@openrig/cli 0.6.10 → 0.6.12

package/daemon/dist/domain/queue-repository.js

@@ -62,6 +62,8 @@ export function hasLiveHumanGate(item) {
 }
 const AUTO_UNPARK_WAKE_TAG = "queue:auto-unpark:blocker";
 const AUTO_UNPARK_BLOCKER_TAG_PREFIX = "queue:auto-unpark:blocker-ref:";
+/** The actor on the transition routeToFallback writes; the row's own history is how a later reroute finds the line it wrote. */
+const FALLBACK_ACTOR = "system:queue-fallback";
 /** 0.5.1-53 Atom 1a — typed non-qitem gate blocker prefixes. A park may be gated on a fold / auth /
  *  external condition that is NOT a qitem and NOT a human seat; these prefixes make such a gate a
  *  first-class, compact-visible, downstream-classifiable blocker (the ruling detail rides a transition). */
@@ -185,6 +187,41 @@ export function deriveCrossHostSuccessorId(sourceQitemId, destinationSession, ho
         .slice(0, 16);
     return `qitem-xh-${digest}`;
 }
+/** The retained next owner must describe this closure, not a handoff before a reopen. */
+export function matchesRecordedHandoffTarget(qitemId, handedOffTo, closureTarget) {
+    if (!handedOffTo || !closureTarget)
+        return false;
+    if (closureTarget === handedOffTo)
+        return true;
+    // Cross-host re-drives preserve the pre-convention member@rig@host target.
+    const legacy = /^(.+)@([A-Za-z0-9][A-Za-z0-9._-]*)$/.exec(closureTarget);
+    if (legacy?.[1] === handedOffTo)
+        return true;
+    const foreign = /^(qitem-[^@]+)@([^@]+)$/.exec(closureTarget);
+    return foreign !== null && foreign[1] === deriveCrossHostSuccessorId(qitemId, handedOffTo, foreign[2]);
+}
+/**
+ * Shared read-only lineage helper for handoff advisory and stuck sweep.
+ * Checks whether a local successor item exists matching target (by qitem_id or destination_session)
+ * linked to sourceQitemId (via handed_off_from or chain_of_record membership).
+ *
+ * Excludes source row itself (s.qitem_id != sourceQitemId). Guards chain_of_record with json_valid.
+ * Throws on database/query errors so callers can handle lookup failures with their own policies.
+ */
+export function hasLinkedSuccessor(db, sourceQitemId, target) {
+    const successor = db
+        .prepare(`SELECT 1 FROM queue_items s
+        WHERE (s.qitem_id = ? OR s.destination_session = ?) AND s.qitem_id != ?
+          AND (s.handed_off_from = ? OR (
+            s.chain_of_record IS NOT NULL
+            AND json_valid(s.chain_of_record)
+            AND EXISTS (
+              SELECT 1 FROM json_each(s.chain_of_record) WHERE value = ?
+            )
+          )) LIMIT 1`)
+        .get(target, target, sourceQitemId, sourceQitemId, sourceQitemId);
+    return Boolean(successor);
+}
 /** PL-007 — defensive column probe. Older test fixtures bypass the
  *  canonical migration list, so target_repo may be absent. Mirrors
  *  the `hasNodeColumn` pattern in rig-repository.ts. */
@@ -227,7 +264,12 @@ function compactRow(item) {
         delete row[field];
     return row;
 }
-const COMPACT_QUEUE_COLUMNS = "qitem_id, ts_created, ts_updated, source_session, destination_session, state, priority, tier, tags, blocked_on, handed_off_to, handed_off_from, expires_at, closure_reason, closure_target, closure_required_at, claimed_at, last_nudge_attempt, last_nudge_result, last_heartbeat, resolution, target_repo";
+const COMPACT_QUEUE_COLUMN_NAMES = [
+    "qitem_id", "ts_created", "ts_updated", "source_session", "destination_session", "state", "priority", "tier", "tags",
+    "blocked_on", "handed_off_to", "handed_off_from", "expires_at", "closure_reason", "closure_target", "closure_required_at",
+    "claimed_at", "last_nudge_attempt", "last_nudge_result", "last_heartbeat", "resolution", "target_repo",
+];
+const COMPACT_QUEUE_COLUMNS = COMPACT_QUEUE_COLUMN_NAMES.join(", ");
 export function stampSelfHostSuffix(session) {
     if (session === undefined)
         return undefined;
@@ -276,6 +318,9 @@ export function destinationRigTeaching(session) {
  * gateway resolver (how to register + "not an agent seat"). Loads the registry only for
  * the (rare) @external refusal path. Undefined for non-@external / registered / scheme.
  */
+/** Refusal teachings issued because nobody is registered yet (the load result's `noHumans`), so the refusal's
+ *  wording can say so. Kept off the teaching object itself, whose fields are unchanged. */
+const NOBODY_REGISTERED_TEACHINGS = new WeakSet();
 export function externalAdmissionTeaching(session, loadRegistry = loadHumanRegistry) {
     const parsed = parseSessionName(session);
     if (parsed.kind !== "external")
@@ -283,6 +328,18 @@ export function externalAdmissionTeaching(session, loadRegistry = loadHumanRegis
     if (resolveExternal(parsed.local, []).kind === "scheme")
         return undefined;
     const reg = loadRegistry();
+    if (!reg.ok && reg.noHumans) {
+        // Nobody registered yet: not a broken registry. Same fields as below; the hint names the registration verb.
+        const teaching = {
+            externalDomain: parsed.domain,
+            registryLoadError: true,
+            registryError: reg.error,
+            hint: `human registry admission is unavailable because no human is registered yet: ${reg.error}. ` +
+                "Register the person with rig gateway human add; do not downgrade the destination to an agent seat.",
+        };
+        NOBODY_REGISTERED_TEACHINGS.add(teaching);
+        return teaching;
+    }
     if (!reg.ok) {
         return {
             externalDomain: parsed.domain,
@@ -307,7 +364,9 @@ export function destinationRefusalTeaching(session, loadRegistry = loadHumanRegi
 function destinationValidationError(field, session, loadRegistry) {
     const teaching = destinationRefusalTeaching(session, loadRegistry);
     if (teaching?.registryLoadError === true) {
-        return new QueueRepositoryError("human_registry_unavailable", `${field} ${session} cannot be admitted because the human registry failed to load: ${String(teaching.registryError)}`, teaching);
+        return new QueueRepositoryError("human_registry_unavailable", NOBODY_REGISTERED_TEACHINGS.has(teaching)
+            ? `${field} ${session} cannot be admitted because no human is registered yet: ${String(teaching.registryError)}`
+            : `${field} ${session} cannot be admitted because the human registry failed to load: ${String(teaching.registryError)}`, teaching);
     }
     return new QueueRepositoryError("unknown_destination_rig", `${field} ${session} references an unknown rig`, teaching);
 }
@@ -372,7 +431,8 @@ export class QueueRepository {
         this.wakeRepo = new QueueWakeRepository(db);
         this.validateRig = opts?.validateRig ?? (() => true);
         this.destinationAdvisory = opts?.destinationAdvisory ?? (() => null);
-        this.transport = opts?.transport;
+        if (opts?.transport)
+            this.attachTransport(opts.transport);
         this.workflowFrontierPredicate = opts?.workflowFrontierPredicate;
         this.resolveOccupantGeneration = opts?.resolveOccupantGeneration;
         this.loadHumanRegistryFn = opts?.loadHumanRegistry ?? (() => loadHumanRegistry());
@@ -436,6 +496,39 @@ export class QueueRepository {
      */
     attachTransport(transport) {
         this.transport = transport;
+        transport.configureGuardedWakes?.(entries => entries.every(entry => {
+            const row = entry.auditPointer ? this.getById(entry.auditPointer) : null;
+            if (!row || row.destinationSession !== entry.destinationSession)
+                return false;
+            return entry.outboxId.startsWith(WAKE_INTENT_PREFIX) ? this.currentWakeIntent(entry) : isBlockerLive(row.state);
+        }));
+    }
+    currentWakeIntent(entry) {
+        const row = entry.auditPointer ? this.db.prepare("SELECT state FROM queue_items WHERE qitem_id=?").get(entry.auditPointer) : undefined;
+        if (row?.state !== "pending")
+            return false;
+        const prefix = `${WAKE_INTENT_PREFIX}blocker-`;
+        if (!entry.outboxId.startsWith(prefix))
+            return true;
+        const expected = Number(entry.outboxId.slice(prefix.length));
+        const latest = this.db.prepare(`SELECT transition_id FROM (
+      SELECT transition_id, state, LAG(state) OVER (ORDER BY transition_id) AS previous_state
+      FROM queue_transitions WHERE qitem_id=?)
+      WHERE state='pending' AND previous_state IS NOT 'pending' ORDER BY transition_id DESC LIMIT 1`)
+            .get(entry.auditPointer);
+        return expected === latest?.transition_id;
+    }
+    classifyWakeResult(res) {
+        if (res.outcome === "retained")
+            return { classified: "retained", nudgeResult: res.reason?.startsWith("draft_")
+                    ? "retained:draft_aware" : "retained:typing_guard" };
+        if (res.ok)
+            return res.verified ? { classified: "verified", nudgeResult: "verified" } : { classified: "indeterminate", nudgeResult: "delivered-ack-pending" };
+        const detail = res.error ?? res.reason ?? "unknown";
+        if (res.delivery?.state === "indeterminate" || res.delivery?.state === "sending" || isWakeTimeoutSignal(res.reason) || isWakeTimeoutSignal(res.error)) {
+            return { classified: "indeterminate", nudgeResult: `indeterminate:${detail}` };
+        }
+        return { classified: "failed", nudgeResult: `failed:${detail}` };
     }
     /**
      * W1 (transactional closure): attach the durable wake-intent store AFTER
@@ -528,6 +621,11 @@ export class QueueRepository {
         if (target)
             this.outbox.retain(record, target);
         else {
+            // Draft-aware wakes remain pending until the transport owns their bounded
+            // retry. Manual retention is deliberately never drained.
+            const draftTarget = this.transport?.draftAwareTarget?.(input.toSession);
+            if (draftTarget)
+                this.outbox.assertRetentionCapacity(draftTarget.nodeId, frozenEnvelope);
             this.outbox.record(record);
             const binding = this.transport?.deliveryTarget?.(input.toSession);
             if (binding)
@@ -618,18 +716,7 @@ export class QueueRepository {
         // original frozen intent and audit pointer survives; only transport coalesces.
         let superseded = false;
         const actionable = (entry) => {
-            const row = entry.auditPointer ? this.db.prepare("SELECT state FROM queue_items WHERE qitem_id = ?").get(entry.auditPointer) : undefined;
-            let current = row?.state === "pending";
-            const resumePrefix = `${WAKE_INTENT_PREFIX}blocker-`;
-            if (current && entry.outboxId.startsWith(resumePrefix)) {
-                const expected = Number(entry.outboxId.slice(resumePrefix.length));
-                const latest = this.db.prepare(`SELECT transition_id FROM (
-          SELECT transition_id, state, LAG(state) OVER (ORDER BY transition_id) AS previous_state
-          FROM queue_transitions WHERE qitem_id = ?)
-          WHERE state = 'pending' AND previous_state IS NOT 'pending' ORDER BY transition_id DESC LIMIT 1`)
-                    .get(entry.auditPointer);
-                current = expected === latest?.transition_id;
-            }
+            const current = this.currentWakeIntent(entry);
             if (!current) {
                 // Existing failed state means the requested old delivery was refused;
                 // the explicit tag distinguishes supersession from a transport attempt.
@@ -920,12 +1007,12 @@ export class QueueRepository {
         }
         const deliveryId = `guard-nudge-${qitemId}-${createHash("sha256").update(JSON.stringify([sourceSession, destinationSession, bodyOverride ?? null])).digest("hex")}`;
         const held = !committedOutboxIds ? this.outbox?.getById(deliveryId) : null;
-        if (held?.deliveryState === "retained" || held?.deliveryState === "retired") {
+        if (held?.guardBinding) {
             // Same logical nudge reuses its original frozen envelope, not a new timestamp.
             text = held.body;
         }
         try {
-            const res = await this.transport.send(destinationSession, text, { verify: true, stampISO, actorSession: sourceSession, committedOutboxIds, deliveryId: committedOutboxIds ? undefined : deliveryId, auditPointer: qitemId });
+            const res = await this.transport.send(destinationSession, text, { verify: true, stampISO, actorSession: sourceSession, committedOutboxIds, deliveryId: committedOutboxIds ? undefined : deliveryId, auditPointer: qitemId, queueWake: true });
             // OPR.0.3.2.21.FR-4(c) — wording rename: the prior literal
             // "sent-unverified" read as a failure even in the common case
             // (delivery confirmed but the synchronous ack window expired,
@@ -933,22 +1020,11 @@ export class QueueRepository {
             // "delivered-ack-pending" reads as healthy. The old "verified"
             // case is unchanged for backward-compat with any tooling that
             // already consumed the positive literal.
-            if (res.outcome === "retained")
-                return { classified: "retained", nudgeResult: "retained:typing_guard" };
-            if (res.ok) {
-                return res.verified
-                    ? { classified: "verified", nudgeResult: "verified" }
-                    : { classified: "indeterminate", nudgeResult: "delivered-ack-pending" };
-            }
             // MF6: a TIMEOUT is ambiguous — the send may have landed but the ack window
             // expired — so it records `indeterminate` (never silently delivered, never a
             // hard `failed`). A definite non-timeout failure (unreachable, unknown
             // session) stays `failed`.
-            const detail = res.error ?? res.reason ?? "unknown";
-            if (isWakeTimeoutSignal(res.reason) || isWakeTimeoutSignal(res.error)) {
-                return { classified: "indeterminate", nudgeResult: `indeterminate:${detail}` };
-            }
-            return { classified: "failed", nudgeResult: `failed:${detail}` };
+            return this.classifyWakeResult(res);
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1556,6 +1632,7 @@ export class QueueRepository {
                 transitionNote: input.transitionNote ?? `cross-host handoff to ${input.toSession}`,
                 closureReason: "handed_off_to",
                 closureTarget: input.closureTarget,
+                identityProvenance: input.identityProvenance ?? null,
             });
             // OPR.0.5.8.1 S1b — third member of the handoff family, same bypass.
             this.retireParkGeneratedTimer(input.qitemId, `park_ended:${input.terminalState}`);
@@ -1577,7 +1654,7 @@ export class QueueRepository {
                 qitemId: input.qitemId,
                 terminalState: input.terminalState,
                 actorSession: input.fromSession,
-                identityProvenance: null,
+                identityProvenance: input.identityProvenance ?? null,
                 ts,
             })) {
                 events.push(dependentEvent);
@@ -1814,11 +1891,12 @@ export class QueueRepository {
             throw new QueueRepositoryError("qitem_not_found", `qitem ${input.qitemId} not found`);
         }
         const hasNote = typeof input.transitionNote === "string" && input.transitionNote.trim().length > 0;
+        const hasValidSummary = typeof input.summary === "string" && input.summary.trim().length > 0;
         const isGuardedTerminal = ["done", "canceled", "handed-off"].includes(qitem.state);
         const isStatePreservingAppend = input.state === undefined || (isGuardedTerminal && input.state === qitem.state);
         if (isStatePreservingAppend) {
-            if (input.state === undefined && !hasNote) {
-                throw new QueueRepositoryError("state_or_note_required", "queue update requires --state or a non-empty --note; nothing was written");
+            if (input.state === undefined && !hasNote && !hasValidSummary) {
+                throw new QueueRepositoryError("state_or_note_required", "queue update requires --state, a non-empty --note, or a non-empty --summary; nothing was written");
             }
             const disallowed = input.reopen === true
                 || input.closureReason != null
@@ -1830,16 +1908,25 @@ export class QueueRepository {
                 || input.wakeMaxSeconds != null
                 || input.wakeProgressEvidence != null
                 || input.wakeMessage != null
-                || input.summary != null
-                || input.evidenceRef != null;
+                || input.evidenceRef != null
+                || (input.state !== undefined && input.summary != null)
+                || (input.summary != null && !hasValidSummary);
             if (disallowed) {
                 throw new QueueRepositoryError("note_append_fields_not_admitted", "a state-preserving note append accepts only --note (and an optional same --state); state-write fields were supplied, so nothing was written");
             }
+            if (hasValidSummary) {
+                this.persistSummary(input.qitemId, input.summary);
+            }
+            const note = hasValidSummary
+                ? (hasNote
+                    ? (input.transitionNote.includes("(summary updated)") ? input.transitionNote : `${input.transitionNote} (summary updated)`)
+                    : "summary updated")
+                : input.transitionNote;
             this.transitionLog.append({
                 qitemId: input.qitemId,
                 state: qitem.state,
                 actorSession: input.actorSession,
-                transitionNote: input.transitionNote,
+                transitionNote: note,
                 // A note-only append does not clear the claim's retained park gate.
                 // Carry its audit pointer so a later state write can end this chain.
                 closureTarget: qitem.state === "in-progress" ? this.retainedClaimBlocker(input.qitemId) : undefined,
@@ -1853,7 +1940,7 @@ export class QueueRepository {
                 closureReason: null,
                 closureTarget: null,
                 actorSession: input.actorSession,
-                summary: qitem.summary ?? null,
+                summary: hasValidSummary ? input.summary : (qitem.summary ?? null),
             });
             return { persistedEvent, persistedEvents: [persistedEvent] };
         }
@@ -2089,6 +2176,15 @@ export class QueueRepository {
         // NULL. The prior `COALESCE(?, blocked_on)` preserved the blocker on every non-blocked
         // transition, leaving dead blockers that nothing audits (the root-cause strand).
         const nextBlockedOn = input.state === "blocked" ? effectiveBlockedOn : null;
+        // The outcome is used only as non-blank text on the update that closes an open row; on any other
+        // update the field is ignored and the row answers as it would without it. It goes after what the row
+        // already carries (a pod-fallback line, or an earlier close's outcome) on its own line, text as sent.
+        const closingResolution = typeof input.resolution === "string" && input.resolution.trim().length > 0
+            && isBlockerLive(qitem.state) && !isBlockerLive(input.state)
+            ? input.resolution : null;
+        const nextResolution = closingResolution === null
+            ? qitem.resolution
+            : qitem.resolution ? `${qitem.resolution}\n${closingResolution}` : closingResolution;
         const notification = this.classifyOwnerNotification({
             action: "update",
             destinationSession: qitem.destinationSession,
@@ -2105,9 +2201,10 @@ export class QueueRepository {
                closure_reason = COALESCE(?, closure_reason),
                closure_target = COALESCE(?, closure_target),
                handed_off_to = COALESCE(?, handed_off_to),
-               blocked_on = ?
+               blocked_on = ?,
+               resolution = ?
          WHERE qitem_id = ?`)
-            .run(input.state, ts, validation.closureReason, validation.closureTarget, input.handedOffTo ?? null, nextBlockedOn, input.qitemId);
+            .run(input.state, ts, validation.closureReason, validation.closureTarget, input.handedOffTo ?? null, nextBlockedOn, nextResolution, input.qitemId);
         // FR-6: park-time summary/evidence_ref are PERSISTED onto the existing
         // item (not merely validated-then-dropped) — visible to the attention
         // query and to Packet 2. Only the park path writes them.
@@ -2308,6 +2405,10 @@ export class QueueRepository {
     getParkWakeStatus(qitemId) {
         return this.wakeRepo.getStatus(qitemId);
     }
+    /** For parked diagnosis only (see QueueWakeRepository.servedByOwnRepeatingReminder). */
+    parkWakeServedByOwnReminder(qitemId) {
+        return this.wakeRepo.servedByOwnRepeatingReminder(qitemId);
+    }
     /** Park timers a seat swap keeps: each is still its blocked row's current wake and still targets the
      *  row's owner (see QueueWakeRepository.currentParkTimerIds). */
     currentParkTimerIds() {
@@ -2333,6 +2434,18 @@ export class QueueRepository {
             return wake ? { ...transition, wake } : transition;
         });
     }
+    /** The transition that closed a row: the first of the trailing run in its current closed state.
+     *  Later notes and delivery receipts on a closed row repeat that state, so the latest transition
+     *  is not the close. Null while the row is still active (pending, in-progress, blocked). */
+    closingTransition(qitemId, currentState) {
+        if (isBlockerLive(currentState))
+            return null;
+        const transitions = this.transitionLog.listForQitem(qitemId);
+        let closing = null;
+        for (let i = transitions.length - 1; i >= 0 && transitions[i].state === currentState; i--)
+            closing = transitions[i];
+        return closing;
+    }
     /** Read-only scope-aware RECENT projection. Normalization and its hard cap
      * live with the append-only transition log; the repository owns the public
      * queue-domain door. */
@@ -2391,8 +2504,20 @@ export class QueueRepository {
             if (deliveryStatus === "retained")
                 return firedEvents;
             if (usageLimitBlockers.length === 0) {
-                if (parkGeneratedTimer && !backOffQueueWait(this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db), jobId, deliveryStatus)) {
-                    (this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db)).markTerminal(jobId, "park_timer_fired_once");
+                const jobsRepo = this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db);
+                if (parkGeneratedTimer && !backOffQueueWait(jobsRepo, jobId, deliveryStatus)) {
+                    jobsRepo.markTerminal(jobId, "park_timer_fired_once");
+                }
+                else if (!parkGeneratedTimer) {
+                    // A one-shot generated job whose original park has ended and whose last attachment this attempt just
+                    // consumed is retired now, not at its next check: while it stayed active, --wake-watchdog could attach
+                    // another task to it. Repeating (queue-wait) jobs keep their own lifecycle.
+                    const job = jobsRepo.getById(jobId);
+                    if (job && !isQueueWait(job.specYaml)) {
+                        const reason = this.resolveWatchdogPreDeliveryTerminalReason(jobId);
+                        if (reason)
+                            jobsRepo.markTerminal(jobId, reason);
+                    }
                 }
                 return firedEvents;
             }
@@ -2519,23 +2644,46 @@ export class QueueRepository {
     }
     /** #96 — whether some update recorded this Slack root as the thread it posts into. Such a
      *  root is shared: its owner's next decision must not reuse it (see slack-subsystem). */
-    isReplyToThread(threadTs) {
+    isReplyToThread(threadTs, where) {
         if (!this.hasQueueTransitionsTable)
             return false;
         // Same trust rule as replyToChoiceFor: a pre-provenance schema reads every row as null.
         const provenance = this.hasTransitionProvenanceColumn ? " AND identity_provenance IS NULL" : "";
+        const note = formatReplyToChoice({ kind: "thread", threadTs });
+        // A root is its channel's: with `where`, only a choice naming that channel counts. One naming no
+        // channel is judged by the caller from the rows that made it (unnamedReplyToChoiceRows).
+        if (where) {
+            return this.db.prepare(`SELECT 1 FROM queue_transitions WHERE transition_note = ? AND actor_session = ?${provenance} LIMIT 1`).get(`${note} channel=${where.channel}`, REPLY_TO_CHOICE_ACTOR) !== undefined;
+        }
         // #192: with a channel map the note carries a ` channel=<id>` suffix. Match the exact note, or
         // the exact note followed by that suffix; a prefix compare, not LIKE (the note itself contains
         // `_`), and the trailing space keeps thread 1.1 from matching 1.10.
-        const note = formatReplyToChoice({ kind: "thread", threadTs });
         const withChannel = `${note} channel=`;
         return this.db.prepare(`SELECT 1 FROM queue_transitions
         WHERE (transition_note = ? OR substr(transition_note, 1, ?) = ?) AND actor_session = ?${provenance} LIMIT 1`).get(note, withChannel.length, withChannel, REPLY_TO_CHOICE_ACTOR) !== undefined;
     }
+    /** #96 — the rows whose recorded choice threads into this ts without naming a channel. Such a choice
+     *  was made for the default channel of its day, which may have changed since, so the note alone
+     *  can't say which root it took; the caller checks where each row's post landed (its recorded parts). */
+    unnamedReplyToChoiceRows(threadTs) {
+        if (!this.hasQueueTransitionsTable)
+            return [];
+        const provenance = this.hasTransitionProvenanceColumn ? " AND identity_provenance IS NULL" : "";
+        const rows = this.db.prepare(`SELECT DISTINCT qitem_id FROM queue_transitions WHERE transition_note = ? AND actor_session = ?${provenance}`).all(formatReplyToChoice({ kind: "thread", threadTs }), REPLY_TO_CHOICE_ACTOR);
+        return rows.map((r) => r.qitem_id);
+    }
     replyToFallbackFor(qitemId) {
         const choice = this.replyToChoiceFor(qitemId);
         return choice?.kind === "fallback" ? describeReplyToFallback(choice) : null;
     }
+    /** The parked query's obligation face: open rows to one destination, newest first, without the per-row
+     *  projections list() derives (pickup, waiting view, delivery ledger), which this read never uses. */
+    listOpenObligations(destinationSession, limit) {
+        const rows = this.db.prepare(`SELECT qitem_id, state${this.hasSummaryColumn ? ", summary" : ""} FROM queue_items
+        WHERE destination_session = ? AND state IN ('pending', 'in-progress', 'blocked')
+        ORDER BY ts_created DESC LIMIT ?`).all(destinationSession, limit);
+        return rows.map((r) => ({ qitemId: r.qitem_id, state: r.state, summary: r.summary ?? null }));
+    }
     list(opts) {
         const limit = opts?.limit ?? 100;
         const conditions = [];
@@ -2584,9 +2732,11 @@ export class QueueRepository {
         const rows = this.db
             .prepare(`SELECT ${columns} FROM queue_items ${where} ORDER BY ${orderBy} LIMIT ?`)
             .all(...params);
+        const owners = this.transitionLog.ownerNotificationsForQitems(rows.map((row) => row.qitem_id));
+        const ledgers = this.deliveryOutcomesFor(rows, owners);
         const items = rows.map((r) => {
-            const item = this.rowToItem(r, !opts?.compact);
-            const ledger = this.deliveryOutcomeFor(item.qitemId);
+            const ledger = ledgers.get(r.qitem_id);
+            const item = this.rowToItem(r, !opts?.compact, { owners: owners.get(r.qitem_id) ?? [], ledger: ledger ?? null });
             return {
                 ...item,
                 deliveryOutcome: ledger?.outcome ?? null,
@@ -2882,9 +3032,10 @@ export class QueueRepository {
         }
     }
     /** Null means legacy/no OWNER history; inactive means OWNER history exists
-     *  but the row no longer projects a current human-notification episode. */
-    currentDeliveryEpisode(item, knownOwner) {
-        let transition = knownOwner ?? this.transitionLog.latestOwnerNotificationForQitem(item.qitemId);
+     *  but the row no longer projects a current human-notification episode.
+     *  owners: the row's owner notifications, newest first. */
+    currentDeliveryEpisode(item, owners, loadRegistry) {
+        let transition = owners[0];
         if (!transition)
             return null;
         // A human-decision-resolved notice written BY the transition that closed the row (a human's direct reply closing
@@ -2894,15 +3045,13 @@ export class QueueRepository {
         // stayed active is a real delivery and keeps its outcome after an agent later closes the row.
         let resolvedBy = null;
         if (transition.ownerNotificationKind === "human-decision-resolved" && !["pending", "in-progress", "blocked"].includes(transition.state)) {
-            const outbound = this.transitionLog.listForQitem(item.qitemId)
-                .filter((t) => t.ownerNotificationLevel != null && t.ownerNotificationKind != null && t.ownerNotificationKind !== "human-decision-resolved")
-                .sort((a, b) => b.transitionId - a.transitionId)[0];
+            const outbound = owners.find(isOutboundOwnerNotice);
             if (!outbound)
                 return "inactive";
             resolvedBy = transition.actorSession;
             transition = outbound;
         }
-        const registry = this.loadHumanRegistryFn();
+        const registry = loadRegistry();
         if (!registry.ok)
             return "inactive";
         // After that fallback the recipient is the human who answered: the row may be an agent's that was parked on them
@@ -2930,13 +3079,14 @@ export class QueueRepository {
      *  to a registered human, aliases included) has a POSTED receipt. Legacy rows with no OWNER
      *  history, inactive episodes, never-posted and transport-failed all read false. Same derivation
      *  as deliveryOutcomeFor; it reads row fields, never the waiting view. */
-    humanNotificationPostedThisEpisode(qitemId) {
+    humanNotificationPostedThisEpisode(qitemId, listed) {
         if (!this.hasQueueTransitionsTable)
             return false;
         // Only the ask's own notification binds a recipient: create writes it in state pending, to the destination of
         // that moment. A park notice (its recipient is not retained), a resolution notice, or a later destination change
         // (routeToFallback opens no new episode) cannot establish that the current destination received this ask.
-        const owner = this.transitionLog.latestOwnerNotificationForQitem(qitemId);
+        const owners = listed?.owners ?? this.transitionLog.ownerNotificationsForQitems([qitemId]).get(qitemId) ?? [];
+        const owner = owners[0];
         if (!owner || owner.state !== "pending")
             return false;
         if (owner.ownerNotificationKind !== "human-required" && owner.ownerNotificationKind !== "human-update")
@@ -2945,10 +3095,11 @@ export class QueueRepository {
         if (rerouted)
             return false;
         // The ledger's episode exists only when the destination resolves to a registered human (aliases included).
-        const ledger = this.deliveryLedger(qitemId, owner);
+        const ledger = listed ? listed.ledger : this.deliveryLedger(qitemId, owners);
         return ledger !== null && ledger.outcome === "posted" && ledger.episode?.notificationKey === `${qitemId}:${owner.transitionId}`;
     }
-    deliveryLedger(qitemId, knownOwner) {
+    /** owners: the row's owner notifications as ownerNotificationsForQitems gives them, when the caller read them. */
+    deliveryLedger(qitemId, owners) {
         // Some repository-only fixtures intentionally model the pre-transition
         // schema. Delivery projection is additive there: absence means no verdict,
         // never a list failure.
@@ -2958,26 +3109,65 @@ export class QueueRepository {
             .get(qitemId);
         if (!row)
             return null;
-        // The delivery episode uses row fields, not the waiting/backstop view.
-        // Keep this read fresh without repeating the caller's recovery-tag scan.
-        const item = this.rowToItem(row, false);
-        const episodeState = this.currentDeliveryEpisode(item, knownOwner);
-        if (episodeState === "inactive")
-            return null;
-        const episode = episodeState;
-        const notes = this.db.prepare(`SELECT transition_note FROM queue_transitions
-        WHERE qitem_id = ? AND (transition_note LIKE 'slack-owner-notification-posted %'
+        // The delivery episode uses row fields, not the waiting/backstop view. Its receipts are read after it, as they
+        // always were for a single row: a receipt committed while the human registry loads is then seen.
+        return this.deliveryOutcomesFor([row], owners && new Map([[qitemId, owners]]), true).get(qitemId) ?? null;
+    }
+    receiptNotesStatement;
+    /** The delivery ledger of each row, its reads batched: one read of the rows' owner notifications (unless the caller
+     *  read them already), one of their receipts, the human registry loaded once at most. A single row's
+     *  (deliveryOutcomeFor, show, the sweeps) is a batch of one. receiptsAfterEpisodes: read the receipts once the
+     *  episodes (and so the registry) are worked out, as a single row's ledger does; a listing reads them before. */
+    deliveryOutcomesFor(rows, knownOwners, receiptsAfterEpisodes = false) {
+        const ledgers = new Map();
+        if (!this.hasQueueTransitionsTable || rows.length === 0)
+            return ledgers;
+        const qitemIds = rows.map((row) => row.qitem_id);
+        const owners = knownOwners ?? this.transitionLog.ownerNotificationsForQitems(qitemIds);
+        let notes = receiptsAfterEpisodes ? undefined : this.receiptNotesFor(qitemIds);
+        let registry;
+        const loadRegistry = () => (registry ??= this.loadHumanRegistryFn());
+        const episodes = rows.map((row) => {
+            const item = ledgerItem(row);
+            return { item, episode: this.currentDeliveryEpisode(item, owners.get(row.qitem_id) ?? [], loadRegistry) };
+        });
+        notes ??= this.receiptNotesFor(qitemIds);
+        for (const { item, episode } of episodes) {
+            if (episode === "inactive")
+                continue;
+            const ledger = this.ledgerOf(item, episode, notes.get(item.qitemId) ?? []);
+            if (ledger)
+                ledgers.set(item.qitemId, ledger);
+        }
+        return ledgers;
+    }
+    /** The delivery receipt notes of these qitems, newest first, by qitem. */
+    receiptNotesFor(qitemIds) {
+        this.receiptNotesStatement ??= this.db.prepare(`SELECT qitem_id, transition_note FROM queue_transitions
+        WHERE qitem_id IN (SELECT value FROM json_each(?)) AND (transition_note LIKE 'slack-owner-notification-posted %'
                              OR transition_note LIKE 'slack-owner-notification-transport-failed %')
-        ORDER BY transition_id DESC`).all(qitemId);
+        ORDER BY transition_id DESC`);
+        const notes = new Map();
+        for (const row of this.receiptNotesStatement.all(JSON.stringify(qitemIds))) {
+            const own = notes.get(row.qitem_id);
+            if (own)
+                own.push(row.transition_note);
+            else
+                notes.set(row.qitem_id, [row.transition_note]);
+        }
+        return notes;
+    }
+    /** The ledger of one row's current episode, from its receipt notes (newest first). */
+    ledgerOf(item, episode, notes) {
         const currentNotes = episode
-            ? notes.filter((note) => note.transition_note.split(/\s+/).includes(`notification_key=${episode.notificationKey}`))
+            ? notes.filter((note) => note.split(/\s+/).includes(`notification_key=${episode.notificationKey}`))
             : notes;
-        const posted = currentNotes.find((note) => note.transition_note.startsWith("slack-owner-notification-posted "));
+        const posted = currentNotes.find((note) => note.startsWith("slack-owner-notification-posted "));
         if (posted)
-            return { outcome: "posted", detail: posted.transition_note, episode };
-        const failed = currentNotes.find((note) => note.transition_note.startsWith("slack-owner-notification-transport-failed "));
+            return { outcome: "posted", detail: posted, episode };
+        const failed = currentNotes.find((note) => note.startsWith("slack-owner-notification-transport-failed "));
         if (failed)
-            return { outcome: "transport-failed", detail: failed.transition_note, episode };
+            return { outcome: "transport-failed", detail: failed, episode };
         const startedAt = episode?.startedAt ?? item.tsCreated;
         const gatewayRouted = episode !== null || item.lastNudgeResult?.startsWith("gateway-owned") === true;
         if (gatewayRouted) {
@@ -3000,6 +3190,56 @@ export class QueueRepository {
          WHERE qitem_id = ?`)
             .run(ts, result, qitemId);
     }
+    /**
+     * Where, in the row's `resolution`, the fallback line `routeToFallback` last wrote begins; null when it cannot be
+     * told, and the field is then left whole. The row's own transitions say what that reroute printed: a newest-first
+     * seek by row on the live log, then on the archive the retention sweep moves an aged closed row's transitions to,
+     * stopping at the reroute's own transition (the in-process one, with no identity provenance), whose note is `fallback-routed: <from> → <to> (<reason>)`. The line is
+     * `fallback: <reason>`, built from the same printed reason, so it starts at a line start `i` of the field with
+     * `fallback: ` there and the rest of the field, `r`, satisfying note ends with ` (r)`. Neither the destinations nor
+     * the chain are consulted, so how a value was stored cannot matter. At most one `i` can satisfy it when the field
+     * ends with that line: a longer `r` would have to be preceded in the note by ` (`, and a shorter one starts inside the
+     * reason, right after a newline, which is not ` (`.
+     *
+     * A close that came after that reroute from an open state may have appended an outcome behind the line, and an
+     * outcome can read like the line, so then only a field that is nothing but the line (`i` = 0, which an appended
+     * outcome would lengthen) is accepted.
+     */
+    fallbackLineStart(qitemId, resolution) {
+        let note = null;
+        let newerClosed = false;
+        let outcomeMayFollow = false;
+        for (const table of ["queue_transitions", ...(detectTable(this.db, "queue_transitions_archive") ? ["queue_transitions_archive"] : [])]) {
+            // The reroute's transition is written in-process, so it has no identity provenance; the update route records one
+            // on every write and takes the actor and note from the request, so a transition it wrote can carry the same
+            // actor and note without being a reroute (the trust rule replyToChoiceFor uses). A schema without the column
+            // predates the update route's provenance and reads every row as unstamped.
+            const stamped = this.db.prepare(`PRAGMA table_info(${table})`).all().some((c) => c.name === "identity_provenance");
+            const newestFirst = this.db.prepare(`SELECT state, actor_session, transition_note, ${stamped ? "identity_provenance" : "NULL AS identity_provenance"} FROM ${table} WHERE qitem_id = ? ORDER BY transition_id DESC`);
+            for (const row of newestFirst.iterate(qitemId)) {
+                if (newerClosed && isBlockerLive(row.state))
+                    outcomeMayFollow = true;
+                if (row.identity_provenance === null && row.actor_session === FALLBACK_ACTOR && row.transition_note?.startsWith("fallback-routed: ")) {
+                    note = row.transition_note;
+                    break;
+                }
+                newerClosed = !isBlockerLive(row.state);
+            }
+            if (note !== null)
+                break;
+        }
+        if (note === null)
+            return null;
+        const printed = note;
+        const startsHere = (i) => resolution.startsWith("fallback: ", i) && (i === 0 || resolution[i - 1] === "\n") && printed.endsWith(` (${resolution.slice(i + "fallback: ".length)})`);
+        if (outcomeMayFollow)
+            return startsHere(0) ? 0 : null;
+        for (let i = 0; i < resolution.length; i = resolution.indexOf("\n", i) + 1 || resolution.length) {
+            if (startsHere(i))
+                return i;
+        }
+        return null;
+    }
     /**
      * Pod-fallback: redirect qitem to a fallback destination (e.g., when a seat
      * is unreachable). Emits qitem.fallback_routed; preserves chain_of_record.
@@ -3012,6 +3252,16 @@ export class QueueRepository {
         const ts = new Date().toISOString();
         const originalDestination = qitem.destinationSession;
         const newChain = JSON.stringify([...(qitem.chainOfRecord ?? []), `fallback-from:${originalDestination}`]);
+        // The field held only a fallback line before a close could store an outcome. The line this method last
+        // wrote is replaced, as it always was; anything else in the field is an outcome (possibly after an
+        // earlier fallback line) and stays, with the new line after it. "The line it last wrote" comes from the
+        // row's own transitions, so no marker is stored in the text. When the row has closed since, the field may
+        // end with an outcome that reads like that line, so then only a field that is exactly the line (an
+        // appended outcome would make it longer) is replaced; with no such reroute transition the field is left whole.
+        const fallbackLine = `fallback: ${reason}`;
+        const start = qitem.resolution ? this.fallbackLineStart(qitemId, qitem.resolution) : null;
+        const kept = qitem.resolution && start !== null ? qitem.resolution.slice(0, Math.max(0, start - 1)) : qitem.resolution;
+        const nextResolution = kept ? `${kept}\n${fallbackLine}` : fallbackLine;
         const txn = this.db.transaction(() => {
             this.db
                 .prepare(`UPDATE queue_items
@@ -3020,7 +3270,7 @@ export class QueueRepository {
                  chain_of_record = ?,
                  resolution = ?
            WHERE qitem_id = ?`)
-                .run(fallbackDestination, ts, newChain, `fallback: ${reason}`, qitemId);
+                .run(fallbackDestination, ts, newChain, nextResolution, qitemId);
             // A park timer targets the owner that parked the row. Once the row belongs to someone else it must not keep
             // waking the old owner, so it ends here like any other exit from the park. A repeating wait is left running:
             // it resolves its recipient from the row's current owner at delivery (evaluateQueueWait).
@@ -3031,7 +3281,7 @@ export class QueueRepository {
             this.transitionLog.append({
                 qitemId,
                 state: qitem.state,
-                actorSession: "system:queue-fallback",
+                actorSession: FALLBACK_ACTOR,
                 transitionNote: `fallback-routed: ${originalDestination} → ${fallbackDestination} (${reason})`,
                 closureTarget: qitem.state === "in-progress" ? this.retainedClaimBlocker(qitemId) : undefined,
             });
@@ -3147,12 +3397,13 @@ export class QueueRepository {
             return null;
         }
     }
-    waitingView(qitemId) {
+    /** listed: the row's owner notifications and ledger, when a listing read them for all its rows. */
+    waitingView(qitemId, listed) {
         const view = readWaitingView(this.db, qitemId, this.activityReader);
         if (view && ["pending", "in-progress"].includes(view.state)) {
             // #514 — the unclaimed sweep skips a pending ask already posted to its human in the current
             // episode (same predicate as runStuckSweep), so the view must not promise that sweep.
-            const awaitingHuman = view.state === "pending" && this.humanNotificationPostedThisEpisode(qitemId);
+            const awaitingHuman = view.state === "pending" && this.humanNotificationPostedThisEpisode(qitemId, listed);
             if (awaitingHuman) {
                 view.nextBackstop = { owner: view.owner, mechanism: "none (posted to the human; awaiting their decision)", dueAt: null, intervalSeconds: null };
             }
@@ -3166,21 +3417,14 @@ export class QueueRepository {
         return view;
     }
     handoffAdvisory(row) {
-        // handoff() creates its local successor in the same transaction. Do not
-        // scan successor history again on every projection of those source rows.
-        if (row.state === "handed-off" || !isTerminalState(row.state)
+        // Generic updates can write handed-off and retain a previous handoff's owner
+        // after reopening. Skip only when that owner still matches this closure.
+        if ((row.state === "handed-off" && matchesRecordedHandoffTarget(row.qitem_id, row.handed_off_to, row.closure_target)) || !isTerminalState(row.state)
             || row.closure_reason !== "handed_off_to" || !row.closure_target)
             return undefined;
         const target = row.closure_target;
         try {
-            const successor = this.db.prepare(`SELECT 1 FROM queue_items s
-          WHERE (s.qitem_id = ? OR s.destination_session = ?) AND s.qitem_id != ?
-            AND (s.handed_off_from = ? OR EXISTS (
-              SELECT 1 FROM json_each(s.chain_of_record) WHERE value = ?
-            )) LIMIT 1`).get(target, target, row.qitem_id, row.qitem_id, row.qitem_id);
-            // A linked row may have handed on to another owner. Its current state
-            // does not establish whether later hops still hold the work.
-            if (successor)
+            if (hasLinkedSuccessor(this.db, row.qitem_id, target))
                 return undefined;
         }
         catch {
@@ -3194,15 +3438,15 @@ export class QueueRepository {
             target,
             reason: "no-live-local-successor",
             message: foreignTarget
-                ? `Successor custody for '${target}' is unverified on this daemon: the successor is named on that host, and this daemon cannot read its custody. This closure records a handoff claim, not proof of transfer or pickup.`
-                : `Successor custody for '${target}' is unverified on this daemon: no local row with this source's lineage was found. A successor may exist on another host. This closure records a handoff claim, not proof of transfer or pickup; reconcile the successor by ID.`,
+                ? `Successor custody for '${target}' is unverified on this daemon: the successor is named on that host, and this daemon cannot read its custody. This closure records a handoff claim, not proof of transfer or pickup. Use 'rig queue handoff' or 'handoff-and-complete': a local handoff is atomic, across hosts the successor is created first and the source closed after, and an uncertain result is reconciled by its exact id, since re-running the same handoff is idempotent.`
+                : `Successor custody for '${target}' is unverified on this daemon: no local row with this source's lineage was found. A successor may exist on another host. This closure records a handoff claim, not proof of transfer or pickup; reconcile the successor by ID. Use 'rig queue handoff' or 'handoff-and-complete': a local handoff is atomic, across hosts the successor is created first and the source closed after, and an uncertain result is reconciled by its exact id, since re-running the same handoff is idempotent.`,
         };
     }
-    rowToItem(row, includeWaiting = true) {
+    rowToItem(row, includeWaiting = true, listed) {
         // S04 — derive the pickup receipt at the ONE shared projection point (list/show/overdue
         // all flow through here), so the park-vs-strand question is answered by the row face.
         const meaningful = lastMeaningfulTransition(this.db, row.qitem_id);
-        const waiting = includeWaiting ? this.waitingView(row.qitem_id) : null;
+        const waiting = includeWaiting ? this.waitingView(row.qitem_id, listed) : null;
         const activity = this.ownerActivity(row.destination_session);
         const pickup = derivePickup({
             state: row.state,
@@ -3259,6 +3503,20 @@ export class QueueRepository {
         };
     }
 }
+function ledgerItem(row) {
+    return {
+        qitemId: row.qitem_id,
+        state: row.state,
+        blockedOn: row.blocked_on,
+        destinationSession: row.destination_session,
+        tsCreated: row.ts_created,
+        lastNudgeResult: presentedNudgeResult(row.last_nudge_result, row.claimed_at),
+    };
+}
+/** A notice sent to the owner, as opposed to the resolution notice a human's own answer writes. */
+function isOutboundOwnerNotice(t) {
+    return t.ownerNotificationLevel != null && t.ownerNotificationKind != null && t.ownerNotificationKind !== "human-decision-resolved";
+}
 function isQueueState(value) {
     return typeof value === "string" && QUEUE_STATES.includes(value);
 }