@ours.network/fleet 2.1.2 → 2.2.0

package/dist/notifications/task-producer.d.ts

@@ -1,3 +1,4 @@
+import type { TaskRecord } from '../rooms-tasks/types.js';
 import type { ProducerConfig } from './outbox.js';
 /** The Fleet manager owns this sender even when the web console is stopped.
  * Events are already durable in their owning task commit, so no second outbox
@@ -6,13 +7,22 @@ export declare class TaskNotificationProducer {
     private readonly config;
     private readonly warn;
     private readonly request;
+    /** Existing tasks and their layout room CIDs, registered once per start before own-room OFF can be chosen. */
+    private readonly missions?;
     private timer?;
     private dirty;
     private running?;
     private offset;
     private stopped;
     private readonly shutdown;
-    constructor(config: ProducerConfig, warn?: (line: string) => void, request?: typeof fetch);
+    private bootstrapped;
+    private bootstrapAt;
+    constructor(config: ProducerConfig, warn?: (line: string) => void, request?: typeof fetch, 
+    /** Existing tasks and their layout room CIDs, registered once per start before own-room OFF can be chosen. */
+    missions?: {
+        tasks: () => TaskRecord[];
+        layoutRooms: (task: TaskRecord) => string[];
+    } | undefined);
     drain(): Promise<void>;
     private retry;
     private drainOnce;

package/dist/notifications/task-producer.js

@@ -1,6 +1,7 @@
 import { observeFleetResources } from '../application/resource-observer.js';
 import { tasksDir } from '../rooms-tasks/task-state.js';
-import { acknowledgeTaskNotification, pendingTaskNotifications } from '../rooms-tasks/task-state.js';
+import { acknowledgeTaskNotification, convertRetiredTaskNotifications, pendingTaskNotifications } from '../rooms-tasks/task-state.js';
+import { bootstrapMissionRooms, drainMissionCleanup } from './mission-ownership.js';
 /** The Fleet manager owns this sender even when the web console is stopped.
  * Events are already durable in their owning task commit, so no second outbox
  * admission/crash window is needed. A failed task does not block other tasks. */
@@ -8,16 +9,22 @@ export class TaskNotificationProducer {
     config;
     warn;
     request;
+    missions;
     timer;
     dirty = false;
     running;
     offset = 0;
     stopped = false;
     shutdown = new AbortController();
-    constructor(config, warn = () => { }, request = fetch) {
+    bootstrapped = false;
+    bootstrapAt = 0;
+    constructor(config, warn = () => { }, request = fetch, 
+    /** Existing tasks and their layout room CIDs, registered once per start before own-room OFF can be chosen. */
+    missions) {
         this.config = config;
         this.warn = warn;
         this.request = request;
+        this.missions = missions;
         // Subscribe before startup replay: a commit while fetch is pending needs a second pass.
         observeFleetResources({ retryWatchFailures: true, paths: [tasksDir()], roots: [] }, state => {
             if (state.health !== 'healthy')
@@ -49,15 +56,35 @@ export class TaskNotificationProducer {
         });
         return this.running;
     }
-    retry() {
+    retry(delay = 3000) {
         if (this.stopped || this.timer)
             return;
-        this.timer = setTimeout(() => { this.timer = undefined; void this.drain(); }, 3000);
+        this.timer = setTimeout(() => { this.timer = undefined; void this.drain(); }, delay);
         this.timer.unref();
     }
     async drainOnce() {
         if (this.stopped)
             return;
+        // Deletion first: a retired task's notifications go before any other delivery work in this pass.
+        if (convertRetiredTaskNotifications() || await drainMissionCleanup(this.config, this.warn, this.request))
+            this.retry();
+        if (this.missions && !this.bootstrapped && !this.stopped) {
+            // A failed run waits 30s: unavailable inventory or a refused registration needs repair, not a tight loop.
+            const wait = this.bootstrapAt - Date.now();
+            if (wait > 0)
+                this.retry(wait);
+            else {
+                try {
+                    await bootstrapMissionRooms(this.config, this.missions.tasks, this.missions.layoutRooms, this.request);
+                    this.bootstrapped = true;
+                }
+                catch {
+                    this.warn('Mission room registration pending; own-room message preference stays unavailable');
+                    this.bootstrapAt = Date.now() + 30_000;
+                    this.retry(30_000);
+                }
+            }
+        }
         const pending = pendingTaskNotifications(this.warn);
         if (!pending.length)
             return;
@@ -83,7 +110,9 @@ export class TaskNotificationProducer {
                         });
                         await response.body?.cancel();
                         if (!response.ok) {
-                            this.warn(`Task notification delivery pending (HTTP ${response.status}); committed event retained`);
+                            this.warn(response.status === 400 && event.delivery
+                                ? 'Notification service does not support push-only task events; committed events retained'
+                                : `Task notification delivery pending (HTTP ${response.status}); committed event retained`);
                             break;
                         }
                         acknowledgeTaskNotification(task.taskId, event.eventId);

package/dist/rooms-tasks/layout-service.d.ts

@@ -30,6 +30,8 @@ export declare class RoomLayoutService {
     supervisor(id?: string, templates?: Record<string, AgentTemplateDefinition>): NativeLayoutSupervisor;
     private owner;
     private engine;
+    /** A task's layout rooms are registered with the notification service before the Owner can join them. */
+    private beforeOwner;
     open(id: string, cleanup?: boolean): RoomLayout;
     /** `scope` lets an owner (e.g. a Task) snapshot an adjusted definition and pin agent working directories. */
     create(name: string, bindings?: Record<string, LayoutInstance>, id?: string, scope?: {

package/dist/rooms-tasks/layout-service.js

@@ -178,11 +178,16 @@ export class RoomLayoutService {
         const path = layoutRunPath(id);
         if (existsSync(path))
             assertLayoutFile(path);
-        return new RoomLayout(path, () => createCoworkAdapter(), this.supervisor(id), cleanup ? undefined : this.owner());
+        return new RoomLayout(path, () => createCoworkAdapter(), this.supervisor(id), cleanup ? undefined : this.owner(), this.beforeOwner(id));
+    }
+    /** A task's layout rooms are registered with the notification service before the Owner can join them. */
+    beforeOwner(id) {
+        const taskId = /^task-([0-9a-z]{9}[0-9a-f]{8})$/.exec(id)?.[1];
+        return taskId ? async (roomCid) => (await import('../notifications/mission-ownership.js')).associateRoomNotifications(taskId, roomCid) : undefined;
     }
     open(id, cleanup = false) {
         const initial = this.engine(id, cleanup), snapshot = initial.snapshot();
-        return new RoomLayout(layoutRunPath(id), () => createCoworkAdapter(), this.supervisor(id, snapshot.agent_templates ?? {}), cleanup ? undefined : this.owner());
+        return new RoomLayout(layoutRunPath(id), () => createCoworkAdapter(), this.supervisor(id, snapshot.agent_templates ?? {}), cleanup ? undefined : this.owner(), this.beforeOwner(id));
     }
     /** `scope` lets an owner (e.g. a Task) snapshot an adjusted definition and pin agent working directories. */
     async create(name, bindings = {}, id = `run-${randomUUID()}`, scope = {}) {

package/dist/rooms-tasks/layout.d.ts

@@ -104,9 +104,13 @@ export declare class RoomLayout {
     private file;
     private supervisor;
     private owner?;
+    /** Runs before the Owner may join each room; a failure stops here and the next pass retries it. */
+    private beforeOwner?;
     private coworkAdapter?;
     private readonly coworkFactory;
-    constructor(file: string, cowork: CoworkAdapter | (() => CoworkAdapter), supervisor: LayoutSupervisor, owner?: LayoutOwner | undefined);
+    constructor(file: string, cowork: CoworkAdapter | (() => CoworkAdapter), supervisor: LayoutSupervisor, owner?: LayoutOwner | undefined, 
+    /** Runs before the Owner may join each room; a failure stops here and the next pass retries it. */
+    beforeOwner?: ((roomCid: string) => Promise<void>) | undefined);
     private get cowork();
     snapshot(): RoomLayoutState;
     private save;

package/dist/rooms-tasks/layout.js

@@ -39,12 +39,16 @@ export class RoomLayout {
     file;
     supervisor;
     owner;
+    beforeOwner;
     coworkAdapter;
     coworkFactory;
-    constructor(file, cowork, supervisor, owner) {
+    constructor(file, cowork, supervisor, owner, 
+    /** Runs before the Owner may join each room; a failure stops here and the next pass retries it. */
+    beforeOwner) {
         this.file = file;
         this.supervisor = supervisor;
         this.owner = owner;
+        this.beforeOwner = beforeOwner;
         this.coworkFactory = typeof cowork === 'function' ? cowork : () => cowork;
     }
     get cowork() { return this.coworkAdapter ??= this.coworkFactory(); }
@@ -161,6 +165,8 @@ export class RoomLayout {
                 activation_requirements: !spec.members.length && s.owner ? [{ role: s.owner.role, count: 1 }]
                     : [...new Set(spec.members.map(roleFor))].map(role => ({ role, count: spec.members.filter(m => roleFor(m) === role).length })),
             }), native => { room.native = native; s.order.push(key); });
+        if (s.owner && !room.owner_ready && this.beforeOwner)
+            await this.beforeOwner(room.native.identity_cid);
         if (s.owner && !room.owner_ready)
             await this.mutation(s, `owner:${key}`, async () => {
                 await this.cowork.acceptInvite(room.native.room_id, this.owner.invite, { role: s.owner.role, expected_cid: s.owner.cid });

package/dist/rooms-tasks/notification-manifest.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Notification ownership of a task's rooms. Room identity CIDs are recorded when Fleet records the room, and are
+ * never removed (a room erased early stays attributable), so deleting the task can retire its rooms' notifications
+ * even after room records are gone.
+ */
+export interface TaskNotificationManifest {
+    revision: number;
+    room_cids: string[];
+}
+export declare const canonicalCid: (cid: string) => string;
+export declare function validRoomCid(cid: unknown): cid is string;
+/** Union of rooms; the revision advances only when a room is added. */
+export declare function withManifestRooms(manifest: TaskNotificationManifest | undefined, cids: string[]): TaskNotificationManifest;
+/** Durable intent to retire a deleted task's notifications; written at deletion acceptance, merged, removed on service acknowledgement. */
+export interface MissionCleanupIntent {
+    schema: 1;
+    taskId: string;
+    contactIds: string[];
+}
+export declare const missionCleanupDir: () => string;
+/** Merge rooms into the task's intent. An existing intent that cannot be read is never replaced: this throws and the
+ * file keeps its bytes, so a later writer with only some rooms cannot erase coverage recorded earlier. */
+export declare function queueMissionCleanup(taskId: string, contactIds: string[], dir?: string): void;
+/** Readable intents, in directory order. Unreadable ones are reported by `unavailableMissionCleanups`, never dropped. */
+export declare function pendingMissionCleanups(dir?: string): MissionCleanupIntent[];
+/** Task IDs whose intent file exists but cannot be read. Their bytes are kept; they block nothing else but stay pending. */
+export declare function unavailableMissionCleanups(dir?: string): string[];
+/** Remove only the exact intent the service acknowledged; a merge since then, or an unreadable file, keeps it for another pass. */
+export declare function settleMissionCleanup(intent: MissionCleanupIntent, dir?: string): boolean;

package/dist/rooms-tasks/notification-manifest.js

@@ -0,0 +1,65 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { stateRoot } from '../paths.js';
+const CID = /^[A-Za-z0-9_-]{1,512}$/;
+export const canonicalCid = (cid) => /^[a-f0-9]{64}$/i.test(cid) ? cid.toUpperCase() : cid;
+export function validRoomCid(cid) { return typeof cid === 'string' && CID.test(cid); }
+/** Union of rooms; the revision advances only when a room is added. */
+export function withManifestRooms(manifest, cids) {
+    const current = manifest ?? { revision: 0, room_cids: [] };
+    const added = cids.filter(validRoomCid).map(canonicalCid).filter(cid => !current.room_cids.includes(cid));
+    return added.length ? { revision: current.revision + 1, room_cids: [...current.room_cids, ...new Set(added)] } : current;
+}
+export const missionCleanupDir = () => join(stateRoot(), 'notifications', 'mission-cleanup');
+const TASK_ID = /^[0-9a-z]{9}[0-9a-f]{8}$/;
+/** Merge rooms into the task's intent. An existing intent that cannot be read is never replaced: this throws and the
+ * file keeps its bytes, so a later writer with only some rooms cannot erase coverage recorded earlier. */
+export function queueMissionCleanup(taskId, contactIds, dir = missionCleanupDir()) {
+    if (!TASK_ID.test(taskId))
+        throw new Error('invalid task ID');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = join(dir, `${taskId}.json`), previous = readMissionCleanup(path, taskId);
+    if (previous === 'unavailable')
+        throw new Error(`mission cleanup intent for ${taskId} is unreadable; file retained`);
+    const known = previous === 'absent' ? [] : previous.contactIds;
+    const merged = [...new Set([...known, ...contactIds.filter(validRoomCid).map(canonicalCid)])];
+    if (previous !== 'absent' && merged.length === known.length)
+        return;
+    replaceFileAtomically(path, JSON.stringify({ schema: 1, taskId, contactIds: merged }) + '\n', 0o600);
+}
+/** Only a missing file is absent. Unreadable, malformed or mismatched content is unavailable, never "no intent". */
+function readMissionCleanup(path, taskId) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch (error) {
+        return error.code === 'ENOENT' ? 'absent' : 'unavailable';
+    }
+    try {
+        const value = JSON.parse(text);
+        if (value?.schema === 1 && value.taskId === taskId && Array.isArray(value.contactIds) && value.contactIds.every(validRoomCid))
+            return value;
+    }
+    catch { /* malformed */ }
+    return 'unavailable';
+}
+const intentFiles = (dir) => existsSync(dir) ? readdirSync(dir).filter(name => /^[0-9a-z]{9}[0-9a-f]{8}\.json$/.test(name)) : [];
+/** Readable intents, in directory order. Unreadable ones are reported by `unavailableMissionCleanups`, never dropped. */
+export function pendingMissionCleanups(dir = missionCleanupDir()) {
+    return intentFiles(dir).map(name => readMissionCleanup(join(dir, name), name.slice(0, -5)))
+        .filter((intent) => typeof intent === 'object');
+}
+/** Task IDs whose intent file exists but cannot be read. Their bytes are kept; they block nothing else but stay pending. */
+export function unavailableMissionCleanups(dir = missionCleanupDir()) {
+    return intentFiles(dir).filter(name => readMissionCleanup(join(dir, name), name.slice(0, -5)) === 'unavailable').map(name => name.slice(0, -5));
+}
+/** Remove only the exact intent the service acknowledged; a merge since then, or an unreadable file, keeps it for another pass. */
+export function settleMissionCleanup(intent, dir = missionCleanupDir()) {
+    const path = join(dir, `${intent.taskId}.json`), current = readMissionCleanup(path, intent.taskId);
+    if (typeof current !== 'object' || current.contactIds.length !== intent.contactIds.length)
+        return false;
+    rmSync(path, { force: true });
+    return true;
+}

package/dist/rooms-tasks/task-review.d.ts

@@ -103,6 +103,8 @@ export declare function publicReview(review: TaskReview): TaskReview;
 /** Compact summary for list and detail payloads; bodies are fetched separately. */
 export declare function taskContributionSummary(task: TaskRecord): {
     progress_count: number;
+    progress_unread: number;
+    review_unread: boolean;
     review: {
         has_markdown: boolean;
         artifact_count: number;

package/dist/rooms-tasks/task-review.js

@@ -12,7 +12,7 @@ import { open } from 'node:fs/promises';
 import { basename, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { stateRoot } from '../paths.js';
 import { MAX_FILE_BYTES, openDirectory } from '../file-delivery/reader.js';
-import { getTask, TaskStateError, updateTaskContribution } from './task-state.js';
+import { contributionUnread, getTask, reviewRevision, TaskStateError, updateTaskContribution } from './task-state.js';
 import { assertWorkspacePresent } from './workspace.js';
 export const PROGRESS_TEXT_MAX = 4_000;
 export const PROGRESS_MAX_ENTRIES = 200;
@@ -109,7 +109,7 @@ export function appendTaskProgress(taskId, input) {
 // ── Review Markdown ────────────────────────────────────────────────────
 /** Every change to the package gets the next revision, so readers can tell any two states apart. */
 function nextRevision(review) {
-    return (review?.revision ?? 0) + 1;
+    return reviewRevision(review) + 1;
 }
 export function getTaskReview(taskId) {
     assertTaskId(taskId);
@@ -544,17 +544,19 @@ export function publicProgressEntry(entry) {
     return rest;
 }
 export function publicReview(review) {
-    return { ...review, revision: review.revision ?? 1, artifacts: review.artifacts.map(({ request_key: _key, ...rest }) => rest) };
+    return { ...review, revision: reviewRevision(review), artifacts: review.artifacts.map(({ request_key: _key, ...rest }) => rest) };
 }
 /** Compact summary for list and detail payloads; bodies are fetched separately. */
 export function taskContributionSummary(task) {
+    const unread = contributionUnread(task);
     return {
         progress_count: task.progress?.length ?? 0,
+        progress_unread: unread.progress,
+        review_unread: unread.review,
         review: {
             has_markdown: !!task.review?.markdown.trim(),
             artifact_count: task.review?.artifacts.length ?? 0,
-            // Packages written before revisions existed count as revision 1 until their next change.
-            revision: task.review ? task.review.revision ?? 1 : 0,
+            revision: reviewRevision(task.review),
             ...(task.review ? { updated_at: task.review.updated_at } : {}),
         },
     };

package/dist/rooms-tasks/task-state.d.ts

@@ -1,13 +1,41 @@
 import type { ArchivedMemberAbsence } from './types.js';
 import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase, TaskNotificationEvent } from './types.js';
+import { type TaskNotificationManifest } from './notification-manifest.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
 }
+/** Packages written before revisions existed count as revision 1; their next change becomes 2. No package is 0. */
+export declare const reviewRevision: (review: {
+    revision?: number;
+} | undefined) => number;
+/** Item-based Progress unread and revision-based To review unread. An absent read state means nothing is unread. */
+export declare function contributionUnread(task: Pick<TaskRecord, 'progress' | 'review' | 'contribution_reads'>): {
+    progress: number;
+    review: boolean;
+};
+/** Acknowledge Progress entries the user actually viewed; unknown IDs are ignored and the set only grows. */
+export declare function acknowledgeTaskProgress(id: string, ids: string[]): {
+    progress: number;
+    review: boolean;
+};
+/** Acknowledge the To review revision the user saw. Only moves forward; a revision newer than current is refused. */
+export declare function acknowledgeTaskReview(id: string, revision: number): {
+    progress: number;
+    review: boolean;
+};
 /** Atomic snapshots contain the events, including intermediate states between polls. */
+/** `upgraded`: IDs of events queued by an earlier release without a delivery policy. They are sent push-only under the
+ * same event ID (state transitions never count as unread); the queued record itself is not rewritten. A service that
+ * already admitted one as an inbox row repairs that row to push-only itself, so the retry matches; any refusal keeps the
+ * event queued. */
 export declare function pendingTaskNotifications(warn?: (line: string) => void): Array<{
     taskId: string;
     events: TaskNotificationEvent[];
+    upgraded: string[];
 }>;
+/** Earlier releases kept a deleted task's queued events in `.notification-retired`. They are obsolete: each
+ * becomes a cleanup intent for its task and is never delivered. Returns the number converted. */
+export declare function convertRetiredTaskNotifications(): number;
 /** Service event-id dedupe covers acceptance followed by a crash before this acknowledgement. */
 export declare function acknowledgeTaskNotification(id: string, eventId: string): void;
 /**
@@ -62,6 +90,13 @@ export declare function setTaskTerminalIntentError(id: string, error: string, re
 export declare function finishTaskTerminalIntent(id: string): TaskRecord;
 export declare function failTask(id: string, error: string): TaskRecord;
 export declare function updateTaskRoom(id: string, roomId: string, roomIdentityCid: string): TaskRecord;
+/** Record room CIDs as this task's notification-owned rooms (union only). Returns the manifest to register. */
+export declare function recordNotificationRooms(id: string, cids: string[]): TaskNotificationManifest;
+/** After a refused registration (409), move the manifest revision past the refused one; rooms are unchanged. A retry
+ * then registers the full union under a newer revision. Nothing happens if the manifest already moved on. */
+export declare function advanceNotificationRevision(id: string, refused: number): void;
+/** Every room this task ever recorded, including the current one from records written before manifests existed. */
+export declare function notificationRoomCids(task: Pick<TaskRecord, 'notification_manifest' | 'room_identity_cid'>): string[];
 export declare function updateTaskTemplate(id: string, template: TaskTemplateRef): TaskRecord;
 export declare function updateTaskMembers(id: string, members: TaskMemberRole[]): TaskRecord;
 /**

package/dist/rooms-tasks/task-state.js

@@ -8,6 +8,7 @@ import { stateRoot } from '../paths.js';
 import { planWorkspace, ensureWorkspace } from './workspace.js';
 import { storedRoomLaunchPolicy, TASK_TERMINAL_STATES, TASK_CANCELLABLE_STATES } from './types.js';
 import { DEFAULT_TASK_LIST_ID, readTaskLists } from './task-lists.js';
+import { queueMissionCleanup, withManifestRooms } from './notification-manifest.js';
 export const tasksDir = () => join(stateRoot(), 'tasks');
 function taskPath(id) { return join(tasksDir(), `${id}.json`); }
 function taskLockPath(id) { return join(tasksDir(), '.locks', id); }
@@ -165,14 +166,24 @@ function writeTask(record) {
     const status = (task) => task.deletion?.status === 'pending' ? 'deleting' : task.blocked ? `${task.state} (blocked)` : task.state;
     // Read pending events under the same task lock as every mutation. Metadata edits
     // and retries preserve the queue; acknowledgement cannot be resurrected by stale input.
-    const pending = [...(previous?.notification_events ?? [])];
-    if (!previous || status(previous) !== status(record)) {
-        const next = status(record), before = previous ? status(previous) : undefined;
-        pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
-            title: `Task ${!previous ? 'created' : 'updated'}: ${record.title}`.slice(0, 160),
-            body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
-            target: { kind: 'task', taskId: record.task_id } });
+    let pending = [...(previous?.notification_events ?? [])];
+    if (record.deletion?.status === 'pending') {
+        // Deletion acceptance is the notification fence: queued transitions are obsolete and nothing new is produced.
+        pending = [];
     }
+    else {
+        if (!previous || status(previous) !== status(record)) {
+            const next = status(record), before = previous ? status(previous) : undefined;
+            pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
+                title: `Task ${!previous ? 'created' : 'updated'}: ${record.title}`.slice(0, 160),
+                body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
+                target: { kind: 'task', taskId: record.task_id }, delivery: 'push-only' });
+        }
+        pending.push(...contributionEvents(previous, record));
+    }
+    if (previous && !previous.contribution_reads && contributionsChanged(previous, record))
+        // First post-upgrade change: everything that existed before it counts as read, under this same lock.
+        persisted.contribution_reads = { progress_read: (previous.progress ?? []).map(entry => entry.id), review_revision: reviewRevision(previous.review) };
     if (pending.length)
         persisted.notification_events = pending;
     else
@@ -180,9 +191,76 @@ function writeTask(record) {
     replaceFileAtomically(taskPath(record.task_id), JSON.stringify(persisted, null, 2) + '\n');
     publishFleetResourceCommit(taskPath(record.task_id));
 }
+/** Packages written before revisions existed count as revision 1; their next change becomes 2. No package is 0. */
+export const reviewRevision = (review) => review ? review.revision ?? 1 : 0;
+const contributionsChanged = (previous, record) => (record.progress ?? []).some(entry => !(previous.progress ?? []).some(old => old.id === entry.id))
+    || reviewRevision(record.review) !== reviewRevision(previous.review);
+/** New Progress entries and new To review revisions push once each; reads and replays produce nothing. */
+function contributionEvents(previous, record) {
+    if (!previous)
+        return [];
+    const id = record.task_id, events = [];
+    for (const entry of record.progress ?? []) {
+        if ((previous.progress ?? []).some(old => old.id === entry.id))
+            continue;
+        events.push({ eventId: `task:${id}:progress:${entry.id}`, taskId: id, title: `Progress: ${record.title}`.slice(0, 160),
+            body: (entry.text.trim() || 'New progress entry').slice(0, 512), target: { kind: 'task', taskId: id }, delivery: 'push-only' });
+    }
+    const revision = reviewRevision(record.review);
+    if (revision > reviewRevision(previous.review))
+        events.push({ eventId: `task:${id}:review:${revision}`, taskId: id, title: `To review updated: ${record.title}`.slice(0, 160),
+            body: `Task ${id}: the review package changed.`, target: { kind: 'task', taskId: id }, delivery: 'push-only' });
+    return events;
+}
+/** Item-based Progress unread and revision-based To review unread. An absent read state means nothing is unread. */
+export function contributionUnread(task) {
+    const reads = task.contribution_reads;
+    if (!reads)
+        return { progress: 0, review: false };
+    const seen = new Set(reads.progress_read);
+    return { progress: (task.progress ?? []).filter(entry => !seen.has(entry.id)).length, review: reviewRevision(task.review) > reads.review_revision };
+}
+/** Acknowledge Progress entries the user actually viewed; unknown IDs are ignored and the set only grows. */
+export function acknowledgeTaskProgress(id, ids) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        // Without a read state everything present already counts as read: there is nothing to record.
+        const reads = task.contribution_reads;
+        if (!reads)
+            return contributionUnread(task);
+        const present = new Set((task.progress ?? []).map(entry => entry.id));
+        const added = [...new Set(ids.filter(entryId => present.has(entryId) && !reads.progress_read.includes(entryId)))];
+        if (added.length) {
+            task.contribution_reads = { ...reads, progress_read: [...reads.progress_read, ...added] };
+            writeTask(task);
+        }
+        return contributionUnread(task);
+    });
+}
+/** Acknowledge the To review revision the user saw. Only moves forward; a revision newer than current is refused. */
+export function acknowledgeTaskReview(id, revision) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        const current = reviewRevision(task.review);
+        if (!Number.isSafeInteger(revision) || revision < 0 || revision > current)
+            throw new TaskStateError('That review revision does not exist.');
+        const reads = task.contribution_reads;
+        if (reads && revision > reads.review_revision) {
+            task.contribution_reads = { ...reads, review_revision: Math.max(reads.review_revision, revision) };
+            writeTask(task);
+        }
+        return contributionUnread(task);
+    });
+}
 const retiredNotificationsDir = () => join(tasksDir(), '.notification-retired');
 function typedTaskNotification(value, id) {
-    if (!value || typeof value !== 'object' || Object.keys(value).some(key => !['eventId', 'title', 'body', 'target', 'taskId'].includes(key)))
+    if (!value || typeof value !== 'object' || Object.keys(value).some(key => !['eventId', 'title', 'body', 'target', 'taskId', 'delivery'].includes(key)))
+        return false;
+    if (value.delivery !== undefined && value.delivery !== 'push-only')
         return false;
     const target = value.target;
     return typeof value.eventId === 'string' && value.eventId.startsWith(`task:${id}:`) && value.eventId.length <= 512
@@ -193,9 +271,13 @@ function typedTaskNotification(value, id) {
         && typeof value.body === 'string' && !!value.body.trim() && value.body.length <= 512;
 }
 /** Atomic snapshots contain the events, including intermediate states between polls. */
+/** `upgraded`: IDs of events queued by an earlier release without a delivery policy. They are sent push-only under the
+ * same event ID (state transitions never count as unread); the queued record itself is not rewritten. A service that
+ * already admitted one as an inbox row repairs that row to push-only itself, so the retry matches; any refusal keeps the
+ * event queued. */
 export function pendingTaskNotifications(warn = () => { }) {
     const result = [];
-    for (const dir of [tasksDir(), retiredNotificationsDir()]) {
+    for (const dir of [tasksDir()]) {
         if (!existsSync(dir))
             continue;
         for (const file of readdirSync(dir).filter(file => TASK_ID_PATTERN.test(file.slice(0, -5)) && file.endsWith('.json'))) {
@@ -214,9 +296,11 @@ export function pendingTaskNotifications(warn = () => { }) {
                     throw new Error('invalid notification events');
                 // Only typed task events are delivered. Unsupported entries are never sent or converted,
                 // and they do not block later lifecycle events.
-                const events = value.notification_events.filter(event => typedTaskNotification(event, id));
+                const typed = value.notification_events.filter(event => typedTaskNotification(event, id));
+                const upgraded = typed.filter(event => event.delivery === undefined).map(event => event.eventId);
+                const events = typed.map(event => event.delivery ? event : { ...event, delivery: 'push-only' });
                 if (events.length)
-                    result.push({ taskId: id, events });
+                    result.push({ taskId: id, events, upgraded });
             }
             catch (error) {
                 if (!isNotFoundError(error))
@@ -226,6 +310,25 @@ export function pendingTaskNotifications(warn = () => { }) {
     }
     return result;
 }
+/** Earlier releases kept a deleted task's queued events in `.notification-retired`. They are obsolete: each
+ * becomes a cleanup intent for its task and is never delivered. Returns the number converted. */
+export function convertRetiredTaskNotifications() {
+    const dir = retiredNotificationsDir();
+    if (!existsSync(dir))
+        return 0;
+    let converted = 0;
+    for (const file of readdirSync(dir).filter(file => file.endsWith('.json') && TASK_ID_PATTERN.test(file.slice(0, -5)))) {
+        const id = file.slice(0, -5);
+        withTaskLock(id, () => {
+            if (existsSync(taskPath(id)))
+                return; // a prepared copy has no authority while the task exists
+            queueMissionCleanup(id, []);
+            rmSync(join(dir, file), { force: true });
+            converted++;
+        });
+    }
+    return converted;
+}
 /** Service event-id dedupe covers acceptance followed by a crash before this acknowledgement. */
 export function acknowledgeTaskNotification(id, eventId) {
     assertCanonicalTaskId(id);
@@ -583,10 +686,41 @@ export function updateTaskRoom(id, roomId, roomIdentityCid) {
         assertNoPendingTerminalIntent(t);
         t.room_id = roomId;
         t.room_identity_cid = roomIdentityCid;
+        t.notification_manifest = withManifestRooms(t.notification_manifest, [roomIdentityCid]);
         writeTask(t);
         return t;
     });
 }
+/** Record room CIDs as this task's notification-owned rooms (union only). Returns the manifest to register. */
+export function recordNotificationRooms(id, cids) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const t = readTask(id);
+        assertNoPendingDeletion(t);
+        const next = withManifestRooms(t.notification_manifest, cids);
+        if (next !== t.notification_manifest) {
+            t.notification_manifest = next;
+            writeTask(t);
+        }
+        return next;
+    });
+}
+/** After a refused registration (409), move the manifest revision past the refused one; rooms are unchanged. A retry
+ * then registers the full union under a newer revision. Nothing happens if the manifest already moved on. */
+export function advanceNotificationRevision(id, refused) {
+    assertCanonicalTaskId(id);
+    withTaskLock(id, () => {
+        const t = readTask(id);
+        if (t.deletion?.status === 'pending' || t.notification_manifest?.revision !== refused)
+            return;
+        t.notification_manifest = { ...t.notification_manifest, revision: refused + 1 };
+        writeTask(t);
+    });
+}
+/** Every room this task ever recorded, including the current one from records written before manifests existed. */
+export function notificationRoomCids(task) {
+    return withManifestRooms(task.notification_manifest, task.room_identity_cid ? [task.room_identity_cid] : []).room_cids;
+}
 export function updateTaskTemplate(id, template) {
     return withTaskLock(id, () => {
         const t = readTask(id);
@@ -729,6 +863,7 @@ export function beginTaskDeletionIntent(id, actor) {
             // Heal a crash between the intent write and the receipt write.
             if (!readTaskDeletionReceipt(id))
                 writeDeletionReceiptForIntent(stored);
+            queueMissionCleanup(id, notificationRoomCids(stored));
             return { status: 'pending', task: presentTaskLenient(stored) };
         }
         const now = new Date().toISOString();
@@ -741,7 +876,9 @@ export function beginTaskDeletionIntent(id, actor) {
                 name: member.name, identity_cid: member.identity_cid, phase: 'pending', updated_at: now,
             })),
         };
+        // The task write drops queued transitions; the cleanup intent then retires everything already delivered.
         writeTask(stored);
+        queueMissionCleanup(id, notificationRoomCids(stored));
         writeDeletionReceiptForIntent(stored);
         return { status: 'accepted', task: presentTaskLenient(stored) };
     });
@@ -967,12 +1104,9 @@ export function unlinkDeletedTask(id) {
         }
         if (stored.deletion?.status !== 'pending')
             throw new TaskStateError(`task ${id} has no pending deletion`);
-        // Preserve committed deliveries outside the record before deletion. A crash
-        // before unlink may replay two copies; both carry identical service dedupe IDs.
-        const removed = { eventId: `task:${id}:deleted`, taskId: id,
-            title: `Task deleted: ${stored.title}`.slice(0, 160), body: `Task ${id}: deleting → deleted.`,
-            target: { kind: 'task-deleted', taskId: id } };
-        replaceFileAtomically(join(retiredNotificationsDir(), `${id}.json`), JSON.stringify({ notification_events: [...(stored.notification_events ?? []), removed] }) + '\n');
+        // Merge rooms proven since acceptance into the durable cleanup intent before the record disappears.
+        // No deletion notification is produced: deleting retires the task's notifications instead.
+        queueMissionCleanup(id, notificationRoomCids(stored));
         try {
             unlinkSync(taskPath(id));
         }