@openrig/cli 0.5.5 → 0.5.6

package/node_modules/@openrig/daemon/dist/domain/queue-repository.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { loadHumanRegistry } from "./gateway/human-registry.js";
+import { loadHumanRegistry, resolveRegisteredHumanAddress } from "./gateway/human-registry.js";
 import { resolveExternal } from "./gateway/external-admission.js";
 import { QueueTransitionLog } from "./queue-transition-log.js";
 import { WAKE_INTENT_PREFIX } from "./outbox-handler.js";
@@ -7,9 +7,10 @@ import { derivePickup } from "./queue-pickup.js";
 import { wrapPaneEnvelope } from "../lib/pane-envelope.js";
 import { getSelfHostId } from "./hosts/fanout-contract.js";
 import { parseSessionName } from "./session-name.js";
+import { classifyDestination } from "./gateway/destination-resolver.js";
 import { computeClosureRequiredAt, validateClosure, } from "./hot-potato-enforcer.js";
 import { isHumanSeatSession, validateHumanPark, validateHumanRoute } from "./human-route-enforcer.js";
-import { QueueWakeRepository } from "./queue-wake-repository.js";
+import { QueueWakeRepository, USAGE_LIMIT_BLOCKER_TAG, } from "./queue-wake-repository.js";
 import { WatchdogJobsRepository } from "./watchdog-jobs-repository.js";
 export const QUEUE_STATES = [
     "pending",
@@ -164,6 +165,14 @@ function detectQueueColumn(db, columnName) {
         return false;
     }
 }
+function detectTable(db, tableName) {
+    try {
+        return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(tableName);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * L3 — Queue repository. Owns CRUD over `queue_items` plus the wired-in
  * append-only transition log and hot-potato strict-rejection contract.
@@ -284,6 +293,9 @@ export class QueueRepository {
     hasEvidenceRefColumn;
     hasMintingGenColumn;
     hasClaimedGenColumn;
+    hasQueueTransitionsTable;
+    hasOwnerNotificationColumns;
+    loadHumanRegistryFn;
     /** OPR.0.4.6.WF3 FR-6 — injected by startup (never imported): the
      *  workflow domain's is-live-frontier-packet predicate. */
     workflowFrontierPredicate;
@@ -296,9 +308,16 @@ export class QueueRepository {
         this.transport = opts?.transport;
         this.workflowFrontierPredicate = opts?.workflowFrontierPredicate;
         this.resolveOccupantGeneration = opts?.resolveOccupantGeneration;
+        this.loadHumanRegistryFn = opts?.loadHumanRegistry ?? (() => loadHumanRegistry());
         this.hasTargetRepoColumn = detectQueueColumn(db, "target_repo");
         this.hasSummaryColumn = detectQueueColumn(db, "summary");
         this.hasEvidenceRefColumn = detectQueueColumn(db, "evidence_ref");
+        this.hasQueueTransitionsTable = detectTable(db, "queue_transitions");
+        const transitionColumns = this.hasQueueTransitionsTable
+            ? new Set(db.prepare("PRAGMA table_info(queue_transitions)").all().map((column) => column.name))
+            : new Set();
+        this.hasOwnerNotificationColumns = transitionColumns.has("owner_notification_kind")
+            && transitionColumns.has("owner_notification_level");
         // GHOST-STAGE (e/Class-B): generation stamps (migration 063). Defensive detect so a pre-063
         // harness degrades (writers skip the columns; the release predicate never matches unstamped rows).
         this.hasMintingGenColumn = detectQueueColumn(db, "minting_generation_uuid");
@@ -347,6 +366,26 @@ export class QueueRepository {
         }
         this.outbox = outbox;
     }
+    /** The one transition-write classifier. It consumes structured state/action facts only. */
+    classifyOwnerNotification(input) {
+        if (input.explicitKind === "human-decision-resolved") {
+            return { kind: input.explicitKind, level: "NOTICE" };
+        }
+        const registry = this.loadHumanRegistryFn();
+        if (!registry.ok)
+            return null;
+        const blockedHuman = resolveRegisteredHumanAddress(input.nextBlockedOn, registry.entities);
+        const previousBlockedHuman = resolveRegisteredHumanAddress(input.previousBlockedOn, registry.entities);
+        const enteredHumanPark = input.nextState === "blocked" && blockedHuman !== null &&
+            (input.previousState !== "blocked" || previousBlockedHuman !== blockedHuman);
+        if (enteredHumanPark)
+            return { kind: "human-required", level: "ALERT" };
+        const destinationHuman = resolveRegisteredHumanAddress(input.destinationSession, registry.entities);
+        if (input.action === "create" && destinationHuman !== null) {
+            return { kind: "human-required", level: "ALERT" };
+        }
+        return null;
+    }
     /**
      * W1 (transactional closure) — the PUBLIC composable primitive (stage half).
      * Stage the durable WAKE INTENT for a successor qitem from INSIDE a terminal
@@ -677,18 +716,36 @@ export class QueueRepository {
         // subsystem's input (the Slack connector polls human-destined rows and its own
         // ledger is the delivery record). Falling through to tmux here recorded
         // "failed: … tmux reports no session" while the founder verifiably received the
-        // message, and that failed: literal poisoned the undelivered surface. So: the
-        // wake for this class is GATEWAY-OWNED — tmux is never consulted, and the
-        // recorded wording claims exactly what was (and was not) checked. Classified
-        // indeterminate (landed with the owning subsystem; render unconfirmable here) —
-        // never verified, never failed. Human-CLASS seats with real panes
-        // (human-*@kernel) are NOT this class and keep tmux transport.
-        if (parseSessionName(destinationSession).kind === "external") {
+        // message, and that failed: literal poisoned the undelivered surface.
+        // OPR.0.5.6.14 — the inline @external branch became THE ONE RESOLVER SEAM
+        // (gateway/destination-resolver.ts): pane-bound keeps terminal transport;
+        // gateway-routable (@external AND registry-resolved aliases like the
+        // paneless human-*@kernel virtual identities — the live 4-row specimen
+        // class) is GATEWAY-OWNED (tmux never consulted; the connector's row-poll
+        // is the dispatch and its ledger the delivery record); neither is an
+        // honest structured teaching refusal (tmux is not consulted for an
+        // address it can never hold). Classified indeterminate for gateway
+        // (landed with the owning subsystem; render unconfirmable here) — never
+        // verified, never failed.
+        const destClass = classifyDestination(destinationSession, {
+            entities: (() => {
+                const loaded = this.loadHumanRegistryFn();
+                return loaded.ok ? loaded.entities : null;
+            })(),
+            hasTerminalTransport: (dest) => this.hasTerminalTransport(dest),
+        });
+        if (destClass.class === "gateway-routable") {
+            const resolvedNote = destClass.via === "registry-alias" && destClass.resolvedHuman
+                ? ` — the human registry resolves it to registered human '${destClass.resolvedHuman}'`
+                : "";
             return {
                 classified: "indeterminate",
-                nudgeResult: `gateway-owned: '${destinationSession}' is a virtual @external destination — delivery rides the gateway subsystem (Slack connector), whose own ledger is the delivery record; tmux was not consulted (it can never hold this address class)`,
+                nudgeResult: `gateway-owned: '${destinationSession}' is a virtual ${destClass.via === "registry-alias" ? "paneless human" : "@external"} destination${resolvedNote} — delivery rides the gateway subsystem (Slack connector), whose own ledger is the delivery record; tmux was not consulted (it can never hold this address class)`,
             };
         }
+        if (destClass.class === "unroutable") {
+            return { classified: "failed", nudgeResult: destClass.teaching };
+        }
         const stampISO = new Date().toISOString();
         let text;
         if (prebuiltText !== undefined) {
@@ -873,12 +930,19 @@ export class QueueRepository {
         this.persistSummary(id, input.summary ?? null);
         this.persistEvidenceRef(id, input.evidenceRef ?? null);
         this.persistMintingGeneration(id, input.sourceSession);
+        const notification = this.classifyOwnerNotification({
+            action: "create",
+            destinationSession: input.destinationSession,
+            nextState: "pending",
+        });
         this.transitionLog.append({
             qitemId: id,
             state: "pending",
             actorSession: input.sourceSession,
             transitionNote: "created",
             identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
+            ownerNotificationKind: notification?.kind,
+            ownerNotificationLevel: notification?.level,
         });
         const persistedEvent = this.eventBus.persistWithinTransaction({
             type: "queue.created",
@@ -968,12 +1032,19 @@ export class QueueRepository {
             this.persistSummary(newId, input.summary ?? null);
             this.persistEvidenceRef(newId, input.evidenceRef ?? null);
             this.persistMintingGeneration(newId, input.fromSession);
+            const successorNotification = this.classifyOwnerNotification({
+                action: "create",
+                destinationSession: input.toSession,
+                nextState: "pending",
+            });
             this.transitionLog.append({
                 qitemId: newId,
                 state: "pending",
                 actorSession: input.fromSession,
                 transitionNote: `handoff from ${source.qitemId}`,
                 identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
+                ownerNotificationKind: successorNotification?.kind,
+                ownerNotificationLevel: successorNotification?.level,
             });
             // W1-a: the durable wake intent joins the SAME transaction as the close +
             // successor create. If this (or anything above) throws, the whole act rolls
@@ -988,6 +1059,17 @@ export class QueueRepository {
                 summary: source.summary ?? null,
             });
             events.push({ name: "queue.handed_off", payload: handoffEvent });
+            // OPR.0.5.6.26 — a handed-off blocker actuates its attached rows through the one
+            // propagation site, with the update path's exact effect set.
+            for (const dependentEvent of this.propagateBlockerCompletion({
+                qitemId: source.qitemId,
+                terminalState: "handed-off",
+                actorSession: input.fromSession,
+                identityProvenance: input.identityProvenance ?? null,
+                ts,
+            })) {
+                events.push({ name: "queue.updated", payload: dependentEvent });
+            }
             const createdEvent = this.eventBus.persistWithinTransaction({
                 type: "queue.created",
                 qitemId: newId,
@@ -1092,11 +1174,18 @@ export class QueueRepository {
             this.persistSummary(newId, input.summary ?? null);
             this.persistEvidenceRef(newId, input.evidenceRef ?? null);
             this.persistMintingGeneration(newId, input.fromSession);
+            const successorNotification = this.classifyOwnerNotification({
+                action: "create",
+                destinationSession: input.toSession,
+                nextState: "pending",
+            });
             this.transitionLog.append({
                 qitemId: newId,
                 state: "pending",
                 actorSession: input.fromSession,
                 transitionNote: `handoff-and-complete from ${source.qitemId}`,
+                ownerNotificationKind: successorNotification?.kind,
+                ownerNotificationLevel: successorNotification?.level,
             });
             // W1-a: the durable wake intent joins the SAME transaction as the close +
             // successor create — one act or none (symmetric with handoff()).
@@ -1110,6 +1199,17 @@ export class QueueRepository {
                 summary: source.summary ?? null,
             });
             events.push({ name: "queue.handed_off", payload: handoffEvent });
+            // OPR.0.5.6.26 — a done-via-handoff-and-complete blocker actuates its attached rows through the one
+            // propagation site, with the update path's exact effect set (the confirmed R-2 prediction).
+            for (const dependentEvent of this.propagateBlockerCompletion({
+                qitemId: source.qitemId,
+                terminalState: "done",
+                actorSession: input.fromSession,
+                identityProvenance: input.identityProvenance ?? null,
+                ts,
+            })) {
+                events.push({ name: "queue.updated", payload: dependentEvent });
+            }
             const createdEvent = this.eventBus.persistWithinTransaction({
                 type: "queue.created",
                 qitemId: newId,
@@ -1155,9 +1255,9 @@ export class QueueRepository {
      *     `cross_host_close_conflict` (someone else closed it meanwhile —
      *     surface, never overwrite).
      *   - otherwise → close exactly like the local handoff's close leg:
-     *     `closure_reason=handed_off_to`; `closure_target` carries the OPAQUE
-     *     three-part `<member@rig>@<host>` form (arch R1 — presence-checked
-     *     display/audit metadata, NEVER parsed for routing); `handed_off_to`
+     *     `closure_reason=handed_off_to`; `closure_target` carries the
+     *     host-qualified successor key `<qitem-id>@<host>` (custody metadata,
+     *     never a local lookup key); `handed_off_to`
      *     stays the two-part `member@rig` (BR-1 — session-string carriers
      *     never gain `@host`).
      */
@@ -1193,7 +1293,7 @@ export class QueueRepository {
                 state: input.terminalState,
                 actorSession: input.fromSession,
                 // BR-1: the minted note carries the TWO-PART toSession only — the
-                // host-qualified 3-part form is allowed in closure_target and nowhere
+                // host-qualified successor key is allowed in closure_target and nowhere
                 // else, and transition_note is a durable carrier.
                 transitionNote: input.transitionNote ?? `cross-host handoff to ${input.toSession}`,
                 closureReason: "handed_off_to",
@@ -1209,6 +1309,19 @@ export class QueueRepository {
                 summary: source.summary ?? null,
             });
             events.push(handoffEvent);
+            // OPR.0.5.6.26 (R2 B-1) — the cross-host terminal close is the third
+            // handoff-family caller of the one propagation site: attached rows actuate
+            // with the update path's exact effect set, at this close's actual terminal
+            // state. Absorbed redrives return above this transaction and never re-run it.
+            for (const dependentEvent of this.propagateBlockerCompletion({
+                qitemId: input.qitemId,
+                terminalState: input.terminalState,
+                actorSession: input.fromSession,
+                identityProvenance: null,
+                ts,
+            })) {
+                events.push(dependentEvent);
+            }
         });
         txn();
         for (const e of events) {
@@ -1615,6 +1728,12 @@ export class QueueRepository {
                 intervalSeconds: input.wakeAfterSeconds,
                 registeredBySession: input.actorSession,
             });
+            // S16 only: ordinary periodic reminders intentionally evaluate immediately.
+            // A provider-limit timer instead starts its interval at registration so the
+            // existing scheduler's due boundary is registeredAt + intervalSeconds.
+            if (qitem.tags?.includes(USAGE_LIMIT_BLOCKER_TAG)) {
+                jobsRepo.recordEvaluation(job.jobId, job.registeredAt, false);
+            }
             parkWake = { kind: "timer", ref: job.jobId };
         }
         else if (input.state === "blocked" && effectiveBlockedOn?.startsWith("qitem-")) {
@@ -1628,6 +1747,15 @@ export class QueueRepository {
         // NULL. The prior `COALESCE(?, blocked_on)` preserved the blocker on every non-blocked
         // transition, leaving dead blockers that nothing audits (the root-cause strand).
         const nextBlockedOn = input.state === "blocked" ? effectiveBlockedOn : null;
+        const notification = this.classifyOwnerNotification({
+            action: "update",
+            destinationSession: qitem.destinationSession,
+            previousState: qitem.state,
+            previousBlockedOn: qitem.blockedOn,
+            nextState: input.state,
+            nextBlockedOn,
+            explicitKind: input.ownerNotificationKind,
+        });
         this.db
             .prepare(`UPDATE queue_items
            SET state = ?,
@@ -1653,6 +1781,8 @@ export class QueueRepository {
             closureReason: validation.closureReason ?? undefined,
             closureTarget: validation.closureTarget ?? undefined,
             identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
+            ownerNotificationKind: notification?.kind,
+            ownerNotificationLevel: notification?.level,
         });
         if (parkWake) {
             this.wakeRepo.record({
@@ -1669,45 +1799,15 @@ export class QueueRepository {
         // When THIS qitem reaches a terminal state, auto-unpark every row parked on it (blocked_on = this,
         // state='blocked') to pending, clear its (now-resolved) blocker, log the transition, and emit an
         // event so watchers/sweeps see the unblock without a fetch.
-        const dependentEvents = [];
-        if (!isBlockerLive(input.state)) {
-            const blockedRows = this.db
-                .prepare("SELECT qitem_id, destination_session FROM queue_items WHERE blocked_on = ? AND state = 'blocked'")
-                .all(input.qitemId);
-            for (const r of blockedRows) {
-                this.db
-                    .prepare("UPDATE queue_items SET state = 'pending', blocked_on = NULL, ts_updated = ? WHERE qitem_id = ?")
-                    .run(ts, r.qitem_id);
-                const resumeTransition = this.transitionLog.append({
-                    qitemId: r.qitem_id,
-                    state: "pending",
-                    actorSession: input.actorSession,
-                    transitionNote: `auto-unparked: blocker ${input.qitemId} reached terminal state '${input.state}'`,
-                });
-                const wakeIntentId = this.stageAutoUnparkWakeIntent({
-                    qitemId: r.qitem_id,
-                    destinationSession: r.destination_session,
-                    fromSession: input.actorSession,
-                    identityProvenance: input.identityProvenance ?? null,
-                    blockerQitemId: input.qitemId,
-                    resumeTransitionId: resumeTransition.transitionId,
-                });
-                if (wakeIntentId)
-                    this.deliverWakeIntentAfterCommit(wakeIntentId);
-                const dependentEvent = this.eventBus.persistWithinTransaction({
-                    type: "queue.updated",
-                    qitemId: r.qitem_id,
-                    fromState: "blocked",
-                    toState: "pending",
-                    closureReason: null,
-                    closureTarget: null,
-                    actorSession: input.actorSession,
-                    summary: this.getById(r.qitem_id)?.summary ?? null,
-                });
-                this.eventBus.registerPersistedWithinActiveEnvelope(dependentEvent);
-                dependentEvents.push(dependentEvent);
-            }
-        }
+        const dependentEvents = !isBlockerLive(input.state)
+            ? this.propagateBlockerCompletion({
+                qitemId: input.qitemId,
+                terminalState: input.state,
+                actorSession: input.actorSession,
+                identityProvenance: input.identityProvenance ?? null,
+                ts,
+            })
+            : [];
         const persistedEvent = this.eventBus.persistWithinTransaction({
             type: "queue.updated",
             qitemId: input.qitemId,
@@ -1722,6 +1822,52 @@ export class QueueRepository {
         });
         return { persistedEvent, persistedEvents: [...dependentEvents, persistedEvent] };
     }
+    /** OPR.0.5.6.26 — THE ONE PROPAGATION SITE. blocked_on promises "A waits until B
+     *  completes"; every terminal closure of a blocker actuates the attached rows'
+     *  auto-unpark through THIS helper — the update path and the handoff family both
+     *  call it inside their own transactions. The class this unifies away was
+     *  per-code-path: the handoff verbs wrote terminal states via direct SQL and the
+     *  promise never fired for them. Never a second copy of this logic. */
+    propagateBlockerCompletion(input) {
+        const dependentEvents = [];
+        const blockedRows = this.db
+            .prepare("SELECT qitem_id, destination_session FROM queue_items WHERE blocked_on = ? AND state = 'blocked'")
+            .all(input.qitemId);
+        for (const r of blockedRows) {
+            this.db
+                .prepare("UPDATE queue_items SET state = 'pending', blocked_on = NULL, ts_updated = ? WHERE qitem_id = ?")
+                .run(input.ts, r.qitem_id);
+            const resumeTransition = this.transitionLog.append({
+                qitemId: r.qitem_id,
+                state: "pending",
+                actorSession: input.actorSession,
+                transitionNote: `auto-unparked: blocker ${input.qitemId} reached terminal state '${input.terminalState}'`,
+            });
+            const wakeIntentId = this.stageAutoUnparkWakeIntent({
+                qitemId: r.qitem_id,
+                destinationSession: r.destination_session,
+                fromSession: input.actorSession,
+                identityProvenance: input.identityProvenance,
+                blockerQitemId: input.qitemId,
+                resumeTransitionId: resumeTransition.transitionId,
+            });
+            if (wakeIntentId)
+                this.deliverWakeIntentAfterCommit(wakeIntentId);
+            const dependentEvent = this.eventBus.persistWithinTransaction({
+                type: "queue.updated",
+                qitemId: r.qitem_id,
+                fromState: "blocked",
+                toState: "pending",
+                closureReason: null,
+                closureTarget: null,
+                actorSession: input.actorSession,
+                summary: this.getById(r.qitem_id)?.summary ?? null,
+            });
+            this.eventBus.registerPersistedWithinActiveEnvelope(dependentEvent);
+            dependentEvents.push(dependentEvent);
+        }
+        return dependentEvents;
+    }
     getParkWakeStatus(qitemId) {
         return this.wakeRepo.getStatus(qitemId);
     }
@@ -1738,7 +1884,7 @@ export class QueueRepository {
         const targets = this.wakeRepo.findBlockedQitemsByWatchdog(jobId);
         if (targets.length === 0)
             return;
-        const events = this.db.transaction(() => targets.map(({ qitemId, kind }) => {
+        const recordFired = ({ qitemId, kind }) => {
             const transition = this.transitionLog.append({
                 qitemId,
                 state: "blocked",
@@ -1763,7 +1909,22 @@ export class QueueRepository {
                 actorSession: "watchdog@system",
                 summary: this.getById(qitemId)?.summary ?? null,
             });
-        }))();
+        };
+        const usageLimitBlockers = targets.filter(({ qitemId }) => this.getById(qitemId)?.tags?.includes(USAGE_LIMIT_BLOCKER_TAG));
+        const events = this.db.transaction(() => {
+            const firedEvents = targets.map(recordFired);
+            if (usageLimitBlockers.length === 0)
+                return firedEvents;
+            (this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db)).markTerminal(jobId, "usage_limit_expiry_fired");
+            const resolutionEvents = usageLimitBlockers.flatMap(({ qitemId }) => this.updateInTransactionalContext({
+                qitemId,
+                actorSession: "watchdog@system",
+                state: "done",
+                closureReason: "no-follow-on",
+                transitionNote: `provider-limit timer ${jobId} reached its expiry; resolving the shared blocker once`,
+            }).persistedEvents);
+            return [...firedEvents, ...resolutionEvents];
+        })();
         for (const event of events)
             this.eventBus.notifySubscribers(event);
     }
@@ -1771,7 +1932,13 @@ export class QueueRepository {
         const row = this.db
             .prepare("SELECT * FROM queue_items WHERE qitem_id = ?")
             .get(qitemId);
-        return row ? this.rowToItem(row) : null;
+        if (!row)
+            return null;
+        const item = this.rowToItem(row);
+        // OPR.0.5.6.14 — the row FACE answers "did it reach them" in one read for
+        // gateway-routed rows; null for pane-bound (absence-governed, no key lies).
+        const ledger = this.deliveryOutcomeFor(item.qitemId);
+        return { ...item, deliveryOutcome: ledger?.outcome ?? null };
     }
     list(opts) {
         const limit = opts?.limit ?? 100;
@@ -1817,7 +1984,11 @@ export class QueueRepository {
         const rows = this.db
             .prepare(`SELECT ${columns} FROM queue_items ${where} ORDER BY ${orderBy} LIMIT ?`)
             .all(...params);
-        const items = rows.map((r) => this.rowToItem(r));
+        const items = rows.map((r) => {
+            const item = this.rowToItem(r);
+            const ledger = this.deliveryOutcomeFor(item.qitemId);
+            return { ...item, deliveryOutcome: ledger?.outcome ?? null };
+        });
         return opts?.compact
             ? items.map((item) => ({
                 ...item,
@@ -1935,22 +2106,34 @@ export class QueueRepository {
         return rows.map((r) => this.rowToItem(r));
     }
     /**
-     * 0.5.1-54 DR-1 — surface the create-path failed-nudge strands. `last_nudge_result` is written by
-     * `recordNudgeAttempt` (from `maybeNudge`) but nothing ever queries it, so a create whose nudge FAILED
-     * (`failed:<msg>`) is invisible: the sender records a successful create while the destination was never
-     * woken. This is the `/overdue` analogue for pending-undelivered create-path work — a READ only (no
-     * retry, no unwind; DR-2 retry is PM-gated on DR-1's live measurement).
-     *
-     * V1-ONLY predicate, NO false-positive mode: `state='pending' AND last_nudge_result LIKE 'failed:%'`.
-     *   - A delivered row (`verified` / `delivered-ack-pending`) is excluded — it was woken.
-     *   - A NEVER-ATTEMPTED row (`last_nudge_result IS NULL` — a deliberate cold-park or a no-transport create)
-     *     is excluded. That class is FP-dominated (a legitimate cold-park is indistinguishable from a real
-     *     never-reached strand at the row) and stays DEFERRED behind a forward create-time intent bit; surfacing
-     *     it here would train the reader to ignore the signal. The reason it is excluded lives in this comment
-     *     AND the PRD, not in chat — it must outlive the excluder.
+     * Surface two evidence-backed undelivered classes: the original pending
+     * create-path nudge failures, and active human-notification episodes whose
+     * gateway ledger says transport-failed or receiptless past the post window.
+     * A generic null nudge is still excluded; only a structured OWNER episode
+     * makes that absence meaningful. READ only — no retry or unwind.
      */
     findUndelivered(opts) {
-        const conditions = ["state = 'pending'", "last_nudge_result LIKE 'failed:%'"];
+        // OPR.0.5.6.14 — delivery truth belongs to the CURRENT human-notification
+        // episode, not to the row's whole history. Pull every active row that can
+        // carry a current episode or a legacy nudge/receipt, then derive/filter in
+        // JS. LIMIT is applied after that filtering so historical POSTED episodes
+        // cannot consume the window and hide a later failure.
+        const ownerEpisodeCandidate = this.hasOwnerNotificationColumns
+            ? `EXISTS (SELECT 1 FROM queue_transitions owner_episode
+                   WHERE owner_episode.qitem_id = queue_items.qitem_id
+                     AND owner_episode.owner_notification_level IS NOT NULL)`
+            : "0";
+        const conditions = [
+            "state IN ('pending', 'in-progress', 'blocked')",
+            `((state = 'pending' AND (last_nudge_result LIKE 'failed:%'
+                             OR last_nudge_result LIKE 'unroutable:%'
+                             OR last_nudge_result LIKE 'gateway-owned%'))
+         OR ${ownerEpisodeCandidate}
+         OR EXISTS (SELECT 1 FROM queue_transitions receipt
+                      WHERE receipt.qitem_id = queue_items.qitem_id
+                        AND (receipt.transition_note LIKE 'slack-owner-notification-posted %'
+                          OR receipt.transition_note LIKE 'slack-owner-notification-transport-failed %')))`,
+        ];
         const params = [];
         if (opts?.rig) {
             const escaped = opts.rig.replace(/%/g, "\\%").replace(/_/g, "\\_");
@@ -1958,14 +2141,141 @@ export class QueueRepository {
             params.push(`%@${escaped}`, `%@${escaped}`);
         }
         const columns = opts?.compact ? COMPACT_QUEUE_COLUMNS : "*";
-        let sql = `SELECT ${columns} FROM queue_items WHERE ${conditions.join(" AND ")} ORDER BY ts_created ASC`;
-        if (opts?.limit !== undefined) {
-            sql += " LIMIT ?";
-            params.push(opts.limit);
-        }
+        const sql = `SELECT ${columns} FROM queue_items WHERE ${conditions.join(" AND ")} ORDER BY ts_created ASC`;
         const rows = this.db.prepare(sql).all(...params);
-        return rows.map((r) => this.rowToItem(r));
+        const out = [];
+        for (const r of rows) {
+            const item = this.rowToItem(r);
+            const ledger = this.deliveryOutcomeFor(item.qitemId);
+            if (ledger?.outcome === "posted")
+                continue; // the receipt wins, always
+            if (ledger?.outcome === "transport-failed") {
+                out.push({
+                    ...item,
+                    deliveryOutcome: "transport-failed",
+                    deliveryFailureClass: "transport-failed",
+                    deliveryFailureDetail: ledger.detail,
+                });
+            }
+            else if (ledger?.outcome === "never-posted") {
+                out.push({
+                    ...item,
+                    deliveryOutcome: "never-posted",
+                    deliveryFailureClass: "never-posted",
+                    deliveryFailureDetail: ledger.detail,
+                });
+            }
+            else {
+                // No ledger verdict: only the legacy pending failed/unroutable class is
+                // undelivered. An active non-human row can still have an old OWNER
+                // transition; that historical episode is not a current obligation.
+                const lastNudge = item.lastNudgeResult ?? "";
+                if (item.state === "pending" && (lastNudge.startsWith("failed:") || lastNudge.startsWith("unroutable:"))) {
+                    out.push(item);
+                }
+            }
+            if (opts?.limit !== undefined && out.length >= opts.limit)
+                break;
+        }
+        return out;
+    }
+    /** OPR.0.5.6.14 — terminal transport is a CAPABILITY, not topology presence.
+     *  An exact session or composed canonical seat is pane-bound only when its
+     *  node carries an explicit tmux binding. external_cli is paneless and must
+     *  continue to the human-registry/gateway leg. FAIL-OPEN only where the DB
+     *  cannot carry classification evidence (empty/partial bootstrap schemas). */
+    hasTerminalTransport(dest) {
+        try {
+            const anyTopology = this.db.prepare("SELECT 1 FROM sessions LIMIT 1").get()
+                ?? this.db.prepare("SELECT 1 FROM nodes LIMIT 1").get();
+            if (!anyTopology)
+                return true;
+            if (this.db.prepare(`SELECT 1 FROM sessions s JOIN bindings b ON b.node_id = s.node_id
+          WHERE s.session_name = ?
+            AND COALESCE(b.attachment_type, 'tmux') = 'tmux'
+            AND b.tmux_session IS NOT NULL LIMIT 1`).get(dest))
+                return true;
+            const at = dest.lastIndexOf("@");
+            if (at <= 0)
+                return true; // non-canonical shapes stay on the legacy path
+            const seat = dest.slice(0, at);
+            const rig = dest.slice(at + 1);
+            const composed = this.db.prepare(`SELECT 1 FROM nodes n
+          JOIN rigs r ON r.id = n.rig_id
+          JOIN bindings b ON b.node_id = n.id
+          WHERE r.name = ? AND REPLACE(n.logical_id, '.', '-') = ?
+            AND COALESCE(b.attachment_type, 'tmux') = 'tmux'
+            AND b.tmux_session IS NOT NULL LIMIT 1`).get(rig, seat);
+            return !!composed;
+        }
+        catch {
+            return true; // schema-partial fixture DB: never discriminate without evidence
+        }
+    }
+    /** Null means legacy/no OWNER history; inactive means OWNER history exists
+     *  but the row no longer projects a current human-notification episode. */
+    currentDeliveryEpisode(item) {
+        const transition = this.transitionLog.latestOwnerNotificationForQitem(item.qitemId);
+        if (!transition)
+            return null;
+        const registry = this.loadHumanRegistryFn();
+        if (!registry.ok)
+            return "inactive";
+        const humanAddress = transition.ownerNotificationKind === "human-decision-resolved"
+            ? resolveRegisteredHumanAddress(transition.actorSession, registry.entities)
+            : item.state === "blocked"
+                ? resolveRegisteredHumanAddress(item.blockedOn, registry.entities)
+                : resolveRegisteredHumanAddress(item.destinationSession, registry.entities);
+        return humanAddress
+            ? { notificationKey: `${item.qitemId}:${transition.transitionId}`, startedAt: transition.ts }
+            : "inactive";
+    }
+    /** OPR.0.5.6.14 — derive the current episode's delivery ledger. Receipt
+     *  transitions are same-row but keyed by qitemId:OWNER-transitionId; an old
+     *  posted receipt cannot mask a later human park. Legacy pre-OWNER or literal
+     *  external rows retain their row-scoped fallback. */
+    deliveryOutcomeFor(qitemId) {
+        // Some repository-only fixtures intentionally model the pre-transition
+        // schema. Delivery projection is additive there: absence means no verdict,
+        // never a list failure.
+        if (!this.hasQueueTransitionsTable)
+            return null;
+        const row = this.db.prepare("SELECT * FROM queue_items WHERE qitem_id = ?")
+            .get(qitemId);
+        if (!row)
+            return null;
+        const item = this.rowToItem(row);
+        const episodeState = this.currentDeliveryEpisode(item);
+        if (episodeState === "inactive")
+            return null;
+        const episode = episodeState;
+        const notes = this.db.prepare(`SELECT transition_note FROM queue_transitions
+        WHERE qitem_id = ? AND (transition_note LIKE 'slack-owner-notification-posted %'
+                             OR transition_note LIKE 'slack-owner-notification-transport-failed %')
+        ORDER BY transition_id DESC`).all(qitemId);
+        const currentNotes = episode
+            ? notes.filter((note) => note.transition_note.split(/\s+/).includes(`notification_key=${episode.notificationKey}`))
+            : notes;
+        const posted = currentNotes.find((note) => note.transition_note.startsWith("slack-owner-notification-posted "));
+        if (posted)
+            return { outcome: "posted", detail: posted.transition_note };
+        const failed = currentNotes.find((note) => note.transition_note.startsWith("slack-owner-notification-transport-failed "));
+        if (failed)
+            return { outcome: "transport-failed", detail: failed.transition_note };
+        const startedAt = episode?.startedAt ?? item.tsCreated;
+        const gatewayRouted = episode !== null || item.lastNudgeResult?.startsWith("gateway-owned") === true;
+        if (gatewayRouted) {
+            const ageMs = Date.now() - new Date(startedAt.includes("T") ? startedAt : startedAt + "Z").getTime();
+            if (ageMs > QueueRepository.NEVER_POSTED_WINDOW_MS) {
+                const key = episode ? ` for notification_key=${episode.notificationKey}` : "";
+                return { outcome: "never-posted", detail: `gateway-routed row with no delivery receipt${key} past the post window` };
+            }
+        }
+        return null;
     }
+    /** The grace window before a receiptless gateway-routed row honestly reads
+     *  never-posted (the connector sweep cadence bounds normal posting latency). */
+    static NEVER_POSTED_WINDOW_MS = 120_000;
     recordNudgeAttempt(qitemId, result) {
         const ts = new Date().toISOString();
         this.db
@@ -1974,12 +2284,6 @@ export class QueueRepository {
          WHERE qitem_id = ?`)
             .run(ts, result, qitemId);
     }
-    recordHeartbeat(qitemId) {
-        const ts = new Date().toISOString();
-        this.db
-            .prepare(`UPDATE queue_items SET last_heartbeat = ? WHERE qitem_id = ?`)
-            .run(ts, qitemId);
-    }
     /**
      * Pod-fallback: redirect qitem to a fallback destination (e.g., when a seat
      * is unreachable). Emits qitem.fallback_routed; preserves chain_of_record.