.transitionLog.listForQitem(qitemId).map((transition) => {
+            const wake = this.wakeRepo.getForTransition(transition.transitionId);
+            return wake ? { ...transition, wake } : transition;
+        });
+    }
+    /** Called by the watchdog engine after the delivery attempt is durably
+     *  audited. The queue transition records that attempt independently of
+     *  whether the HELD row's owner consumed it. */
+    recordWatchdogWakeAttempt(jobId, deliveryStatus) {
+        const targets = this.wakeRepo.findBlockedQitemsByWatchdog(jobId);
+        if (targets.length === 0)
+            return;
+        const recordFired = ({ qitemId, kind }) => {
+            const transition = this.transitionLog.append({
+                qitemId,
+                state: "blocked",
+                actorSession: "watchdog@system",
+                transitionNote: `park wake fired: watchdog ${jobId}; delivery=${deliveryStatus}; awaiting owner consumption`,
+            });
+            this.wakeRepo.record({
+                transitionId: transition.transitionId,
+                qitemId,
+                phase: "fired",
+                kind,
+                ref: jobId,
+                deliveryStatus,
+            });
+            return this.eventBus.persistWithinTransaction({
+                type: "queue.updated",
+                qitemId,
+                fromState: "blocked",
+                toState: "blocked",
+                closureReason: null,
+                closureTarget: null,
+                actorSession: "watchdog@system",
+                summary: this.getById(qitemId)?.summary ?? null,
+            });
+        };
+        const usageLimitBlockers = targets.filter(({ qitemId }) => this.getById(qitemId)?.tags?.includes(USAGE_LIMIT_BLOCKER_TAG));
+        const events = this.db.transaction(() => {
+            const firedEvents = targets.map(recordFired);
+            if (usageLimitBlockers.length === 0)
+                return firedEvents;
+            (this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db)).markTerminal(jobId, "usage_limit_expiry_fired");
+            const resolutionEvents = usageLimitBlockers.flatMap(({ qitemId }) => this.updateInTransactionalContext({
+                qitemId,
+                actorSession: "watchdog@system",
+                state: "done",
+                closureReason: "no-follow-on",
+                transitionNote: `provider-limit timer ${jobId} reached its expiry; resolving the shared blocker once`,
+            }).persistedEvents);
+            return [...firedEvents, ...resolutionEvents];
+        })();
+        for (const event of events)
+            this.eventBus.notifySubscribers(event);
     }
     getById(qitemId) {
         const row = this.db
             .prepare("SELECT * FROM queue_items WHERE qitem_id = ?")
             .get(qitemId);
-        return row ? this.rowToItem(row) : null;
+        if (!row)
+            return null;
+        const item = this.rowToItem(row);
+        // OPR.0.5.6.14 — the row FACE answers "did it reach them" in one read for
+        // gateway-routed rows; null for pane-bound (absence-governed, no key lies).
+        const ledger = this.deliveryOutcomeFor(item.qitemId);
+        return { ...item, deliveryOutcome: ledger?.outcome ?? null };
     }
     list(opts) {
         const limit = opts?.limit ?? 100;
@@ -1608,7 +1984,11 @@ export class QueueRepository {
         const rows = this.db
             .prepare(`SELECT ${columns} FROM queue_items ${where} ORDER BY ${orderBy} LIMIT ?`)
             .all(...params);
-        const items = rows.map((r) => this.rowToItem(r));
+        const items = rows.map((r) => {
+            const item = this.rowToItem(r);
+            const ledger = this.deliveryOutcomeFor(item.qitemId);
+            return { ...item, deliveryOutcome: ledger?.outcome ?? null };
+        });
         return opts?.compact
             ? items.map((item) => ({
                 ...item,
@@ -1726,22 +2106,34 @@ export class QueueRepository {
         return rows.map((r) => this.rowToItem(r));
     }
     /**
-     * 0.5.1-54 DR-1 — surface the create-path failed-nudge strands. `last_nudge_result` is written by
-     * `recordNudgeAttempt` (from `maybeNudge`) but nothing ever queries it, so a create whose nudge FAILED
-     * (`failed:<msg>`) is invisible: the sender records a successful create while the destination was never
-     * woken. This is the `/overdue` analogue for pending-undelivered create-path work — a READ only (no
-     * retry, no unwind; DR-2 retry is PM-gated on DR-1's live measurement).
-     *
-     * V1-ONLY predicate, NO false-positive mode: `state='pending' AND last_nudge_result LIKE 'failed:%'`.
-     *   - A delivered row (`verified` / `delivered-ack-pending`) is excluded — it was woken.
-     *   - A NEVER-ATTEMPTED row (`last_nudge_result IS NULL` — a deliberate cold-park or a no-transport create)
-     *     is excluded. That class is FP-dominated (a legitimate cold-park is indistinguishable from a real
-     *     never-reached strand at the row) and stays DEFERRED behind a forward create-time intent bit; surfacing
-     *     it here would train the reader to ignore the signal. The reason it is excluded lives in this comment
-     *     AND the PRD, not in chat — it must outlive the excluder.
+     * Surface two evidence-backed undelivered classes: the original pending
+     * create-path nudge failures, and active human-notification episodes whose
+     * gateway ledger says transport-failed or receiptless past the post window.
+     * A generic null nudge is still excluded; only a structured OWNER episode
+     * makes that absence meaningful. READ only — no retry or unwind.
      */
     findUndelivered(opts) {
-        const conditions = ["state = 'pending'", "last_nudge_result LIKE 'failed:%'"];
+        // OPR.0.5.6.14 — delivery truth belongs to the CURRENT human-notification
+        // episode, not to the row's whole history. Pull every active row that can
+        // carry a current episode or a legacy nudge/receipt, then derive/filter in
+        // JS. LIMIT is applied after that filtering so historical POSTED episodes
+        // cannot consume the window and hide a later failure.
+        const ownerEpisodeCandidate = this.hasOwnerNotificationColumns
+            ? `EXISTS (SELECT 1 FROM queue_transitions owner_episode
+                   WHERE owner_episode.qitem_id = queue_items.qitem_id
+                     AND owner_episode.owner_notification_level IS NOT NULL)`
+            : "0";
+        const conditions = [
+            "state IN ('pending', 'in-progress', 'blocked')",
+            `((state = 'pending' AND (last_nudge_result LIKE 'failed:%'
+                             OR last_nudge_result LIKE 'unroutable:%'
+                             OR last_nudge_result LIKE 'gateway-owned%'))
+         OR ${ownerEpisodeCandidate}
+         OR EXISTS (SELECT 1 FROM queue_transitions receipt
+                      WHERE receipt.qitem_id = queue_items.qitem_id
+                        AND (receipt.transition_note LIKE 'slack-owner-notification-posted %'
+                          OR receipt.transition_note LIKE 'slack-owner-notification-transport-failed %')))`,
+        ];
         const params = [];
         if (opts?.rig) {
             const escaped = opts.rig.replace(/%/g, "\\%").replace(/_/g, "\\_");
@@ -1749,14 +2141,141 @@ export class QueueRepository {
             params.push(`%@${escaped}`, `%@${escaped}`);
         }
         const columns = opts?.compact ? COMPACT_QUEUE_COLUMNS : "*";
-        let sql = `SELECT ${columns} FROM queue_items WHERE ${conditions.join(" AND ")} ORDER BY ts_created ASC`;
-        if (opts?.limit !== undefined) {
-            sql += " LIMIT ?";
-            params.push(opts.limit);
-        }
+        const sql = `SELECT ${columns} FROM queue_items WHERE ${conditions.join(" AND ")} ORDER BY ts_created ASC`;
         const rows = this.db.prepare(sql).all(...params);
-        return rows.map((r) => this.rowToItem(r));
+        const out = [];
+        for (const r of rows) {
+            const item = this.rowToItem(r);
+            const ledger = this.deliveryOutcomeFor(item.qitemId);
+            if (ledger?.outcome === "posted")
+                continue; // the receipt wins, always
+            if (ledger?.outcome === "transport-failed") {
+                out.push({
+                    ...item,
+                    deliveryOutcome: "transport-failed",
+                    deliveryFailureClass: "transport-failed",
+                    deliveryFailureDetail: ledger.detail,
+                });
+            }
+            else if (ledger?.outcome === "never-posted") {
+                out.push({
+                    ...item,
+                    deliveryOutcome: "never-posted",
+                    deliveryFailureClass: "never-posted",
+                    deliveryFailureDetail: ledger.detail,
+                });
+            }
+            else {
+                // No ledger verdict: only the legacy pending failed/unroutable class is
+                // undelivered. An active non-human row can still have an old OWNER
+                // transition; that historical episode is not a current obligation.
+                const lastNudge = item.lastNudgeResult ?? "";
+                if (item.state === "pending" && (lastNudge.startsWith("failed:") || lastNudge.startsWith("unroutable:"))) {
+                    out.push(item);
+                }
+            }
+            if (opts?.limit !== undefined && out.length >= opts.limit)
+                break;
+        }
+        return out;
     }
+    /** OPR.0.5.6.14 — terminal transport is a CAPABILITY, not topology presence.
+     *  An exact session or composed canonical seat is pane-bound only when its
+     *  node carries an explicit tmux binding. external_cli is paneless and must
+     *  continue to the human-registry/gateway leg. FAIL-OPEN only where the DB
+     *  cannot carry classification evidence (empty/partial bootstrap schemas). */
+    hasTerminalTransport(dest) {
+        try {
+            const anyTopology = this.db.prepare("SELECT 1 FROM sessions LIMIT 1").get()
+                ?? this.db.prepare("SELECT 1 FROM nodes LIMIT 1").get();
+            if (!anyTopology)
+                return true;
+            if (this.db.prepare(`SELECT 1 FROM sessions s JOIN bindings b ON b.node_id = s.node_id
+          WHERE s.session_name = ?
+            AND COALESCE(b.attachment_type, 'tmux') = 'tmux'
+            AND b.tmux_session IS NOT NULL LIMIT 1`).get(dest))
+                return true;
+            const at = dest.lastIndexOf("@");
+            if (at <= 0)
+                return true; // non-canonical shapes stay on the legacy path
+            const seat = dest.slice(0, at);
+            const rig = dest.slice(at + 1);
+            const composed = this.db.prepare(`SELECT 1 FROM nodes n
+          JOIN rigs r ON r.id = n.rig_id
+          JOIN bindings b ON b.node_id = n.id
+          WHERE r.name = ? AND REPLACE(n.logical_id, '.', '-') = ?
+            AND COALESCE(b.attachment_type, 'tmux') = 'tmux'
+            AND b.tmux_session IS NOT NULL LIMIT 1`).get(rig, seat);
+            return !!composed;
+        }
+        catch {
+            return true; // schema-partial fixture DB: never discriminate without evidence
+        }
+    }
+    /** Null means legacy/no OWNER history; inactive means OWNER history exists
+     *  but the row no longer projects a current human-notification episode. */
+    currentDeliveryEpisode(item) {
+        const transition = this.transitionLog.latestOwnerNotificationForQitem(item.qitemId);
+        if (!transition)
+            return null;
+        const registry = this.loadHumanRegistryFn();
+        if (!registry.ok)
+            return "inactive";
+        const humanAddress = transition.ownerNotificationKind === "human-decision-resolved"
+            ? resolveRegisteredHumanAddress(transition.actorSession, registry.entities)
+            : item.state === "blocked"
+                ? resolveRegisteredHumanAddress(item.blockedOn, registry.entities)
+                : resolveRegisteredHumanAddress(item.destinationSession, registry.entities);
+        return humanAddress
+            ? { notificationKey: `${item.qitemId}:${transition.transitionId}`, startedAt: transition.ts }
+            : "inactive";
+    }
+    /** OPR.0.5.6.14 — derive the current episode's delivery ledger. Receipt
+     *  transitions are same-row but keyed by qitemId:OWNER-transitionId; an old
+     *  posted receipt cannot mask a later human park. Legacy pre-OWNER or literal
+     *  external rows retain their row-scoped fallback. */
+    deliveryOutcomeFor(qitemId) {
+        // Some repository-only fixtures intentionally model the pre-transition
+        // schema. Delivery projection is additive there: absence means no verdict,
+        // never a list failure.
+        if (!this.hasQueueTransitionsTable)
+            return null;
+        const row = this.db.prepare("SELECT * FROM queue_items WHERE qitem_id = ?")
+            .get(qitemId);
+        if (!row)
+            return null;
+        const item = this.rowToItem(row);
+        const episodeState = this.currentDeliveryEpisode(item);
+        if (episodeState === "inactive")
+            return null;
+        const episode = episodeState;
+        const notes = this.db.prepare(`SELECT transition_note FROM queue_transitions
+        WHERE qitem_id = ? AND (transition_note LIKE 'slack-owner-notification-posted %'
+                             OR transition_note LIKE 'slack-owner-notification-transport-failed %')
+        ORDER BY transition_id DESC`).all(qitemId);
+        const currentNotes = episode
+            ? notes.filter((note) => note.transition_note.split(/\s+/).includes(`notification_key=${episode.notificationKey}`))
+            : notes;
+        const posted = currentNotes.find((note) => note.transition_note.startsWith("slack-owner-notification-posted "));
+        if (posted)
+            return { outcome: "posted", detail: posted.transition_note };
+        const failed = currentNotes.find((note) => note.transition_note.startsWith("slack-owner-notification-transport-failed "));
+        if (failed)
+            return { outcome: "transport-failed", detail: failed.transition_note };
+        const startedAt = episode?.startedAt ?? item.tsCreated;
+        const gatewayRouted = episode !== null || item.lastNudgeResult?.startsWith("gateway-owned") === true;
+        if (gatewayRouted) {
+            const ageMs = Date.now() - new Date(startedAt.includes("T") ? startedAt : startedAt + "Z").getTime();
+            if (ageMs > QueueRepository.NEVER_POSTED_WINDOW_MS) {
+                const key = episode ? ` for notification_key=${episode.notificationKey}` : "";
+                return { outcome: "never-posted", detail: `gateway-routed row with no delivery receipt${key} past the post window` };
+            }
+        }
+        return null;
+    }
+    /** The grace window before a receiptless gateway-routed row honestly reads
+     *  never-posted (the connector sweep cadence bounds normal posting latency). */
+    static NEVER_POSTED_WINDOW_MS = 120_000;
     recordNudgeAttempt(qitemId, result) {
         const ts = new Date().toISOString();
         this.db
@@ -1765,12 +2284,6 @@ export class QueueRepository {
          WHERE qitem_id = ?`)
             .run(ts, result, qitemId);
     }
-    recordHeartbeat(qitemId) {
-        const ts = new Date().toISOString();
-        this.db
-            .prepare(`UPDATE queue_items SET last_heartbeat = ? WHERE qitem_id = ?`)
-            .run(ts, qitemId);
-    }
     /**
      * Pod-fallback: redirect qitem to a fallback destination (e.g., when a seat
      * is unreachable). Emits qitem.fallback_routed; preserves chain_of_record.
@@ -1881,8 +2394,31 @@ export class QueueRepository {
         txn();
         return rows.length;
     }
+    /** S04 — substantive post-claim motion: transitions strictly after the claim, excluding the
+     *  claim's own 'claimed' transition. Lazily prepared; indexed on qitem_id. */
+    postClaimMotionStmt;
+    postClaimMotionCount(qitemId, claimedAt) {
+        this.postClaimMotionStmt ??= this.db.prepare("SELECT COUNT(*) AS n FROM queue_transitions WHERE qitem_id = ? AND ts > ? AND transition_note IS NOT 'claimed'");
+        try {
+            return this.postClaimMotionStmt.get(qitemId, claimedAt).n;
+        }
+        catch {
+            return 0; // minimal fixture DBs without the transitions table: degrade, never throw
+        }
+    }
     rowToItem(row) {
+        // S04 — derive the pickup receipt at the ONE shared projection point (list/show/overdue
+        // all flow through here), so the park-vs-strand question is answered by the row face.
+        const pickup = derivePickup({
+            state: row.state,
+            claimedAt: row.claimed_at,
+            lastHeartbeat: row.last_heartbeat,
+            postClaimMotionCount: row.claimed_at && row.state !== "blocked"
+                ? this.postClaimMotionCount(row.qitem_id, row.claimed_at)
+                : 0,
+        });
         return {
+            pickup,
             qitemId: row.qitem_id,
             tsCreated: row.ts_created,
             tsUpdated: row.ts_updated,