@openrig/cli 0.7.0 → 0.7.1

package/daemon/dist/domain/queue-repository.js

@@ -1,13 +1,15 @@
 import { PROMPT_ALERT_TAG, readWakeLadderBackstop } from "./queue-wake-ladder.js";
+import { withUrgentLine } from "./urgent-line.js";
 import { quietCustodyBackstop, quietHoldCustody } from "./quiet-hold-custody.js";
 import { createHash } from "node:crypto";
-import { loadHumanRegistry, resolveRegisteredHumanAddress } from "./gateway/human-registry.js";
+import { loadHumanRegistry, resolveRegisteredHumanAddress, slackSubscriptionFor, withHumanAlertTag } from "./gateway/human-registry.js";
 import { resolveExternal } from "./gateway/external-admission.js";
 import { QueueTransitionLog } from "./queue-transition-log.js";
 import { WAKE_INTENT_PREFIX } from "./outbox-handler.js";
 import { derivePickup } from "./queue-pickup.js";
 import { lastMeaningfulTransition, readWaitingView } from "./queue-waiting.js";
 import { wrapPaneEnvelope } from "../lib/pane-envelope.js";
+import { isBoundTerminalSeat } from "./terminal-seat.js";
 import { renderQueueHandoffNudge } from "./queue-nudge-text.js";
 import { getSelfHostId } from "./hosts/fanout-contract.js";
 import { parseSessionName, isHumanSeatSessionRef } from "./session-name.js";
@@ -63,6 +65,10 @@ export function hasLiveHumanGate(item) {
     return isBlockerLive(item.state) && isHumanSeatSessionRef(item.destinationSession);
 }
 const AUTO_UNPARK_WAKE_TAG = "queue:auto-unpark:blocker";
+/** A durable wake OpenRig's own scheduling triggered (an auto-unpark, a row OpenRig creates), not an agent's create or
+ *  handoff: it keeps that source when it's replayed later. Send, broadcast, queue create and the cross-host forward never
+ *  set it from a request; the trusted local outbox recorder (/api/queue/outbox/record) accepts caller tags by design. */
+const WAKE_TRIGGER_OPENRIG_TAG = "queue:wake-trigger:openrig";
 const AUTO_UNPARK_BLOCKER_TAG_PREFIX = "queue:auto-unpark:blocker-ref:";
 /** The actor on the transition routeToFallback writes; the row's own history is how a later reroute finds the line it wrote. */
 const FALLBACK_ACTOR = "system:queue-fallback";
@@ -125,33 +131,15 @@ export function classifyNudgeFailure(lastNudgeResult) {
     return "unknown";
 }
 export const QUEUE_PRIORITIES = ["routine", "urgent", "critical"];
-/** #1278: reject incomplete or invalid readings and keep only the four diagnostic fields. */
-function inputBoxReading(inputBox) {
-    if (!inputBox || typeof inputBox !== "object")
-        return undefined;
-    const { seat, before, after, sameProcess } = inputBox;
-    if (!["idle", "not-idle", "unknown", "unchecked"].includes(seat) || typeof sameProcess !== "boolean")
-        return undefined;
-    const readings = ["exact", "ambiguous", "empty", "queued", "hidden", "other", "unrecognized", "unavailable", "unchecked"];
-    if (!readings.includes(before) || !readings.includes(after))
-        return undefined;
-    return { seat, before, after, sameProcess };
-}
-/** #1278: read a stored reading back; an absent or unreadable value reads unknown (null). The
- *  reading carries its attempt's timestamp (`at`), and reads unknown unless that is still the row's
- *  latest attempt: an older daemon records an attempt without touching this column, so a reading
- *  left behind by an earlier attempt must not read as the latest one's. */
-function parseNudgeInputBox(stored, lastAttempt) {
-    if (!stored || !lastAttempt)
-        return null;
-    try {
-        const parsed = JSON.parse(stored);
-        if (parsed?.at !== lastAttempt)
-            return null;
-        return inputBoxReading(parsed) ?? null;
+/** Adds the handoff-successor and updated-since filters both list paths share. */
+function pushFollowThroughFilters(opts, conditions, params) {
+    if (opts?.handedOffFrom) {
+        conditions.push("handed_off_from = ?");
+        params.push(opts.handedOffFrom);
     }
-    catch {
-        return null;
+    if (opts?.updatedSince) {
+        conditions.push("ts_updated >= ?");
+        params.push(opts.updatedSince);
     }
 }
 /** The message a `--wake-after` park timer carries when its owner gives none. */
@@ -292,7 +280,6 @@ function detectTable(db, tableName) {
 // and named in fieldsElided, never backfilled as empty.
 const COMPACT_ELIDED_FIELDS = [
     "body", "evidenceRef", "humanDetail", "waiting", "chainOfRecord", "replyTo", "humanQuestions", "humanAnswers", "delegatedDecision",
-    "lastNudgeInputBox",
 ];
 function compactRow(item) {
     const row = { ...item, fieldsElided: [...COMPACT_ELIDED_FIELDS] };
@@ -453,8 +440,6 @@ export class QueueRepository {
     hasHumanQuestionsColumn;
     hasDelegatedDecisionColumn;
     hasEvidenceRefColumn;
-    /** #1278 — migration 116; older fixtures without it record no reading. */
-    hasNudgeInputBoxColumn;
     hasMintingGenColumn;
     hasClaimedGenColumn;
     hasQueueTransitionsTable;
@@ -484,7 +469,6 @@ export class QueueRepository {
         this.hasHumanQuestionsColumn = detectQueueColumn(db, "human_questions");
         this.hasDelegatedDecisionColumn = detectQueueColumn(db, "delegated_decision");
         this.hasEvidenceRefColumn = detectQueueColumn(db, "evidence_ref");
-        this.hasNudgeInputBoxColumn = detectQueueColumn(db, "last_nudge_input_box");
         this.hasQueueTransitionsTable = detectTable(db, "queue_transitions");
         const transitionColumns = this.hasQueueTransitionsTable
             ? new Set(db.prepare("PRAGMA table_info(queue_transitions)").all().map((column) => column.name))
@@ -561,23 +545,30 @@ export class QueueRepository {
             .get(entry.auditPointer);
         return expected === latest?.transition_id;
     }
+    /** A wake's source and urgency at the seat's level: the trigger decides the source; the row's priority (urgent or
+     *  critical) makes it urgent, marked by whoever created the row. */
+    wakeAdmission(qitemId, trigger) {
+        const row = this.getById(qitemId);
+        const urgent = row?.priority === "urgent" || row?.priority === "critical";
+        // OpenRig's own row is marked urgent by OpenRig, not by the person whose obligation it's about.
+        return { source: trigger, urgent, ...(urgent && row ? { urgentBy: trigger === "openrig" ? "OpenRig" : row.sourceSession } : {}) };
+    }
     classifyWakeResult(res) {
-        // #1278: the reading rides along unchanged; it never alters the classification.
-        const inputBox = inputBoxReading(res.inputBox);
-        const reading = inputBox ? { inputBox } : {};
+        // Held by the seat's hold or interruption level (on purpose; a retry is held again) is the typing guard's; any other
+        // retention is the draft-aware delivery's (a draft, an unreadable input, a native prompt), which can clear.
         if (res.outcome === "retained")
-            return { classified: "retained", nudgeResult: res.reason?.startsWith("draft_")
-                    ? "retained:draft_aware" : "retained:typing_guard", ...reading };
+            return { classified: "retained", nudgeResult: res.reason === "typing_guard_enabled"
+                    ? "retained:typing_guard" : "retained:draft_aware" };
         if (res.ok)
-            return res.verified ? { classified: "verified", nudgeResult: "verified", ...reading } : { classified: "indeterminate", nudgeResult: "delivered-ack-pending", ...reading };
+            return res.verified ? { classified: "verified", nudgeResult: "verified" } : { classified: "indeterminate", nudgeResult: "delivered-ack-pending" };
         const detail = res.error ?? res.reason ?? "unknown";
         // Input evidence survives receipt removal: an issued paste or uncertain Enter is never an unsent failure.
         const inputUncertain = res.sent === true || res.inputPhase === "attempted" || res.inputPhase === "written"
             || (res.sent !== false && res.inputPhase !== "not_reached" && (res.reason === "delivery_indeterminate" || res.reason === "submit_failed"));
         if (inputUncertain || isWakeTimeoutSignal(res.reason) || isWakeTimeoutSignal(res.error)) {
-            return { classified: "indeterminate", nudgeResult: `indeterminate:${detail}`, ...reading };
+            return { classified: "indeterminate", nudgeResult: `indeterminate:${detail}` };
         }
-        return { classified: "failed", nudgeResult: `failed:${detail}`, ...reading };
+        return { classified: "failed", nudgeResult: `failed:${detail}` };
     }
     /**
      * W1 (transactional closure): attach the durable wake-intent store AFTER
@@ -611,9 +602,13 @@ export class QueueRepository {
             return { kind: "human-required", level: "ALERT" };
         const destinationHuman = resolveRegisteredHumanAddress(input.destinationSession, registry.entities);
         if (input.action === "create" && destinationHuman !== null) {
+            // The person's Slack subscription decides: `every-ask` (the default) posts every ask (ALERT); `urgent-only` posts only
+            // one marked --alert, and a plain ask lands on Steering and the TUI (RECORD: below the posting dial, so no post is owed).
+            const person = registry.entities.find((entity) => entity.address === destinationHuman);
+            const posts = input.humanAlert === true || slackSubscriptionFor(person).preset === "every-ask";
             return input.humanIntent === "update"
                 ? { kind: "human-update", level: "NOTICE" }
-                : { kind: "human-required", level: "ALERT" };
+                : { kind: "human-required", level: posts ? "ALERT" : "RECORD" };
         }
         return null;
     }
@@ -635,7 +630,7 @@ export class QueueRepository {
      * `nudge:false` intends no wake ⇒ no intent. A missing outbox is enforced by the
      * guard (fail-closed, MF2), not silently skipped here.
      */
-    stageWakeIntent(successorQitemId, fromSession, toSession, identityProvenance, nudge) {
+    stageWakeIntent(successorQitemId, fromSession, toSession, identityProvenance, nudge, trigger = "agent") {
         // No wake intended (nudge:false) ⇒ no durable intent to make durable. The
         // W1-c guard is nudge-aware for the same reason: absence of an intent is a
         // defect only when a wake WAS intended.
@@ -651,7 +646,9 @@ export class QueueRepository {
             toSession,
             identityProvenance,
             bareBody: renderQueueHandoffNudge(successorQitemId, successor?.summary),
-            tags: successor?.handedOffFrom ? [`queue:return:${successor.handedOffFrom}`] : undefined,
+            tags: successor?.handedOffFrom || trigger === "openrig"
+                ? [...(successor?.handedOffFrom ? [`queue:return:${successor.handedOffFrom}`] : []), ...(trigger === "openrig" ? [WAKE_TRIGGER_OPENRIG_TAG] : [])]
+                : undefined,
         });
     }
     recordWakeIntent(input) {
@@ -662,11 +659,15 @@ export class QueueRepository {
         const stampISO = new Date().toISOString();
         const genUuid = this.resolveOccupantGeneration?.(input.fromSession) ?? undefined;
         const frozenEnvelope = wrapPaneEnvelope(input.fromSession, input.toSession, input.bareBody, { stampISO, genUuid });
+        const admission = this.wakeAdmission(input.auditPointer, input.tags?.includes(WAKE_TRIGGER_OPENRIG_TAG) ? "openrig" : "agent");
+        // An urgent wake's frozen body carries the line naming who marked it, so a person reading it held sees it too; the
+        // transport won't add it a second time when it's delivered.
         const record = {
             outboxId: input.outboxId, senderSession: input.fromSession, destinationSession: input.toSession,
-            body: frozenEnvelope, tags: input.tags, auditPointer: input.auditPointer, identityProvenance: input.identityProvenance,
+            body: admission.urgentBy ? withUrgentLine(frozenEnvelope, admission.urgentBy) : frozenEnvelope, tags: input.tags, auditPointer: input.auditPointer, identityProvenance: input.identityProvenance,
+            ...(admission.urgent ? { urgency: "urgent" } : {}),
         };
-        const target = this.transport?.retentionTarget?.(input.toSession);
+        const target = this.transport?.retentionTarget?.(input.toSession, admission);
         if (target)
             this.outbox.retain(record, target);
         else {
@@ -691,7 +692,7 @@ export class QueueRepository {
             toSession: input.destinationSession,
             identityProvenance: input.identityProvenance,
             bareBody: `Blocker ${input.blockerQitemId} resolved; parked qitem ${input.qitemId} is pending. Resume the recorded continuation and update the row.`,
-            tags: [AUTO_UNPARK_WAKE_TAG, `${AUTO_UNPARK_BLOCKER_TAG_PREFIX}${input.blockerQitemId}`, `queue:return:${input.blockerQitemId}`],
+            tags: [AUTO_UNPARK_WAKE_TAG, WAKE_TRIGGER_OPENRIG_TAG, `${AUTO_UNPARK_BLOCKER_TAG_PREFIX}${input.blockerQitemId}`, `queue:return:${input.blockerQitemId}`],
         });
     }
     deliverWakeIntentAfterCommit(outboxId) {
@@ -739,12 +740,12 @@ export class QueueRepository {
      * hold is left alone; failed/uncertain history permits another attempt. A recovery
      * pass tracks its coalesced members only in memory so each is attempted once per pass.
      */
-    async deliverWakeIntent(outboxId, attempted) {
+    async deliverWakeIntent(outboxId, attempted = new Set()) {
         if (!this.outbox)
             return "skipped";
         if (!this.transport)
             return "skipped"; // no transport → stays pending for a later drain
-        if (attempted?.has(outboxId))
+        if (attempted.has(outboxId))
             return "skipped";
         const alreadyHeld = this.outbox.getById(outboxId);
         if (alreadyHeld?.deliveryState === "retained" || alreadyHeld?.deliveryState === "retired") {
@@ -754,9 +755,9 @@ export class QueueRepository {
         }
         let recovering = false;
         const claim = (entry) => {
-            if (attempted?.has(entry.outboxId) || !this.outbox.claimForDelivery(entry.outboxId))
+            if (attempted.has(entry.outboxId) || !this.outbox.claimForDelivery(entry.outboxId))
                 return false;
-            attempted?.add(entry.outboxId);
+            attempted.add(entry.outboxId);
             recovering ||= entry.deliveryState !== "pending";
             return true;
         };
@@ -782,6 +783,16 @@ export class QueueRepository {
             const first = candidate; // Keep each member's pre-claim uncertainty.
             const intents = [first];
             const correlation = first.tags?.find(tag => tag.startsWith("queue:return:"));
+            // Group by outcome at the seat's current level: each member is admitted with its own source and urgency, and only
+            // members with the first one's outcome (typed or held) go together. With no level (off, draft-aware), everything is
+            // admitted, so a returned result and its resume still go as one send. At a level, a routine wake never rides in on
+            // an urgent one, nor an urgent one under a routine one's hold; any other member waits for its own delivery.
+            const outcome = (entry) => {
+                const trigger = entry.tags?.includes(WAKE_TRIGGER_OPENRIG_TAG) ? "openrig" : "agent";
+                const admission = entry.auditPointer ? this.wakeAdmission(entry.auditPointer, trigger) : { source: trigger, urgent: false };
+                return this.transport?.retentionTarget?.(entry.destinationSession, { source: admission.source, urgent: admission.urgent }) ? "held" : "typed";
+            };
+            const firstOutcome = outcome(first);
             if (correlation) {
                 const peers = this.db.prepare(`SELECT outbox_id FROM outbox_entries
           WHERE delivery_state IN ('pending','failed','indeterminate') AND destination_session = ? AND substr(outbox_id, 1, ?) = ?
@@ -789,6 +800,8 @@ export class QueueRepository {
           ORDER BY outbox_id`).all(first.destinationSession, WAKE_INTENT_PREFIX.length, WAKE_INTENT_PREFIX, correlation);
                 for (const peer of peers) {
                     const entry = this.outbox.getById(peer.outbox_id);
+                    if (outcome(entry) !== firstOutcome)
+                        continue;
                     if (actionable(entry) && claim(entry))
                         intents.push(entry);
                 }
@@ -809,9 +822,34 @@ export class QueueRepository {
         const qitemId = intent.auditPointer ?? outboxId;
         // Preserve the original envelope/source generation; add context without rewriting its stored bytes.
         const recoveryNotice = recovering ? "Recovered queue notification: delivery may repeat after an earlier unconfirmed attempt.\n" : "";
-        const outcome = await this.performWakeSend(qitemId, intent.destinationSession, intent.senderSession, undefined, recoveryNotice + group.map(entry => entry.body).join("\n"), group.map(entry => entry.outboxId));
+        // The group was formed on the first member's outcome, so its own source and urgency reach that same outcome at the
+        // send; the other members' bodies keep their own frozen urgent lines.
+        const trigger = group[0].tags?.includes(WAKE_TRIGGER_OPENRIG_TAG) ? "openrig" : "agent";
+        // The level can change while this send waits for the seat's lease. Under the lease, each member is admitted again with
+        // its own source and urgency; only those with the first member's outcome go with this send, and the others go back
+        // to their state before this claim (never marked delivered, held or failed) for their own delivery.
+        const released = [];
+        const recheckMembers = group.length < 2 ? undefined : (holds, held) => {
+            const keep = group.filter((entry, i) => {
+                if (i === 0)
+                    return true;
+                const memberTrigger = entry.tags?.includes(WAKE_TRIGGER_OPENRIG_TAG) ? "openrig" : "agent";
+                const admission = this.wakeAdmission(entry.auditPointer, memberTrigger);
+                return holds({ source: admission.source, urgent: admission.urgent }) === held;
+            });
+            for (const entry of group) {
+                if (keep.includes(entry))
+                    continue;
+                this.db.prepare("UPDATE outbox_entries SET delivery_state = ? WHERE outbox_id = ? AND delivery_state = 'sending'").run(entry.deliveryState, entry.outboxId);
+                released.push(entry);
+            }
+            return { text: recoveryNotice + keep.map(entry => entry.body).join("\n"), outboxIds: keep.map(entry => entry.outboxId) };
+        };
+        const outcome = await this.performWakeSend(qitemId, intent.destinationSession, intent.senderSession, undefined, recoveryNotice + group.map(entry => entry.body).join("\n"), group.map(entry => entry.outboxId), trigger, recheckMembers);
         let reportedState = outcome.classified === "verified" ? "delivered" : outcome.classified;
         for (const intent of group) {
+            if (released.includes(intent))
+                continue;
             // A no-write retry cannot settle whether an earlier attempt landed.
             const earlierUnknown = intent.deliveryState === "indeterminate" && outcome.classified === "failed";
             const finalState = earlierUnknown ? "indeterminate" : outcome.classified === "verified" ? "delivered" : outcome.classified;
@@ -825,8 +863,7 @@ export class QueueRepository {
                     ?.slice(AUTO_UNPARK_BLOCKER_TAG_PREFIX.length)
                 : undefined;
             const wakeEvent = this.db.transaction(() => {
-                // #1278: a coalesced wake is one send, so every row it woke gets that send's reading.
-                this.recordNudgeAttempt(qitemId, nudgeResult, outcome.inputBox);
+                this.recordNudgeAttempt(qitemId, nudgeResult);
                 this.outbox.finalizeDelivery(intent.outboxId, finalState);
                 if (!blockerRef)
                     return null;
@@ -859,6 +896,14 @@ export class QueueRepository {
             if (wakeEvent)
                 this.eventBus.notifySubscribers(wakeEvent);
         }
+        // Each released member is delivered on its own now, so this drain finishes only once every member has its outcome.
+        // One attempt per member for the whole pass: they inherit this pass's history, less themselves (released before any
+        // send, so never attempted), so nothing already sent here is regrouped, and each released member gets one attempt.
+        for (const entry of released)
+            attempted.delete(entry.outboxId);
+        for (const entry of released) {
+            await this.deliverWakeIntent(entry.outboxId, attempted).catch((err) => console.error(`Queue wake delivery failed for ${entry.outboxId}:`, err));
+        }
         return reportedState;
     }
     /** Deliver after the queue transaction commits, never from inside it. The shared
@@ -941,13 +986,13 @@ export class QueueRepository {
      * copies were deleted, refused at the seat boundary instead); this
      * site holds no copy of its own.
      */
-    async maybeNudge(qitemId, destinationSession, nudgeOpt, sourceSession, bodyOverride) {
+    async maybeNudge(qitemId, destinationSession, nudgeOpt, sourceSession, bodyOverride, trigger = "agent") {
         if (nudgeOpt === false)
             return;
         if (!this.transport)
             return;
-        const outcome = await this.performWakeSend(qitemId, destinationSession, sourceSession, bodyOverride);
-        this.recordNudgeAttempt(qitemId, outcome.nudgeResult, outcome.inputBox);
+        const outcome = await this.performWakeSend(qitemId, destinationSession, sourceSession, bodyOverride, undefined, undefined, trigger);
+        this.recordNudgeAttempt(qitemId, outcome.nudgeResult);
     }
     /** The following startup intent drain owns durable pending wakes. Legacy packets
      * and overdue claimed work (not eligible for that drain) still use the nudge path. */
@@ -955,7 +1000,8 @@ export class QueueRepository {
         const outboxId = `${WAKE_INTENT_PREFIX}${qitemId}`;
         if (this.outbox?.getById(outboxId) && this.getById(qitemId)?.state === "pending")
             return;
-        await this.maybeNudge(qitemId, destinationSession, undefined, sourceSession);
+        // Boot recovery is OpenRig's own scheduling, whoever created the row.
+        await this.maybeNudge(qitemId, destinationSession, undefined, sourceSession, undefined, "openrig");
     }
     /**
      * W1 (transactional closure): the shared wake-send CORE. Builds the pane
@@ -970,7 +1016,7 @@ export class QueueRepository {
      * (the "delivered-ack-pending" nudge literal). It is never promoted to
      * delivered nor demoted to failed.
      */
-    async performWakeSend(qitemId, destinationSession, sourceSession, bodyOverride, prebuiltText, committedOutboxIds) {
+    async performWakeSend(qitemId, destinationSession, sourceSession, bodyOverride, prebuiltText, committedOutboxIds, trigger = "agent", recheckMembers) {
         // DEFECT FIX qitem-20260827065907-b9ae334c (S1-class, 3 live specimens): a virtual
         // @external destination has NO pane — the queue row ITSELF is the gateway
         // subsystem's input (the Slack connector polls human-destined rows and its own
@@ -1000,6 +1046,16 @@ export class QueueRepository {
         if (destClass.class === "unroutable") {
             return { classified: "failed", nudgeResult: destClass.teaching };
         }
+        // A terminal seat runs a shell or a TUI, not an agent. Typed wake text would run there as a
+        // command line (it carries the row's summary), and nothing there can claim the row. So nothing
+        // is typed; the row stays queued and visible. `failed:` keeps it on the wake ladder, whose
+        // retries come back here and type nothing before it escalates.
+        if (isBoundTerminalSeat(this.db, destinationSession)) {
+            return {
+                classified: "failed",
+                nudgeResult: `failed:terminal-seat: '${destinationSession}' is a terminal seat (runtime: terminal), not an agent, so no wake was typed into it and nothing there can claim this row. The row stays queued; route it to an agent seat.`,
+            };
+        }
         const stampISO = new Date().toISOString();
         let text;
         if (prebuiltText !== undefined) {
@@ -1029,7 +1085,11 @@ export class QueueRepository {
             text = held.body;
         }
         try {
-            const res = await this.transport.send(destinationSession, text, { verify: true, stampISO, actorSession: sourceSession, committedOutboxIds, deliveryId: committedOutboxIds ? undefined : deliveryId, auditPointer: qitemId, queueWake: true });
+            const admission = this.wakeAdmission(qitemId, trigger);
+            const res = await this.transport.send(destinationSession, text, { verify: true, stampISO, actorSession: sourceSession, committedOutboxIds,
+                deliveryId: committedOutboxIds ? undefined : deliveryId, auditPointer: qitemId, queueWake: true,
+                ...(trigger === "openrig" ? { openrigNotice: true } : {}), ...(admission.urgentBy ? { urgent: { by: admission.urgentBy } } : {}),
+                ...(recheckMembers ? { recheckMembers } : {}) });
             // OPR.0.3.2.21.FR-4(c) — wording rename: the prior literal
             // "sent-unverified" read as a failure even in the common case
             // (delivery confirmed but the synchronous ack window expired,
@@ -1052,6 +1112,30 @@ export class QueueRepository {
             return { classified: "failed", nudgeResult: `failed:${msg}` };
         }
     }
+    /** First committed return of a direct ask, including pre-shared-ID Slack replies. */
+    getHumanAnswer(qitemId, actorSession) {
+        const ask = this.getById(qitemId);
+        if (!this.hasReplyToColumn || !ask || ask.destinationSession !== actorSession
+            || ask.humanIntent === "update" || !this.isPersonAddress(actorSession))
+            return null;
+        const row = this.db.prepare(`SELECT qitem_id FROM queue_items
+      WHERE reply_to = ? AND source_session = ? AND destination_session = ?
+        AND (EXISTS (SELECT 1 FROM json_each(queue_items.tags) WHERE value = 'human-answer')
+          OR (qitem_id LIKE 'qitem-slack-inbound-%' AND COALESCE(summary, '') NOT LIKE '[Recovered after gap] %'))
+      ORDER BY ts_created, rowid LIMIT 1`).get(qitemId, actorSession, ask.sourceSession);
+        return row ? this.getById(row.qitem_id) : null;
+    }
+    /** The lookup and create's insert run synchronously before its first delivery await.
+     * Every new surface uses the same ID; old IDs and their original bodies remain intact. */
+    async createHumanAnswer(input) {
+        const existing = this.getHumanAnswer(input.inboundReplyTo, input.sourceSession);
+        if (existing)
+            return existing;
+        return this.create({ ...input,
+            qitemId: `qitem-human-answer-${createHash("sha256").update(input.inboundReplyTo).digest("hex").slice(0, 20)}`,
+            tags: [...new Set([...(input.tags ?? []), "human-answer"])],
+        });
+    }
     async create(input) {
         // FOUNDER ROOT INVARIANT (2026-08-27, supersedes 51-09 incr 4 / ruling cb19867f Q2):
         // a LOCAL write stores the bare transport identity — no self-host suffix inside one
@@ -1068,7 +1152,7 @@ export class QueueRepository {
                 try {
                     // A savepoint removes any partial intent when staging fails, while
                     // preserving ordinary create's existing acceptance of the task.
-                    this.db.transaction(() => this.stageWakeIntent(created.qitemId, input.sourceSession, input.destinationSession, input.identityProvenance ?? null, input.nudge))();
+                    this.db.transaction(() => this.stageWakeIntent(created.qitemId, input.sourceSession, input.destinationSession, input.identityProvenance ?? null, input.nudge, input.wakeTrigger))();
                     wakeStaged = true;
                 }
                 catch (err) {
@@ -1129,7 +1213,7 @@ export class QueueRepository {
                 this.deliverWakeIntentAfterCommit(`${WAKE_INTENT_PREFIX}${id}`);
         }
         else {
-            await this.maybeNudge(id, input.destinationSession, input.nudge, input.sourceSession);
+            await this.maybeNudge(id, input.destinationSession, input.nudge, input.sourceSession, undefined, input.wakeTrigger);
         }
         return this.getByIdOrThrow(id);
     }
@@ -1220,11 +1304,13 @@ export class QueueRepository {
                 throw new QueueRepositoryError("invalid_human_questions", "humanQuestions require the current queue schema; they were not saved.");
             humanQuestions = parsed.questions;
         }
+        this.assertHumanAlert(input.humanAlert, input.destinationSession, input.humanIntent);
         const id = input.qitemId ?? newQitemId();
         const ts = new Date().toISOString();
         const priority = input.priority ?? "routine";
         const tier = input.tier ?? null;
-        const tags = input.tags ? JSON.stringify(input.tags) : null;
+        const taggedAsk = withHumanAlertTag(input.tags, input.humanAlert);
+        const tags = taggedAsk ? JSON.stringify(taggedAsk) : null;
         const chain = input.chainOfRecord ? JSON.stringify(input.chainOfRecord) : null;
         const expiresAt = input.expiresAt ?? null;
         const targetRepo = input.targetRepo ?? null;
@@ -1264,6 +1350,7 @@ export class QueueRepository {
         const notification = this.classifyOwnerNotification({
             action: "create",
             humanIntent: input.humanIntent,
+            humanAlert: input.humanAlert,
             destinationSession: input.destinationSession,
             nextState: "pending",
         });
@@ -1287,6 +1374,25 @@ export class QueueRepository {
         });
         return { qitemId: id, persistedEvent };
     }
+    /** humanAlert marks an ask to a person: a person by address or by the registry (a registered person may be addressed as
+     *  their seat), as the classifier reads it, and never an update. */
+    assertHumanAlert(humanAlert, destination, humanIntent) {
+        if (humanAlert != null && typeof humanAlert !== "boolean") {
+            throw new QueueRepositoryError("invalid_human_notification", "humanAlert is true or false.");
+        }
+        if (humanAlert !== true)
+            return;
+        if (!this.isPersonAddress(destination) || humanIntent === "update") {
+            throw new QueueRepositoryError("invalid_human_notification", "humanAlert marks an ask to a person as alert-worthy: it needs a human destination, and an update isn't an ask.");
+        }
+    }
+    /** A person by address or by the registry: a registered person may be addressed as their seat or an alias. */
+    isPersonAddress(destination) {
+        if (isHumanSeatSessionRef(destination))
+            return true;
+        const registry = this.loadHumanRegistryFn();
+        return registry.ok && resolveRegisteredHumanAddress(destination, registry.entities) !== null;
+    }
     validateReplyTo(replyTo, humanIntent) {
         if (humanIntent !== "update") {
             throw new QueueRepositoryError("reply_to_requires_update", "replyTo is accepted only with humanIntent update; a decision keeps its own thread so its reply stays unambiguous.");
@@ -1314,12 +1420,14 @@ export class QueueRepository {
         if (!this.validateRig(input.toSession)) {
             throw destinationValidationError("to_session", input.toSession, this.loadHumanRegistryFn);
         }
+        this.assertHumanAlert(input.humanAlert, input.toSession);
         const newId = newQitemId();
         const ts = new Date().toISOString();
         const body = input.body ?? source.body;
         const priority = input.priority ?? source.priority;
         const tier = input.tier ?? source.tier;
-        const tags = input.tags ? JSON.stringify(input.tags) : (source.tags ? JSON.stringify(source.tags) : null);
+        const handedTags = withHumanAlertTag(input.tags ?? source.tags, input.humanAlert);
+        const tags = handedTags ? JSON.stringify(handedTags) : null;
         const chain = JSON.stringify([...(source.chainOfRecord ?? []), source.qitemId]);
         const targetRepo = input.targetRepo === undefined ? source.targetRepo : input.targetRepo;
         // OPR.0.4.4.19 FR-4/FR-5 — the handoff authors a NEW qitem; when that
@@ -1382,6 +1490,7 @@ export class QueueRepository {
             const successorNotification = this.classifyOwnerNotification({
                 action: "create",
                 destinationSession: input.toSession,
+                humanAlert: input.humanAlert,
                 nextState: "pending",
             });
             this.transitionLog.append({
@@ -1463,12 +1572,14 @@ export class QueueRepository {
         if (!this.validateRig(input.toSession)) {
             throw destinationValidationError("to_session", input.toSession, this.loadHumanRegistryFn);
         }
+        this.assertHumanAlert(input.humanAlert, input.toSession);
         const newId = newQitemId();
         const ts = new Date().toISOString();
         const body = input.body ?? source.body;
         const priority = input.priority ?? source.priority;
         const tier = input.tier ?? source.tier;
-        const tags = input.tags ? JSON.stringify(input.tags) : (source.tags ? JSON.stringify(source.tags) : null);
+        const handedTags = withHumanAlertTag(input.tags ?? source.tags, input.humanAlert);
+        const tags = handedTags ? JSON.stringify(handedTags) : null;
         const chain = JSON.stringify([...(source.chainOfRecord ?? []), source.qitemId]);
         const targetRepo = input.targetRepo === undefined ? source.targetRepo : input.targetRepo;
         // OPR.0.4.4.19 FR-4/FR-5 — same new-item enforcement as handoff().
@@ -1528,6 +1639,7 @@ export class QueueRepository {
             const successorNotification = this.classifyOwnerNotification({
                 action: "create",
                 destinationSession: input.toSession,
+                humanAlert: input.humanAlert,
                 nextState: "pending",
             });
             this.transitionLog.append({
@@ -2065,6 +2177,8 @@ export class QueueRepository {
             throw new QueueRepositoryError("invalid_human_notification", "An informational delivery cannot become a human approval park; author a separate decision request.");
         }
         const isHumanPark = input.state === "blocked" && isHumanSeatSession(effectiveBlockedOn);
+        // A done close can also store the artifact the work produced, so the finished row carries its link.
+        const isDoneClose = input.state === "done";
         // OPR.0.5.1 slice-51-06 D2 — summary/evidence_ref are persist-able ONLY at a human-seat park
         // (see the FR-6 note below). Silently ignoring them on any other transition is a data-loss trap
         // (the operator believes the metadata was saved). HARD-REJECT before ANY UPDATE/log/event so the
@@ -2074,11 +2188,14 @@ export class QueueRepository {
             const invalidFields = [];
             if (input.summary != null)
                 invalidFields.push("summary");
-            if (input.evidenceRef != null)
+            if (input.evidenceRef != null && !isDoneClose)
                 invalidFields.push("evidenceRef");
             if (invalidFields.length > 0) {
                 const flags = invalidFields.map((f) => (f === "summary" ? "--summary" : "--evidence-ref")).join(" / ");
-                throw new QueueRepositoryError("summary_evidence_not_persistable", `${invalidFields.join(" + ")} persist only on a human-seat park (state=blocked on a human seat); the '${input.state}' transition cannot store them. Remove ${flags}, or park the item (rig queue block --on <human-seat> --summary … --evidence-ref …).`, { invalidFields });
+                const where = invalidFields.map((f) => f === "summary"
+                    ? "summary persists on a human-seat park, or on its own (rig queue update <id> --summary … with no --state)"
+                    : "evidenceRef persists on a human-seat park or a done close").join("; ");
+                throw new QueueRepositoryError("summary_evidence_not_persistable", `${where}; the '${input.state}' transition cannot store ${invalidFields.length > 1 ? "them" : "it"}. Remove ${flags}, or use one of those.`, { invalidFields });
             }
         }
         // SWEEP-a (shape f2576102) — closure/blocked-field COHERENCE, beside the reference
@@ -2246,11 +2363,14 @@ export class QueueRepository {
             .run(input.state, ts, validation.closureReason, validation.closureTarget, input.handedOffTo ?? null, nextBlockedOn, nextResolution, input.qitemId);
         // FR-6: park-time summary/evidence_ref are PERSISTED onto the existing
         // item (not merely validated-then-dropped) — visible to the attention
-        // query and to Packet 2. Only the park path writes them.
+        // query and to Packet 2. A done close writes evidence_ref the same way.
         if (isHumanPark) {
             this.persistSummary(input.qitemId, input.summary ?? null);
             this.persistEvidenceRef(input.qitemId, input.evidenceRef ?? null);
         }
+        else if (isDoneClose) {
+            this.persistEvidenceRef(input.qitemId, input.evidenceRef ?? null);
+        }
         const transition = this.transitionLog.append({
             qitemId: input.qitemId,
             state: input.state,
@@ -2603,7 +2723,7 @@ export class QueueRepository {
             const item = this.getById(input.qitemId);
             if (item?.state !== "pending" || item.humanIntent === "update"
                 || item.destinationSession !== input.actorSession
-                || parseSessionName(item.destinationSession).kind !== "external")
+                || !this.isPersonAddress(item.destinationSession))
                 return null;
             const text = input.decision.trim();
             const unanswered = this.hasHumanQuestionsColumn && text && text !== "[file reply]"
@@ -2886,6 +3006,7 @@ export class QueueRepository {
             conditions.push("target_repo = ?");
             params.push(opts.targetRepo);
         }
+        pushFollowThroughFilters(opts, conditions, params);
         const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
         const columns = opts?.compact ? this.compactColumns() : "*";
         const useActiveFirst = !!(opts?.rig || opts?.asSession || opts?.activeOnly);
@@ -2992,11 +3113,22 @@ export class QueueRepository {
         // clause: a qitem parked as state=blocked on a HUMAN-seat blocker is a
         // decision the human owes. Blocking on another qitem (today's shipped
         // usage) does NOT match — is_human_seat_session rejects qitem ids.
+        // An ask to a person lands here by its classification (isCurrentHumanAsk), alerted or not, so one to a registered
+        // person addressed as a seat or an alias is on Steering too; a reroute ends that.
+        const quietAsk = this.hasOwnerNotificationColumns ? `
+        OR EXISTS (SELECT 1 FROM queue_transitions ask
+          WHERE ask.qitem_id = queue_items.qitem_id AND ask.state = 'pending'
+            AND ask.owner_notification_kind = 'human-required'
+            AND ask.transition_id = (SELECT MAX(latest.transition_id) FROM queue_transitions latest
+              WHERE latest.qitem_id = queue_items.qitem_id AND latest.owner_notification_level IS NOT NULL
+                AND latest.owner_notification_kind <> 'human-decision-resolved')
+            AND NOT EXISTS (SELECT 1 FROM queue_transitions moved WHERE moved.qitem_id = ask.qitem_id
+              AND moved.transition_id > ask.transition_id AND moved.transition_note LIKE 'fallback-routed:%'))` : "";
         const conditions = [
             `state IN (${statePlaceholders})`,
             `(
         is_human_seat_session(destination_session) = 1
-        OR (state = 'blocked' AND is_human_seat_session(blocked_on) = 1)
+        OR (state = 'blocked' AND is_human_seat_session(blocked_on) = 1)${quietAsk}
       )`,
         ];
         if (this.hasHumanIntentColumn)
@@ -3016,6 +3148,7 @@ export class QueueRepository {
             conditions.push("target_repo = ?");
             params.push(opts.targetRepo);
         }
+        pushFollowThroughFilters(opts, conditions, params);
         params.push(limit);
         const sql = `
       SELECT * FROM queue_items
@@ -3264,8 +3397,11 @@ export class QueueRepository {
                 : item.state === "blocked"
                     ? resolveRegisteredHumanAddress(item.blockedOn, registry.entities)
                     : resolveRegisteredHumanAddress(item.destinationSession, registry.entities);
+        // An ask placed on Steering without an alert (RECORD) owes no post: its ledger reports a real receipt (a posting
+        // dial set to RECORD posts it) and never a missing one.
         return humanAddress
-            ? { notificationKey: `${item.qitemId}:${transition.transitionId}`, startedAt: transition.ts }
+            ? { notificationKey: `${item.qitemId}:${transition.transitionId}`, startedAt: transition.ts,
+                ...(transition.ownerNotificationLevel === "RECORD" ? { quiet: true } : {}) }
             : "inactive";
     }
     /** OPR.0.5.6.14 — derive the current episode's delivery ledger. Receipt
@@ -3283,21 +3419,46 @@ export class QueueRepository {
     humanNotificationPostedThisEpisode(qitemId, listed) {
         if (!this.hasQueueTransitionsTable)
             return false;
-        // Only the ask's own notification binds a recipient: create writes it in state pending, to the destination of
-        // that moment. A park notice (its recipient is not retained), a resolution notice, or a later destination change
-        // (routeToFallback opens no new episode) cannot establish that the current destination received this ask.
         const owners = listed?.owners ?? this.transitionLog.ownerNotificationsForQitems([qitemId]).get(qitemId) ?? [];
+        const owner = this.currentAskNotification(qitemId, owners);
+        if (!owner)
+            return false;
+        // The ledger's episode exists only when the destination resolves to a registered human (aliases included).
+        const ledger = listed ? listed.ledger : this.deliveryLedger(qitemId, owners);
+        return ledger !== null && ledger.outcome === "posted" && ledger.episode?.notificationKey === `${qitemId}:${owner.transitionId}`;
+    }
+    /** The ask's own notification while it still binds its recipient. Only that notification does: create writes it in
+     *  state pending, to the destination of that moment. A park notice (its recipient is not retained), a resolution notice,
+     *  or a later destination change (routeToFallback opens no new episode) can't establish who has the ask now. */
+    currentAskNotification(qitemId, owners) {
         const owner = owners[0];
         if (!owner || owner.state !== "pending")
-            return false;
+            return null;
         if (owner.ownerNotificationKind !== "human-required" && owner.ownerNotificationKind !== "human-update")
-            return false;
+            return null;
         const rerouted = this.db.prepare("SELECT 1 FROM queue_transitions WHERE qitem_id = ? AND transition_id > ? AND transition_note LIKE 'fallback-routed:%' LIMIT 1").get(qitemId, owner.transitionId);
-        if (rerouted)
+        return rerouted ? null : owner;
+    }
+    /** True when this row is an ask to a person that's still theirs: its own create-time human-required notification, at
+     *  any level, not rerouted since. Every attention reader (listAttention, the list route, the Feed) uses this one
+     *  membership, whatever happened to its Slack post. */
+    isCurrentHumanAsk(qitemId, listed) {
+        if (!this.hasQueueTransitionsTable)
             return false;
-        // The ledger's episode exists only when the destination resolves to a registered human (aliases included).
-        const ledger = listed ? listed.ledger : this.deliveryLedger(qitemId, owners);
-        return ledger !== null && ledger.outcome === "posted" && ledger.episode?.notificationKey === `${qitemId}:${owner.transitionId}`;
+        const owners = listed?.owners ?? this.transitionLog.ownerNotificationsForQitems([qitemId]).get(qitemId) ?? [];
+        return this.currentAskNotification(qitemId, owners)?.ownerNotificationKind === "human-required";
+    }
+    /** True when this row's current ask was placed on Steering without a Slack alert (human-required at RECORD) and is still
+     *  with that person (not rerouted): it waits on them there by design, like a posted ask, so it isn't stuck and nothing
+     *  re-offers it. */
+    humanAskWithoutAlert(qitemId, listed) {
+        if (!this.hasQueueTransitionsTable)
+            return false;
+        const owners = listed?.owners ?? this.transitionLog.ownerNotificationsForQitems([qitemId]).get(qitemId) ?? [];
+        const owner = this.currentAskNotification(qitemId, owners);
+        // Slack never posts a quiet ask; one that was posted anyway is a posted ask, reported by its receipt.
+        return owner?.ownerNotificationKind === "human-required" && owner.ownerNotificationLevel === "RECORD"
+            && !this.humanNotificationPostedThisEpisode(qitemId, listed);
     }
     /** owners: the row's owner notifications as ownerNotificationsForQitems gives them, when the caller read them. */
     deliveryLedger(qitemId, owners) {
@@ -3369,6 +3530,8 @@ export class QueueRepository {
         const failed = currentNotes.find((note) => note.startsWith("slack-owner-notification-transport-failed "));
         if (failed)
             return { outcome: "transport-failed", detail: failed, episode };
+        if (episode?.quiet)
+            return null;
         const startedAt = episode?.startedAt ?? item.tsCreated;
         const gatewayRouted = episode !== null || item.lastNudgeResult?.startsWith("gateway-owned") === true;
         if (gatewayRouted) {
@@ -3383,22 +3546,9 @@ export class QueueRepository {
     /** The grace window before a receiptless gateway-routed row honestly reads
      *  never-posted (the connector sweep cadence bounds normal posting latency). */
     static NEVER_POSTED_WINDOW_MS = 120_000;
-    /**
-     * Record one wake attempt. #1278: `inputBox` is that attempt's input-box reading, when the
-     * transport returned one. It is written with the attempt every time, so an attempt without a
-     * reading clears an earlier attempt's reading rather than leaving it to read as current.
-     */
-    recordNudgeAttempt(qitemId, result, inputBox) {
+    /** Record one wake attempt. */
+    recordNudgeAttempt(qitemId, result) {
         const ts = new Date().toISOString();
-        if (this.hasNudgeInputBoxColumn) {
-            const reading = inputBoxReading(inputBox);
-            this.db
-                .prepare(`UPDATE queue_items
-             SET last_nudge_attempt = ?, last_nudge_result = ?, last_nudge_input_box = ?
-           WHERE qitem_id = ?`)
-                .run(ts, result, reading ? JSON.stringify({ ...reading, at: ts }) : null, qitemId);
-            return;
-        }
         this.db
             .prepare(`UPDATE queue_items
            SET last_nudge_attempt = ?, last_nudge_result = ?
@@ -3618,9 +3768,13 @@ export class QueueRepository {
         if (view && ["pending", "in-progress"].includes(view.state)) {
             // #514 — the unclaimed sweep skips a pending ask already posted to its human in the current
             // episode (same predicate as runStuckSweep), so the view must not promise that sweep.
-            const awaitingHuman = view.state === "pending" && this.humanNotificationPostedThisEpisode(qitemId, listed);
+            const posted = view.state === "pending" && this.humanNotificationPostedThisEpisode(qitemId, listed);
+            const onSteering = !posted && view.state === "pending" && this.humanAskWithoutAlert(qitemId, listed);
+            const awaitingHuman = posted || onSteering;
             if (awaitingHuman) {
-                view.nextBackstop = { owner: view.owner, mechanism: "none (posted to the human; awaiting their decision)", dueAt: null, intervalSeconds: null };
+                view.nextBackstop = { owner: view.owner, mechanism: onSteering
+                        ? "none (on Steering for the human, with no Slack alert; awaiting their decision)"
+                        : "none (posted to the human; awaiting their decision)", dueAt: null, intervalSeconds: null };
             }
             // Quiet hours: a held ask is owned by its window's release job until it posts.
             const quiet = awaitingHuman ? null : quietCustodyBackstop(view.owner, quietHoldCustody(this.db, qitemId));
@@ -3634,6 +3788,13 @@ export class QueueRepository {
                     view.laterBackstop = { ...view.nextBackstop, note: "Conditional safety net; current delivery/recovery ownership is evaluated first." };
                 view.nextBackstop = recovery;
             }
+            else if (!awaitingHuman && view.state === "pending" && this.db.prepare("SELECT last_nudge_result FROM queue_items WHERE qitem_id = ?")
+                .get(qitemId)?.last_nudge_result === "retained:typing_guard") {
+                // Held at the seat on purpose: not stuck, and not picked up. Nothing replays it; reading or delivering it is a
+                // deliberate step.
+                view.nextBackstop = { owner: view.owner, mechanism: "held by the seat's typing guard", dueAt: null, intervalSeconds: null, held: true,
+                    note: `Nothing was typed into ${view.owner}. Read it with rig seat held-messages ${view.owner}; changing the seat's level doesn't replay it.` };
+            }
         }
         if (view?.state === "blocked") {
             // A row parked on a person carries that person's notification, which quiet hours can hold. Its quiet custody is the
@@ -3684,6 +3845,7 @@ export class QueueRepository {
             lastMeaningfulAt: meaningful?.at,
             activity: activity?.activity,
             needsInput: activity?.needsInput.count,
+            needsInputReason: activity?.needsInput.reason,
             claimedAt: row.claimed_at,
             lastHeartbeat: row.last_heartbeat,
             postClaimMotionCount: 0, // this reader supplies the current meaningful timestamp
@@ -3727,8 +3889,6 @@ export class QueueRepository {
             lastNudgeAttempt: row.last_nudge_attempt,
             lastNudgeResult: presentedNudgeResult(row.last_nudge_result, row.claimed_at),
             lastNudgeWireResult: row.last_nudge_result,
-            // #1278: absent before migration 116 and on compact rows (elided there), so null.
-            lastNudgeInputBox: parseNudgeInputBox(row.last_nudge_input_box, row.last_nudge_attempt),
             lastHeartbeat: row.last_heartbeat,
             resolution: row.resolution,
             // PL-007: target_repo present only when migration 038 has applied;