@openrig/cli 0.6.4 → 0.6.5

package/daemon/dist/domain/queue-repository.js

@@ -9,12 +9,14 @@ import { lastMeaningfulTransition, readWaitingView } from "./queue-waiting.js";
 import { wrapPaneEnvelope } from "../lib/pane-envelope.js";
 import { getSelfHostId } from "./hosts/fanout-contract.js";
 import { parseSessionName, isHumanSeatSessionRef } from "./session-name.js";
+import { parseReplyToChoice, formatReplyToChoice, describeReplyToFallback, REPLY_TO_CHOICE_ACTOR } from "./reply-to-choice.js";
 import { classifyDestination } from "./gateway/destination-resolver.js";
 import { computeClosureRequiredAt, validateClosure, } from "./hot-potato-enforcer.js";
 import { isHumanSeatSession, validateHumanPark, validateHumanRoute } from "./human-route-enforcer.js";
 import { QueueWakeRepository, USAGE_LIMIT_BLOCKER_TAG, } from "./queue-wake-repository.js";
 import { WatchdogJobsRepository } from "./watchdog-jobs-repository.js";
 import { armQueueWait, backOffQueueWait, refreshQueueWaits, evaluateQueueWait, retargetQueueWait, isQueueWait } from "./queue-wait-backoff.js";
+import { parseHumanQuestions, unansweredQuestions } from "./human-questions.js";
 export const QUEUE_STATES = [
     "pending",
     "in-progress",
@@ -44,6 +46,19 @@ export const ACTIVE_QUEUE_STATES = ["pending", "in-progress", "blocked"];
 export function isBlockerLive(state) {
     return ACTIVE_QUEUE_STATES.includes(state);
 }
+/** #96 — a Slack reply routes to the item that owns the thread root, so a later update may
+ *  share that thread only while no reply there could answer a human decision. Deliberately
+ *  BROADER than what makeHumanReplyResolver resolves today (it errs toward posting top-level): any
+ *  active human-destined decision, or a row blocked on any human-class seat right now. A
+ *  resolved park returns to in-progress; blocked_on alone (which the resolve verb documents
+ *  keeping as provenance) is never a live gate. */
+export function hasLiveHumanGate(item) {
+    if (item.humanIntent === "update")
+        return false;
+    if (item.state === "blocked" && item.blockedOn && isHumanSeatSessionRef(item.blockedOn))
+        return true;
+    return isBlockerLive(item.state) && isHumanSeatSessionRef(item.destinationSession);
+}
 const AUTO_UNPARK_WAKE_TAG = "queue:auto-unpark:blocker";
 const AUTO_UNPARK_BLOCKER_TAG_PREFIX = "queue:auto-unpark:blocker-ref:";
 /** 0.5.1-53 Atom 1a — typed non-qitem gate blocker prefixes. A park may be gated on a fold / auth /
@@ -284,6 +299,7 @@ export class QueueRepository {
     db;
     transitionLog;
     eventBus;
+    destinationAdvisory;
     validateRig;
     transport;
     /** W1 (transactional closure): the durable wake-intent store. A terminal act
@@ -313,10 +329,13 @@ export class QueueRepository {
     hasTargetRepoColumn;
     hasSummaryColumn;
     hasHumanIntentColumn;
+    hasReplyToColumn;
+    hasHumanQuestionsColumn;
     hasEvidenceRefColumn;
     hasMintingGenColumn;
     hasClaimedGenColumn;
     hasQueueTransitionsTable;
+    hasTransitionProvenanceColumn;
     hasOwnerNotificationColumns;
     loadHumanRegistryFn;
     /** OPR.0.4.6.WF3 FR-6 — injected by startup (never imported): the
@@ -328,6 +347,7 @@ export class QueueRepository {
         this.transitionLog = new QueueTransitionLog(db);
         this.wakeRepo = new QueueWakeRepository(db);
         this.validateRig = opts?.validateRig ?? (() => true);
+        this.destinationAdvisory = opts?.destinationAdvisory ?? (() => null);
         this.transport = opts?.transport;
         this.workflowFrontierPredicate = opts?.workflowFrontierPredicate;
         this.resolveOccupantGeneration = opts?.resolveOccupantGeneration;
@@ -335,11 +355,14 @@ export class QueueRepository {
         this.hasTargetRepoColumn = detectQueueColumn(db, "target_repo");
         this.hasSummaryColumn = detectQueueColumn(db, "summary");
         this.hasHumanIntentColumn = detectQueueColumn(db, "human_intent");
+        this.hasReplyToColumn = detectQueueColumn(db, "reply_to");
+        this.hasHumanQuestionsColumn = detectQueueColumn(db, "human_questions");
         this.hasEvidenceRefColumn = detectQueueColumn(db, "evidence_ref");
         this.hasQueueTransitionsTable = detectTable(db, "queue_transitions");
         const transitionColumns = this.hasQueueTransitionsTable
             ? new Set(db.prepare("PRAGMA table_info(queue_transitions)").all().map((column) => column.name))
             : new Set();
+        this.hasTransitionProvenanceColumn = transitionColumns.has("identity_provenance");
         this.hasOwnerNotificationColumns = transitionColumns.has("owner_notification_kind")
             && transitionColumns.has("owner_notification_level");
         // GHOST-STAGE (e/Class-B): generation stamps (migration 063). Defensive detect so a pre-063
@@ -945,6 +968,18 @@ export class QueueRepository {
                 if (existing) {
                     if (existing.destinationSession === input.destinationSession &&
                         existing.sourceSession === input.sourceSession) {
+                        // Keep retry compatibility, but never imply that an absorbed,
+                        // different body was saved. Decide at the actual PK conflict,
+                        // rather than comparing a fresh create's post-nudge readback.
+                        if (existing.body !== input.body) {
+                            return {
+                                ...existing,
+                                createWarning: {
+                                    code: "qitem_body_not_saved",
+                                    message: `qitem ${input.qitemId} already exists with a different body. The supplied body was not saved; the existing row is returned unchanged. No new work or delivery was created.`,
+                                },
+                            };
+                        }
                         return existing;
                     }
                     throw new QueueRepositoryError("qitem_id_reuse", `qitem ${input.qitemId} already exists with a different destination/source — id reuse is a caller bug, not an idempotent retry`, {
@@ -1029,6 +1064,24 @@ export class QueueRepository {
             if (!this.hasHumanIntentColumn)
                 throw new QueueRepositoryError("invalid_human_notification", "Human notification fields require the current queue schema; they were not saved.");
         }
+        if (input.replyTo != null)
+            this.validateReplyTo(input.replyTo, input.humanIntent);
+        let humanQuestions = null;
+        if (input.humanQuestions != null) {
+            if (!isHumanSeatSessionRef(input.destinationSession)) {
+                throw new QueueRepositoryError("invalid_human_questions", "humanQuestions require a human destination: only a human can click the options.");
+            }
+            // Omitted intent is a decision (legacy behavior), so it may carry questions too.
+            if (input.humanIntent === "update") {
+                throw new QueueRepositoryError("invalid_human_questions", "humanQuestions are refused on an update: they ask the human to decide. Use humanIntent decision.");
+            }
+            const parsed = parseHumanQuestions(input.humanQuestions);
+            if (!parsed.ok)
+                throw new QueueRepositoryError("invalid_human_questions", parsed.error);
+            if (!this.hasHumanQuestionsColumn)
+                throw new QueueRepositoryError("invalid_human_questions", "humanQuestions require the current queue schema; they were not saved.");
+            humanQuestions = parsed.questions;
+        }
         const id = input.qitemId ?? newQitemId();
         const ts = new Date().toISOString();
         const priority = input.priority ?? "routine";
@@ -1061,6 +1114,12 @@ export class QueueRepository {
             this.db.prepare("UPDATE queue_items SET human_intent = ?, human_detail = ? WHERE qitem_id = ?")
                 .run(input.humanIntent ?? null, input.humanDetail ?? null, id);
         }
+        if (input.replyTo != null) {
+            this.db.prepare("UPDATE queue_items SET reply_to = ? WHERE qitem_id = ?").run(input.replyTo, id);
+        }
+        if (humanQuestions) {
+            this.db.prepare("UPDATE queue_items SET human_questions = ? WHERE qitem_id = ?").run(JSON.stringify(humanQuestions), id);
+        }
         this.persistMintingGeneration(id, input.sourceSession);
         const notification = this.classifyOwnerNotification({
             action: "create",
@@ -1088,6 +1147,17 @@ export class QueueRepository {
         });
         return { qitemId: id, persistedEvent };
     }
+    validateReplyTo(replyTo, humanIntent) {
+        if (humanIntent !== "update") {
+            throw new QueueRepositoryError("reply_to_requires_update", "replyTo is accepted only with humanIntent update; a decision keeps its own thread so its reply stays unambiguous.");
+        }
+        if (!this.hasReplyToColumn)
+            throw new QueueRepositoryError("invalid_human_notification", "replyTo requires the current queue schema; it was not saved.");
+        if (!this.getById(replyTo))
+            throw new QueueRepositoryError("reply_to_not_found", `replyTo names no qitem on this host: ${replyTo}.`);
+        // An item with a live human gate or no usable root is not refused here: delivery posts
+        // the update top-level and records why (deriveReplyToChoice in slack-subsystem).
+    }
     /**
      * Transactional handoff: close the source qitem (state=done,
      * closure_reason=handed_off_to) and create a new qitem owned by `toSession`,
@@ -1902,7 +1972,9 @@ export class QueueRepository {
             }
             const oldWake = this.wakeRepo.getStatus(input.qitemId);
             const job = armQueueWait(this.db, jobsRepo, {
-                previousJobId: oldWake?.kind === "timer" ? oldWake.ref : undefined,
+                // Reusing a shared job would rewrite the attachment's schedule and packet.
+                previousJobId: oldWake?.kind === "timer" && this.wakeRepo.findLiveQitemsByAttachedWatchdog(oldWake.ref).length === 0
+                    ? oldWake.ref : undefined,
                 qitemId: input.qitemId, blocker: effectiveBlockedOn,
                 evidence: input.wakeProgressEvidence,
                 initialSeconds: input.wakeAfterSeconds, maxSeconds: input.wakeMaxSeconds,
@@ -2092,6 +2164,10 @@ export class QueueRepository {
         const armed = this.wakeRepo.getStatus(qitemId);
         if (armed?.kind !== "timer" || !armed.live)
             return;
+        // An explicit --wake-watchdog attachment gives another continuation custody
+        // of this same job. The timer row's exit cannot cancel that attachment.
+        if (this.wakeRepo.findLiveQitemsByAttachedWatchdog(armed.ref).length > 0)
+            return;
         (this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db)).markTerminal(armed.ref, reason);
     }
     propagateBlockerCompletion(input) {
@@ -2172,23 +2248,13 @@ export class QueueRepository {
     currentParkTimerIds() {
         return this.wakeRepo.currentParkTimerIds();
     }
-    /** Refuse a legacy park-generated timer only when every row bound to it is
-     *  terminal. Current exits retire these timers transactionally; this is the
-     *  delivery-seam backstop for residue persisted by an older daemon. A timer
-     *  still bound to any actionable row, and every operator-attached watchdog,
-     *  remains deliverable. */
+    /** Generated jobs end when neither their original park nor an unfired
+     *  attachment still owns them. Standalone operator jobs keep their lifecycle. */
     resolveWatchdogPreDeliveryTerminalReason(jobId) {
         const targets = this.wakeRepo.findQitemsByGeneratedTimer(jobId);
-        if (targets.length === 0 || targets.some(({ state }) => !isTerminalState(state)))
+        if (targets.length === 0 || this.wakeRepo.findCurrentQitemsByGeneratedTimer(jobId).length > 0)
             return null;
-        // Ownership, not just staleness. This backstop may retire a job only when
-        // the job is SOLELY a park-generated timer. `--wake-watchdog` can attach an
-        // operator row to the very job another row's `--wake-after` produced, and
-        // that is a supported path — so a shared job carries a second, watchdog-kind
-        // binding this reason has no authority over. The timer's rows being terminal
-        // says nothing about the attachment; claiming the job anyway terminals it
-        // before transport and the attachment can never wake.
-        if (this.wakeRepo.findQitemsByAttachedWatchdog(jobId).length > 0)
+        if (this.wakeRepo.findLiveQitemsByAttachedWatchdog(jobId).length > 0)
             return null;
         return "park_timer_target_terminal";
     }
@@ -2208,9 +2274,11 @@ export class QueueRepository {
      *  audited. The queue transition records that attempt independently of
      *  whether the HELD row's owner consumed it. */
     recordWatchdogWakeAttempt(jobId, deliveryStatus) {
-        const targets = this.wakeRepo.findBlockedQitemsByWatchdog(jobId);
-        if (targets.length === 0)
+        const bindings = this.wakeRepo.findBlockedQitemsByWatchdog(jobId);
+        if (bindings.length === 0)
             return;
+        // Both receipt ownership and timer lifecycle follow the current park.
+        const targets = this.wakeRepo.findBlockedQitemsByWatchdog(jobId, true);
         const recordFired = ({ qitemId, kind }) => {
             const transition = this.transitionLog.append({
                 qitemId,
@@ -2248,7 +2316,7 @@ export class QueueRepository {
         // behaviour is UNCHANGED by this repair and pinned as unchanged. This widens
         // the same act to ordinary park timers, without their blocker resolution —
         // resolving the blocker is a provider-limit outcome, not a timer one.
-        const parkGeneratedTimer = targets.some(({ kind }) => kind === "timer");
+        const parkGeneratedTimer = this.wakeRepo.findCurrentQitemsByGeneratedTimer(jobId).length > 0;
         const events = this.db.transaction(() => {
             const firedEvents = targets.map(recordFired);
             if (deliveryStatus === "retained")
@@ -2272,6 +2340,38 @@ export class QueueRepository {
         for (const event of events)
             this.eventBus.notifySubscribers(event);
     }
+    /**
+     * #193 — record one clicked answer on a pending decision that carries structured questions.
+     * Only the decision's own human may answer, and only while it is pending. A click may change
+     * an earlier answer until the set is complete; from then on the answers are FINAL, and any
+     * further click returns them unchanged so the caller can retry the continuation (reply row +
+     * resolve) with exactly what the seat will read. Anything else is not-applicable (a forged
+     * id, a stranger, a decision already resolved), never an error the socket must retry.
+     */
+    recordHumanAnswer(input) {
+        if (!this.hasHumanQuestionsColumn)
+            return { status: "not-applicable", reason: "schema" };
+        return this.db.transaction(() => {
+            const item = this.getById(input.qitemId);
+            if (!item?.humanQuestions?.length)
+                return { status: "not-applicable", reason: "no-questions" };
+            if (item.state !== "pending")
+                return { status: "not-applicable", reason: `state-${item.state}` };
+            if (item.destinationSession !== input.actorSession)
+                return { status: "not-applicable", reason: "not-the-asked-human" };
+            const question = item.humanQuestions.find((q) => q.id === input.questionId);
+            if (!question?.options.some((o) => o.id === input.optionId))
+                return { status: "not-applicable", reason: "unknown-option" };
+            const recorded = item.humanAnswers ?? {};
+            if (unansweredQuestions(item.humanQuestions, recorded).length === 0) {
+                return { status: "recorded", answers: recorded, complete: true, questions: item.humanQuestions };
+            }
+            const answers = { ...(item.humanAnswers ?? {}), [input.questionId]: input.optionId };
+            this.db.prepare("UPDATE queue_items SET human_answers = ? WHERE qitem_id = ?").run(JSON.stringify(answers), input.qitemId);
+            const complete = unansweredQuestions(item.humanQuestions, answers).length === 0;
+            return { status: "recorded", answers, complete, questions: item.humanQuestions };
+        })();
+    }
     getById(qitemId) {
         const row = this.db
             .prepare("SELECT * FROM queue_items WHERE qitem_id = ?")
@@ -2286,8 +2386,36 @@ export class QueueRepository {
             ...item,
             deliveryOutcome: ledger?.outcome ?? null,
             ...(ledger && ledger.outcome !== "posted" ? { deliveryFailureDetail: ledger.detail } : {}),
+            ...(item.replyTo ? { replyToFallback: this.replyToFallbackFor(item.qitemId) } : {}),
         };
     }
+    /** #96 — the thread choice the daemon recorded before this replyTo update's first post;
+     *  null = not yet chosen. Only an in-process daemon write counts: any HTTP write carries an
+     *  identity provenance (and its actor is caller-asserted), so a note from there could forge
+     *  a thread and is ignored. */
+    replyToChoiceFor(qitemId) {
+        for (const t of this.transitionLog.listForQitem(qitemId).reverse()) {
+            if (t.actorSession !== REPLY_TO_CHOICE_ACTOR || t.identityProvenance !== null)
+                continue;
+            const choice = parseReplyToChoice(t.transitionNote ?? "");
+            if (choice)
+                return choice;
+        }
+        return null;
+    }
+    /** #96 — whether some update recorded this Slack root as the thread it posts into. Such a
+     *  root is shared: its owner's next decision must not reuse it (see slack-subsystem). */
+    isReplyToThread(threadTs) {
+        if (!this.hasQueueTransitionsTable)
+            return false;
+        // Same trust rule as replyToChoiceFor: a pre-provenance schema reads every row as null.
+        const provenance = this.hasTransitionProvenanceColumn ? " AND identity_provenance IS NULL" : "";
+        return this.db.prepare(`SELECT 1 FROM queue_transitions WHERE transition_note = ? AND actor_session = ?${provenance} LIMIT 1`).get(formatReplyToChoice({ kind: "thread", threadTs }), REPLY_TO_CHOICE_ACTOR) !== undefined;
+    }
+    replyToFallbackFor(qitemId) {
+        const choice = this.replyToChoiceFor(qitemId);
+        return choice?.kind === "fallback" ? describeReplyToFallback(choice) : null;
+    }
     list(opts) {
         const limit = opts?.limit ?? 100;
         const conditions = [];
@@ -2479,6 +2607,57 @@ export class QueueRepository {
         const rows = this.db.prepare(sql).all(...params);
         return rows.map((r) => this.rowToItem(r, !opts?.compact));
     }
+    /**
+     * Record that an in-progress queue item has exceeded its closure_required_at
+     * deadline, appending a transition note and emitting `qitem.closure_overdue`.
+     *
+     * Deduplicated: if this obligation has already recorded `closure-overdue`
+     * since it was claimed (or created), no duplicate event or transition is emitted.
+     */
+    recordClosureOverdue(qitemId, opts) {
+        const qitem = this.getById(qitemId);
+        if (!qitem || qitem.state !== "in-progress" || !qitem.closureRequiredAt)
+            return null;
+        const cutoff = opts?.now ?? new Date().toISOString();
+        if (qitem.closureRequiredAt > cutoff)
+            return null;
+        const claimSince = qitem.claimedAt ?? qitem.tsCreated;
+        if (this.hasQueueTransitionsTable) {
+            const alreadyRecorded = this.db.prepare(`SELECT 1 FROM queue_transitions WHERE qitem_id = ? AND transition_note = 'closure-overdue' AND ts >= ? LIMIT 1`).get(qitemId, claimSince);
+            if (alreadyRecorded)
+                return null;
+            if (detectTable(this.db, "queue_transitions_archive")) {
+                const alreadyRecordedArchive = this.db.prepare(`SELECT 1 FROM queue_transitions_archive WHERE qitem_id = ? AND transition_note = 'closure-overdue' AND ts >= ? LIMIT 1`).get(qitemId, claimSince);
+                if (alreadyRecordedArchive)
+                    return null;
+            }
+        }
+        else {
+            const alreadyRecorded = this.db.prepare(`SELECT 1 FROM events WHERE type = 'qitem.closure_overdue' AND json_extract(payload, '$.qitemId') = ? AND julianday(created_at) >= julianday(?) LIMIT 1`).get(qitemId, claimSince);
+            if (alreadyRecorded)
+                return null;
+        }
+        const txn = this.db.transaction(() => {
+            if (this.hasQueueTransitionsTable) {
+                this.transitionLog.append({
+                    qitemId,
+                    state: qitem.state,
+                    actorSession: "daemon@system",
+                    transitionNote: "closure-overdue",
+                });
+            }
+            return this.eventBus.persistWithinTransaction({
+                type: "qitem.closure_overdue",
+                qitemId,
+                destinationSession: qitem.destinationSession,
+                closureRequiredAt: qitem.closureRequiredAt,
+                overdueSince: qitem.closureRequiredAt,
+            });
+        });
+        const persisted = txn();
+        this.eventBus.notifySubscribers(persisted);
+        return persisted;
+    }
     /**
      * Surface two evidence-backed undelivered classes: the original pending
      * create-path nudge failures, and active human-notification episodes whose
@@ -2588,18 +2767,37 @@ export class QueueRepository {
     }
     /** Null means legacy/no OWNER history; inactive means OWNER history exists
      *  but the row no longer projects a current human-notification episode. */
-    currentDeliveryEpisode(item) {
-        const transition = this.transitionLog.latestOwnerNotificationForQitem(item.qitemId);
+    currentDeliveryEpisode(item, knownOwner) {
+        let transition = knownOwner ?? this.transitionLog.latestOwnerNotificationForQitem(item.qitemId);
         if (!transition)
             return null;
+        // A human-decision-resolved notice written BY the transition that closed the row (a human's direct reply closing
+        // it) is never posted: the Slack outbound lists active rows only (listHumanAlerts), and that human just answered.
+        // It opens no new delivery episode; the delivery that happened is the latest OUTBOUND notice's, to that human.
+        // Judged by the notice's own transition, not the row's current state: a resolved notice written while the row
+        // stayed active is a real delivery and keeps its outcome after an agent later closes the row.
+        let resolvedBy = null;
+        if (transition.ownerNotificationKind === "human-decision-resolved" && !["pending", "in-progress", "blocked"].includes(transition.state)) {
+            const outbound = this.transitionLog.listForQitem(item.qitemId)
+                .filter((t) => t.ownerNotificationLevel != null && t.ownerNotificationKind != null && t.ownerNotificationKind !== "human-decision-resolved")
+                .sort((a, b) => b.transitionId - a.transitionId)[0];
+            if (!outbound)
+                return "inactive";
+            resolvedBy = transition.actorSession;
+            transition = outbound;
+        }
         const registry = this.loadHumanRegistryFn();
         if (!registry.ok)
             return "inactive";
-        const humanAddress = transition.ownerNotificationKind === "human-decision-resolved"
-            ? resolveRegisteredHumanAddress(transition.actorSession, registry.entities)
-            : item.state === "blocked"
-                ? resolveRegisteredHumanAddress(item.blockedOn, registry.entities)
-                : resolveRegisteredHumanAddress(item.destinationSession, registry.entities);
+        // After that fallback the recipient is the human who answered: the row may be an agent's that was parked on them
+        // (its destination is the agent, and closing cleared blocked_on).
+        const humanAddress = resolvedBy !== null
+            ? resolveRegisteredHumanAddress(resolvedBy, registry.entities)
+            : transition.ownerNotificationKind === "human-decision-resolved"
+                ? resolveRegisteredHumanAddress(transition.actorSession, registry.entities)
+                : item.state === "blocked"
+                    ? resolveRegisteredHumanAddress(item.blockedOn, registry.entities)
+                    : resolveRegisteredHumanAddress(item.destinationSession, registry.entities);
         return humanAddress
             ? { notificationKey: `${item.qitemId}:${transition.transitionId}`, startedAt: transition.ts }
             : "inactive";
@@ -2609,6 +2807,32 @@ export class QueueRepository {
      *  posted receipt cannot mask a later human park. Legacy pre-OWNER or literal
      *  external rows retain their row-scoped fallback. */
     deliveryOutcomeFor(qitemId) {
+        const ledger = this.deliveryLedger(qitemId);
+        return ledger ? { outcome: ledger.outcome, detail: ledger.detail } : null;
+    }
+    /** #514 — true only when this row's CURRENT human-notification episode (OWNER history addressed
+     *  to a registered human, aliases included) has a POSTED receipt. Legacy rows with no OWNER
+     *  history, inactive episodes, never-posted and transport-failed all read false. Same derivation
+     *  as deliveryOutcomeFor; it reads row fields, never the waiting view. */
+    humanNotificationPostedThisEpisode(qitemId) {
+        if (!this.hasQueueTransitionsTable)
+            return false;
+        // Only the ask's own notification binds a recipient: create writes it in state pending, to the destination of
+        // that moment. A park notice (its recipient is not retained), a resolution notice, or a later destination change
+        // (routeToFallback opens no new episode) cannot establish that the current destination received this ask.
+        const owner = this.transitionLog.latestOwnerNotificationForQitem(qitemId);
+        if (!owner || owner.state !== "pending")
+            return false;
+        if (owner.ownerNotificationKind !== "human-required" && owner.ownerNotificationKind !== "human-update")
+            return false;
+        const rerouted = this.db.prepare("SELECT 1 FROM queue_transitions WHERE qitem_id = ? AND transition_id > ? AND transition_note LIKE 'fallback-routed:%' LIMIT 1").get(qitemId, owner.transitionId);
+        if (rerouted)
+            return false;
+        // The ledger's episode exists only when the destination resolves to a registered human (aliases included).
+        const ledger = this.deliveryLedger(qitemId, owner);
+        return ledger !== null && ledger.outcome === "posted" && ledger.episode?.notificationKey === `${qitemId}:${owner.transitionId}`;
+    }
+    deliveryLedger(qitemId, knownOwner) {
         // Some repository-only fixtures intentionally model the pre-transition
         // schema. Delivery projection is additive there: absence means no verdict,
         // never a list failure.
@@ -2621,7 +2845,7 @@ export class QueueRepository {
         // The delivery episode uses row fields, not the waiting/backstop view.
         // Keep this read fresh without repeating the caller's recovery-tag scan.
         const item = this.rowToItem(row, false);
-        const episodeState = this.currentDeliveryEpisode(item);
+        const episodeState = this.currentDeliveryEpisode(item, knownOwner);
         if (episodeState === "inactive")
             return null;
         const episode = episodeState;
@@ -2634,17 +2858,17 @@ export class QueueRepository {
             : notes;
         const posted = currentNotes.find((note) => note.transition_note.startsWith("slack-owner-notification-posted "));
         if (posted)
-            return { outcome: "posted", detail: posted.transition_note };
+            return { outcome: "posted", detail: posted.transition_note, episode };
         const failed = currentNotes.find((note) => note.transition_note.startsWith("slack-owner-notification-transport-failed "));
         if (failed)
-            return { outcome: "transport-failed", detail: failed.transition_note };
+            return { outcome: "transport-failed", detail: failed.transition_note, episode };
         const startedAt = episode?.startedAt ?? item.tsCreated;
         const gatewayRouted = episode !== null || item.lastNudgeResult?.startsWith("gateway-owned") === true;
         if (gatewayRouted) {
             const ageMs = Date.now() - new Date(startedAt.includes("T") ? startedAt : startedAt + "Z").getTime();
             if (ageMs > QueueRepository.NEVER_POSTED_WINDOW_MS) {
                 const key = episode ? ` for notification_key=${episode.notificationKey}` : "";
-                return { outcome: "never-posted", detail: `gateway-routed row with no delivery receipt${key} past the post window` };
+                return { outcome: "never-posted", detail: `gateway-routed row with no delivery receipt${key} past the post window`, episode };
             }
         }
         return null;
@@ -2782,10 +3006,9 @@ export class QueueRepository {
     workflowGuidance;
     attachWorkflowGuidance(reader) { this.workflowGuidance = reader; }
     evaluateWaitReminder(input) {
-        if (this.wakeRepo.findQitemsByAttachedWatchdog(input.jobId).length > 0
-            && this.wakeRepo.findQitemsByGeneratedTimer(input.jobId).every(row => row.state !== "blocked"))
+        const binding = this.wakeRepo.findCurrentQitemsByGeneratedTimer(input.jobId)[0];
+        if (!binding && this.wakeRepo.findLiveQitemsByAttachedWatchdog(input.jobId).length > 0)
             return null;
-        const binding = this.wakeRepo.findBlockedQitemsByWatchdog(input.jobId).find(row => row.kind === "timer");
         const result = evaluateQueueWait(this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db), input.jobId, binding ? this.waitingView(binding.qitemId) : null);
         // Only an already-admitted send reads prose: healthy silence, receipts and
         // failed-delivery retries remain owned by the existing wait evaluator.
@@ -2810,14 +3033,54 @@ export class QueueRepository {
     waitingView(qitemId) {
         const view = readWaitingView(this.db, qitemId, this.activityReader);
         if (view && ["pending", "in-progress"].includes(view.state)) {
+            // #514 — the unclaimed sweep skips a pending ask already posted to its human in the current
+            // episode (same predicate as runStuckSweep), so the view must not promise that sweep.
+            const awaitingHuman = view.state === "pending" && this.humanNotificationPostedThisEpisode(qitemId);
+            if (awaitingHuman) {
+                view.nextBackstop = { owner: view.owner, mechanism: "none (posted to the human; awaiting their decision)", dueAt: null, intervalSeconds: null };
+            }
             const recovery = readWakeLadderBackstop(this.db, qitemId);
             if (recovery) {
-                view.laterBackstop = { ...view.nextBackstop, note: "Conditional safety net; current delivery/recovery ownership is evaluated first." };
+                if (!awaitingHuman)
+                    view.laterBackstop = { ...view.nextBackstop, note: "Conditional safety net; current delivery/recovery ownership is evaluated first." };
                 view.nextBackstop = recovery;
             }
         }
         return view;
     }
+    handoffAdvisory(row) {
+        // handoff() creates its local successor in the same transaction. Do not
+        // scan successor history again on every projection of those source rows.
+        if (row.state === "handed-off" || !isTerminalState(row.state)
+            || row.closure_reason !== "handed_off_to" || !row.closure_target)
+            return undefined;
+        const target = row.closure_target;
+        try {
+            const successor = this.db.prepare(`SELECT 1 FROM queue_items s
+          WHERE (s.qitem_id = ? OR s.destination_session = ?) AND s.qitem_id != ?
+            AND (s.handed_off_from = ? OR EXISTS (
+              SELECT 1 FROM json_each(s.chain_of_record) WHERE value = ?
+            )) LIMIT 1`).get(target, target, row.qitem_id, row.qitem_id, row.qitem_id);
+            // A linked row may have handed on to another owner. Its current state
+            // does not establish whether later hops still hold the work.
+            if (successor)
+                return undefined;
+        }
+        catch {
+            // Optional reporting must not fail a close that has already committed,
+            // or describe an unavailable lookup as proof of a missing local row.
+            return undefined;
+        }
+        const foreignTarget = /^qitem-[^@]+@[^@]+$/.test(target);
+        return {
+            status: "unverified",
+            target,
+            reason: "no-live-local-successor",
+            message: foreignTarget
+                ? `Successor custody for '${target}' is unverified on this daemon: the successor is named on that host, and this daemon cannot read its custody. This closure records a handoff claim, not proof of transfer or pickup.`
+                : `Successor custody for '${target}' is unverified on this daemon: no local row with this source's lineage was found. A successor may exist on another host. This closure records a handoff claim, not proof of transfer or pickup; reconcile the successor by ID.`,
+        };
+    }
     rowToItem(row, includeWaiting = true) {
         // S04 — derive the pickup receipt at the ONE shared projection point (list/show/overdue
         // all flow through here), so the park-vs-strand question is answered by the row face.
@@ -2833,7 +3096,9 @@ export class QueueRepository {
             lastHeartbeat: row.last_heartbeat,
             postClaimMotionCount: 0, // this reader supplies the current meaningful timestamp
         });
+        const handoffAdvisory = this.handoffAdvisory(row);
         return {
+            ...(handoffAdvisory ? { handoffAdvisory } : {}),
             pickup,
             ...(waiting ? { waiting } : {}),
             qitemId: row.qitem_id,
@@ -2859,6 +3124,9 @@ export class QueueRepository {
             evidenceRef: row.evidence_ref ?? null,
             humanIntent: row.human_intent ?? null,
             humanDetail: row.human_detail ?? null,
+            replyTo: row.reply_to ?? null,
+            humanQuestions: row.human_questions ? JSON.parse(row.human_questions) : null,
+            humanAnswers: row.human_answers ? JSON.parse(row.human_answers) : null,
             closureReason: row.closure_reason,
             closureTarget: row.closure_target,
             closureRequiredAt: row.closure_required_at,