@ours.network/cli 1.0.1 → 2.0.1

package/dist/{chunk-MHVYJY3H.js → chunk-LJ35FDQH.js}

@@ -89,7 +89,7 @@ function createStartupProgressReporter(stateDir, opts = {}) {
 }
 
 // ../../src/runtime/env.ts
-var VERSION = typeof __OURS_VERSION__ !== "undefined" ? __OURS_VERSION__ : "0.0.0-dev";
+var VERSION = true ? "3.0.1" : "0.0.0-dev";
 var CONFIG = loadConfig();
 var STATE_DIR = CONFIG.stateDir;
 var BROKER_URL = CONFIG.brokerUrl;
@@ -186,9 +186,586 @@ function setUnit(u) {
 }
 
 // ../../src/identity/model.ts
-import { join as join3 } from "node:path";
-import { createHash } from "node:crypto";
+import { join as join4 } from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+import * as fs4 from "node:fs";
+
+// ../../src/history.ts
+import { createHash, randomUUID } from "node:crypto";
 import * as fs3 from "node:fs";
+import { dirname as dirname2, join as join3, resolve as resolve2, sep } from "node:path";
+import Database from "better-sqlite3";
+var MAX_BATCH = 200;
+var DEFAULT_BATCH = 50;
+var MAX_TEXT_BYTES = 2 * 1024 * 1024;
+var MAX_FILE_BYTES = 8 * 1024 * 1024;
+var DB_NAME = "history.sqlite3";
+var SCHEMA_VERSION = 1;
+var stores = /* @__PURE__ */ new Map();
+var health = /* @__PURE__ */ new Map();
+var outboundFailures = /* @__PURE__ */ new Map();
+var historyPath = (id) => join3(id.dir, DB_NAME);
+function initialHealth() {
+  return {
+    write_failures: 0,
+    message_write_failures: 0,
+    file_write_failures: 0,
+    receipt_update_failures: 0,
+    last_failure_at_ms: null
+  };
+}
+function noteHistoryFailure(id, kind, wireId, direction) {
+  const next = health.get(id.dir) ?? initialHealth();
+  next.write_failures += 1;
+  next.last_failure_at_ms = Date.now();
+  if (kind === "message") next.message_write_failures += 1;
+  else if (kind === "file") next.file_write_failures += 1;
+  else next.receipt_update_failures += 1;
+  health.set(id.dir, next);
+  if (direction === "out" && wireId) {
+    let failed = outboundFailures.get(id.dir);
+    if (!failed) {
+      failed = /* @__PURE__ */ new Set();
+      outboundFailures.set(id.dir, failed);
+    }
+    failed.add(wireId);
+  }
+}
+function consumeOutboundHistoryFailure(id, wireId) {
+  const failed = outboundFailures.get(id.dir);
+  if (!failed?.delete(wireId)) return false;
+  if (failed.size === 0) outboundFailures.delete(id.dir);
+  return true;
+}
+function schema(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS history_meta (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS wire_items (
+      wire_id TEXT PRIMARY KEY,
+      item_kind TEXT NOT NULL CHECK (item_kind IN ('message','file'))
+    );
+    CREATE TABLE IF NOT EXISTS messages (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      wire_id TEXT NOT NULL UNIQUE,
+      peer_cid TEXT NOT NULL,
+      peer_name_snapshot TEXT NOT NULL,
+      direction TEXT NOT NULL CHECK (direction IN ('in','out')),
+      body TEXT NOT NULL,
+      occurred_at_ms INTEGER NOT NULL,
+      reply_to_wire_id TEXT,
+      reply_to_sentence INTEGER,
+      encryption TEXT NOT NULL CHECK (encryption IN ('legacy','e2e')),
+      inbox_state TEXT NOT NULL CHECK (inbox_state IN ('pending_introduction','unread','read')),
+      delivery_state TEXT,
+      human_read_at_ms INTEGER,
+      inserted_at_ms INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS messages_unread_seq ON messages(inbox_state, seq ASC);
+    CREATE INDEX IF NOT EXISTS messages_peer_seq ON messages(peer_cid, seq DESC);
+    CREATE TRIGGER IF NOT EXISTS messages_release_wire AFTER DELETE ON messages BEGIN
+      DELETE FROM wire_items WHERE wire_id = OLD.wire_id AND item_kind = 'message';
+    END;
+    CREATE TABLE IF NOT EXISTS files (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      wire_id TEXT NOT NULL UNIQUE,
+      peer_cid TEXT NOT NULL,
+      peer_name_snapshot TEXT NOT NULL,
+      direction TEXT NOT NULL CHECK (direction IN ('in','out')),
+      filename TEXT NOT NULL,
+      mime TEXT NOT NULL,
+      byte_length INTEGER NOT NULL,
+      sha256 TEXT NOT NULL,
+      blob_relpath TEXT NOT NULL,
+      occurred_at_ms INTEGER NOT NULL,
+      reply_to_wire_id TEXT,
+      reply_to_sentence INTEGER,
+      encryption TEXT NOT NULL CHECK (encryption IN ('legacy','e2e')),
+      inbox_state TEXT NOT NULL CHECK (inbox_state IN ('pending_introduction','unread','read')),
+      delivery_state TEXT,
+      human_read_at_ms INTEGER,
+      inserted_at_ms INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS files_unread_seq ON files(inbox_state, seq ASC);
+    CREATE INDEX IF NOT EXISTS files_peer_seq ON files(peer_cid, seq DESC);
+    CREATE TRIGGER IF NOT EXISTS files_release_wire AFTER DELETE ON files BEGIN
+      DELETE FROM wire_items WHERE wire_id = OLD.wire_id AND item_kind = 'file';
+    END;
+    CREATE TABLE IF NOT EXISTS monitoring_items (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      item_id TEXT NOT NULL UNIQUE,
+      source_cid TEXT NOT NULL,
+      source_name_snapshot TEXT NOT NULL,
+      direction TEXT NOT NULL CHECK (direction IN ('in','out')),
+      peer_cid TEXT NOT NULL,
+      peer_name_snapshot TEXT NOT NULL,
+      body TEXT NOT NULL,
+      occurred_at_ms INTEGER NOT NULL,
+      queue_state TEXT NOT NULL CHECK (queue_state IN ('pending','processed')),
+      inserted_at_ms INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS monitoring_pending_seq ON monitoring_items(queue_state, seq ASC);
+    CREATE TABLE IF NOT EXISTS control_requests (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      item_id TEXT NOT NULL UNIQUE,
+      sender_cid TEXT NOT NULL,
+      sender_name_snapshot TEXT NOT NULL,
+      payload TEXT NOT NULL,
+      occurred_at_ms INTEGER NOT NULL,
+      queue_state TEXT NOT NULL CHECK (queue_state IN ('pending','processed')),
+      inserted_at_ms INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS control_pending_seq ON control_requests(queue_state, seq ASC);
+  `);
+  const version = db.prepare("SELECT value FROM history_meta WHERE key = ?").pluck().get("schema_version");
+  if (version !== void 0 && Number(version) !== SCHEMA_VERSION) {
+    throw new Error(`unsupported history database schema ${String(version)} (expected ${SCHEMA_VERSION})`);
+  }
+  db.prepare("INSERT OR IGNORE INTO history_meta(key, value) VALUES (?, ?)").run("schema_version", String(SCHEMA_VERSION));
+}
+function openHistory(id) {
+  const existing = stores.get(id.dir);
+  if (existing) return existing;
+  fs3.mkdirSync(id.dir, { recursive: true, mode: 448 });
+  fs3.chmodSync(id.dir, 448);
+  const path = historyPath(id);
+  const db = new Database(path);
+  try {
+    fs3.chmodSync(path, 384);
+    db.pragma("journal_mode = WAL");
+    db.pragma("synchronous = NORMAL");
+    db.pragma("foreign_keys = ON");
+    db.pragma("busy_timeout = 5000");
+    schema(db);
+    for (const suffix of ["", "-wal", "-shm"]) {
+      const candidate = `${path}${suffix}`;
+      if (fs3.existsSync(candidate)) fs3.chmodSync(candidate, 384);
+    }
+  } catch (error) {
+    db.close();
+    throw error;
+  }
+  stores.set(id.dir, db);
+  return db;
+}
+function closeHistory(id) {
+  const db = stores.get(id.dir);
+  if (!db) return;
+  stores.delete(id.dir);
+  db.close();
+}
+function validateCommon(event) {
+  if (!event.wireId || event.wireId.length > 256) throw new Error("invalid wire_id");
+  if (!event.peerCid || event.peerCid.length > 256) throw new Error("invalid peer cid");
+  if (!event.peerName || event.peerName.length > 512) throw new Error("invalid peer name");
+  if (!Number.isSafeInteger(event.occurredAtMs) || event.occurredAtMs < 0) throw new Error("invalid timestamp");
+  if (event.replyToWireId !== void 0 && (!event.replyToWireId || event.replyToWireId.length > 256)) {
+    throw new Error("invalid reply wire_id");
+  }
+  if (event.replyToSentence !== void 0 && (!Number.isSafeInteger(event.replyToSentence) || event.replyToSentence < 1)) {
+    throw new Error("invalid reply sentence");
+  }
+}
+function validateEvent(event) {
+  validateCommon(event);
+  if (event.kind === "message") {
+    if (Buffer.byteLength(event.body, "utf8") > MAX_TEXT_BYTES) throw new Error("message body exceeds host limit");
+    return;
+  }
+  if (!event.filename || event.filename.length > 512 || /[\0]/.test(event.filename)) throw new Error("invalid filename");
+  if (event.mime.length > 512 || /[\r\n\0]/.test(event.mime)) throw new Error("invalid MIME type");
+  if (event.bytes.byteLength > MAX_FILE_BYTES) throw new Error("file exceeds host limit");
+}
+function reply(row) {
+  if (!row.reply_to_wire_id) return null;
+  return row.reply_to_sentence === null ? { wire_id: row.reply_to_wire_id } : { wire_id: row.reply_to_wire_id, sentence: row.reply_to_sentence };
+}
+function iso(ms) {
+  return new Date(ms).toISOString();
+}
+function messageFromRow(row) {
+  const peer = { id: row.peer_cid, name: row.peer_name_snapshot };
+  return {
+    seq: row.seq,
+    msg_id: row.seq,
+    wire_id: row.wire_id,
+    from: peer,
+    peer,
+    direction: row.direction,
+    text: row.body,
+    body: row.body,
+    occurred_at_ms: row.occurred_at_ms,
+    date: iso(row.occurred_at_ms),
+    encryption: row.encryption,
+    transport: row.encryption === "e2e" ? "double_ratchet" : "legacy_box",
+    inbox_state: row.inbox_state,
+    status: row.inbox_state,
+    delivery_state: row.delivery_state,
+    human_read_at_ms: row.human_read_at_ms,
+    reply_to: reply(row)
+  };
+}
+function fileFromRow(id, row) {
+  const peer = { id: row.peer_cid, name: row.peer_name_snapshot };
+  const mime = row.mime || "application/octet-stream";
+  return {
+    seq: row.seq,
+    file_id: row.seq,
+    wire_id: row.wire_id,
+    from: peer,
+    peer,
+    direction: row.direction,
+    filename: row.filename,
+    mime,
+    size: row.byte_length,
+    byte_length: row.byte_length,
+    sha256: row.sha256,
+    occurred_at_ms: row.occurred_at_ms,
+    date: iso(row.occurred_at_ms),
+    encryption: row.encryption,
+    inbox_state: row.inbox_state,
+    status: row.inbox_state,
+    delivery_state: row.delivery_state,
+    human_read_at_ms: row.human_read_at_ms,
+    reply_to: reply(row),
+    blob_path: join3(id.dir, row.blob_relpath),
+    kind: mime.startsWith("audio/") ? "voice_message" : "file"
+  };
+}
+function writeBlob(id, bytes) {
+  const sha256 = createHash("sha256").update(bytes).digest("hex");
+  const relpath = join3("blobs", "sha256", sha256.slice(0, 2), sha256);
+  const final = join3(id.dir, relpath);
+  fs3.mkdirSync(dirname2(final), { recursive: true, mode: 448 });
+  fs3.chmodSync(dirname2(final), 448);
+  if (!fs3.existsSync(final)) {
+    const tmp = join3(dirname2(final), `.${sha256}.${process.pid}.${randomUUID()}.tmp`);
+    try {
+      fs3.writeFileSync(tmp, bytes, { flag: "wx", mode: 384 });
+      fs3.chmodSync(tmp, 384);
+      try {
+        fs3.renameSync(tmp, final);
+      } catch (error) {
+        if (!fs3.existsSync(final)) throw error;
+        fs3.rmSync(tmp, { force: true });
+      }
+    } catch (error) {
+      try {
+        fs3.rmSync(tmp, { force: true });
+      } catch {
+      }
+      throw error;
+    }
+  }
+  fs3.chmodSync(final, 384);
+  return { sha256, relpath };
+}
+function ingestApplicationEvent(id, event) {
+  validateEvent(event);
+  const db = openHistory(id);
+  if (event.direction === "out" && event.inboxState !== void 0) throw new Error("outbound event cannot set inbox state");
+  const inboxState = event.direction === "in" ? event.inboxState ?? "unread" : "read";
+  const deliveryState = event.direction === "out" ? "sent" : null;
+  if (event.kind === "message") {
+    return db.transaction(() => {
+      const claimed = db.prepare(`
+        INSERT INTO wire_items(wire_id, item_kind) VALUES (?, 'message')
+        ON CONFLICT(wire_id) DO NOTHING
+      `).run(event.wireId);
+      if (claimed.changes !== 1) return false;
+      db.prepare(`
+        INSERT INTO messages (
+          wire_id, peer_cid, peer_name_snapshot, direction, body, occurred_at_ms,
+          reply_to_wire_id, reply_to_sentence, encryption, inbox_state,
+          delivery_state, human_read_at_ms, inserted_at_ms
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        event.wireId,
+        event.peerCid,
+        event.peerName,
+        event.direction,
+        event.body,
+        event.occurredAtMs,
+        event.replyToWireId ?? null,
+        event.replyToSentence ?? null,
+        event.encryption,
+        inboxState,
+        deliveryState,
+        event.direction === "out" ? event.occurredAtMs : null,
+        Date.now()
+      );
+      return true;
+    })();
+  }
+  const duplicate = db.prepare("SELECT 1 FROM wire_items WHERE wire_id = ?").get(event.wireId);
+  if (duplicate) return false;
+  const blob = writeBlob(id, event.bytes);
+  return db.transaction(() => {
+    const claimed = db.prepare(`
+      INSERT INTO wire_items(wire_id, item_kind) VALUES (?, 'file')
+      ON CONFLICT(wire_id) DO NOTHING
+    `).run(event.wireId);
+    if (claimed.changes !== 1) return false;
+    db.prepare(`
+      INSERT INTO files (
+        wire_id, peer_cid, peer_name_snapshot, direction, filename, mime,
+        byte_length, sha256, blob_relpath, occurred_at_ms, reply_to_wire_id,
+        reply_to_sentence, encryption, inbox_state, delivery_state,
+        human_read_at_ms, inserted_at_ms
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      event.wireId,
+      event.peerCid,
+      event.peerName,
+      event.direction,
+      event.filename,
+      event.mime || "application/octet-stream",
+      event.bytes.byteLength,
+      blob.sha256,
+      blob.relpath,
+      event.occurredAtMs,
+      event.replyToWireId ?? null,
+      event.replyToSentence ?? null,
+      event.encryption,
+      inboxState,
+      deliveryState,
+      event.direction === "out" ? event.occurredAtMs : null,
+      Date.now()
+    );
+    return true;
+  })();
+}
+function ingestMonitoringEvent(id, event) {
+  if (!event.itemId || !event.sourceCid || !event.sourceName || !event.peerCid || !event.peerName) {
+    throw new Error("invalid monitoring event metadata");
+  }
+  if (!Number.isSafeInteger(event.occurredAtMs) || event.occurredAtMs < 0) throw new Error("invalid monitoring timestamp");
+  if (Buffer.byteLength(event.body, "utf8") > MAX_TEXT_BYTES) throw new Error("monitoring body exceeds host limit");
+  return openHistory(id).prepare(`
+    INSERT INTO monitoring_items (
+      item_id, source_cid, source_name_snapshot, direction, peer_cid,
+      peer_name_snapshot, body, occurred_at_ms, queue_state, inserted_at_ms
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?)
+    ON CONFLICT(item_id) DO NOTHING
+  `).run(
+    event.itemId,
+    event.sourceCid,
+    event.sourceName,
+    event.direction,
+    event.peerCid,
+    event.peerName,
+    event.body,
+    event.occurredAtMs,
+    Date.now()
+  ).changes === 1;
+}
+function ingestControlEvent(id, event) {
+  if (!event.itemId || !event.senderCid || !event.senderName) throw new Error("invalid control event metadata");
+  if (!Number.isSafeInteger(event.occurredAtMs) || event.occurredAtMs < 0) throw new Error("invalid control timestamp");
+  if (Buffer.byteLength(event.payload, "utf8") > MAX_TEXT_BYTES) throw new Error("control payload exceeds host limit");
+  return openHistory(id).prepare(`
+    INSERT INTO control_requests (
+      item_id, sender_cid, sender_name_snapshot, payload,
+      occurred_at_ms, queue_state, inserted_at_ms
+    ) VALUES (?, ?, ?, ?, ?, 'pending', ?)
+    ON CONFLICT(item_id) DO NOTHING
+  `).run(
+    event.itemId,
+    event.senderCid,
+    event.senderName,
+    event.payload,
+    event.occurredAtMs,
+    Date.now()
+  ).changes === 1;
+}
+function promotePendingIntroduction(id, peerCid) {
+  const db = openHistory(id);
+  return db.transaction(() => {
+    const messages = db.prepare(`
+      UPDATE messages SET inbox_state = 'unread'
+      WHERE direction = 'in' AND peer_cid = ? AND inbox_state = 'pending_introduction'
+    `).run(peerCid).changes;
+    const files = db.prepare(`
+      UPDATE files SET inbox_state = 'unread'
+      WHERE direction = 'in' AND peer_cid = ? AND inbox_state = 'pending_introduction'
+    `).run(peerCid).changes;
+    return messages + files;
+  })();
+}
+function rejectPendingIntroduction(id, peerCid) {
+  const db = openHistory(id);
+  return db.transaction(() => {
+    const messages = db.prepare(`
+      DELETE FROM messages
+      WHERE direction = 'in' AND peer_cid = ? AND inbox_state = 'pending_introduction'
+    `).run(peerCid).changes;
+    const files = db.prepare(`
+      DELETE FROM files
+      WHERE direction = 'in' AND peer_cid = ? AND inbox_state = 'pending_introduction'
+    `).run(peerCid).changes;
+    return messages + files;
+  })();
+}
+function batchLimit(value) {
+  const limit = value ?? DEFAULT_BATCH;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_BATCH) {
+    throw new Error(`limit must be an integer from 1 to ${MAX_BATCH}`);
+  }
+  return limit;
+}
+function listIncomingMessages(id) {
+  const rows = openHistory(id).prepare(`
+    SELECT seq, wire_id, peer_cid, peer_name_snapshot, occurred_at_ms,
+           reply_to_wire_id, reply_to_sentence, encryption
+    FROM messages
+    WHERE direction = 'in' AND inbox_state = 'unread'
+    ORDER BY seq ASC
+  `).all();
+  return rows.map((row) => ({
+    seq: row.seq,
+    msg_id: row.seq,
+    wire_id: row.wire_id,
+    from: { id: row.peer_cid, name: row.peer_name_snapshot },
+    occurred_at_ms: row.occurred_at_ms,
+    date: iso(row.occurred_at_ms),
+    encryption: row.encryption,
+    inbox_state: "unread",
+    status: "unread",
+    reply_to: reply(row)
+  }));
+}
+function takeUnreadMessages(id, input = {}) {
+  const db = openHistory(id);
+  const limit = batchLimit(input.limit);
+  return db.transaction(() => {
+    const rows = db.prepare(`
+      SELECT * FROM messages
+      WHERE direction = 'in' AND inbox_state = 'unread'
+      ORDER BY seq ASC LIMIT ?
+    `).all(limit);
+    const mark = db.prepare(`
+      UPDATE messages SET inbox_state = 'read'
+      WHERE seq = ? AND direction = 'in' AND inbox_state = 'unread'
+    `);
+    for (const row of rows) {
+      if (mark.run(row.seq).changes !== 1) throw new Error(`message row ${row.seq} changed during read batch`);
+      row.inbox_state = "read";
+    }
+    const remaining = Number(db.prepare(`
+      SELECT COUNT(*) FROM messages WHERE direction = 'in' AND inbox_state = 'unread'
+    `).pluck().get());
+    return { messages: rows.map(messageFromRow), remaining };
+  })();
+}
+function listIncomingFiles(id) {
+  const rows = openHistory(id).prepare(`
+    SELECT * FROM files WHERE direction = 'in' AND inbox_state = 'unread' ORDER BY seq ASC
+  `).all();
+  return rows.map((row) => fileFromRow(id, row));
+}
+function takeUnreadFiles(id, input = {}) {
+  const db = openHistory(id);
+  const limit = batchLimit(input.limit);
+  const requested = input.wire_ids;
+  return db.transaction(() => {
+    let rows;
+    if (requested !== void 0) {
+      if (requested.length < 1 || requested.length > MAX_BATCH) throw new Error(`wire_ids must contain 1-${MAX_BATCH} items`);
+      if (new Set(requested).size !== requested.length) throw new Error("wire_ids must not contain duplicates");
+      const get = db.prepare(`
+        SELECT * FROM files WHERE wire_id = ? AND direction = 'in' AND inbox_state = 'unread'
+      `);
+      rows = requested.map((wireId) => get.get(wireId)).filter((row) => !!row);
+      if (rows.length !== requested.length) throw new Error("selected file wire_id is unknown, stale, or no longer unread");
+    } else {
+      rows = db.prepare(`
+        SELECT * FROM files WHERE direction = 'in' AND inbox_state = 'unread'
+        ORDER BY seq ASC LIMIT ?
+      `).all(limit);
+    }
+    const mark = db.prepare(`
+      UPDATE files SET inbox_state = 'read'
+      WHERE seq = ? AND direction = 'in' AND inbox_state = 'unread'
+    `);
+    for (const row of rows) {
+      if (mark.run(row.seq).changes !== 1) throw new Error(`file row ${row.seq} changed during read batch`);
+      row.inbox_state = "read";
+    }
+    const remaining = Number(db.prepare(`
+      SELECT COUNT(*) FROM files WHERE direction = 'in' AND inbox_state = 'unread'
+    `).pluck().get());
+    return { files: rows.map((row) => fileFromRow(id, row)), remaining };
+  })();
+}
+function historyWhere(query) {
+  const clauses = [];
+  const args = [];
+  if (query.peer_cid !== void 0) {
+    clauses.push("peer_cid = ?");
+    args.push(query.peer_cid);
+  }
+  if (query.direction !== void 0) {
+    clauses.push("direction = ?");
+    args.push(query.direction);
+  }
+  if (query.before_seq !== void 0) {
+    clauses.push("seq < ?");
+    args.push(query.before_seq);
+  }
+  return { sql: clauses.length ? `WHERE ${clauses.join(" AND ")}` : "", args };
+}
+function listMessageHistory(id, query = {}) {
+  const db = openHistory(id);
+  const limit = batchLimit(query.limit);
+  const where = historyWhere(query);
+  const rows = db.prepare(`SELECT * FROM messages ${where.sql} ORDER BY seq DESC LIMIT ?`).all(...where.args, limit + 1);
+  const hasMore = rows.length > limit;
+  if (hasMore) rows.pop();
+  return { items: rows.map(messageFromRow), next_cursor: hasMore ? rows.at(-1).seq : null };
+}
+function getMessageHistoryItem(id, wireId) {
+  const row = openHistory(id).prepare("SELECT * FROM messages WHERE wire_id = ?").get(wireId);
+  return row ? messageFromRow(row) : null;
+}
+function listFileHistory(id, query = {}) {
+  const db = openHistory(id);
+  const limit = batchLimit(query.limit);
+  const where = historyWhere(query);
+  const rows = db.prepare(`SELECT * FROM files ${where.sql} ORDER BY seq DESC LIMIT ?`).all(...where.args, limit + 1);
+  const hasMore = rows.length > limit;
+  if (hasMore) rows.pop();
+  return { items: rows.map((row) => fileFromRow(id, row)), next_cursor: hasMore ? rows.at(-1).seq : null };
+}
+function getFileHistoryItem(id, wireId) {
+  const row = openHistory(id).prepare("SELECT * FROM files WHERE wire_id = ?").get(wireId);
+  return row ? fileFromRow(id, row) : null;
+}
+function resolveStoredFile(id, wireId) {
+  const item = getFileHistoryItem(id, wireId);
+  if (!item || !fs3.existsSync(item.blob_path)) return null;
+  const identityRoot = resolve2(id.dir);
+  const resolvedPath = resolve2(item.blob_path);
+  return resolvedPath.startsWith(`${identityRoot}${sep}`) ? resolvedPath : null;
+}
+function updateDeliveryState(id, peerCid, kind, wireIds) {
+  const db = openHistory(id);
+  const rank = kind === "read" ? 2 : 1;
+  const tx = db.transaction(() => {
+    for (const wireId of wireIds) {
+      for (const table of ["messages", "files"]) {
+        db.prepare(`
+          UPDATE ${table}
+          SET delivery_state = ?, human_read_at_ms = CASE WHEN ? = 'read' THEN COALESCE(human_read_at_ms, ?) ELSE human_read_at_ms END
+          WHERE wire_id = ? AND peer_cid = ? AND direction = 'out'
+            AND (CASE delivery_state WHEN 'read' THEN 2 WHEN 'delivered' THEN 1 WHEN 'sent' THEN 0 ELSE -1 END) < ?
+        `).run(kind, kind, Date.now(), wireId, peerCid, rank);
+      }
+    }
+  });
+  tx();
+}
 
 // ../../src/constants.ts
 var FILE_SELECTION_CAP = 32;
@@ -207,16 +784,15 @@ function setRegistrar(id) {
 function setRegistrarAdBlob(blob) {
   registrarAdBlob = blob;
 }
-var identityDir = (name) => join3(STATE_DIR, name);
-var keyPath = (dir) => join3(dir, "identity.key");
-var dataPath = (dir) => join3(dir, "state_data.bin");
-var notifyLogPath = (dir) => join3(dir, "notifications.log");
-var unreadPath = (dir) => join3(dir, "unread.json");
-var filesDirFor = (id) => join3(id.dir, "files");
-var tempMetaPath = (dir) => join3(dir, "temp.json");
-var hashLeaseToken = (token) => createHash("sha256").update(token).digest("hex");
+var identityDir = (name) => join4(STATE_DIR, name);
+var keyPath = (dir) => join4(dir, "identity.key");
+var dataPath = (dir) => join4(dir, "state_data.bin");
+var notifyLogPath = (dir) => join4(dir, "notifications.log");
+var unreadPath = (dir) => join4(dir, "unread.json");
+var tempMetaPath = (dir) => join4(dir, "temp.json");
+var hashLeaseToken = (token) => createHash2("sha256").update(token).digest("hex");
 function writeTempMetaFile(dir, meta) {
-  fs3.writeFileSync(
+  fs4.writeFileSync(
     tempMetaPath(dir),
     JSON.stringify({ v: 1, owner: { token_sha256: meta.owner.tokenHash, pid: meta.owner.pid }, created_at: meta.createdAt }),
     { mode: 384 }
@@ -224,7 +800,7 @@ function writeTempMetaFile(dir, meta) {
 }
 function readTempMetaFile(dir) {
   try {
-    const raw = JSON.parse(fs3.readFileSync(tempMetaPath(dir), "utf8"));
+    const raw = JSON.parse(fs4.readFileSync(tempMetaPath(dir), "utf8"));
     if (raw.v !== 1 || typeof raw.owner?.token_sha256 !== "string" || typeof raw.owner?.pid !== "number") return null;
     return {
       owner: { tokenHash: raw.owner.token_sha256, pid: raw.owner.pid },
@@ -236,45 +812,58 @@ function readTempMetaFile(dir) {
 }
 function tightenIdentityPerms() {
   for (const name of listPersistedNames()) {
-    const dir = join3(STATE_DIR, name);
+    const dir = join4(STATE_DIR, name);
     try {
-      fs3.chmodSync(dir, 448);
+      fs4.chmodSync(dir, 448);
     } catch (err) {
       log(`[${name}] chmod 0700 failed:`, String(err));
     }
-    for (const f of [dataPath(dir), keyPath(dir)]) {
-      if (!fs3.existsSync(f)) continue;
+    for (const f of [dataPath(dir), keyPath(dir), historyPath({ dir }), `${historyPath({ dir })}-wal`, `${historyPath({ dir })}-shm`, notifyLogPath(dir), unreadPath(dir)]) {
+      if (!fs4.existsSync(f)) continue;
       try {
-        fs3.chmodSync(f, 384);
+        fs4.chmodSync(f, 384);
       } catch (err) {
         log(`[${name}] chmod 0600 ${f} failed:`, String(err));
       }
     }
+    const blobs = join4(dir, "blobs");
+    if (fs4.existsSync(blobs)) {
+      const tightenTree = (path) => {
+        for (const entry of fs4.readdirSync(path, { withFileTypes: true })) {
+          const child = join4(path, entry.name);
+          if (entry.isDirectory()) {
+            fs4.chmodSync(child, 448);
+            tightenTree(child);
+          } else if (entry.isFile()) fs4.chmodSync(child, 384);
+        }
+      };
+      try {
+        fs4.chmodSync(blobs, 448);
+        tightenTree(blobs);
+      } catch (err) {
+        log(`[${name}] chmod history blobs failed:`, String(err));
+      }
+    }
   }
 }
 var isWireId = (s) => /^[A-Za-z0-9]+$/.test(s) && s.length > 0 && s.length <= 128;
 var isSelectableWireId = (s) => /^[A-Fa-f0-9]{64}$/.test(s);
 function findIdentityFile(id, wireId) {
   if (!isWireId(wireId)) return null;
-  const dir = filesDirFor(id);
-  let entries;
   try {
-    entries = fs3.readdirSync(dir);
+    return resolveStoredFile(id, wireId);
   } catch {
     return null;
   }
-  const prefix = `${wireId}-`;
-  const match = entries.find((name) => name.startsWith(prefix));
-  return match ? join3(dir, match) : null;
 }
 function listPersistedNames() {
-  if (!fs3.existsSync(STATE_DIR)) return [];
-  return fs3.readdirSync(STATE_DIR, { withFileTypes: true }).filter((d) => d.isDirectory() && fs3.existsSync(keyPath(join3(STATE_DIR, d.name)))).map((d) => d.name);
+  if (!fs4.existsSync(STATE_DIR)) return [];
+  return fs4.readdirSync(STATE_DIR, { withFileTypes: true }).filter((d) => d.isDirectory() && fs4.existsSync(keyPath(join4(STATE_DIR, d.name)))).map((d) => d.name);
 }
 
 // ../../src/identity/lease.ts
-import { join as join4 } from "node:path";
-import * as fs4 from "node:fs";
+import { join as join5 } from "node:path";
+import * as fs5 from "node:fs";
 var leases = /* @__PURE__ */ new Map();
 var tombstones = /* @__PURE__ */ new Set();
 var sessionHeaders = /* @__PURE__ */ new Map();
@@ -292,17 +881,17 @@ function leaseByToken(token) {
   for (const l of leases.values()) if (l.token === token) return l;
   return void 0;
 }
-var bindingsSnapshotPath = () => join4(STATE_DIR, "bindings.json");
+var bindingsSnapshotPath = () => join5(STATE_DIR, "bindings.json");
 function persistBindings() {
   try {
-    fs4.mkdirSync(STATE_DIR, { recursive: true });
+    fs5.mkdirSync(STATE_DIR, { recursive: true });
     const tmp = `${bindingsSnapshotPath()}.tmp`;
-    fs4.writeFileSync(tmp, JSON.stringify({
+    fs5.writeFileSync(tmp, JSON.stringify({
       pid: process.pid,
       bound: [...leases.keys()],
       holders: [...leases.values()].map((l) => ({ identity: l.identity, pid: l.pid }))
     }));
-    fs4.renameSync(tmp, bindingsSnapshotPath());
+    fs5.renameSync(tmp, bindingsSnapshotPath());
   } catch (err) {
     log("failed to persist bindings snapshot:", String(err));
   }
@@ -349,18 +938,18 @@ function bindSession(sid, name) {
 
 // ../../src/identity/hierarchy.ts
 import { join as join8 } from "node:path";
-import * as fs9 from "node:fs";
+import * as fs10 from "node:fs";
 
 // ../../src/mufl/tx.ts
 import { AdaptObjectLifetime as AdaptObjectLifetime2 } from "@adapt-toolkit/sdk/common";
 import { object_to_adapt_value } from "@adapt-toolkit/sdk/wrapper";
 
 // ../../src/state.ts
-import * as fs8 from "node:fs";
+import * as fs9 from "node:fs";
 import { randomBytes as randomBytes2 } from "node:crypto";
 
 // ../../src/identity/provision.ts
-import * as fs7 from "node:fs";
+import * as fs8 from "node:fs";
 import { randomBytes } from "node:crypto";
 import { PacketWrapperConfigurator } from "@adapt-toolkit/sdk/wrappers";
 
@@ -369,42 +958,7 @@ import { AdaptObjectLifetime } from "@adapt-toolkit/sdk/common";
 
 // ../../src/notify.ts
 import { join as join6 } from "node:path";
-import * as fs5 from "node:fs";
-
-// ../../src/inbox.ts
-var E2E_RECV_EVENTS = /* @__PURE__ */ new Set(["e2e_app_recv", "migration_deferred_flush"]);
-function e2eWireIdsFromEvents(events) {
-  const out = /* @__PURE__ */ new Set();
-  for (const ev of events) {
-    if (!ev || typeof ev !== "object") continue;
-    const event = ev.event;
-    if (typeof event !== "string" || !E2E_RECV_EVENTS.has(event)) continue;
-    const wire = ev.wire_id;
-    if (typeof wire === "string" && wire.length > 0) out.add(wire);
-  }
-  return out;
-}
-function encryptionFor(wireId, e2eWireIds) {
-  return wireId && e2eWireIds.has(wireId) ? "e2e" : "legacy";
-}
-function toMessageJson(m, e2eWireIds) {
-  const encryption = encryptionFor(m.wire_id, e2eWireIds);
-  return {
-    msg_id: m.msg_id,
-    wire_id: m.wire_id,
-    from: { id: m.sender_id, name: m.sender_name },
-    encryption,
-    transport: encryption === "e2e" ? "double_ratchet" : "legacy_box",
-    text: m.text,
-    date: m.date,
-    status: m.status,
-    reply_to: m.reply_to
-  };
-}
-function buildMessagesPayload(msgs, e2eWireIds) {
-  const messages = msgs.map((m) => toMessageJson(m, e2eWireIds));
-  return { count: messages.length, messages };
-}
+import * as fs6 from "node:fs";
 
 // ../../src/events.ts
 var nonEmptyString = (value) => typeof value === "string" && value.length > 0;
@@ -470,628 +1024,148 @@ function emitDaemonNotification(identityName, summary) {
   handlers.notification(identityName, summary);
 }
 
-// ../../src/render/adapt-to-json.ts
-import { basename as basename2, join as join5 } from "node:path";
-import { createHash as createHash2, randomUUID } from "node:crypto";
-import { mkdir, open, rename, unlink, lstat } from "node:fs/promises";
-import { brotliCompressSync, brotliDecompressSync } from "node:zlib";
-
-// ../../src/files.ts
-import { basename, extname } from "node:path";
-var FILE_MIME = {
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".bmp": "image/bmp",
-  ".ico": "image/x-icon",
-  ".pdf": "application/pdf",
-  ".txt": "text/plain",
-  ".md": "text/markdown",
-  ".json": "application/json",
-  ".csv": "text/csv",
-  ".html": "text/html",
-  ".xml": "application/xml",
-  ".zip": "application/zip",
-  ".gz": "application/gzip",
-  ".tar": "application/x-tar",
-  ".mp3": "audio/mpeg",
-  ".wav": "audio/wav",
-  ".mp4": "video/mp4",
-  ".mov": "video/quicktime"
-};
-function mimeFromExt(p) {
-  return FILE_MIME[extname(p).toLowerCase()] ?? "application/octet-stream";
-}
-function sanitizeFilename(name) {
-  const base = basename(name).replace(/[^A-Za-z0-9._-]/g, "_");
-  return base.length ? base.slice(0, 200) : "file";
+// ../../src/notify.ts
+var installed = null;
+function setNotifyHook(fn) {
+  installed?.uninstall();
+  installed = fn === null ? null : { hook: fn, uninstall: setDaemonEventHandler("notification", fn) };
 }
-
-// ../../src/transcribe.ts
-var VOICE_MESSAGE_MIME_PARAM = "x-ours-kind=voice-message";
-var VOICE_MESSAGE_FILENAME_PREFIX = "voice-message-";
-function isVoiceMessage(mime, filename) {
-  const parts = (mime ?? "").toLowerCase().split(";").map((p) => p.trim());
-  if (parts[0].startsWith("audio/") && parts.slice(1).includes(VOICE_MESSAGE_MIME_PARAM)) return true;
-  return filename.toLowerCase().startsWith(VOICE_MESSAGE_FILENAME_PREFIX) && parts[0].startsWith("audio/");
+function clearNotifyHook(fn) {
+  if (installed?.hook === fn) {
+    installed.uninstall();
+    installed = null;
+  }
 }
-function baseMime(mime) {
-  return (mime ?? "").split(";")[0].trim() || "application/octet-stream";
+function fireNotify(identityName, summary) {
+  emitDaemonNotification(identityName, summary);
 }
-var STT_PROVIDERS = ["openai-compatible", "elevenlabs", "deepgram", "custom"];
-var STT_MAX_BYTES_DEFAULT = 5 * 1024 * 1024;
-var STT_TIMEOUT_MS_DEFAULT = 6e4;
-function sttStatus(cfg) {
-  const hint = "configure it in config.json `stt: {}` or via OURS_STT_* env";
-  if (!cfg?.provider) {
-    return { ready: false, reason: `no STT provider configured (stt.provider: ${STT_PROVIDERS.join(" | ")}) \u2014 ${hint}` };
-  }
-  const provider = cfg.provider.trim().toLowerCase();
-  if (!STT_PROVIDERS.includes(provider)) {
-    return { ready: false, reason: `unknown STT provider "${cfg.provider}" (expected: ${STT_PROVIDERS.join(" | ")})` };
+var notifyHooks = {
+  onNotify: (identityName, summary) => fireNotify(identityName, summary)
+};
+var NOTIFY_KIND_SETS = {
+  // Genuine inbound arrivals — something addressed to this identity landed.
+  inbound: ["message_received", "file_received"],
+  // Introduction bookkeeping — not an arrival, but an away agent must act on it.
+  intro: ["local_contact_request", "pending_message"],
+  // What `ours-mcp watch` surfaces: arrivals plus the intro events. This is
+  // 7a7ec16's whitelist exactly, and it is a UNION rather than a third list so
+  // the two cannot drift apart.
+  get wake() {
+    return [...NOTIFY_KIND_SETS.inbound, ...NOTIFY_KIND_SETS.intro];
   }
-  if (!cfg.apiKey?.trim()) {
-    return { ready: false, reason: `STT provider "${provider}" is set but the API key is missing (stt.apiKey / OURS_STT_API_KEY)` };
+};
+function parseNotifyKinds(kindsParam) {
+  if (kindsParam === null || kindsParam === "") return null;
+  const keep = /* @__PURE__ */ new Set();
+  for (const raw of kindsParam.split(",")) {
+    const kind = raw.trim();
+    if (kind === "") continue;
+    const events = NOTIFY_KIND_SETS[kind];
+    if (!events) throw new Error(kind);
+    for (const e of events) keep.add(e);
   }
-  if (provider === "openai-compatible") {
-    if (!cfg.baseUrl?.trim()) {
-      return { ready: false, reason: "openai-compatible STT needs stt.baseUrl / OURS_STT_BASE_URL (e.g. your provider's /v1 root) \u2014 no endpoint is assumed" };
+  return keep;
+}
+function notifyEventMatches(event, keep) {
+  if (keep === null) return true;
+  return typeof event.event === "string" && keep.has(event.event);
+}
+var notifyWaiters = /* @__PURE__ */ new Map();
+function fireNotifyWaiters(name) {
+  const set = notifyWaiters.get(name);
+  if (!set || set.size === 0) return;
+  for (const w of [...set]) {
+    try {
+      w();
+    } catch {
     }
-    if (!cfg.model?.trim()) {
-      return { ready: false, reason: "openai-compatible STT needs stt.model / OURS_STT_MODEL (passed to the provider verbatim) \u2014 no model is assumed" };
+  }
+}
+function waitForNotify(name, ms) {
+  return new Promise((resolve3) => {
+    let set = notifyWaiters.get(name);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      notifyWaiters.set(name, set);
     }
+    let done = false;
+    const finish = () => {
+      if (done) return;
+      done = true;
+      set.delete(fn);
+      if (set.size === 0) notifyWaiters.delete(name);
+      clearTimeout(timer);
+      resolve3();
+    };
+    const fn = finish;
+    const timer = setTimeout(finish, ms);
+    set.add(fn);
+  });
+}
+var NOTIFY_BODY_KEYS = /* @__PURE__ */ new Set(["body", "text", "payload", "data", "bytes", "content"]);
+function bodyFreeNotifyValue(value) {
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array) return void 0;
+  if (Array.isArray(value)) {
+    return value.map(bodyFreeNotifyValue).filter((item) => item !== void 0);
   }
-  if (provider === "elevenlabs" && !cfg.model?.trim()) {
-    return { ready: false, reason: "elevenlabs STT needs stt.model / OURS_STT_MODEL (the model_id, e.g. from your ElevenLabs account) \u2014 no model is assumed" };
+  if (!value || typeof value !== "object") return value;
+  const clean = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (NOTIFY_BODY_KEYS.has(key.toLowerCase())) continue;
+    const sanitized = bodyFreeNotifyValue(item);
+    if (sanitized !== void 0) clean[key] = sanitized;
   }
-  if (provider === "custom") {
-    if (!cfg.custom?.url?.trim()) {
-      return { ready: false, reason: "custom STT needs stt.custom.url (the full endpoint URL of your provider)" };
-    }
-    const wantsModel = cfg.custom.url.includes("{model}") || cfg.custom.modelField !== void 0 && cfg.custom.modelField !== "";
-    if (wantsModel && !cfg.model?.trim()) {
-      return { ready: false, reason: "the custom STT template references a model (url {model} or modelField) but stt.model / OURS_STT_MODEL is not set" };
-    }
+  return clean;
+}
+function appendNotifyLog(id, event) {
+  const contentFree = bodyFreeNotifyValue(event);
+  try {
+    fs6.mkdirSync(id.dir, { recursive: true, mode: 448 });
+    const path = notifyLogPath(id.dir);
+    fs6.appendFileSync(path, JSON.stringify(contentFree) + "\n", { mode: 384 });
+    fs6.chmodSync(path, 384);
+  } catch (err) {
+    log(`[${id.name}] failed to append notifications.log:`, String(err));
   }
-  return { ready: true, provider };
+  fireNotifyWaiters(id.name);
+  emitDaemonEvent(id, contentFree);
 }
-function textAtPath(obj, path) {
-  let cur = obj;
-  for (const seg of path.split(".")) {
-    if (cur === null || typeof cur !== "object") return void 0;
-    cur = cur[seg];
+function binHexField(av, field) {
+  const x = av.Reduce(field);
+  return x.IsNil() ? "" : Buffer.from(x.GetBinary()).toString("hex");
+}
+var NOTIFY_LONGPOLL_MS = Number(process.env.OURS_NOTIFY_LONGPOLL_MS) > 0 ? Number(process.env.OURS_NOTIFY_LONGPOLL_MS) : 25e3;
+var NOTIFY_RECHECK_MS = 250;
+function notifyLogSize(logPath) {
+  try {
+    return fs6.statSync(logPath).size;
+  } catch {
+    return 0;
   }
-  return typeof cur === "string" ? cur : void 0;
 }
-async function request(url, init, timeoutMs, secrets = []) {
-  const aborter = new AbortController();
-  const timer = setTimeout(() => aborter.abort(), timeoutMs);
+function readNotifyRange(logPath, from, to) {
+  if (to <= from) return { events: [], cursor: from };
+  const buf = Buffer.alloc(to - from);
+  let read = 0;
   try {
-    const resp = await fetch(url, { ...init, signal: aborter.signal });
-    if (!resp.ok) {
-      let detail = await resp.text().catch(() => "");
-      for (const secret of secrets) {
-        if (secret) detail = detail.split(secret).join("[redacted]");
-      }
-      return { ok: false, error: `STT HTTP ${resp.status}${detail ? `: ${detail.slice(0, 200)}` : ""}` };
+    const fd = fs6.openSync(logPath, "r");
+    try {
+      read = fs6.readSync(fd, buf, 0, buf.length, from);
+    } finally {
+      fs6.closeSync(fd);
     }
-    return { ok: true, json: await resp.json() };
-  } catch (err) {
-    if (err?.name === "AbortError") {
-      return { ok: false, error: `STT timeout after ${timeoutMs}ms` };
-    }
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-var audioBlob = (bytes, mime) => (
-  // Copy into a plain Uint8Array — a Buffer is not a valid BlobPart.
-  new Blob([new Uint8Array(bytes)], { type: baseMime(mime) })
-);
-var openaiCompatible = async (bytes, filename, mime, cfg, timeoutMs) => {
-  const form = new FormData();
-  form.set("file", audioBlob(bytes, mime), filename);
-  form.set("model", cfg.model.trim());
-  form.set("response_format", "json");
-  if (cfg.language?.trim()) form.set("language", cfg.language.trim());
-  const r = await request(
-    `${cfg.baseUrl.trim().replace(/\/$/, "")}/audio/transcriptions`,
-    { method: "POST", headers: { Authorization: `Bearer ${cfg.apiKey.trim()}` }, body: form },
-    timeoutMs,
-    [cfg.apiKey.trim()]
-  );
-  if (!r.ok) return r;
-  const text = textAtPath(r.json, "text");
-  return text !== void 0 ? { ok: true, text } : { ok: false, error: "STT response missing text" };
-};
-var elevenlabs = async (bytes, filename, mime, cfg, timeoutMs) => {
-  const form = new FormData();
-  form.set("file", audioBlob(bytes, mime), filename);
-  form.set("model_id", cfg.model.trim());
-  if (cfg.language?.trim()) form.set("language_code", cfg.language.trim());
-  const r = await request(
-    `${(cfg.baseUrl?.trim() || "https://api.elevenlabs.io").replace(/\/$/, "")}/v1/speech-to-text`,
-    { method: "POST", headers: { "xi-api-key": cfg.apiKey.trim() }, body: form },
-    timeoutMs,
-    [cfg.apiKey.trim()]
-  );
-  if (!r.ok) return r;
-  const text = textAtPath(r.json, "text");
-  return text !== void 0 ? { ok: true, text } : { ok: false, error: "STT response missing text" };
-};
-var deepgram = async (bytes, _filename, mime, cfg, timeoutMs) => {
-  const params = new URLSearchParams();
-  if (cfg.model?.trim()) params.set("model", cfg.model.trim());
-  if (cfg.language?.trim()) params.set("language", cfg.language.trim());
-  const q = params.toString();
-  const r = await request(
-    `${(cfg.baseUrl?.trim() || "https://api.deepgram.com").replace(/\/$/, "")}/v1/listen${q ? `?${q}` : ""}`,
-    {
-      method: "POST",
-      headers: { Authorization: `Token ${cfg.apiKey.trim()}`, "Content-Type": baseMime(mime) },
-      body: new Uint8Array(bytes)
-    },
-    timeoutMs,
-    [cfg.apiKey.trim()]
-  );
-  if (!r.ok) return r;
-  const text = textAtPath(r.json, "results.channels.0.alternatives.0.transcript");
-  return text !== void 0 ? { ok: true, text } : { ok: false, error: "STT response missing transcript" };
-};
-var custom = async (bytes, filename, mime, cfg, timeoutMs) => {
-  const t = cfg.custom;
-  const model = cfg.model?.trim() ?? "";
-  const url = t.url.replaceAll("{model}", encodeURIComponent(model));
-  const headers = {};
-  const authName = t.authHeaderName?.trim() || "Authorization";
-  const authValue = (t.authHeaderTemplate ?? "Bearer {key}").replaceAll("{key}", cfg.apiKey.trim());
-  if (authValue) headers[authName] = authValue;
-  const mode = t.bodyMode ?? "multipart";
-  const fileField = t.fileField?.trim() || "file";
-  const modelField = t.modelField === void 0 ? "model" : t.modelField.trim();
-  let body;
-  if (mode === "multipart") {
-    const form = new FormData();
-    form.set(fileField, audioBlob(bytes, mime), filename);
-    if (modelField && model) form.set(modelField, model);
-    for (const [k, v] of Object.entries(t.extraFields ?? {})) form.set(k, v);
-    body = form;
-  } else if (mode === "raw") {
-    headers["Content-Type"] = baseMime(mime);
-    body = new Uint8Array(bytes);
-  } else {
-    headers["Content-Type"] = "application/json";
-    body = JSON.stringify({
-      [fileField]: bytes.toString("base64"),
-      ...modelField && model ? { [modelField]: model } : {},
-      ...t.extraFields ?? {}
-    });
-  }
-  const r = await request(url, { method: t.method?.trim() || "POST", headers, body }, timeoutMs, [cfg.apiKey.trim()]);
-  if (!r.ok) return r;
-  const text = textAtPath(r.json, t.responseTextPath?.trim() || "text");
-  return text !== void 0 ? { ok: true, text } : { ok: false, error: `STT response has no text at "${t.responseTextPath?.trim() || "text"}"` };
-};
-var ADAPTERS = {
-  "openai-compatible": openaiCompatible,
-  elevenlabs,
-  deepgram,
-  custom
-};
-async function transcribeVoice(bytes, filename, mime, cfg) {
-  const status = sttStatus(cfg);
-  if (!status.ready) return { ok: false, error: status.reason };
-  const maxBytes = cfg.maxBytes ?? STT_MAX_BYTES_DEFAULT;
-  if (bytes.length > maxBytes) {
-    return { ok: false, error: `voice message is ${bytes.length} B \u2014 over the ${maxBytes} B STT limit (stt.maxBytes)` };
-  }
-  const timeoutMs = cfg.timeoutMs ?? STT_TIMEOUT_MS_DEFAULT;
-  try {
-    return await ADAPTERS[status.provider](bytes, filename, mime, cfg, timeoutMs);
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  }
-}
-function voiceErrorCategory(error) {
-  if (/limit|over .* bytes/i.test(error)) return "size_limit";
-  if (/timeout/i.test(error)) return "timeout";
-  if (/HTTP \d+/i.test(error)) return "provider_http";
-  if (/missing|no text|no transcript/i.test(error)) return "invalid_response";
-  return "provider_error";
-}
-function structuredVoiceOutcome(readiness, outcome, association) {
-  if (!readiness.ready || outcome.kind === "unconfigured") {
-    return {
-      configured: false,
-      attempted: false,
-      status: "unavailable",
-      provider: null,
-      text: null,
-      error_category: "not_configured",
-      audio_path: association.audioPath,
-      file_wire_id: association.wireId
-    };
-  }
-  if (outcome.kind === "transcript") {
-    return {
-      configured: true,
-      attempted: true,
-      status: "succeeded",
-      provider: readiness.provider,
-      text: outcome.text,
-      error_category: null,
-      audio_path: association.audioPath,
-      file_wire_id: association.wireId
-    };
-  }
-  return {
-    configured: true,
-    attempted: true,
-    status: "failed",
-    provider: readiness.provider,
-    text: null,
-    error_category: voiceErrorCategory(outcome.error),
-    audio_path: association.audioPath,
-    file_wire_id: association.wireId
-  };
-}
-function voiceDeliveryLine(args, outcome) {
-  const head = `  \u2022 \u{1F3A4} voice message from ${args.sender} (${args.sizeBytes} B)`;
-  const tail = `audio saved \u2192 ${args.savedPath} {${args.wire}}`;
-  switch (outcome.kind) {
-    case "transcript":
-      return `${head}: "${outcome.text}" \u2014 transcribed from voice message (STT); ${tail}`;
-    case "unconfigured":
-      return `${head}: cannot transcribe \u2014 ${outcome.reason}. Tell the user you can't listen to voice messages until the operator configures transcription on this ours-mcp server, and ask them to send text meanwhile; ${tail}`;
-    case "failed":
-      return `${head}: transcription failed (${outcome.error}). Tell the user their voice message could not be transcribed right now and ask them to send text or retry; ${tail}`;
-  }
-}
-
-// ../../src/render/adapt-to-json.ts
-function renderContacts(v) {
-  const out = [];
-  if (v.IsNil()) return out;
-  for (const key of v.GetKeys()) {
-    const c = v.Reduce(key);
-    if (c.IsNil()) continue;
-    out.push({
-      name: c.Reduce("name").Visualize(),
-      container_id: c.Reduce("container_id").Visualize()
-    });
-  }
-  return out;
-}
-function renderImportRenames(v) {
-  const out = {};
-  if (v.IsNil()) return out;
-  for (const key of v.GetKeys()) {
-    const n = v.Reduce(key);
-    if (!n.IsNil()) out[typeof key === "string" ? key : key.Visualize()] = n.Visualize();
-  }
-  return out;
-}
-function renderInbox(v) {
-  const out = [];
-  if (v.IsNil()) return out;
-  for (let i = 0; ; i++) {
-    const m = v.Reduce(i);
-    if (m.IsNil()) break;
-    const rt = m.Reduce("reply_to");
-    let reply_to = null;
-    if (!rt.IsNil()) {
-      reply_to = { wire_id: rt.Reduce("wire_id").Visualize() };
-      const s = rt.Reduce("sentence");
-      if (!s.IsNil()) reply_to.sentence = parseInt(s.Visualize(), 10);
-    }
-    out.push({
-      msg_id: parseInt(m.Reduce("msg_id").Visualize(), 10),
-      sender_id: m.Reduce("sender_id").Visualize(),
-      sender_name: m.Reduce("sender_name").Visualize(),
-      text: m.Reduce("text").Visualize(),
-      date: m.Reduce("date").Visualize(),
-      status: m.Reduce("status").Visualize(),
-      wire_id: m.Reduce("wire_id").Visualize(),
-      reply_to
-    });
-  }
-  return out;
-}
-function renderFileMetadata(v) {
-  const files = [];
-  if (v.IsNil()) return files;
-  for (let i = 0; ; i++) {
-    const f = v.Reduce(i);
-    if (f.IsNil()) break;
-    const filename = f.Reduce("filename").Visualize();
-    const mime = f.Reduce("mime").Visualize() || "application/octet-stream";
-    const reply = f.Reduce("reply_to");
-    let reply_to = null;
-    if (!reply.IsNil()) {
-      reply_to = { wire_id: reply.Reduce("wire_id").Visualize() };
-      const sentence = parseInt(reply.Reduce("sentence").Visualize(), 10);
-      if (Number.isSafeInteger(sentence) && sentence > 0) reply_to.sentence = sentence;
-    }
-    files.push({
-      file_id: parseInt(f.Reduce("file_id").Visualize(), 10),
-      wire_id: f.Reduce("wire_id").Visualize(),
-      from: { id: f.Reduce("sender_id").Visualize(), name: f.Reduce("sender_name").Visualize() },
-      filename,
-      mime,
-      size: parseInt(f.Reduce("size").Visualize(), 10),
-      size_source: "received_payload",
-      status: f.Reduce("status").Visualize(),
-      date: f.Reduce("date").Visualize(),
-      sha256: null,
-      reply_to,
-      kind: isVoiceMessage(mime, filename) ? "voice_message" : "file"
-    });
-  }
-  return files;
-}
-async function writeReceivedFileSafely(dir, outPath, bytes) {
-  await mkdir(dir, { recursive: true, mode: 448 });
-  const dirStat = await lstat(dir);
-  if (!dirStat.isDirectory() || dirStat.isSymbolicLink()) throw new Error("received-files directory is not a safe directory");
-  const tmp = join5(dir, `.${basename2(outPath)}.${randomUUID()}.tmp`);
-  const handle = await open(tmp, "wx", 384);
-  try {
-    await handle.writeFile(bytes);
-    await handle.sync();
-  } catch (error) {
-    await handle.close().catch(() => {
-    });
-    await unlink(tmp).catch(() => {
-    });
-    throw error;
-  }
-  await handle.close();
-  try {
-    await rename(tmp, outPath);
-  } catch (error) {
-    await unlink(tmp).catch(() => {
-    });
-    throw error;
-  }
-}
-async function writeIncomingFiles(id, v) {
-  const files = [];
-  if (v.IsNil()) return { text: "No new files.", files };
-  const dir = filesDirFor(id);
-  const lines = [];
-  for (let i = 0; ; i++) {
-    const f = v.Reduce(i);
-    if (f.IsNil()) break;
-    const name = f.Reduce("filename").Visualize();
-    const mime = f.Reduce("mime").Visualize() || "application/octet-stream";
-    const sender = f.Reduce("sender_name").Visualize();
-    const senderId = f.Reduce("sender_id").Visualize();
-    const fileId = parseInt(f.Reduce("file_id").Visualize(), 10);
-    const date = f.Reduce("date").Visualize();
-    const wire = f.Reduce("wire_id").Visualize();
-    const bytes = Buffer.from(f.Reduce("data").GetBinary());
-    const sha256 = createHash2("sha256").update(bytes).digest("hex");
-    const outPath = join5(dir, `${wire}-${sanitizeFilename(name)}`);
-    await writeReceivedFileSafely(dir, outPath, bytes);
-    const base = {
-      file_id: fileId,
-      wire_id: wire,
-      from: { id: senderId, name: sender },
-      filename: name,
-      path: outPath,
-      mime,
-      size: bytes.length,
-      sha256,
-      status: "processed",
-      date,
-      kind: isVoiceMessage(mime, name) ? "voice_message" : "file",
-      sender
-    };
-    if (isVoiceMessage(mime, name)) {
-      const st = sttStatus(CONFIG.stt);
-      let outcome;
-      if (!st.ready) {
-        outcome = { kind: "unconfigured", reason: st.reason };
-      } else {
-        const r = await transcribeVoice(bytes, name, mime, CONFIG.stt);
-        outcome = r.ok ? { kind: "transcript", text: r.text } : { kind: "failed", error: r.error };
-      }
-      base.transcription = structuredVoiceOutcome(st, outcome, { audioPath: outPath, wireId: wire });
-      lines.push(voiceDeliveryLine({ sender, wire, savedPath: outPath, sizeBytes: bytes.length }, outcome));
-      files.push(base);
-      continue;
-    }
-    files.push(base);
-    lines.push(`  \u2022 ${name} (${mime}, ${bytes.length} B, sha256 ${sha256}) from ${sender} \u2192 ${outPath} {${wire}}`);
-  }
-  if (lines.length === 0) return { text: "No new files.", files };
-  return {
-    text: `${lines.length} new file(s) written to your identity's files dir \u2014 paths + metadata below (bytes stay on disk, never in this result). If your OS user can read the path, use it directly; otherwise use save_file({ wire_id, dest_path }) to stream a copy to a path you can write:
-${lines.join("\n")}`,
-    files
-  };
-}
-function renderPending(v) {
-  const out = [];
-  if (v.IsNil()) return out;
-  for (const key of v.GetKeys()) {
-    const p = v.Reduce(key);
-    if (p.IsNil()) continue;
-    out.push({
-      container_id: typeof key === "string" ? key : key.Visualize(),
-      name: p.Reduce("name").Visualize(),
-      queued: parseInt(p.Reduce("queued").Visualize(), 10) || 0
-    });
-  }
-  return out;
-}
-function renderContactRoots(v) {
-  const out = {};
-  if (v.IsNil()) return out;
-  for (const key of v.GetKeys()) {
-    const r = v.Reduce(key);
-    if (r.IsNil()) continue;
-    out[typeof key === "string" ? key : key.Visualize()] = {
-      root_cid: r.Reduce("root_cid").Visualize(),
-      root_name: r.Reduce("root_name").Visualize(),
-      role_id: r.Reduce("role_id").Visualize()
-    };
-  }
-  return out;
-}
-function encodeWireBin(raw) {
-  return brotliCompressSync(raw).toString("base64url");
-}
-function decodeWireBin(s) {
-  return brotliDecompressSync(Buffer.from(s.replace(/\s+/g, ""), "base64url"));
-}
-
-// ../../src/notify.ts
-var installed = null;
-function setNotifyHook(fn) {
-  installed?.uninstall();
-  installed = fn === null ? null : { hook: fn, uninstall: setDaemonEventHandler("notification", fn) };
-}
-function clearNotifyHook(fn) {
-  if (installed?.hook === fn) {
-    installed.uninstall();
-    installed = null;
-  }
-}
-function fireNotify(identityName, summary) {
-  emitDaemonNotification(identityName, summary);
-}
-var notifyHooks = {
-  onNotify: (identityName, summary) => fireNotify(identityName, summary)
-};
-var NOTIFY_KIND_SETS = {
-  // Genuine inbound arrivals — something addressed to this identity landed.
-  inbound: ["message_received", "file_received"],
-  // Introduction bookkeeping — not an arrival, but an away agent must act on it.
-  intro: ["local_contact_request", "pending_message"],
-  // What `ours-mcp watch` surfaces: arrivals plus the intro events. This is
-  // 7a7ec16's whitelist exactly, and it is a UNION rather than a third list so
-  // the two cannot drift apart.
-  get wake() {
-    return [...NOTIFY_KIND_SETS.inbound, ...NOTIFY_KIND_SETS.intro];
-  }
-};
-function parseNotifyKinds(kindsParam) {
-  if (kindsParam === null || kindsParam === "") return null;
-  const keep = /* @__PURE__ */ new Set();
-  for (const raw of kindsParam.split(",")) {
-    const kind = raw.trim();
-    if (kind === "") continue;
-    const events = NOTIFY_KIND_SETS[kind];
-    if (!events) throw new Error(kind);
-    for (const e of events) keep.add(e);
-  }
-  return keep;
-}
-function notifyEventMatches(event, keep) {
-  if (keep === null) return true;
-  return typeof event.event === "string" && keep.has(event.event);
-}
-var notifyWaiters = /* @__PURE__ */ new Map();
-function fireNotifyWaiters(name) {
-  const set = notifyWaiters.get(name);
-  if (!set || set.size === 0) return;
-  for (const w of [...set]) {
-    try {
-      w();
-    } catch {
-    }
-  }
-}
-function waitForNotify(name, ms) {
-  return new Promise((resolve2) => {
-    let set = notifyWaiters.get(name);
-    if (!set) {
-      set = /* @__PURE__ */ new Set();
-      notifyWaiters.set(name, set);
-    }
-    let done = false;
-    const finish = () => {
-      if (done) return;
-      done = true;
-      set.delete(fn);
-      if (set.size === 0) notifyWaiters.delete(name);
-      clearTimeout(timer);
-      resolve2();
-    };
-    const fn = finish;
-    const timer = setTimeout(finish, ms);
-    set.add(fn);
-  });
-}
-function appendNotifyLog(id, event) {
-  try {
-    fs5.mkdirSync(id.dir, { recursive: true, mode: 448 });
-    fs5.appendFileSync(notifyLogPath(id.dir), JSON.stringify(event) + "\n");
-  } catch (err) {
-    log(`[${id.name}] failed to append notifications.log:`, String(err));
-  }
-  fireNotifyWaiters(id.name);
-  emitDaemonEvent(id, event);
-}
-function readE2eWireIds(id) {
-  const logPath = notifyLogPath(id.dir);
-  let text = "";
-  try {
-    text = fs5.readFileSync(logPath, "utf8");
-  } catch {
-    return /* @__PURE__ */ new Set();
-  }
-  const events = [];
-  for (const line of text.split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      events.push(JSON.parse(line));
-    } catch {
-    }
-  }
-  return e2eWireIdsFromEvents(events);
-}
-function binHexField(av, field) {
-  const x = av.Reduce(field);
-  return x.IsNil() ? "" : Buffer.from(x.GetBinary()).toString("hex");
-}
-var NOTIFY_LONGPOLL_MS = Number(process.env.OURS_NOTIFY_LONGPOLL_MS) > 0 ? Number(process.env.OURS_NOTIFY_LONGPOLL_MS) : 25e3;
-var NOTIFY_RECHECK_MS = 250;
-function notifyLogSize(logPath) {
-  try {
-    return fs5.statSync(logPath).size;
-  } catch {
-    return 0;
-  }
-}
-function readNotifyRange(logPath, from, to) {
-  if (to <= from) return { events: [], cursor: from };
-  const buf = Buffer.alloc(to - from);
-  let read = 0;
-  try {
-    const fd = fs5.openSync(logPath, "r");
-    try {
-      read = fs5.readSync(fd, buf, 0, buf.length, from);
-    } finally {
-      fs5.closeSync(fd);
-    }
-  } catch {
-    return { events: [], cursor: from };
-  }
-  const slice = buf.subarray(0, read);
-  const lastNl = slice.lastIndexOf(10);
-  if (lastNl === -1) return { events: [], cursor: from };
-  const events = [];
-  for (const line of slice.subarray(0, lastNl + 1).toString("utf8").split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      events.push(JSON.parse(line));
-    } catch {
+  } catch {
+    return { events: [], cursor: from };
+  }
+  const slice = buf.subarray(0, read);
+  const lastNl = slice.lastIndexOf(10);
+  if (lastNl === -1) return { events: [], cursor: from };
+  const events = [];
+  for (const line of slice.subarray(0, lastNl + 1).toString("utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      events.push(JSON.parse(line));
+    } catch {
     }
   }
   return { events, cursor: from + lastNl + 1 };
@@ -1151,40 +1225,28 @@ async function serveNotifications(req, res, name, sinceParam, kindsParam = null)
 }
 function refreshUnread(id) {
   try {
-    const { unread, unreadFiles } = withScope((lt) => {
-      const inbox = renderInbox(readonlyTx(id, "::actor::list_incoming_messages", lt));
-      const unread2 = inbox.filter((m) => m.status === "unread");
-      const filesAv = readonlyTx(id, "::actor::list_incoming_files", lt);
-      const unreadFiles2 = [];
-      if (!filesAv.IsNil()) {
-        for (let i = 0; ; i++) {
-          const f = filesAv.Reduce(i);
-          if (f.IsNil()) break;
-          if (f.Reduce("status").Visualize() !== "unread") continue;
-          unreadFiles2.push({
-            file_id: f.Reduce("file_id").Visualize(),
-            sender_id: f.Reduce("sender_id").Visualize(),
-            from: f.Reduce("sender_name").Visualize(),
-            filename: f.Reduce("filename").Visualize(),
-            mime: f.Reduce("mime").Visualize(),
-            bytes: f.Reduce("size").Visualize(),
-            date: f.Reduce("date").Visualize(),
-            wire_id: f.Reduce("wire_id").Visualize()
-          });
-        }
-      }
-      return { unread: unread2, unreadFiles: unreadFiles2 };
-    });
+    const unread = listIncomingMessages(id);
+    const unreadFiles = listIncomingFiles(id).map((file) => ({
+      file_id: String(file.file_id),
+      sender_id: file.from.id,
+      from: file.from.name,
+      filename: file.filename,
+      mime: file.mime,
+      bytes: String(file.byte_length),
+      date: file.date,
+      wire_id: file.wire_id
+    }));
     const snapshot = {
       count: unread.length,
-      recent: unread.slice(-10).map((m) => ({ from: m.sender_name, msg_id: m.msg_id, date: m.date })),
+      recent: unread.slice(-10).map((m) => ({ from: m.from.name, msg_id: m.msg_id, date: m.date })),
       files: unreadFiles.length,
       unread_files: unreadFiles.slice(-10)
     };
-    fs5.mkdirSync(id.dir, { recursive: true, mode: 448 });
+    fs6.mkdirSync(id.dir, { recursive: true, mode: 448 });
     const tmp = `${unreadPath(id.dir)}.tmp`;
-    fs5.writeFileSync(tmp, JSON.stringify(snapshot));
-    fs5.renameSync(tmp, unreadPath(id.dir));
+    fs6.writeFileSync(tmp, JSON.stringify(snapshot), { mode: 384 });
+    fs6.chmodSync(tmp, 384);
+    fs6.renameSync(tmp, unreadPath(id.dir));
   } catch (err) {
     log(`[${id.name}] failed to refresh unread snapshot:`, String(err));
   }
@@ -1193,7 +1255,7 @@ function unreadSummary() {
   const out = [];
   let entries = [];
   try {
-    entries = fs5.readdirSync(STATE_DIR, { withFileTypes: true });
+    entries = fs6.readdirSync(STATE_DIR, { withFileTypes: true });
   } catch {
     return { identities: out };
   }
@@ -1201,7 +1263,7 @@ function unreadSummary() {
     if (!entry.isDirectory() || validateName(entry.name) !== null) continue;
     let value;
     try {
-      value = JSON.parse(fs5.readFileSync(unreadPath(join6(STATE_DIR, entry.name)), "utf8"));
+      value = JSON.parse(fs6.readFileSync(unreadPath(join6(STATE_DIR, entry.name)), "utf8"));
     } catch {
       continue;
     }
@@ -1355,6 +1417,28 @@ async function e2eRecoverySweep(id) {
 }
 
 // ../../src/mufl/handlers.ts
+function eventTimeMs(value) {
+  const shown = value.Visualize();
+  const numeric = Number(shown);
+  if (Number.isFinite(numeric) && numeric >= 0) return numeric;
+  const parsed = Date.parse(shown);
+  if (!Number.isFinite(parsed)) throw new Error("invalid host-event date");
+  return parsed;
+}
+function replyFields(payload) {
+  const reply2 = payload.Reduce("reply_to");
+  if (reply2.IsNil()) return {};
+  const wireId = reply2.Reduce("wire_id").Visualize();
+  const sentenceValue = reply2.Reduce("sentence");
+  return sentenceValue.IsNil() ? { replyToWireId: wireId } : { replyToWireId: wireId, replyToSentence: Number(sentenceValue.Visualize()) };
+}
+function appendPostInsertWake(id, event) {
+  try {
+    appendNotifyLog(id, event);
+  } catch (error) {
+    log(`[${id.name}] post-insert history wake failed event=${String(event.event ?? "")}:`, String(error));
+  }
+}
 function wireHandlers(id, hooks) {
   id.pw.on_return_data = (data) => {
     const lt = new AdaptObjectLifetime();
@@ -1365,31 +1449,133 @@ function wireHandlers(id, hooks) {
         saveStateFailClosed(id);
         return;
       }
+      if (kind === "host_event") {
+        const payload = data.Reduce("payload");
+        const event = payload.Reduce("event").Visualize();
+        if (event === "application_payload") {
+          const itemKind = payload.Reduce("item_kind").Visualize();
+          const direction = payload.Reduce("direction").Visualize();
+          const wireId = payload.Reduce("wire_id").Visualize();
+          const peerCid = payload.Reduce("peer_cid").Visualize();
+          const peerName = payload.Reduce("peer_name").Visualize();
+          const encryption = payload.Reduce("encryption").Visualize();
+          const inboxValue = payload.Reduce("inbox_state");
+          const inboxState = direction === "in" && !inboxValue.IsNil() ? inboxValue.Visualize() : void 0;
+          try {
+            const inserted = itemKind === "message" ? ingestApplicationEvent(id, {
+              kind: "message",
+              wireId,
+              peerCid,
+              peerName,
+              direction,
+              inboxState,
+              body: payload.Reduce("body").Visualize(),
+              occurredAtMs: eventTimeMs(payload.Reduce("date")),
+              encryption,
+              ...replyFields(payload)
+            }) : ingestApplicationEvent(id, {
+              kind: "file",
+              wireId,
+              peerCid,
+              peerName,
+              direction,
+              inboxState,
+              filename: payload.Reduce("filename").Visualize(),
+              mime: payload.Reduce("mime").Visualize(),
+              bytes: Buffer.from(payload.Reduce("data").GetBinary()),
+              occurredAtMs: eventTimeMs(payload.Reduce("date")),
+              encryption,
+              ...replyFields(payload)
+            });
+            if (inserted && direction === "in" && inboxState === "unread") {
+              if (itemKind === "message") {
+                const item = getMessageHistoryItem(id, wireId);
+                appendPostInsertWake(id, {
+                  event: "message_received",
+                  from: peerName,
+                  sender_name: peerName,
+                  sender_id: peerCid,
+                  msg_id: String(item.msg_id),
+                  wire_id: wireId,
+                  date: item.date
+                });
+                refreshUnread(id);
+                process.nextTick(
+                  () => hooks.onNotify(id.name, `[${id.name}] new message from ${peerName} (#${item.msg_id})`)
+                );
+              } else {
+                const item = getFileHistoryItem(id, wireId);
+                appendPostInsertWake(id, {
+                  event: "file_received",
+                  from: peerName,
+                  sender_id: peerCid,
+                  file_id: String(item.file_id),
+                  wire_id: wireId,
+                  filename: item.filename,
+                  mime: item.mime,
+                  bytes: String(item.byte_length),
+                  date: item.date
+                });
+                refreshUnread(id);
+                process.nextTick(() => hooks.onNotify(
+                  id.name,
+                  `[${id.name}] new file ${item.filename} (${item.byte_length} B) from ${peerName} (sender_id ${peerCid}, file_id ${item.file_id}, wire_id ${wireId})`
+                ));
+              }
+            }
+          } catch (error) {
+            const failureKind = itemKind === "file" ? "file" : "message";
+            noteHistoryFailure(id, failureKind, wireId, direction);
+            log(`[${id.name}] history ${failureKind} write failed direction=${direction} wire_id=${wireId}:`, String(error));
+          }
+        } else if (event === "pending_introduction_decision") {
+          const peerCid = payload.Reduce("peer_cid").Visualize();
+          const action = payload.Reduce("action").Visualize();
+          try {
+            if (action === "approve") promotePendingIntroduction(id, peerCid);
+            else if (action === "reject") rejectPendingIntroduction(id, peerCid);
+            refreshUnread(id);
+          } catch (error) {
+            log(`[${id.name}] pending-introduction history update failed action=${action} peer_cid=${peerCid}:`, String(error));
+          }
+        } else if (event === "monitoring_payload") {
+          const itemId = payload.Reduce("item_id").Visualize();
+          try {
+            if (ingestMonitoringEvent(id, {
+              kind: "monitoring_copy",
+              itemId,
+              sourceCid: payload.Reduce("source_cid").Visualize(),
+              sourceName: payload.Reduce("source_name").Visualize(),
+              direction: payload.Reduce("direction").Visualize(),
+              peerCid: payload.Reduce("peer_cid").Visualize(),
+              peerName: payload.Reduce("peer_name").Visualize(),
+              body: payload.Reduce("body").Visualize(),
+              occurredAtMs: eventTimeMs(payload.Reduce("date"))
+            })) appendPostInsertWake(id, { event: "monitoring_copy", item_id: itemId });
+          } catch (error) {
+            log(`[${id.name}] monitoring history write failed item_id=${itemId}:`, String(error));
+          }
+        } else if (event === "control_payload") {
+          const itemId = payload.Reduce("item_id").Visualize();
+          try {
+            if (ingestControlEvent(id, {
+              kind: "control_request",
+              itemId,
+              senderCid: payload.Reduce("sender_cid").Visualize(),
+              senderName: payload.Reduce("sender_name").Visualize(),
+              payload: payload.Reduce("payload").Visualize(),
+              occurredAtMs: eventTimeMs(payload.Reduce("date"))
+            })) appendPostInsertWake(id, { event: "control_request", item_id: itemId });
+          } catch (error) {
+            log(`[${id.name}] control history write failed item_id=${itemId}:`, String(error));
+          }
+        }
+        return;
+      }
       if (kind === "notify_agent") {
         const payload = data.Reduce("payload");
         const event = payload.Reduce("event").Visualize();
-        if (event === "message_received") {
-          const sender = payload.Reduce("sender_name").Visualize();
-          const senderIdValue = payload.Reduce("sender_id");
-          const senderId = senderIdValue.IsNil() ? "" : senderIdValue.Visualize();
-          const msgId = payload.Reduce("msg_id").Visualize();
-          const wireIdValue = payload.Reduce("wire_id");
-          const wireId = wireIdValue.IsNil() ? "" : wireIdValue.Visualize();
-          const date = payload.Reduce("date").Visualize();
-          appendNotifyLog(id, {
-            event: "message_received",
-            from: sender,
-            sender_name: sender,
-            sender_id: senderId,
-            msg_id: msgId,
-            wire_id: wireId,
-            date
-          });
-          refreshUnread(id);
-          process.nextTick(
-            () => hooks.onNotify(id.name, `[${id.name}] new message from ${sender} (#${msgId})`)
-          );
-        } else if (event === "receipt_received") {
+        if (event === "receipt_received") {
           const senderIdValue = payload.Reduce("sender_id");
           const senderId = senderIdValue.IsNil() ? "" : String(senderIdValue.Visualize());
           const kindValue = payload.Reduce("kind");
@@ -1405,6 +1591,14 @@ function wireHandlers(id, hooks) {
           }
           const dateValue = payload.Reduce("date");
           const date = dateValue.IsNil() ? (/* @__PURE__ */ new Date()).toISOString() : String(dateValue.Visualize());
+          if (receiptKind === "delivered" || receiptKind === "read") {
+            try {
+              updateDeliveryState(id, senderId, receiptKind, wireIds);
+            } catch (error) {
+              noteHistoryFailure(id, "receipt");
+              log(`[${id.name}] history receipt update failed sender_id=${senderId} kind=${receiptKind} count=${wireIds.length}:`, String(error));
+            }
+          }
           appendNotifyLog(id, {
             event: "receipt_received",
             sender_id: senderId,
@@ -1412,33 +1606,6 @@ function wireHandlers(id, hooks) {
             wire_ids: wireIds,
             date
           });
-        } else if (event === "file_received") {
-          const sender = payload.Reduce("sender_name").Visualize();
-          const senderId = payload.Reduce("sender_id").Visualize();
-          const fileId = payload.Reduce("file_id").Visualize();
-          const wireId = payload.Reduce("wire_id").Visualize();
-          const filename = payload.Reduce("filename").Visualize();
-          const mime = payload.Reduce("mime").Visualize();
-          const bytes = payload.Reduce("bytes").Visualize();
-          const date = payload.Reduce("date").Visualize();
-          appendNotifyLog(id, {
-            event: "file_received",
-            from: sender,
-            sender_id: senderId,
-            file_id: fileId,
-            wire_id: wireId,
-            filename,
-            mime,
-            bytes,
-            date
-          });
-          refreshUnread(id);
-          process.nextTick(
-            () => hooks.onNotify(
-              id.name,
-              `[${id.name}] new file ${filename} (${bytes} B) from ${sender} (sender_id ${senderId}, file_id ${fileId}, wire_id ${wireId})`
-            )
-          );
         } else if (event === "contact_accepted") {
           const name = payload.Reduce("name").Visualize();
           const cid = payload.Reduce("container_id").Visualize();
@@ -1642,23 +1809,23 @@ function wireHandlers(id, hooks) {
 
 // ../../src/book.ts
 import { join as join7 } from "node:path";
-import * as fs6 from "node:fs";
+import * as fs7 from "node:fs";
 var bookDir = () => join7(STATE_DIR, BOOK_DIR_NAME);
 var registrarKeyPath = () => join7(bookDir(), "registrar.key");
 var bookPath = () => join7(bookDir(), "book.json");
 function readBook() {
   try {
-    const parsed = JSON.parse(fs6.readFileSync(bookPath(), "utf8"));
+    const parsed = JSON.parse(fs7.readFileSync(bookPath(), "utf8"));
     return parsed && typeof parsed.entries === "object" ? parsed.entries : {};
   } catch {
     return {};
   }
 }
 function writeBook(entries) {
-  fs6.mkdirSync(bookDir(), { recursive: true });
+  fs7.mkdirSync(bookDir(), { recursive: true });
   const tmp = `${bookPath()}.tmp`;
-  fs6.writeFileSync(tmp, JSON.stringify({ v: 1, entries }, null, 2), { mode: 384 });
-  fs6.renameSync(tmp, bookPath());
+  fs7.writeFileSync(tmp, JSON.stringify({ v: 1, entries }, null, 2), { mode: 384 });
+  fs7.renameSync(tmp, bookPath());
 }
 function exportAdBlob(id) {
   return withScope(
@@ -1762,9 +1929,10 @@ async function provisionIdentity(name, opts = { exposeLocal: true, localAutoAcce
     );
   }
   reservedNames.add(name);
+  let provisioned;
   try {
     const dir = identityDir(name);
-    fs7.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs8.mkdirSync(dir, { recursive: true, mode: 448 });
     let tempMeta;
     if (opts.temp) {
       tempMeta = { owner: { tokenHash: opts.temp.tokenHash, pid: opts.temp.pid }, createdAt: Date.now() };
@@ -1772,8 +1940,10 @@ async function provisionIdentity(name, opts = { exposeLocal: true, localAutoAcce
     }
     const seed = randomBytes(24).toString("hex");
     const id = await createPacket(name, seed, dir);
+    provisioned = id;
+    openHistory(id);
     if (tempMeta) id.temp = tempMeta;
-    fs7.writeFileSync(keyPath(dir), exportSigningSecret(id), { mode: 384 });
+    fs8.writeFileSync(keyPath(dir), exportSigningSecret(id), { mode: 384 });
     await withScopeAsync(async (lt) => {
       await mutatingTx(id, "::a2a_messaging::set_my_name", { name }, lt);
     });
@@ -1789,13 +1959,14 @@ async function provisionIdentity(name, opts = { exposeLocal: true, localAutoAcce
     saveStateFailClosed(id);
     return id;
   } catch (err) {
+    if (provisioned) closeHistory(provisioned);
     reservedNames.delete(name);
     throw err;
   }
 }
 async function restoreIdentity(name) {
   const dir = identityDir(name);
-  const secret = fs7.readFileSync(keyPath(dir), "utf8").trim();
+  const secret = fs8.readFileSync(keyPath(dir), "utf8").trim();
   const id = await createPacket(name, "", dir, false, secret, true);
   log(`[${name}] created QUARANTINED (no routing/broker registration, not client-bindable) \u2014 importing state before exposure`);
   const holdMs = Number(process.env.OURS_TEST_RESTORE_HOLD_MS || "") || 0;
@@ -1806,10 +1977,6 @@ async function restoreIdentity(name) {
   const isTimeout = (err) => /timed out waiting for the transaction result/.test(String(err));
   const tearDownUnexposed = (step, why, err) => {
     log(`[${name}] ${step} ${why} \u2014 identity left UNEXPOSED and UNTRACKED (fail-closed)`);
-    try {
-      appendNotifyLog(id, { event: "restore_fail_closed", step, error: String(err).slice(0, 300) });
-    } catch {
-    }
     identities.delete(name);
     try {
       wrapper.remove_packet(id.cid);
@@ -1820,32 +1987,26 @@ async function restoreIdentity(name) {
   };
   const failClosed = (step, err) => tearDownUnexposed(step, "outcome UNKNOWN (timeout): the transaction may still execute and exposure would race it", err);
   if (hasSavedState(dir)) {
-    let imported = false;
     try {
       if (process.env.OURS_TEST_FORCE_IMPORT_TIMEOUT === "1") {
         throw new Error("timed out waiting for the transaction result (forced by OURS_TEST_FORCE_IMPORT_TIMEOUT)");
       }
-      const buf = fs7.readFileSync(dataPath(dir));
+      const buf = fs8.readFileSync(dataPath(dir));
       await withScopeAsync(async (lt) => {
         const adaptData = id.pw.packet.ParseValue(new Uint8Array(buf)).Attach(lt);
         const importTimeoutMs = Number(process.env.OURS_IMPORT_TIMEOUT_MS || "") || void 0;
         await mutatingTx(id, "::actor::import_state", adaptData, lt, importTimeoutMs);
       });
-      imported = true;
       log(`[${name}] state import completed (positively observed)`);
     } catch (err) {
       if (isTimeout(err)) failClosed("import_state", err);
-      log(`[${name}] FAILED TO IMPORT SAVED STATE \u2014 continuing with the reseeded identity; surviving contacts (if the blob was partially migrated) self-heal via contact restore:`, String(err));
-      appendNotifyLog(id, { event: "state_import_failed", error: String(err).slice(0, 300) });
-      try {
-        const failedPath = `${dataPath(dir)}.failed-${Date.now()}`;
-        fs7.renameSync(dataPath(dir), failedPath);
-        fs7.chmodSync(failedPath, 384);
-        log(`[${name}] unreadable state blob preserved as state_data.bin.failed-*`);
-      } catch {
-      }
+      tearDownUnexposed(
+        "import_state",
+        "REFUSED: this release accepts only direct-host-storage app format 2; existing state was left untouched",
+        err
+      );
     }
-    if (imported) {
+    {
       try {
         const st = await withScopeAsync(async (lt) => {
           const r = await mutatingTx(id, "::a2a_messaging::commit_e2e_restore", {}, lt);
@@ -1894,269 +2055,577 @@ async function restoreIdentity(name) {
       }
     }
   }
-  wrapper.expose_packet(id.cid);
-  identities.set(name, id);
-  log(`[${name}] EXPOSED (routing + broker registration) \u2014 import phase complete`);
-  await contactRestoreSweep(id);
-  refreshUnread(id);
-  return id;
+  try {
+    openHistory(id);
+  } catch (err) {
+    tearDownUnexposed("history_open", "FAILED (SQLite history unavailable)", err);
+  }
+  wrapper.expose_packet(id.cid);
+  identities.set(name, id);
+  log(`[${name}] EXPOSED (routing + broker registration) \u2014 import phase complete`);
+  await contactRestoreSweep(id);
+  refreshUnread(id);
+  return id;
+}
+
+// ../../src/state.ts
+async function ensureRegistrar() {
+  fs9.mkdirSync(bookDir(), { recursive: true });
+  let secret;
+  try {
+    secret = fs9.readFileSync(registrarKeyPath(), "utf8").trim();
+  } catch {
+  }
+  const seed = randomBytes2(24).toString("hex");
+  setRegistrar(await createPacket(BOOK_DIR_NAME, seed, bookDir(), false, secret));
+  if (!secret) {
+    fs9.writeFileSync(registrarKeyPath(), exportSigningSecret(registrar), { mode: 384 });
+  }
+  setRegistrarAdBlob(exportAdBlob(registrar));
+  log(`contact-book registrar ready (${registrar.cid})`);
+}
+function hasSavedState(dir) {
+  try {
+    return fs9.existsSync(dataPath(dir)) && fs9.statSync(dataPath(dir)).size > 0;
+  } catch {
+    return false;
+  }
+}
+function saveState(id) {
+  const bytes = withScope(
+    (lt) => Buffer.from(readonlyTx(id, "::actor::export_state", lt).Serialize())
+  );
+  fs9.mkdirSync(id.dir, { recursive: true, mode: 448 });
+  const final = dataPath(id.dir);
+  const tmp = `${final}.tmp`;
+  let fd;
+  try {
+    fd = fs9.openSync(tmp, "w", 384);
+    fs9.fchmodSync(fd, 384);
+    fs9.writeFileSync(fd, bytes);
+    fs9.fsyncSync(fd);
+    fs9.closeSync(fd);
+    fd = void 0;
+    fs9.renameSync(tmp, final);
+    fs9.chmodSync(final, 384);
+    try {
+      fs9.chmodSync(keyPath(id.dir), 384);
+    } catch {
+    }
+    const dirFd = fs9.openSync(id.dir, "r");
+    try {
+      fs9.fsyncSync(dirFd);
+    } finally {
+      fs9.closeSync(dirFd);
+    }
+  } catch (err) {
+    if (fd !== void 0) {
+      try {
+        fs9.closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      fs9.rmSync(tmp, { force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+function saveStateFailClosed(id) {
+  try {
+    saveState(id);
+    if (id.persistFailed) {
+      id.persistFailed = false;
+      log(`[${id.name}] persist recovered \u2014 quarantine lifted`);
+      appendNotifyLog(id, { event: "persist_recovered" });
+    }
+  } catch (err) {
+    id.persistFailed = true;
+    log(`[${id.name}] PERSIST FAILED \u2014 identity quarantined (fail-closed), outbound of this txn withheld:`, String(err));
+    try {
+      appendNotifyLog(id, { event: "persist_failed", error: String(err).slice(0, 300) });
+    } catch {
+    }
+    process.nextTick(
+      () => fireNotify(id.name, `[${id.name}] PERSIST FAILED \u2014 messaging quarantined until the state file is writable again`)
+    );
+    throw err;
+  }
+}
+
+// ../../src/mufl/tx.ts
+function withScope(fn) {
+  const lt = new AdaptObjectLifetime2();
+  try {
+    return fn(lt);
+  } finally {
+    lt.Finalize();
+  }
+}
+async function withScopeAsync(fn) {
+  const lt = new AdaptObjectLifetime2();
+  try {
+    return await fn(lt);
+  } finally {
+    lt.Finalize();
+  }
+}
+function readonlyTx(id, name, lt, targ) {
+  const envelope = object_to_adapt_value({ name, targ });
+  const result = id.pw.packet.ExecuteTransaction(envelope);
+  envelope.Destroy();
+  return lt ? result.Attach(lt) : result;
+}
+async function withLock(id, fn) {
+  const prev = id.lock;
+  let release;
+  id.lock = new Promise((r) => release = r);
+  await prev;
+  try {
+    return await fn();
+  } finally {
+    release();
+  }
+}
+function enqueueMutation(id, envelope, timeoutMs = 25e3) {
+  return new Promise((res, rej) => {
+    const timer = setTimeout(() => {
+      const i = id.pending.findIndex((p) => p.timer === timer);
+      if (i >= 0) id.pending.splice(i, 1);
+      rej(new Error("timed out waiting for the transaction result"));
+    }, timeoutMs);
+    id.pending.push({ resolve: res, reject: rej, timer });
+    id.pw.add_client_message(envelope);
+  });
+}
+function mutatingTx(id, name, targ, lt, timeoutMs) {
+  if (id.persistFailed) {
+    try {
+      saveStateFailClosed(id);
+    } catch (err) {
+      return Promise.reject(new Error(
+        `identity "${id.name}" is quarantined: state persist is failing (${String(err)}) \u2014 mutations are rejected until state_data.bin is writable again`
+      ));
+    }
+  }
+  const envelope = object_to_adapt_value({ name, targ });
+  return withLock(id, () => enqueueMutation(id, envelope, timeoutMs)).then(
+    (payload) => {
+      envelope.Destroy();
+      if (id.persistFailed) {
+        try {
+          payload.Destroy();
+        } catch {
+        }
+        throw new Error(
+          `identity "${id.name}": state persist FAILED \u2014 this transaction's outbound was withheld (fail-closed); fix the state directory and retry`
+        );
+      }
+      return lt ? payload.Attach(lt) : payload;
+    },
+    (err) => {
+      try {
+        envelope.Destroy();
+      } catch {
+      }
+      throw err;
+    }
+  );
+}
+
+// ../../src/identity/hierarchy.ts
+function setRootName(name) {
+  rootName = name;
+}
+var rootMarkerPath = () => join8(STATE_DIR, "root.json");
+var rootName = null;
+function readRootMarker() {
+  try {
+    const parsed = JSON.parse(fs10.readFileSync(rootMarkerPath(), "utf8"));
+    return typeof parsed.name === "string" ? parsed.name : null;
+  } catch {
+    return null;
+  }
+}
+function writeRootMarker(name) {
+  fs10.mkdirSync(STATE_DIR, { recursive: true });
+  const tmp = `${rootMarkerPath()}.tmp`;
+  fs10.writeFileSync(tmp, JSON.stringify({ v: 1, name }));
+  fs10.renameSync(tmp, rootMarkerPath());
+}
+function clearRootMarker() {
+  fs10.rmSync(rootMarkerPath(), { force: true });
+}
+function describeIdentity(id) {
+  return withScope((lt) => {
+    const v = readonlyTx(id, "::actor::describe_identity", lt);
+    return {
+      bio: v.Reduce("bio").Visualize(),
+      persona: v.Reduce("persona").Visualize(),
+      hasCert: v.Reduce("has_cert").GetBoolean(),
+      roleId: v.Reduce("role_id").Visualize(),
+      rootCid: v.Reduce("root_cid").Visualize(),
+      rootName: v.Reduce("root_name").Visualize(),
+      monitoringEnabled: v.Reduce("monitoring_enabled").GetBoolean()
+    };
+  });
+}
+async function delegateRole(root, role) {
+  await withScopeAsync(async (lt) => {
+    const roleAd = exportAdBlob(role);
+    const signed = await mutatingTx(root, "::actor::sign_delegation", {
+      role_ad: root.pw.packet.NewBinaryFromBuffer(roleAd).Attach(lt),
+      role_id: role.name
+    }, lt);
+    const certBlob = Buffer.from(signed.Reduce("cert").GetBinary());
+    const profileData = await mutatingTx(root, "::actor::export_root_profile", {}, lt);
+    const profileBlob = Buffer.from(profileData.Reduce("profile").GetBinary());
+    const rootAdBlob = exportAdBlob(root);
+    const roleAdV1 = Buffer.from(
+      (await mutatingTx(role, "::actor::export_v1_address_document", {}, lt)).Reduce("ad").GetBinary()
+    );
+    const signedV1 = await mutatingTx(root, "::actor::sign_delegation", {
+      role_ad: root.pw.packet.NewBinaryFromBuffer(roleAdV1).Attach(lt),
+      role_id: role.name
+    }, lt);
+    const certV1Blob = Buffer.from(signedV1.Reduce("cert").GetBinary());
+    await mutatingTx(role, "::actor::set_delegation", {
+      cert: role.pw.packet.NewBinaryFromBuffer(certBlob).Attach(lt),
+      root_ad: role.pw.packet.NewBinaryFromBuffer(rootAdBlob).Attach(lt),
+      root_profile: role.pw.packet.NewBinaryFromBuffer(profileBlob).Attach(lt),
+      cert_v1: role.pw.packet.NewBinaryFromBuffer(certV1Blob).Attach(lt)
+    }, lt);
+  });
+  log(`[${role.name}] delegated as a role under root "${root.name}"`);
+}
+async function establishRoot(id) {
+  rootName = id.name;
+  writeRootMarker(id.name);
+  const adopted = [];
+  const failed = [];
+  for (const other of identities.values()) {
+    if (other.name === id.name) continue;
+    if (other.temp) continue;
+    try {
+      await delegateRole(id, other);
+      adopted.push(other.name);
+    } catch (err) {
+      log(`failed to adopt "${other.name}" as a role under new root "${id.name}":`, String(err));
+      failed.push(other.name);
+    }
+  }
+  log(`[${id.name}] established as the host root${adopted.length ? ` (adopted ${adopted.length} role(s))` : ""}`);
+  return { adopted, failed };
 }
 
-// ../../src/state.ts
-async function ensureRegistrar() {
-  fs8.mkdirSync(bookDir(), { recursive: true });
-  let secret;
-  try {
-    secret = fs8.readFileSync(registrarKeyPath(), "utf8").trim();
-  } catch {
+// ../../src/identity/lifecycle.ts
+import { join as join9 } from "node:path";
+import * as fs11 from "node:fs";
+
+// ../../src/render/adapt-to-json.ts
+import { brotliCompressSync, brotliDecompressSync } from "node:zlib";
+
+// ../../src/transcribe.ts
+function baseMime(mime) {
+  return (mime ?? "").split(";")[0].trim() || "application/octet-stream";
+}
+var STT_PROVIDERS = ["openai-compatible", "elevenlabs", "deepgram", "custom"];
+var STT_MAX_BYTES_DEFAULT = 5 * 1024 * 1024;
+var STT_TIMEOUT_MS_DEFAULT = 6e4;
+function sttStatus(cfg) {
+  const hint = "configure it in config.json `stt: {}` or via OURS_STT_* env";
+  if (!cfg?.provider) {
+    return { ready: false, reason: `no STT provider configured (stt.provider: ${STT_PROVIDERS.join(" | ")}) \u2014 ${hint}` };
   }
-  const seed = randomBytes2(24).toString("hex");
-  setRegistrar(await createPacket(BOOK_DIR_NAME, seed, bookDir(), false, secret));
-  if (!secret) {
-    fs8.writeFileSync(registrarKeyPath(), exportSigningSecret(registrar), { mode: 384 });
+  const provider = cfg.provider.trim().toLowerCase();
+  if (!STT_PROVIDERS.includes(provider)) {
+    return { ready: false, reason: `unknown STT provider "${cfg.provider}" (expected: ${STT_PROVIDERS.join(" | ")})` };
   }
-  setRegistrarAdBlob(exportAdBlob(registrar));
-  log(`contact-book registrar ready (${registrar.cid})`);
-}
-function hasSavedState(dir) {
-  try {
-    return fs8.existsSync(dataPath(dir)) && fs8.statSync(dataPath(dir)).size > 0;
-  } catch {
-    return false;
+  if (!cfg.apiKey?.trim()) {
+    return { ready: false, reason: `STT provider "${provider}" is set but the API key is missing (stt.apiKey / OURS_STT_API_KEY)` };
   }
-}
-function saveState(id) {
-  const bytes = withScope(
-    (lt) => Buffer.from(readonlyTx(id, "::actor::export_state", lt).Serialize())
-  );
-  fs8.mkdirSync(id.dir, { recursive: true, mode: 448 });
-  const final = dataPath(id.dir);
-  const tmp = `${final}.tmp`;
-  let fd;
-  try {
-    fd = fs8.openSync(tmp, "w", 384);
-    fs8.fchmodSync(fd, 384);
-    fs8.writeFileSync(fd, bytes);
-    fs8.fsyncSync(fd);
-    fs8.closeSync(fd);
-    fd = void 0;
-    fs8.renameSync(tmp, final);
-    fs8.chmodSync(final, 384);
-    try {
-      fs8.chmodSync(keyPath(id.dir), 384);
-    } catch {
+  if (provider === "openai-compatible") {
+    if (!cfg.baseUrl?.trim()) {
+      return { ready: false, reason: "openai-compatible STT needs stt.baseUrl / OURS_STT_BASE_URL (e.g. your provider's /v1 root) \u2014 no endpoint is assumed" };
     }
-    const dirFd = fs8.openSync(id.dir, "r");
-    try {
-      fs8.fsyncSync(dirFd);
-    } finally {
-      fs8.closeSync(dirFd);
+    if (!cfg.model?.trim()) {
+      return { ready: false, reason: "openai-compatible STT needs stt.model / OURS_STT_MODEL (passed to the provider verbatim) \u2014 no model is assumed" };
     }
-  } catch (err) {
-    if (fd !== void 0) {
-      try {
-        fs8.closeSync(fd);
-      } catch {
-      }
+  }
+  if (provider === "elevenlabs" && !cfg.model?.trim()) {
+    return { ready: false, reason: "elevenlabs STT needs stt.model / OURS_STT_MODEL (the model_id, e.g. from your ElevenLabs account) \u2014 no model is assumed" };
+  }
+  if (provider === "custom") {
+    if (!cfg.custom?.url?.trim()) {
+      return { ready: false, reason: "custom STT needs stt.custom.url (the full endpoint URL of your provider)" };
     }
-    try {
-      fs8.rmSync(tmp, { force: true });
-    } catch {
+    const wantsModel = cfg.custom.url.includes("{model}") || cfg.custom.modelField !== void 0 && cfg.custom.modelField !== "";
+    if (wantsModel && !cfg.model?.trim()) {
+      return { ready: false, reason: "the custom STT template references a model (url {model} or modelField) but stt.model / OURS_STT_MODEL is not set" };
     }
-    throw err;
   }
+  return { ready: true, provider };
 }
-function saveStateFailClosed(id) {
+function textAtPath(obj, path) {
+  let cur = obj;
+  for (const seg of path.split(".")) {
+    if (cur === null || typeof cur !== "object") return void 0;
+    cur = cur[seg];
+  }
+  return typeof cur === "string" ? cur : void 0;
+}
+async function request(url, init, timeoutMs, secrets = []) {
+  const aborter = new AbortController();
+  const timer = setTimeout(() => aborter.abort(), timeoutMs);
   try {
-    saveState(id);
-    if (id.persistFailed) {
-      id.persistFailed = false;
-      log(`[${id.name}] persist recovered \u2014 quarantine lifted`);
-      appendNotifyLog(id, { event: "persist_recovered" });
+    const resp = await fetch(url, { ...init, signal: aborter.signal });
+    if (!resp.ok) {
+      let detail = await resp.text().catch(() => "");
+      for (const secret of secrets) {
+        if (secret) detail = detail.split(secret).join("[redacted]");
+      }
+      return { ok: false, error: `STT HTTP ${resp.status}${detail ? `: ${detail.slice(0, 200)}` : ""}` };
     }
+    return { ok: true, json: await resp.json() };
   } catch (err) {
-    id.persistFailed = true;
-    log(`[${id.name}] PERSIST FAILED \u2014 identity quarantined (fail-closed), outbound of this txn withheld:`, String(err));
-    try {
-      appendNotifyLog(id, { event: "persist_failed", error: String(err).slice(0, 300) });
-    } catch {
+    if (err?.name === "AbortError") {
+      return { ok: false, error: `STT timeout after ${timeoutMs}ms` };
     }
-    process.nextTick(
-      () => fireNotify(id.name, `[${id.name}] PERSIST FAILED \u2014 messaging quarantined until the state file is writable again`)
-    );
-    throw err;
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    clearTimeout(timer);
   }
 }
-
-// ../../src/mufl/tx.ts
-function withScope(fn) {
-  const lt = new AdaptObjectLifetime2();
-  try {
-    return fn(lt);
-  } finally {
-    lt.Finalize();
+var audioBlob = (bytes, mime) => (
+  // Copy into a plain Uint8Array — a Buffer is not a valid BlobPart.
+  new Blob([new Uint8Array(bytes)], { type: baseMime(mime) })
+);
+var openaiCompatible = async (bytes, filename, mime, cfg, timeoutMs) => {
+  const form = new FormData();
+  form.set("file", audioBlob(bytes, mime), filename);
+  form.set("model", cfg.model.trim());
+  form.set("response_format", "json");
+  if (cfg.language?.trim()) form.set("language", cfg.language.trim());
+  const r = await request(
+    `${cfg.baseUrl.trim().replace(/\/$/, "")}/audio/transcriptions`,
+    { method: "POST", headers: { Authorization: `Bearer ${cfg.apiKey.trim()}` }, body: form },
+    timeoutMs,
+    [cfg.apiKey.trim()]
+  );
+  if (!r.ok) return r;
+  const text = textAtPath(r.json, "text");
+  return text !== void 0 ? { ok: true, text } : { ok: false, error: "STT response missing text" };
+};
+var elevenlabs = async (bytes, filename, mime, cfg, timeoutMs) => {
+  const form = new FormData();
+  form.set("file", audioBlob(bytes, mime), filename);
+  form.set("model_id", cfg.model.trim());
+  if (cfg.language?.trim()) form.set("language_code", cfg.language.trim());
+  const r = await request(
+    `${(cfg.baseUrl?.trim() || "https://api.elevenlabs.io").replace(/\/$/, "")}/v1/speech-to-text`,
+    { method: "POST", headers: { "xi-api-key": cfg.apiKey.trim() }, body: form },
+    timeoutMs,
+    [cfg.apiKey.trim()]
+  );
+  if (!r.ok) return r;
+  const text = textAtPath(r.json, "text");
+  return text !== void 0 ? { ok: true, text } : { ok: false, error: "STT response missing text" };
+};
+var deepgram = async (bytes, _filename, mime, cfg, timeoutMs) => {
+  const params = new URLSearchParams();
+  if (cfg.model?.trim()) params.set("model", cfg.model.trim());
+  if (cfg.language?.trim()) params.set("language", cfg.language.trim());
+  const q = params.toString();
+  const r = await request(
+    `${(cfg.baseUrl?.trim() || "https://api.deepgram.com").replace(/\/$/, "")}/v1/listen${q ? `?${q}` : ""}`,
+    {
+      method: "POST",
+      headers: { Authorization: `Token ${cfg.apiKey.trim()}`, "Content-Type": baseMime(mime) },
+      body: new Uint8Array(bytes)
+    },
+    timeoutMs,
+    [cfg.apiKey.trim()]
+  );
+  if (!r.ok) return r;
+  const text = textAtPath(r.json, "results.channels.0.alternatives.0.transcript");
+  return text !== void 0 ? { ok: true, text } : { ok: false, error: "STT response missing transcript" };
+};
+var custom = async (bytes, filename, mime, cfg, timeoutMs) => {
+  const t = cfg.custom;
+  const model = cfg.model?.trim() ?? "";
+  const url = t.url.replaceAll("{model}", encodeURIComponent(model));
+  const headers = {};
+  const authName = t.authHeaderName?.trim() || "Authorization";
+  const authValue = (t.authHeaderTemplate ?? "Bearer {key}").replaceAll("{key}", cfg.apiKey.trim());
+  if (authValue) headers[authName] = authValue;
+  const mode = t.bodyMode ?? "multipart";
+  const fileField = t.fileField?.trim() || "file";
+  const modelField = t.modelField === void 0 ? "model" : t.modelField.trim();
+  let body;
+  if (mode === "multipart") {
+    const form = new FormData();
+    form.set(fileField, audioBlob(bytes, mime), filename);
+    if (modelField && model) form.set(modelField, model);
+    for (const [k, v] of Object.entries(t.extraFields ?? {})) form.set(k, v);
+    body = form;
+  } else if (mode === "raw") {
+    headers["Content-Type"] = baseMime(mime);
+    body = new Uint8Array(bytes);
+  } else {
+    headers["Content-Type"] = "application/json";
+    body = JSON.stringify({
+      [fileField]: bytes.toString("base64"),
+      ...modelField && model ? { [modelField]: model } : {},
+      ...t.extraFields ?? {}
+    });
+  }
+  const r = await request(url, { method: t.method?.trim() || "POST", headers, body }, timeoutMs, [cfg.apiKey.trim()]);
+  if (!r.ok) return r;
+  const text = textAtPath(r.json, t.responseTextPath?.trim() || "text");
+  return text !== void 0 ? { ok: true, text } : { ok: false, error: `STT response has no text at "${t.responseTextPath?.trim() || "text"}"` };
+};
+var ADAPTERS = {
+  "openai-compatible": openaiCompatible,
+  elevenlabs,
+  deepgram,
+  custom
+};
+async function transcribeVoice(bytes, filename, mime, cfg) {
+  const status = sttStatus(cfg);
+  if (!status.ready) return { ok: false, error: status.reason };
+  const maxBytes = cfg.maxBytes ?? STT_MAX_BYTES_DEFAULT;
+  if (bytes.length > maxBytes) {
+    return { ok: false, error: `voice message is ${bytes.length} B \u2014 over the ${maxBytes} B STT limit (stt.maxBytes)` };
   }
-}
-async function withScopeAsync(fn) {
-  const lt = new AdaptObjectLifetime2();
+  const timeoutMs = cfg.timeoutMs ?? STT_TIMEOUT_MS_DEFAULT;
   try {
-    return await fn(lt);
-  } finally {
-    lt.Finalize();
+    return await ADAPTERS[status.provider](bytes, filename, mime, cfg, timeoutMs);
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
 }
-function readonlyTx(id, name, lt, targ) {
-  const envelope = object_to_adapt_value({ name, targ });
-  const result = id.pw.packet.ExecuteTransaction(envelope);
-  envelope.Destroy();
-  return lt ? result.Attach(lt) : result;
+function voiceErrorCategory(error) {
+  if (/limit|over .* bytes/i.test(error)) return "size_limit";
+  if (/timeout/i.test(error)) return "timeout";
+  if (/HTTP \d+/i.test(error)) return "provider_http";
+  if (/missing|no text|no transcript/i.test(error)) return "invalid_response";
+  return "provider_error";
 }
-async function withLock(id, fn) {
-  const prev = id.lock;
-  let release;
-  id.lock = new Promise((r) => release = r);
-  await prev;
-  try {
-    return await fn();
-  } finally {
-    release();
+function structuredVoiceOutcome(readiness, outcome, association) {
+  if (!readiness.ready || outcome.kind === "unconfigured") {
+    return {
+      configured: false,
+      attempted: false,
+      status: "unavailable",
+      provider: null,
+      text: null,
+      error_category: "not_configured",
+      audio_path: association.audioPath,
+      file_wire_id: association.wireId
+    };
   }
+  if (outcome.kind === "transcript") {
+    return {
+      configured: true,
+      attempted: true,
+      status: "succeeded",
+      provider: readiness.provider,
+      text: outcome.text,
+      error_category: null,
+      audio_path: association.audioPath,
+      file_wire_id: association.wireId
+    };
+  }
+  return {
+    configured: true,
+    attempted: true,
+    status: "failed",
+    provider: readiness.provider,
+    text: null,
+    error_category: voiceErrorCategory(outcome.error),
+    audio_path: association.audioPath,
+    file_wire_id: association.wireId
+  };
 }
-function enqueueMutation(id, envelope, timeoutMs = 25e3) {
-  return new Promise((res, rej) => {
-    const timer = setTimeout(() => {
-      const i = id.pending.findIndex((p) => p.timer === timer);
-      if (i >= 0) id.pending.splice(i, 1);
-      rej(new Error("timed out waiting for the transaction result"));
-    }, timeoutMs);
-    id.pending.push({ resolve: res, reject: rej, timer });
-    id.pw.add_client_message(envelope);
-  });
-}
-function mutatingTx(id, name, targ, lt, timeoutMs) {
-  if (id.persistFailed) {
-    try {
-      saveStateFailClosed(id);
-    } catch (err) {
-      return Promise.reject(new Error(
-        `identity "${id.name}" is quarantined: state persist is failing (${String(err)}) \u2014 mutations are rejected until state_data.bin is writable again`
-      ));
-    }
+function voiceDeliveryLine(args, outcome) {
+  const head = `  \u2022 \u{1F3A4} voice message from ${args.sender} (${args.sizeBytes} B)`;
+  const tail = `audio saved \u2192 ${args.savedPath} {${args.wire}}`;
+  switch (outcome.kind) {
+    case "transcript":
+      return `${head}: "${outcome.text}" \u2014 transcribed from voice message (STT); ${tail}`;
+    case "unconfigured":
+      return `${head}: cannot transcribe \u2014 ${outcome.reason}. Tell the user you can't listen to voice messages until the operator configures transcription on this ours-mcp server, and ask them to send text meanwhile; ${tail}`;
+    case "failed":
+      return `${head}: transcription failed (${outcome.error}). Tell the user their voice message could not be transcribed right now and ask them to send text or retry; ${tail}`;
   }
-  const envelope = object_to_adapt_value({ name, targ });
-  return withLock(id, () => enqueueMutation(id, envelope, timeoutMs)).then(
-    (payload) => {
-      envelope.Destroy();
-      if (id.persistFailed) {
-        try {
-          payload.Destroy();
-        } catch {
-        }
-        throw new Error(
-          `identity "${id.name}": state persist FAILED \u2014 this transaction's outbound was withheld (fail-closed); fix the state directory and retry`
-        );
-      }
-      return lt ? payload.Attach(lt) : payload;
-    },
-    (err) => {
-      try {
-        envelope.Destroy();
-      } catch {
-      }
-      throw err;
-    }
-  );
 }
 
-// ../../src/identity/hierarchy.ts
-function setRootName(name) {
-  rootName = name;
-}
-var rootMarkerPath = () => join8(STATE_DIR, "root.json");
-var rootName = null;
-function readRootMarker() {
-  try {
-    const parsed = JSON.parse(fs9.readFileSync(rootMarkerPath(), "utf8"));
-    return typeof parsed.name === "string" ? parsed.name : null;
-  } catch {
-    return null;
+// ../../src/render/adapt-to-json.ts
+function renderContacts(v) {
+  const out = [];
+  if (v.IsNil()) return out;
+  for (const key of v.GetKeys()) {
+    const c = v.Reduce(key);
+    if (c.IsNil()) continue;
+    out.push({
+      name: c.Reduce("name").Visualize(),
+      container_id: c.Reduce("container_id").Visualize()
+    });
   }
+  return out;
 }
-function writeRootMarker(name) {
-  fs9.mkdirSync(STATE_DIR, { recursive: true });
-  const tmp = `${rootMarkerPath()}.tmp`;
-  fs9.writeFileSync(tmp, JSON.stringify({ v: 1, name }));
-  fs9.renameSync(tmp, rootMarkerPath());
+function renderImportRenames(v) {
+  const out = {};
+  if (v.IsNil()) return out;
+  for (const key of v.GetKeys()) {
+    const n = v.Reduce(key);
+    if (!n.IsNil()) out[typeof key === "string" ? key : key.Visualize()] = n.Visualize();
+  }
+  return out;
 }
-function clearRootMarker() {
-  fs9.rmSync(rootMarkerPath(), { force: true });
+function renderPending(v) {
+  const out = [];
+  if (v.IsNil()) return out;
+  for (const key of v.GetKeys()) {
+    const p = v.Reduce(key);
+    if (p.IsNil()) continue;
+    out.push({
+      container_id: typeof key === "string" ? key : key.Visualize(),
+      name: p.Reduce("name").Visualize(),
+      queued: parseInt(p.Reduce("queued").Visualize(), 10) || 0
+    });
+  }
+  return out;
 }
-function describeIdentity(id) {
-  return withScope((lt) => {
-    const v = readonlyTx(id, "::actor::describe_identity", lt);
-    return {
-      bio: v.Reduce("bio").Visualize(),
-      persona: v.Reduce("persona").Visualize(),
-      hasCert: v.Reduce("has_cert").GetBoolean(),
-      roleId: v.Reduce("role_id").Visualize(),
-      rootCid: v.Reduce("root_cid").Visualize(),
-      rootName: v.Reduce("root_name").Visualize(),
-      monitoringEnabled: v.Reduce("monitoring_enabled").GetBoolean()
+function renderContactRoots(v) {
+  const out = {};
+  if (v.IsNil()) return out;
+  for (const key of v.GetKeys()) {
+    const r = v.Reduce(key);
+    if (r.IsNil()) continue;
+    out[typeof key === "string" ? key : key.Visualize()] = {
+      root_cid: r.Reduce("root_cid").Visualize(),
+      root_name: r.Reduce("root_name").Visualize(),
+      role_id: r.Reduce("role_id").Visualize()
     };
-  });
+  }
+  return out;
 }
-async function delegateRole(root, role) {
-  await withScopeAsync(async (lt) => {
-    const roleAd = exportAdBlob(role);
-    const signed = await mutatingTx(root, "::actor::sign_delegation", {
-      role_ad: root.pw.packet.NewBinaryFromBuffer(roleAd).Attach(lt),
-      role_id: role.name
-    }, lt);
-    const certBlob = Buffer.from(signed.Reduce("cert").GetBinary());
-    const profileData = await mutatingTx(root, "::actor::export_root_profile", {}, lt);
-    const profileBlob = Buffer.from(profileData.Reduce("profile").GetBinary());
-    const rootAdBlob = exportAdBlob(root);
-    const roleAdV1 = Buffer.from(
-      (await mutatingTx(role, "::actor::export_v1_address_document", {}, lt)).Reduce("ad").GetBinary()
-    );
-    const signedV1 = await mutatingTx(root, "::actor::sign_delegation", {
-      role_ad: root.pw.packet.NewBinaryFromBuffer(roleAdV1).Attach(lt),
-      role_id: role.name
-    }, lt);
-    const certV1Blob = Buffer.from(signedV1.Reduce("cert").GetBinary());
-    await mutatingTx(role, "::actor::set_delegation", {
-      cert: role.pw.packet.NewBinaryFromBuffer(certBlob).Attach(lt),
-      root_ad: role.pw.packet.NewBinaryFromBuffer(rootAdBlob).Attach(lt),
-      root_profile: role.pw.packet.NewBinaryFromBuffer(profileBlob).Attach(lt),
-      cert_v1: role.pw.packet.NewBinaryFromBuffer(certV1Blob).Attach(lt)
-    }, lt);
-  });
-  log(`[${role.name}] delegated as a role under root "${root.name}"`);
+function encodeWireBin(raw) {
+  return brotliCompressSync(raw).toString("base64url");
 }
-async function establishRoot(id) {
-  rootName = id.name;
-  writeRootMarker(id.name);
-  const adopted = [];
-  const failed = [];
-  for (const other of identities.values()) {
-    if (other.name === id.name) continue;
-    if (other.temp) continue;
-    try {
-      await delegateRole(id, other);
-      adopted.push(other.name);
-    } catch (err) {
-      log(`failed to adopt "${other.name}" as a role under new root "${id.name}":`, String(err));
-      failed.push(other.name);
-    }
-  }
-  log(`[${id.name}] established as the host root${adopted.length ? ` (adopted ${adopted.length} role(s))` : ""}`);
-  return { adopted, failed };
+function decodeWireBin(s) {
+  return brotliDecompressSync(Buffer.from(s.replace(/\s+/g, ""), "base64url"));
 }
 
 // ../../src/identity/lifecycle.ts
-import { join as join9 } from "node:path";
-import * as fs10 from "node:fs";
 function deleteIdentityCompletely(id) {
+  try {
+    closeHistory(id);
+  } catch (err) {
+    log(`closeHistory(${id.name}) failed:`, String(err));
+  }
   try {
     wrapper.remove_packet(id.cid);
   } catch (err) {
@@ -2177,7 +2646,7 @@ function deleteIdentityCompletely(id) {
     clearRootMarker();
   }
   try {
-    fs10.rmSync(id.dir, { recursive: true, force: true });
+    fs11.rmSync(id.dir, { recursive: true, force: true });
     reservedNames.delete(id.name);
   } catch (err) {
     return `deleting ${id.dir} failed: ${String(err)}`;
@@ -2242,14 +2711,14 @@ function sweepStaleTempIdentities() {
   }
 }
 function sweepOrphanTempDirs() {
-  if (!fs10.existsSync(STATE_DIR)) return;
-  for (const d of fs10.readdirSync(STATE_DIR, { withFileTypes: true })) {
+  if (!fs11.existsSync(STATE_DIR)) return;
+  for (const d of fs11.readdirSync(STATE_DIR, { withFileTypes: true })) {
     if (!d.isDirectory() || identities.has(d.name)) continue;
     const dir = join9(STATE_DIR, d.name);
     const meta = readTempMetaFile(dir);
     if (!meta || pidAlive(meta.owner.pid)) continue;
     try {
-      fs10.rmSync(dir, { recursive: true, force: true });
+      fs11.rmSync(dir, { recursive: true, force: true });
       reservedNames.delete(d.name);
       log(`[${d.name}] removed orphaned temporary-identity dir (owner pid ${meta.owner.pid} dead, no live packet)`);
     } catch (err) {
@@ -2390,6 +2859,7 @@ async function bootWrapper() {
         if (tempMeta) id.temp = tempMeta;
       } catch (err) {
         log(`failed to restore "${name}":`, String(err));
+        throw err;
       }
       startupProgress?.update("identities", { completed: index + 1, total: names.length });
     }
@@ -2465,6 +2935,15 @@ export {
   log,
   requireAuth,
   validateName,
+  consumeOutboundHistoryFailure,
+  listIncomingMessages,
+  takeUnreadMessages,
+  listIncomingFiles,
+  takeUnreadFiles,
+  listMessageHistory,
+  getMessageHistoryItem,
+  listFileHistory,
+  getFileHistoryItem,
   FILE_SELECTION_CAP,
   identities,
   registrar,
@@ -2481,21 +2960,9 @@ export {
   persistBindings,
   resolveBound,
   bindSession,
-  buildMessagesPayload,
-  mimeFromExt,
-  renderContacts,
-  renderImportRenames,
-  renderInbox,
-  renderFileMetadata,
-  writeIncomingFiles,
-  renderPending,
-  renderContactRoots,
-  encodeWireBin,
-  decodeWireBin,
   setNotifyHook,
   clearNotifyHook,
   appendNotifyLog,
-  readE2eWireIds,
   serveNotifications,
   refreshUnread,
   unreadSummary,
@@ -2519,6 +2986,16 @@ export {
   describeIdentity,
   delegateRole,
   establishRoot,
+  sttStatus,
+  transcribeVoice,
+  structuredVoiceOutcome,
+  voiceDeliveryLine,
+  renderContacts,
+  renderImportRenames,
+  renderPending,
+  renderContactRoots,
+  encodeWireBin,
+  decodeWireBin,
   deleteIdentityCompletely,
   closeTemporaryIdentity,
   sweepStaleTempIdentities,