@qwen-code/qwen-code 0.23.2-preview.0 → 0.23.2

package/chunks/{chunk-5Z4FCEPY.js → chunk-X7LFJF5D.js}

@@ -3,11 +3,11 @@
 import {
   listLiveSessions,
   readOwnSessionRecord
-} from "./chunk-B44JBZBB.js";
+} from "./chunk-QQK4L3UU.js";
 import {
   LEADER_NAME,
   sanitizeName
-} from "./chunk-BF3RUIVP.js";
+} from "./chunk-CH2YDT6X.js";
 import {
   APPROVAL_MODES
 } from "./chunk-JX6XHPTX.js";
@@ -93,8 +93,10 @@ import * as net from "node:net";
 init_esbuild_shims();
 import { randomUUID } from "node:crypto";
 var PEER_FRAME_VERSION = 1;
+var MAX_DROPPED_MSG_IDS = 256;
 var MAX_FRAME_BYTES = 1024 * 1024;
 var MSG_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+var MAX_RETAINED_REPLY_TOKEN_CHARS = 256;
 function canonicalizeMsgId(msgId) {
   return msgId.replace(/-/g, "").toLowerCase();
 }
@@ -107,6 +109,20 @@ function optionalString(value) {
   return typeof value === "string" ? value : void 0;
 }
 __name(optionalString, "optionalString");
+function isAddressableMsgId(value) {
+  return typeof value === "string" && MSG_ID_RE.test(value) && canonicalizeMsgId(value) !== "all";
+}
+__name(isAddressableMsgId, "isAddressableMsgId");
+function optionalDropReason(value) {
+  return value === "rate-limited" || value === "duplicate" || value === "queue-full" ? value : void 0;
+}
+__name(optionalDropReason, "optionalDropReason");
+function parseDroppedMsgIds(value) {
+  if (!Array.isArray(value)) return void 0;
+  const ids = value.filter(isAddressableMsgId).slice(0, MAX_DROPPED_MSG_IDS);
+  return ids.length > 0 ? ids : void 0;
+}
+__name(parseDroppedMsgIds, "parseDroppedMsgIds");
 function parsePeerFrame(line) {
   let parsed;
   try {
@@ -118,8 +134,7 @@ function parsePeerFrame(line) {
   const msgV = parsed["msgV"];
   if (typeof msgV !== "number" || msgV > PEER_FRAME_VERSION) return null;
   const msgId = parsed["msgId"];
-  if (typeof msgId !== "string" || !MSG_ID_RE.test(msgId)) return null;
-  if (canonicalizeMsgId(msgId) === "all") return null;
+  if (!isAddressableMsgId(msgId)) return null;
   if (parsed["type"] === "user") {
     const message = parsed["message"];
     if (!isRecord(message)) return null;
@@ -146,11 +161,13 @@ function parsePeerFrame(line) {
   if (parsed["type"] === "control") {
     if (parsed["action"] !== "delivery_status") return null;
     const status = parsed["status"];
-    if (status !== "held" && status !== "denied" && status !== "refused" && status !== "expired" && status !== "delivered" && status !== "misaddressed") {
+    if (status !== "held" && status !== "denied" && status !== "refused" && status !== "expired" && status !== "delivered" && status !== "misaddressed" && status !== "dropped") {
       return null;
     }
     const origMsgId = parsed["origMsgId"];
     if (typeof origMsgId !== "string" || origMsgId.length === 0) return null;
+    const dropReason = status === "dropped" ? optionalDropReason(parsed["dropReason"]) : void 0;
+    const droppedMsgIds = status === "dropped" ? parseDroppedMsgIds(parsed["droppedMsgIds"]) : void 0;
     return {
       msgV,
       msgId,
@@ -159,7 +176,9 @@ function parsePeerFrame(line) {
       status,
       origMsgId,
       from: optionalString(parsed["from"]),
-      reason: optionalString(parsed["reason"])
+      reason: optionalString(parsed["reason"]),
+      ...dropReason !== void 0 ? { dropReason } : {},
+      ...droppedMsgIds !== void 0 ? { droppedMsgIds } : {}
     };
   }
   return null;
@@ -199,6 +218,8 @@ function describeDeliveryStatus(status) {
       return "Your message was released to the recipient session.";
     case "misaddressed":
       return "That address now belongs to a different session than the one you addressed; it was not delivered. List the agents again before re-sending.";
+    case "dropped":
+      return "Your message was dropped at the recipient's inbox before anyone saw it: sent too fast, a repeat of your previous message, or the inbox queue was full. Treat it as unsent; fold what still matters into one later message rather than re-sending.";
     default: {
       const exhaustive = status;
       return exhaustive;
@@ -206,6 +227,21 @@ function describeDeliveryStatus(status) {
   }
 }
 __name(describeDeliveryStatus, "describeDeliveryStatus");
+function describeDropReason(reason) {
+  switch (reason) {
+    case "rate-limited":
+      return "you sent faster than that session accepts";
+    case "duplicate":
+      return "it repeated your previous message";
+    case "queue-full":
+      return "its queue of undelivered peer messages was full";
+    default: {
+      const exhaustive = reason;
+      return exhaustive;
+    }
+  }
+}
+__name(describeDropReason, "describeDropReason");
 function buildAuthLine(token) {
   return `${JSON.stringify({ msgV: PEER_FRAME_VERSION, type: "auth", token })}
 `;
@@ -235,7 +271,11 @@ function buildDeliveryStatusFrame(fields) {
     status: fields.status,
     origMsgId: fields.origMsgId,
     ...fields.from !== void 0 ? { from: fields.from } : {},
-    reason: describeDeliveryStatus(fields.status)
+    reason: describeDeliveryStatus(fields.status),
+    ...fields.dropReason !== void 0 ? { dropReason: fields.dropReason } : {},
+    // An empty list is left off rather than sent as `[]`: the field means
+    // "these ids too", and there are none.
+    ...fields.droppedMsgIds !== void 0 && fields.droppedMsgIds.length > 0 ? { droppedMsgIds: fields.droppedMsgIds.slice(0, MAX_DROPPED_MSG_IDS) } : {}
   };
 }
 __name(buildDeliveryStatusFrame, "buildDeliveryStatusFrame");
@@ -508,7 +548,225 @@ __name(isInProcessRecipient, "isInProcessRecipient");
 
 // packages/core/src/ipc/inbound-gate.ts
 init_esbuild_shims();
-var debugLogger2 = createDebugLogger("PEER_INBOUND");
+
+// packages/core/src/ipc/peer-admission.ts
+init_esbuild_shims();
+import { createHash as createHash2 } from "node:crypto";
+var debugLogger2 = createDebugLogger("PEER_ADMISSION");
+var PEER_ADMISSION_LIMITS = {
+  bucketCapacity: 30,
+  refillPerSecond: 0.5,
+  dedupWindowMs: 3e4,
+  globalBucketCapacity: 32,
+  globalRefillPerSecond: 1,
+  maxTrackedSenders: 256
+};
+var PEER_BURST_WINDOW_MS = PEER_ADMISSION_LIMITS.bucketCapacity / PEER_ADMISSION_LIMITS.refillPerSecond * 1e3;
+function refillBucket(tokens, lastRefill, now, capacity, perSecond) {
+  const elapsedSeconds = Math.max(0, now - lastRefill) / 1e3;
+  return Math.min(capacity, tokens + elapsedSeconds * perSecond);
+}
+__name(refillBucket, "refillBucket");
+function hasToken(tokens) {
+  return tokens >= 1;
+}
+__name(hasToken, "hasToken");
+function isBodyWithinWindow(at, atWall, now, wallNow, windowMs) {
+  return Math.max(now - at, wallNow - atWall) < windowMs;
+}
+__name(isBodyWithinWindow, "isBodyWithinWindow");
+var PeerAdmission = class {
+  static {
+    __name(this, "PeerAdmission");
+  }
+  now;
+  wallNow;
+  limits;
+  senders = /* @__PURE__ */ new Map();
+  globalTokens;
+  globalRefill;
+  constructor(options = {}) {
+    this.now = options.now ?? (() => performance.now());
+    this.wallNow = options.wallNow ?? (() => Date.now());
+    this.limits = { ...PEER_ADMISSION_LIMITS, ...options.limits };
+    this.globalTokens = this.limits.globalBucketCapacity;
+    this.globalRefill = this.now();
+  }
+  /**
+   * Whether this message may go on to the gate's policy.
+   *
+   * The order matters. The global bucket is checked first, so a flood
+   * that rotates `from` is stopped before it can mint a meter per name.
+   * The duplicate check comes before the sender's bucket is charged: a
+   * repeat should not also cost the sender the allowance it would need to
+   * say something new. Nothing is charged unless every check passes.
+   */
+  admit(request) {
+    const now = this.now();
+    const wallNow = this.wallNow();
+    this.globalTokens = refillBucket(
+      this.globalTokens,
+      this.globalRefill,
+      now,
+      this.limits.globalBucketCapacity,
+      this.limits.globalRefillPerSecond
+    );
+    this.globalRefill = now;
+    if (!hasToken(this.globalTokens)) {
+      debugLogger2.debug(
+        `dropping a peer message from ${request.senderKey}: every sender combined is over the rate limit`
+      );
+      return { admitted: false, reason: "rate-limited" };
+    }
+    const meter = this.trackSender(request.senderKey, now);
+    meter.bodies = meter.bodies.filter(
+      (record) => isBodyWithinWindow(
+        record.at,
+        record.atWall,
+        now,
+        wallNow,
+        this.limits.dedupWindowMs
+      )
+    );
+    const bodyHash = request.exemptFromDedup ? void 0 : hashBody(request.body);
+    const lastBody = meter.bodies.at(-1);
+    if (bodyHash !== void 0 && lastBody?.hash === bodyHash) {
+      debugLogger2.debug(
+        `dropping a peer message from ${request.senderKey}: identical to its previous message`
+      );
+      return { admitted: false, reason: "duplicate" };
+    }
+    meter.tokens = refillBucket(
+      meter.tokens,
+      meter.lastRefill,
+      now,
+      this.limits.bucketCapacity,
+      this.limits.refillPerSecond
+    );
+    meter.lastRefill = now;
+    if (!hasToken(meter.tokens)) {
+      debugLogger2.debug(
+        `dropping a peer message from ${request.senderKey}: over its rate limit`
+      );
+      return { admitted: false, reason: "rate-limited" };
+    }
+    this.globalTokens -= 1;
+    meter.tokens -= 1;
+    if (bodyHash !== void 0) {
+      meter.bodies.push({
+        messageId: request.messageId,
+        hash: bodyHash,
+        at: now,
+        atWall: wallNow
+      });
+    }
+    return { admitted: true };
+  }
+  /** How many senders are metered right now. For tests and diagnostics. */
+  trackedSenderCount() {
+    return this.senders.size;
+  }
+  /**
+   * Undo the repeat record `body` left when it was admitted, leaving the
+   * bucket alone.
+   *
+   * The gate calls this wherever it settles an admitted message as
+   * anything other than delivered or held — a full input queue, a
+   * standing refusal, a hold buffer with no room, a shutdown, a session
+   * swap. In every one of those the far model never saw the message, so a
+   * `duplicate` verdict on the sender's honest retry would assert
+   * something false: that identical content is already over there. The
+   * retry then meets the repeat check it would have met had this message
+   * never arrived.
+   *
+   * Removes only this message's record. A later admitted message remains
+   * the duplicate baseline, and the body admitted before this one keeps
+   * the protection it earned if it becomes the latest remaining record.
+   *
+   * The token stays spent. It is the only bound on how often a peer can
+   * make the receiver attempt, and fail, a delivery.
+   */
+  forgetBody(senderKey, body, messageId) {
+    const meter = this.senders.get(senderKey);
+    if (meter === void 0) return;
+    const bodyHash = hashBody(body);
+    for (let index = meter.bodies.length - 1; index >= 0; index -= 1) {
+      const record = meter.bodies[index];
+      if (record?.hash === bodyHash && (messageId === void 0 || record.messageId === messageId)) {
+        meter.bodies.splice(index, 1);
+      }
+    }
+  }
+  /** Undo every repeat record owned by one admitted message. */
+  forgetMessage(senderKey, messageId) {
+    const meter = this.senders.get(senderKey);
+    if (meter === void 0) return;
+    const canonicalId = canonicalizeMsgId(messageId);
+    meter.bodies = meter.bodies.filter(
+      (record) => record.messageId === void 0 || canonicalizeMsgId(record.messageId) !== canonicalId
+    );
+  }
+  /** Start a fresh per-session conversation without replacing the gate. */
+  reset() {
+    this.senders.clear();
+    this.globalTokens = this.limits.globalBucketCapacity;
+    this.globalRefill = this.now();
+  }
+  /**
+   * The meter for `key`, creating one and making room if needed.
+   *
+   * The map is an LRU: a hit is re-inserted so iteration order is
+   * least-recently-seen first. When it is full, a meter whose bucket has
+   * refilled completely goes first — it is not limiting anyone, so
+   * forgetting it changes no verdict except that its last body is
+   * forgotten too, which can admit one repeat. Losing a repeat check is
+   * the right thing to trade for a bounded map; losing a *bucket* that is
+   * currently holding a flood back is not, which is why a full bucket is
+   * preferred over a merely old one.
+   */
+  trackSender(key, now) {
+    const existing = this.senders.get(key);
+    if (existing !== void 0) {
+      this.senders.delete(key);
+      this.senders.set(key, existing);
+      return existing;
+    }
+    const limit = Math.max(1, this.limits.maxTrackedSenders);
+    while (this.senders.size >= limit) {
+      let victim;
+      for (const [candidate, meter] of this.senders) {
+        const level = refillBucket(
+          meter.tokens,
+          meter.lastRefill,
+          now,
+          this.limits.bucketCapacity,
+          this.limits.refillPerSecond
+        );
+        if (level >= this.limits.bucketCapacity) {
+          victim = candidate;
+          break;
+        }
+      }
+      victim ??= this.senders.keys().next().value;
+      if (victim === void 0) break;
+      this.senders.delete(victim);
+    }
+    const fresh = {
+      tokens: this.limits.bucketCapacity,
+      lastRefill: now,
+      bodies: []
+    };
+    this.senders.set(key, fresh);
+    return fresh;
+  }
+};
+function hashBody(body) {
+  return createHash2("sha256").update(body).digest("hex");
+}
+__name(hashBody, "hashBody");
+
+// packages/core/src/ipc/inbound-gate.ts
+var debugLogger3 = createDebugLogger("PEER_INBOUND");
 var MAX_HELD_MESSAGES = 50;
 var MAX_SETTLED_IDS = 512;
 function receiverReviewsActions(mode) {
@@ -523,6 +781,14 @@ function isInboundPolicy(value) {
   return value === "accept" || value === "hold" || value === "refuse";
 }
 __name(isInboundPolicy, "isInboundPolicy");
+var MAX_SENDER_KEY_CHARS = 256;
+function peerSenderKey(frame, origin) {
+  if (origin.controller) return `controller:${origin.controller.id}`;
+  const address = (frame.from ?? "").slice(0, MAX_SENDER_KEY_CHARS);
+  if (origin.selfSent) return `own:${address}`;
+  return address ? `peer:${address}` : "unknown";
+}
+__name(peerSenderKey, "peerSenderKey");
 var MAX_TIMEOUT_MS = 2 ** 31 - 1;
 var DEFAULT_HELD_EXPIRY_MS = 5 * 60 * 1e3;
 var HELD_EXPIRY_VALUES = {
@@ -535,7 +801,7 @@ var HELD_EXPIRY_OPTIONS = Object.keys(HELD_EXPIRY_VALUES);
 function parseHeldExpiry(value) {
   if (value === void 0) return DEFAULT_HELD_EXPIRY_MS;
   if (typeof value !== "string" || !Object.hasOwn(HELD_EXPIRY_VALUES, value)) {
-    debugLogger2.debug(
+    debugLogger3.debug(
       `unrecognized crossSessionHeldExpiry value (using the default): ${String(
         value
       )}`
@@ -548,6 +814,7 @@ __name(parseHeldExpiry, "parseHeldExpiry");
 var InboundGate = class {
   constructor(options) {
     this.options = options;
+    this.admission = options.admission ?? new PeerAdmission();
   }
   static {
     __name(this, "InboundGate");
@@ -568,6 +835,10 @@ var InboundGate = class {
    * them, all firing to do the same sweep.
    */
   expiryTimer = null;
+  /** How fast senders may arrive. See `peer-admission.ts`. */
+  admission;
+  admissionSessionObserved = false;
+  admissionSessionId;
   /** Messages currently parked, oldest first. */
   getHeld() {
     this.forgetInvalidControllers();
@@ -615,7 +886,7 @@ var InboundGate = class {
     try {
       return this.options.getHeldExpiryMs();
     } catch (error) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `held-expiry getter threw; falling back to the default: ${error instanceof Error ? error.message : String(error)}`
       );
       return DEFAULT_HELD_EXPIRY_MS;
@@ -632,7 +903,7 @@ var InboundGate = class {
     try {
       const configured = this.options.getPolicySetting();
       if (configured !== void 0 && !isInboundPolicy(configured)) {
-        debugLogger2.debug(
+        debugLogger3.debug(
           `unrecognized crossSessionInbound value (failing closed): ${String(
             configured
           )}`
@@ -641,7 +912,7 @@ var InboundGate = class {
       }
       explicit = configured;
     } catch (error) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `policy-setting getter threw (failing closed): ${error instanceof Error ? error.message : String(error)}`
       );
       return { policy: "hold", cause: "policy-unreadable" };
@@ -662,7 +933,7 @@ var InboundGate = class {
     try {
       mode = this.options.getApprovalMode();
     } catch (error) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `approval-mode getter threw (failing closed): ${error instanceof Error ? error.message : String(error)}`
       );
       mode = null;
@@ -684,7 +955,7 @@ var InboundGate = class {
     try {
       return this.options.getPolicyScope?.();
     } catch (error) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `policy-scope getter threw (ignored): ${error instanceof Error ? error.message : String(error)}`
       );
       return void 0;
@@ -695,52 +966,71 @@ var InboundGate = class {
    * an ordinary peer — the transport asserts self-sent, never the frame.
    */
   admit(frame, origin = { selfSent: false }) {
+    const sessionId = this.options.getSessionId?.();
+    if (this.admissionSessionObserved && this.admissionSessionId !== sessionId) {
+      this.admission.reset();
+    }
+    this.admissionSessionObserved = true;
+    this.admissionSessionId = sessionId;
     this.expireOverdue();
+    const verdict = this.admission.admit({
+      senderKey: peerSenderKey(frame, origin),
+      body: frame.message.content,
+      messageId: frame.msgId,
+      // A hook reporting the same line twice, or a user repeating
+      // themselves to a controller, is not the model-driven repetition
+      // the duplicate check exists to stop. Both are still rate limited.
+      exemptFromDedup: origin.selfSent || origin.controller !== void 0
+    });
+    if (!verdict.admitted) {
+      return this.drop(frame, origin, verdict.reason);
+    }
     const settled = this.settled.get(canonicalizeMsgId(frame.msgId));
     if (settled !== void 0) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `re-sent msgId ${frame.msgId}; repeating earlier verdict ${settled}`
       );
+      this.forgetAdmittedBody(frame, origin);
       void this.report(frame, settled);
       return "refused";
     }
     if (this.held.some(
       (entry) => canonicalizeMsgId(entry.frame.msgId) === canonicalizeMsgId(frame.msgId)
     )) {
-      debugLogger2.debug(`duplicate msgId ${frame.msgId}; already held`);
+      debugLogger3.debug(`duplicate msgId ${frame.msgId}; already held`);
+      this.forgetAdmittedBody(frame, origin);
       void this.report(frame, "held");
       return "held";
     }
     const decision = this.resolvePolicy(frame, origin);
     const { policy } = decision;
     if (policy === "refuse") {
-      debugLogger2.debug(`refused peer message ${frame.msgId}`);
+      debugLogger3.debug(`refused peer message ${frame.msgId}`);
+      this.forgetAdmittedBody(frame, origin);
       this.recordSettled(frame.msgId, "refused");
       void this.report(frame, "refused");
       return "refused";
     }
     if (this.shuttingDown) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `not admitting peer message ${frame.msgId} during shutdown; expiring it`
       );
+      this.forgetAdmittedBody(frame, origin);
       void this.report(frame, "expired");
       return "refused";
     }
     if (policy === "accept") {
-      const ok = this.tryDeliver(frame, origin);
-      if (ok) {
-        this.recordSettled(frame.msgId, "delivered");
+      if (!this.tryDeliver(frame, origin)) {
+        this.forgetAdmittedBody(frame, origin);
+        return this.drop(frame, origin, "queue-full");
       }
-      void this.report(frame, ok ? "delivered" : "expired");
-      return ok ? "accept" : "refused";
+      this.recordSettled(frame.msgId, "delivered");
+      void this.report(frame, "delivered");
+      return "accept";
     }
     if (this.held.length >= MAX_HELD_MESSAGES) {
-      const evicted = this.held.shift();
-      if (evicted) {
-        debugLogger2.debug(`hold buffer full; expiring ${evicted.frame.msgId}`);
-        this.recordSettled(evicted.frame.msgId, "expired");
-        void this.report(evicted.frame, "expired");
-      }
+      this.forgetAdmittedBody(frame, origin);
+      return this.drop(frame, origin, "queue-full");
     }
     const cause = decision.policy === "hold" ? decision.cause : "mode-unknown";
     const scope = decision.policy === "hold" ? decision.scope : void 0;
@@ -753,7 +1043,7 @@ var InboundGate = class {
       ...origin.selfSent ? { selfSent: true } : {},
       ...origin.controller ? { controller: origin.controller } : {}
     });
-    debugLogger2.debug(
+    debugLogger3.debug(
       `held peer message ${frame.msgId} (cause=${cause}, ${this.held.length} held)`
     );
     void this.report(frame, "held");
@@ -782,6 +1072,7 @@ var InboundGate = class {
     if (!entry) return "gone";
     if (decision === "approve") {
       if (!this.pinStillValid(entry.frame)) {
+        this.forgetAdmittedBody(entry.frame, originOf(entry));
         this.recordSettled(entry.frame.msgId, "misaddressed");
         void this.report(entry.frame, "misaddressed");
         this.notifyHeldChange();
@@ -798,6 +1089,7 @@ var InboundGate = class {
       this.recordSettled(entry.frame.msgId, "delivered");
       void this.report(entry.frame, "delivered");
     } else {
+      this.forgetAdmittedBody(entry.frame, originOf(entry));
       this.recordSettled(entry.frame.msgId, "denied");
       void this.report(entry.frame, "denied");
     }
@@ -830,6 +1122,7 @@ var InboundGate = class {
         release.push(entry);
       } else if (policy === "refuse") {
         dropped += 1;
+        this.forgetAdmittedBody(entry.frame, originOf(entry));
         this.recordSettled(entry.frame.msgId, "denied");
         void this.report(entry.frame, "denied");
       } else {
@@ -841,6 +1134,7 @@ var InboundGate = class {
     for (const entry of release) {
       if (!this.pinStillValid(entry.frame)) {
         misaddressed += 1;
+        this.forgetAdmittedBody(entry.frame, originOf(entry));
         this.recordSettled(entry.frame.msgId, "misaddressed");
         void this.report(entry.frame, "misaddressed");
         continue;
@@ -859,7 +1153,7 @@ var InboundGate = class {
     this.held.push(...stillHeld);
     this.rescheduleExpiry();
     if (release.length > 0 || dropped > 0) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `reevaluate (${reason}): released ${released}, dropped ${dropped}, misaddressed ${misaddressed}, ${this.held.length} still held`
       );
       this.notifyHeldChange();
@@ -880,12 +1174,13 @@ var InboundGate = class {
     }
     if (this.held.length === 0) return Promise.resolve();
     const settling = this.held.splice(0, this.held.length);
-    debugLogger2.debug(
+    debugLogger3.debug(
       `shutdown: expiring ${settling.length} held peer message(s)`
     );
-    const receipts = settling.map(
-      (entry) => this.report(entry.frame, "expired")
-    );
+    const receipts = settling.map((entry) => {
+      this.forgetAdmittedBody(entry.frame, originOf(entry));
+      return this.report(entry.frame, "expired");
+    });
     this.notifyHeldChange();
     return Promise.allSettled(receipts).then(() => void 0);
   }
@@ -923,19 +1218,70 @@ var InboundGate = class {
     try {
       return Promise.resolve(this.options.reportStatus?.(frame, status));
     } catch (error) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `reportStatus(${status}) threw: ${error instanceof Error ? error.message : String(error)}`
       );
       return Promise.resolve();
     }
   }
+  /**
+   * Undo the repeat record an admitted message left, when the gate went on
+   * to settle it as something the far model never saw.
+   *
+   * Admission records a body before the gate decides what to do with it,
+   * so every terminal that is not a delivery or a hold leaves a record for
+   * content that never arrived — and the sender's honest retry then comes
+   * back `duplicate`, a verdict whose whole premise is that the far side
+   * already has it. Keyed exactly as admission keyed it, or it is a
+   * silent no-op.
+   */
+  forgetAdmittedBody(frame, origin) {
+    this.admission.forgetBody(
+      peerSenderKey(frame, origin),
+      frame.message.content,
+      frame.msgId
+    );
+  }
+  /** Undo an admitted queued message that was invalidated outside the gate. */
+  forgetAdmittedMessage(senderKey, messageId) {
+    this.admission.forgetMessage(senderKey, messageId);
+  }
+  /**
+   * Turn a message away without the model or the user ever seeing it, and
+   * say so to both audiences.
+   *
+   * Two of the three reasons are decided above policy; `queue-full` is
+   * decided below it, when a buffer the message was already accepted into
+   * had no room. What they share is that nothing was *decided about the
+   * message*, which is why none of them leaves a tombstone: a sender that
+   * waits and retries should find the same gate it would have found if it
+   * had waited in the first place.
+   *
+   * Both reporters are best-effort and neither may take the gate down,
+   * for the same reason `report` is wrapped: this runs on the arrival
+   * path of every message.
+   */
+  drop(frame, origin, reason) {
+    debugLogger3.debug(`dropped peer message ${frame.msgId} (${reason})`);
+    try {
+      this.options.reportDropped?.(frame, reason, origin);
+    } catch (error) {
+      debugLogger3.debug(`reportDropped(${reason}) threw: ${describe(error)}`);
+    }
+    try {
+      this.options.onDropped?.(frame, origin, reason);
+    } catch (error) {
+      debugLogger3.debug(`onDropped(${reason}) threw: ${describe(error)}`);
+    }
+    return "dropped";
+  }
   /** Hand a message to the session, reporting whether it landed. */
   tryDeliver(frame, origin) {
     try {
       this.options.deliver(frame, origin);
       return true;
     } catch (error) {
-      debugLogger2.error(
+      debugLogger3.error(
         `deliver threw for ${frame.msgId}: ${error instanceof Error ? error.message : String(error)}`
       );
       return false;
@@ -985,9 +1331,10 @@ var InboundGate = class {
     this.held.length = 0;
     this.held.push(...survivors);
     for (const entry of expired) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `held peer message ${entry.frame.msgId} expired after ${expiryMs} ms`
       );
+      this.forgetAdmittedBody(entry.frame, originOf(entry));
       this.recordSettled(entry.frame.msgId, "expired");
       void this.report(entry.frame, "expired");
     }
@@ -1028,12 +1375,16 @@ var InboundGate = class {
     try {
       this.options.onHeldChange?.(this.held);
     } catch (error) {
-      debugLogger2.debug(
+      debugLogger3.debug(
         `onHeldChange threw: ${error instanceof Error ? error.message : String(error)}`
       );
     }
   }
 };
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+__name(describe, "describe");
 function originOf(entry) {
   return {
     selfSent: entry.selfSent === true,
@@ -1103,6 +1454,14 @@ function senderModeClass(mode) {
 __name(senderModeClass, "senderModeClass");
 var MAX_TRACKED_SENDS = 200;
 var sentMessages = /* @__PURE__ */ new Map();
+var NEVER_WRITTEN_SEND_CODES = /* @__PURE__ */ new Set([
+  void 0,
+  "ENOENT",
+  "ECONNREFUSED",
+  "EMSGSIZE",
+  "EAGAIN",
+  "EBUSY"
+]);
 function trackSent(msgId, info) {
   const key = canonicalizeMsgId(msgId);
   sentMessages.delete(key);
@@ -1121,17 +1480,25 @@ var RECEIPT_TRANSITIONS = {
     "denied",
     "refused",
     "expired",
-    "misaddressed"
+    "misaddressed",
+    "dropped"
   ]),
   // A refusal is decided at admission, so it cannot follow a hold: a
   // message already parked was not turned away. Switching the setting to
   // `refuse` while it sits there settles it as `denied` — someone chose.
+  //
+  // A drop is decided even earlier, before the message is anything to the
+  // receiver at all, so it can only ever follow `pending`. A `dropped`
+  // receipt naming a message this session already saw held or delivered
+  // is answering a *later* frame that reused the id, and applying it
+  // would tell the user a message that did arrive never did.
   held: /* @__PURE__ */ new Set(["delivered", "denied", "expired", "misaddressed"]),
   delivered: /* @__PURE__ */ new Set(["expired", "misaddressed"]),
   denied: /* @__PURE__ */ new Set(),
   refused: /* @__PURE__ */ new Set(),
   expired: /* @__PURE__ */ new Set(),
-  misaddressed: /* @__PURE__ */ new Set()
+  misaddressed: /* @__PURE__ */ new Set(),
+  dropped: /* @__PURE__ */ new Set()
 };
 function settleSentPeerMessage(msgId, status) {
   const entry = sentMessages.get(canonicalizeMsgId(msgId));
@@ -1140,9 +1507,170 @@ function settleSentPeerMessage(msgId, status) {
   }
   const previous = entry.state;
   entry.state = status;
-  return { address: entry.address, previous };
+  return {
+    address: entry.address,
+    ipcPath: entry.ipcPath,
+    previous,
+    ageMs: Math.max(0, pacerWallNow() - entry.sentAt)
+  };
 }
 __name(settleSentPeerMessage, "settleSentPeerMessage");
+var MAX_PACED_TARGETS = 256;
+var pacedTargets = /* @__PURE__ */ new Map();
+function pacedTargetFor(ipcPath, sessionId, now) {
+  const existing = pacedTargets.get(ipcPath);
+  if (existing?.sessionId === sessionId) {
+    pacedTargets.delete(ipcPath);
+    pacedTargets.set(ipcPath, existing);
+    return existing;
+  }
+  const generation = (existing?.generation ?? -1) + 1;
+  pacedTargets.delete(ipcPath);
+  while (pacedTargets.size >= MAX_PACED_TARGETS) {
+    let victim;
+    for (const [candidate, target] of pacedTargets) {
+      const level = refillBucket(
+        target.tokens,
+        target.lastRefill,
+        now,
+        PEER_ADMISSION_LIMITS.bucketCapacity,
+        PEER_ADMISSION_LIMITS.refillPerSecond
+      );
+      if (level >= PEER_ADMISSION_LIMITS.bucketCapacity) {
+        victim = candidate;
+        break;
+      }
+    }
+    victim ??= pacedTargets.keys().next().value;
+    if (victim === void 0) break;
+    pacedTargets.delete(victim);
+  }
+  const fresh = {
+    sessionId,
+    tokens: PEER_ADMISSION_LIMITS.bucketCapacity,
+    lastRefill: now,
+    sentInBurst: 0,
+    burstStartedAt: now,
+    bodies: [],
+    generation
+  };
+  pacedTargets.set(ipcPath, fresh);
+  return fresh;
+}
+__name(pacedTargetFor, "pacedTargetFor");
+var pacerNow = /* @__PURE__ */ __name(() => performance.now(), "pacerNow");
+var pacerWallNow = /* @__PURE__ */ __name(() => Date.now(), "pacerWallNow");
+function reservePacerToken(ipcPath, sessionId, body, messageId) {
+  const now = pacerNow();
+  const wallNow = pacerWallNow();
+  const target = pacedTargetFor(ipcPath, sessionId, now);
+  target.tokens = refillBucket(
+    target.tokens,
+    target.lastRefill,
+    now,
+    PEER_ADMISSION_LIMITS.bucketCapacity,
+    PEER_ADMISSION_LIMITS.refillPerSecond
+  );
+  target.lastRefill = now;
+  target.bodies = target.bodies.filter(
+    (record2) => isBodyWithinWindow(
+      record2.at,
+      record2.atWall,
+      now,
+      wallNow,
+      PEER_ADMISSION_LIMITS.dedupWindowMs
+    )
+  );
+  const bodyHash = hashBody(body);
+  const lastBody = target.bodies.at(-1);
+  if (lastBody?.hash === bodyHash) {
+    return { ok: false, repeat: true };
+  }
+  if (!hasToken(target.tokens)) {
+    return { ok: false, sentInBurst: target.sentInBurst };
+  }
+  if (target.tokens >= PEER_ADMISSION_LIMITS.bucketCapacity || now - target.burstStartedAt > PEER_BURST_WINDOW_MS) {
+    target.sentInBurst = 0;
+    target.burstStartedAt = now;
+  }
+  const generation = target.generation;
+  target.tokens -= 1;
+  const record = {
+    messageId: canonicalizeMsgId(messageId),
+    hash: bodyHash,
+    at: now,
+    atWall: wallNow,
+    generation,
+    tokenSpent: true
+  };
+  target.bodies.push(record);
+  target.sentInBurst += 1;
+  let refunded = false;
+  return {
+    ok: true,
+    refund: /* @__PURE__ */ __name(() => {
+      if (refunded) return;
+      refunded = true;
+      refundPacedRecord(target, record, true);
+      forgetPacedBodies(target, [messageId]);
+    }, "refund")
+  };
+}
+__name(reservePacerToken, "reservePacerToken");
+function drainSendPacer(ipcPath) {
+  const target = pacedTargets.get(ipcPath);
+  if (target === void 0) return;
+  target.tokens = 0;
+  target.lastRefill = pacerNow();
+  target.generation += 1;
+}
+__name(drainSendPacer, "drainSendPacer");
+function forgetSendPacerMessages(ipcPath, messageIds) {
+  const target = pacedTargets.get(ipcPath);
+  if (target === void 0) return;
+  forgetPacedBodies(target, messageIds);
+}
+__name(forgetSendPacerMessages, "forgetSendPacerMessages");
+function refundSendPacerMessage(ipcPath, messageId) {
+  const target = pacedTargets.get(ipcPath);
+  if (target === void 0) return;
+  const canonicalId = canonicalizeMsgId(messageId);
+  const record = target.bodies.find((body) => body.messageId === canonicalId);
+  if (record === void 0) return;
+  refundPacedRecord(target, record);
+  forgetPacedBodies(target, [messageId]);
+}
+__name(refundSendPacerMessage, "refundSendPacerMessage");
+function refundSendPacerToken(ipcPath, messageId) {
+  const target = pacedTargets.get(ipcPath);
+  if (target === void 0) return;
+  const canonicalId = canonicalizeMsgId(messageId);
+  const record = target.bodies.find((body) => body.messageId === canonicalId);
+  if (record === void 0) return;
+  refundPacedRecord(target, record);
+}
+__name(refundSendPacerToken, "refundSendPacerToken");
+function refundPacedRecord(target, record, decrementBurst = false) {
+  if (!record.tokenSpent) return;
+  record.tokenSpent = false;
+  if (decrementBurst) {
+    target.sentInBurst = Math.max(0, target.sentInBurst - 1);
+  }
+  if (record.generation === target.generation) {
+    target.tokens = Math.min(
+      PEER_ADMISSION_LIMITS.bucketCapacity,
+      target.tokens + 1
+    );
+  }
+}
+__name(refundPacedRecord, "refundPacedRecord");
+function forgetPacedBodies(target, messageIds) {
+  const forgotten = new Set(messageIds.map(canonicalizeMsgId));
+  target.bodies = target.bodies.filter(
+    (record) => !forgotten.has(record.messageId)
+  );
+}
+__name(forgetPacedBodies, "forgetPacedBodies");
 async function sendToPeer(options) {
   const own = await readOwnSessionRecord();
   const self = own === null ? null : toPeerSessionInfo(own);
@@ -1214,8 +1742,24 @@ async function sendToPeer(options) {
     toSessionId: peer.sessionId,
     ...options.approvalMode !== null ? { fromMode: senderModeClass(options.approvalMode) } : {}
   });
+  const reservation = reservePacerToken(
+    peer.ipcPath,
+    peer.sessionId,
+    options.message,
+    frame.msgId
+  );
+  if (!reservation.ok) {
+    return {
+      kind: "failed",
+      peer,
+      address,
+      reason: reservation.repeat ? `that exact message went to that session within the last ${PEER_ADMISSION_LIMITS.dedupWindowMs / 1e3} seconds, and its inbox turns away a repeat before anyone reads it, so this one was not sent. Say something different, or wait for a reply rather than re-sending.` : reservation.sentInBurst === 0 ? "that session inbox is still over its rate limit, so this message was not sent. Wait a little before sending more." : `too many messages to that session just now: ${reservation.sentInBurst} were sent in the last ${PEER_BURST_WINDOW_MS / 1e3} seconds and more would be dropped by its rate limit, so this one was not sent. Batch what remains into one message, or wait a little before sending more.`
+    };
+  }
   trackSent(frame.msgId, {
     address,
+    ipcPath: peer.ipcPath,
+    sentAt: pacerWallNow(),
     state: "pending"
   });
   try {
@@ -1224,9 +1768,9 @@ async function sendToPeer(options) {
     });
     return { kind: "sent", peer, address };
   } catch (error) {
-    if (error instanceof PeerSendError && (error.code === "ENOENT" || error.code === "ECONNREFUSED" || error.code === "EMSGSIZE" || // A refused connect (full backlog) and this side's own send cap
-    // both mean the frame was never written.
-    error.code === "EAGAIN" || error.code === "EBUSY")) {
+    const definitelyUnwritten = error instanceof PeerSendError && NEVER_WRITTEN_SEND_CODES.has(error.code);
+    if (definitelyUnwritten) {
+      reservation.refund();
       sentMessages.delete(canonicalizeMsgId(frame.msgId));
     }
     return {
@@ -1248,7 +1792,7 @@ function describeSendFailure(error) {
       case "EBUSY":
         return "the session is alive but momentarily busy. Retry the same name shortly.";
       case "ETIMEDOUT":
-        return "the session accepted the connection but had not read the message after 5 seconds. It may still read it once it is free, so do not assume it was lost; retry once, and if it repeats, that session is stuck and its user should be told.";
+        return "the session accepted the connection but had not read the message after 5 seconds. It may still read it once it is free, so do not assume it was lost or resend the same message; wait for a delivery receipt, then tell that session user if none arrives.";
       default:
         return error.message;
     }
@@ -1261,10 +1805,13 @@ export {
   flattenPeerLabel,
   formatPeerEnvelope,
   formatPeerDisplay,
+  MAX_DROPPED_MSG_IDS,
   MAX_FRAME_BYTES,
+  MAX_RETAINED_REPLY_TOKEN_CHARS,
   canonicalizeMsgId,
   parsePeerFrame,
   describeDeliveryStatus,
+  describeDropReason,
   parsePeerAuthLine,
   MAX_SOCKET_PATH_BYTES,
   SOCKET_DIR_NAME,
@@ -1275,12 +1822,19 @@ export {
   listMessageablePeers,
   advertisablePeerAddress,
   isInProcessRecipient,
+  PEER_ADMISSION_LIMITS,
   MAX_HELD_MESSAGES,
+  MAX_SENDER_KEY_CHARS,
+  peerSenderKey,
   parseHeldExpiry,
   InboundGate,
   describeHoldCause,
   getOwnPeerIdentity,
   settleSentPeerMessage,
+  drainSendPacer,
+  forgetSendPacerMessages,
+  refundSendPacerMessage,
+  refundSendPacerToken,
   sendToPeer
 };
 /**