@securecoms/agent-bridge 0.21.0 → 0.23.0

package/dist/index.js

@@ -1,3 +1,52 @@
+// ../connect-sdk-ts/dist/service-log.js
+var TOKEN = /^[a-z][a-z0-9_.-]{0,63}$/;
+var CLASS = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
+function errorClass(error) {
+  if (error === null)
+    return "NullThrown";
+  if (typeof error !== "object" && typeof error !== "function") {
+    const primitive = {
+      string: "StringThrown",
+      number: "NumberThrown",
+      boolean: "BooleanThrown",
+      bigint: "BigIntThrown",
+      symbol: "SymbolThrown",
+      undefined: "UndefinedThrown"
+    };
+    return primitive[typeof error] ?? "UnknownThrown";
+  }
+  try {
+    const name = Object.getPrototypeOf(error)?.constructor?.name;
+    return typeof name === "string" && CLASS.test(name) ? name : "Error";
+  } catch {
+    return "Error";
+  }
+}
+function formatServiceLog(level, event, fields = {}, error) {
+  const safeEvent = TOKEN.test(event) ? event : "invalid_event";
+  const parts = [`[sdk] ${level} ${safeEvent}`];
+  for (const [key, value] of Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!TOKEN.test(key))
+      continue;
+    if (typeof value === "boolean")
+      parts.push(`${key}=${value}`);
+    else if (typeof value === "number" && Number.isFinite(value))
+      parts.push(`${key}=${value}`);
+  }
+  if (error !== void 0)
+    parts.push(`error_class=${errorClass(error)}`);
+  return parts.join(" ");
+}
+function writeServiceLog(level, event, fields, error) {
+  const line = formatServiceLog(level, event, fields, error);
+  if (level === "error")
+    console.error(line);
+  else if (level === "warn")
+    console.warn(line);
+  else
+    console.log(line);
+}
+
 // ../connect-core/dist/cadence.js
 var SELF_HEAL_SWEEP_INTERVAL_MS = 9e4;
 var SELF_HEAL_SWEEP_JITTER_MS = 3e4;
@@ -1180,17 +1229,29 @@ var enc2 = new TextEncoder();
 var dec2 = new TextDecoder();
 
 // ../connect-clients-core/dist/filesafe/owner-pin.js
+function rejectionReason(e) {
+  const msg = e instanceof Error ? e.message : "";
+  if (msg.includes("does not chain"))
+    return "not_chaining";
+  if (msg.includes("bad handoff signature"))
+    return "bad_signature";
+  return "other";
+}
 async function resolvePinnedOwner(args2) {
   let pin = await args2.store.load(args2.enclaveId);
   if (pin === null) {
     pin = { g0Cred: args2.observedG0Cred, chain: [] };
   }
   let chain = pin.chain;
-  for (const link of args2.relayedLinks) {
+  for (let i = 0; i < args2.relayedLinks.length; i++) {
     const tail = currentOwnerCred(pin.g0Cred, chain);
     try {
-      chain = await extendOwnerChain(chain, link, tail);
-    } catch {
+      chain = await extendOwnerChain(chain, args2.relayedLinks[i], tail);
+    } catch (e) {
+      try {
+        args2.onRejectedLink?.({ index: i, reason: rejectionReason(e) });
+      } catch {
+      }
     }
   }
   const next = { g0Cred: pin.g0Cred, chain };
@@ -1211,7 +1272,7 @@ var SoftwareKeyCustody = class _SoftwareKeyCustody {
     this.priv = priv;
     this.pub = pub;
     if (!quiet) {
-      console.warn("[AgentVault] using a software key (dev/CI only) -- envelopes are not attested. Use kms-hosted or byok custody in production.");
+      writeServiceLog("warn", "custody.software_key_unattested");
     }
   }
   static generate(algo) {
@@ -1321,6 +1382,56 @@ var MalformedGroupRosterError = class extends ConnectSdkError {
     this.receivedType = receivedType;
   }
 };
+var MlsBackendHttpError = class extends ConnectSdkError {
+  status;
+  code;
+  reason;
+  /**
+   * `code` (C2 T0): the backend's error code parsed from the response body
+   * (`{"detail": "x"}`, `{"detail": {"error": "x"}}` or `{"error": "x"}`),
+   * when there is one. The distribute outcome classifier (C2 T3) reads it
+   * against `DISTRIBUTE_DEFINITE_CODES`; absent means "no code", which is
+   * ambiguous by construction. It never enters the message, so the message
+   * stays byte-identical to the pre-C2 one.
+   *
+   * `reason` (C2 T3): the 409 `EPOCH_CONFLICT` body's `reason`
+   * (`stale_epoch`, `epoch_not_monotonic`, `superseded`) when present. The
+   * add and remove sites read it to route a `superseded` refusal away from
+   * the drain-and-retry path (LOW-2). Never in the message either.
+   */
+  constructor(path, status, code, reason) {
+    super(`${path} failed: ${status}`);
+    this.status = status;
+    this.code = code;
+    this.reason = reason;
+  }
+};
+var PendingCommitUnresolvedError = class extends ConnectSdkError {
+  channelId;
+  constructor(channelId) {
+    super("mls.pending_commit.unresolved: a previous commit on this conversation is still being confirmed; retry later");
+    this.channelId = channelId;
+    this.name = "PendingCommitUnresolvedError";
+  }
+};
+var GroupSupersededError = class extends ConnectSdkError {
+  channelId;
+  groupId;
+  constructor(channelId, groupId) {
+    super("mls.group_superseded: the conversation's group was replaced by an owner reset; the change was not applied");
+    this.channelId = channelId;
+    this.groupId = groupId;
+    this.name = "GroupSupersededError";
+  }
+};
+var AttestedOrphanRefusedError = class extends ConnectSdkError {
+  channelId;
+  constructor(channelId) {
+    super("mls.attested_orphan_refused: the conversation's reset did not complete; it needs the owner to reset again");
+    this.channelId = channelId;
+    this.name = "AttestedOrphanRefusedError";
+  }
+};
 
 // ../connect-sdk-ts/dist/envelope-builder.js
 async function buildOutboundEnvelope(p) {
@@ -1447,6 +1558,94 @@ function leafIndicesForKeyPackage(mgr, kp) {
 // ../connect-sdk-ts/dist/groupkey/mls.js
 import { MLSGroupManager as MLSGroupManager2, bytesToHex as bytesToHex2, hexToBytes, verifyApprovalArtifact } from "@agentvault/crypto";
 
+// ../connect-sdk-ts/dist/mls/store.js
+function assertPendingCommitShape(rec) {
+  if (rec.commitEpoch !== rec.request.commit_epoch) {
+    throw new Error("pending commit: commitEpoch does not equal request.commit_epoch");
+  }
+  if (rec.op === "bootstrap" && rec.prior !== null) {
+    throw new Error("pending commit: a bootstrap record must have prior === null");
+  }
+  if (rec.op === "add" || rec.op === "remove") {
+    if (rec.prior === null) {
+      throw new Error(`pending commit: an ${rec.op} record must have a prior MAIN`);
+    }
+    if (rec.groupId !== rec.prior.groupId) {
+      throw new Error(`pending commit: an ${rec.op} record's groupId must equal prior.groupId`);
+    }
+  }
+}
+function isPendingReservation(rec) {
+  return rec.request.commit === void 0;
+}
+function pendingReservation(p) {
+  return {
+    groupId: p.groupId,
+    op: "supersede",
+    request: { device_id: p.deviceId, commit_epoch: 0 },
+    state: p.placeholder,
+    commitEpoch: 0,
+    prior: p.prior,
+    createdAt: p.createdAt
+  };
+}
+function pendingCommitKey(rec) {
+  return { groupId: rec.groupId, commitEpoch: rec.commitEpoch, commit: rec.request.commit ?? "" };
+}
+function matchesPendingCommitKey(rec, k) {
+  return rec.groupId === k.groupId && rec.commitEpoch === k.commitEpoch && (rec.request.commit ?? "") === k.commit;
+}
+function sameMainState(a, b) {
+  if (!a || !b)
+    return !a && !b;
+  return a.groupState === b.groupState && a.ciphersuite === b.ciphersuite;
+}
+
+// ../connect-sdk-ts/dist/mls/distribute-outcome.js
+var CODES = [
+  { status: 409, code: "EPOCH_CONFLICT" },
+  { status: 409, code: "welcome_target_not_approved_member" },
+  { status: 403, code: "not_group_committer" },
+  { status: 403, code: "not_authorized_to_remove" },
+  { status: 403, code: "removal_would_empty_group" },
+  { status: 403, code: "removal_would_drop_last_committer" },
+  { status: 422, code: "device_identity_mismatch" },
+  { status: 422, code: "no_target_devices" },
+  { status: 400, code: "invalid_commit_hex" },
+  { status: 400, code: "expected_epoch_required" },
+  { status: 400, code: "removed_identity_id required" },
+  { status: 400, code: "commit required" },
+  { status: 404, code: "not_connect_group" },
+  { status: 404, code: "group_missing" },
+  { status: 403, code: "agent_paused" },
+  { status: 403, code: "forbidden" },
+  { status: 400, code: "mls.stale_epoch" }
+];
+var DISTRIBUTE_DEFINITE_CODES = Object.freeze(CODES.map((c) => Object.freeze({ ...c })));
+var DEFINITE_KEYS = new Set(DISTRIBUTE_DEFINITE_CODES.map((c) => `${c.status} ${c.code}`));
+function parseErrorCode(body) {
+  if (body === null || typeof body !== "object" || Array.isArray(body))
+    return void 0;
+  const b = body;
+  if (typeof b.detail === "string")
+    return b.detail;
+  if (b.detail !== null && typeof b.detail === "object" && !Array.isArray(b.detail)) {
+    const inner = b.detail.error;
+    if (typeof inner === "string")
+      return inner;
+  }
+  if (typeof b.error === "string")
+    return b.error;
+  return void 0;
+}
+function classifyDistributeError(err) {
+  if (!(err instanceof MlsBackendHttpError))
+    return "ambiguous";
+  if (typeof err.code !== "string")
+    return "ambiguous";
+  return DEFINITE_KEYS.has(`${err.status} ${err.code}`) ? "definite" : "ambiguous";
+}
+
 // ../connect-sdk-ts/dist/groupkey/operation-queue.js
 var MlsOperationQueue = class {
   chains = /* @__PURE__ */ new Map();
@@ -2269,9 +2468,52 @@ function getSignaturePublicKeyFromLeafIndex(ratchetTree, leafIndex) {
 }
 
 // ../connect-sdk-ts/dist/groupkey/mls.js
+var PENDING_INLINE_RESENDS = 2;
+var DEFAULT_PENDING_RESEND_DELAYS_MS = [250, 1e3];
+var PENDING_UNRESOLVED_LOG_INTERVAL_MS = 6e4;
+var PENDING_AUTO_RESOLVE_INTERVAL_MS = 6e4;
+var PENDING_RECEIVE_FAIL_LOG_INTERVAL_MS = 6e4;
+var PENDING_LEFT_ESCALATION_PULLS = 20;
+var PENDING_LEFT_ESCALATION_MS = 10 * 6e4;
+var PendingRowEscalatedError = class extends Error {
+  constructor() {
+    super("mls.pending_commit.left_row_escalated");
+    this.name = "PendingRowEscalatedError";
+  }
+};
+function sleepMs(ms) {
+  return ms > 0 ? new Promise((r) => setTimeout(r, ms)) : Promise.resolve();
+}
+function tagOf(mgr) {
+  return { groupId: new TextDecoder().decode(mgr.groupId), epoch: Number(mgr.epoch) };
+}
+function tagOfState(state) {
+  const m = new MLSGroupManager2(state.ciphersuite);
+  m.importState(state);
+  return tagOf(m);
+}
+function sameMainTag(a, b) {
+  if (a === null || b === null)
+    return a === b;
+  return a.groupId === b.groupId && a.epoch === b.epoch;
+}
+var RESERVATION_PLACEHOLDER_STATE = {
+  groupState: "",
+  ciphersuite: "MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519"
+};
+function isDefiniteReinitRefusal(e) {
+  return e instanceof MlsBackendHttpError && e.status >= 400 && e.status < 500;
+}
+function isSupersededRefusal(e) {
+  return e instanceof MlsBackendHttpError && e.status === 409 && e.code === "EPOCH_CONFLICT" && e.reason === "superseded";
+}
+function isEpochConflict(e) {
+  return e instanceof MlsBackendHttpError && e.status === 409 && e.code === "EPOCH_CONFLICT" && !isSupersededRefusal(e);
+}
 var LABEL = "agentvault-connect-v1";
 var DEFAULT_STUCK_THRESHOLD = 2;
 var DEFAULT_QUARANTINE_THRESHOLD = 8;
+var DELIVERY_PULL_PAGE = 100;
 var BootstrapRaceLostError = class extends Error {
   constructor() {
     super("bootstrap race lost: another device created the group; join instead");
@@ -2296,6 +2538,16 @@ var AmbiguousOwnLeafError = class extends Error {
     this.name = "AmbiguousOwnLeafError";
   }
 };
+var OwnLeafRemoveRefusedError = class extends Error {
+  op;
+  reason;
+  constructor(op, reason) {
+    super(`${op}: refusing a Remove that would or could evict this committer's own leaf (${reason})`);
+    this.op = op;
+    this.reason = reason;
+    this.name = "OwnLeafRemoveRefusedError";
+  }
+};
 var HealAddAfterRemoveError = class extends Error {
   constructor(cause) {
     super("healDivergedMember: Add failed after Remove already landed \u2014 member detached, re-run heal to recover");
@@ -2427,8 +2679,67 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    *  past-epoch {@link permanentlySkipped} drain. Read via
    *  {@link retiredDrainedCount}. */
   retiredDrained = 0;
+  /**
+   * C1 (P0 containment): CUSTODY of every application row this provider has
+   * decrypted, keyed by queue_id, until the server shows the row gone.
+   *
+   * Why: a row's message key comes from the LIVE exporter secret only, so once
+   * any drain applies commit N->N+1 the first successful decrypt of an epoch-N
+   * row is the ONLY one there will ever be. Before C1, internal drains
+   * (reconcileForSend, joinAndReconcile, the committer 409 drain) decrypted such
+   * rows, discarded the plaintext and applied the commit; the redelivered row
+   * then failed AEAD, was classified permanentlySkipped and acked: silent loss.
+   * A CONCURRENT receiveOnce that pulled the row before another drain applied
+   * the commit lost it the same way (C1 review, Important #1).
+   *
+   * Rule: an application row whose queue_id is in custody is NEVER decrypted or
+   * classified again, by any call. {@link receiveOnce} returns the stored entry
+   * for it, un-acked, in the row's seq position, on every pull that contains the
+   * row, so the caller's ack stays the only ack. An internal drain's discard is
+   * therefore harmless (the next receiveOnce serves the entry), and a caller
+   * that drops an entry without acking is offered it again on the next pull,
+   * exactly like a row that still decrypts. Eviction happens only when an
+   * own-device pull SHORTER than {@link DELIVERY_PULL_PAGE} does not contain the
+   * row (acked, expired, dead-lettered or fenced; it cannot come back).
+   *
+   * Limit: memory only. A process restart empties custody, and an un-acked row
+   * whose epoch has moved on then fails AEAD and is acked as permanentlySkipped
+   * (C1 report: durable-sink follow-up).
+   */
+  custody = /* @__PURE__ */ new Map();
+  /*
+   * C2 DEVIATION FROM SPEC §4.2's IN-MEMORY PENDING SET, deliberate: there is
+   * none. Every C2 decision (the send fence, the receive resolver, the
+   * lock-entry resolve, promotion) reads the CHANNEL's DURABLE record, one
+   * store read each. A per-process set can be wrong in BOTH directions across
+   * tabs and processes (MEDIUM-1): it misses a record another tab wrote, and
+   * it keeps fencing a channel another tab already resolved. The durable read
+   * is right in both, and the plan already accepted one store read per send.
+   * Nothing reads `listPendingCommits()` either, so one unreadable record
+   * (T2's SQLite `MlsStoreSealError` refuses the whole list) cannot fence
+   * every channel: it fences only its own, whose per-channel read throws.
+   */
+  /** Memo for the provider-start re-run of owed follow-ups (MEDIUM-3). */
+  owedRerun = null;
+  /** Last `mls.pending_commit.unresolved` log per channel (rate limit). */
+  unresolvedLoggedAt = /* @__PURE__ */ new Map();
+  /** Channels whose legacy (pre-C2) staging slot was already discarded by
+   *  this process (spec §4.5 "Legacy staging residue"). */
+  legacyStagingChecked = /* @__PURE__ */ new Set();
+  /** C2 T3c (H1): last automatic resolve per channel (rate limit). */
+  autoResolveAt = /* @__PURE__ */ new Map();
+  /** C2 T3c (H1): automatic resolves in flight, awaited by drainInFlight. */
+  backgroundResolves = /* @__PURE__ */ new Set();
+  /** C2 T3c (H1): per channel, the run of consecutive pulls that left rows,
+   *  and when it started. Cleared by a pull that leaves none. */
+  leftStreak = /* @__PURE__ */ new Map();
+  /** C2 T3c (H2): last receive_resolve_failed log per channel. */
+  receiveFailLoggedAt = /* @__PURE__ */ new Map();
   constructor(o) {
     this.o = o;
+    if (typeof o.onPendingCommitResolved !== "function") {
+      throw new TypeError("MlsGroupKeyProvider: onPendingCommitResolved is required and must be a function");
+    }
     this.suite = o.suite ?? "xchacha20poly1305";
     this.stuckThreshold = Math.max(1, o.stuckThreshold ?? DEFAULT_STUCK_THRESHOLD);
     this.quarantineThreshold = Math.max(1, o.quarantineThreshold ?? DEFAULT_QUARANTINE_THRESHOLD);
@@ -2559,7 +2870,8 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       timer.unref?.();
     });
     const drain = (async () => {
-      while (this.locks.activeChannels > 0 || this.publishLock.activeChannels > 0) {
+      while (this.locks.activeChannels > 0 || this.publishLock.activeChannels > 0 || this.backgroundResolves.size > 0) {
+        await Promise.allSettled([...this.backgroundResolves]);
         await this.locks.idle();
         await this.publishLock.idle();
       }
@@ -2737,7 +3049,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         orderedDeviceIds
       });
     } else if (outcome !== "committed" && g.priorDeviceId && g.priorDeviceId !== g.newDeviceId) {
-      console.warn(`admitGuestDevice: channel ${channelId} \u2014 Add of ${g.newDeviceId} was a no-op (${outcome}), so the eviction of prior device ${g.priorDeviceId} was SKIPPED. The prior leaf is intact and no swap occurred; re-drive the swap only after the new device holds its own leaf.`);
+      writeServiceLog("warn", "guest.swap_skipped_add_noop");
     }
     return outcome;
   }
@@ -2805,17 +3117,23 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     try {
       await this.locks.run(channelId, async () => {
         const mgr = await this.manager(channelId);
-        for (const c of commits) {
-          if (c.epoch <= Number(mgr.epoch))
-            continue;
-          await mgr.decrypt(hexToBytes(c.payload));
-          applied++;
+        try {
+          for (const c of commits) {
+            if (c.epoch <= Number(mgr.epoch))
+              continue;
+            await mgr.decrypt(hexToBytes(c.payload));
+            applied++;
+          }
+          if (applied > 0)
+            await this.saveMain(channelId, mgr);
+        } catch (e) {
+          if (applied > 0)
+            this.evictIfCached(channelId, mgr);
+          throw e;
         }
-        if (applied > 0)
-          await this.o.store.save(channelId, mgr.exportState());
       });
     } catch (e) {
-      console.warn(`[mls] resyncByReplay ${channelId.slice(0, 8)}: commit failed to apply after ${applied} \u2014 state is forked, not behind:`, e?.message);
+      writeServiceLog("warn", "resync.replay_commit_failed", { applied }, e);
       return false;
     }
     if (applied > 0) {
@@ -2875,6 +3193,494 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * delete (a re-delete is a no-op). On success the manager stays cached as
    * before — no eviction.
    */
+  /**
+   * Phase 3 C4: persist a manager that has ALREADY ADVANCED in memory by applying
+   * a commit the SERVER can hand us again (a delivery row we have not acked, a
+   * /sync replay). If the save throws, evict the cached manager before
+   * rethrowing, so the next access reloads the persisted (pre-commit) state and
+   * re-applies the still-queued commit.
+   *
+   * Why evict rather than keep the advanced cache: with the cache ahead of disk,
+   * the redelivered commit no longer applies to it, the classifier sees a commit
+   * at or below the live epoch and ACKS it as dead, and the disk keeps the old
+   * epoch. The next restart loads that epoch while the server has moved on: a
+   * silent fork (mls.evict-on-save-failure.test.ts).
+   *
+   * ⛔ ONLY for server-redeliverable commits. A committer's OWN commit that the
+   * server already accepted cannot be re-applied from the wire (a member cannot
+   * process its own commit), so evicting there throws away the only copy of the
+   * true state. The committer paths keep their own handling.
+   *
+   * `MLSGroupManager.decrypt` assigns its new state only after processing
+   * succeeds, so a decrypt that THROWS leaves the manager unchanged and needs no
+   * eviction; only the advanced-but-unsaved case does.
+   */
+  async saveAdvancedOrEvict(channelId, mgr) {
+    try {
+      await this.saveMain(channelId, mgr);
+    } catch (e) {
+      this.evictIfCached(channelId, mgr);
+      throw e;
+    }
+  }
+  /**
+   * C2 (spec §4.2, MEDIUM-1): the ONE writer of MAIN outside promotion. Every
+   * MAIN save in this file goes through here (pinned by
+   * `save-main-call-sites.arch.test.ts`), and here goes through the store's
+   * `saveMainGuarded`, which refuses ATOMICALLY when the channel holds a
+   * pending-commit record whose `prior` is not this manager's (group, epoch).
+   * So while a commit's outcome is unknown, MAIN can move only within the
+   * epoch the commit was built on, whether the write comes from this tab, a
+   * second tab, or another process.
+   *
+   * On ANY throw the cached manager is evicted if it is still `mgr`, so the
+   * cache never runs ahead of MAIN: a refusal (`PendingCommitUnresolvedError`)
+   * and a raw store failure (SQLite `SQLITE_BUSY` after its busy timeout, an
+   * IndexedDB abort) are the same fact here, "MAIN did not move". The error
+   * propagates: a receive caller leaves the row un-acked (uncounted, for a
+   * refusal), a committer caller fails.
+   */
+  async saveMain(channelId, mgr) {
+    try {
+      await this.o.store.saveMainGuarded(channelId, mgr.exportState(), tagOf(mgr));
+    } catch (e) {
+      this.evictIfCached(channelId, mgr);
+      throw e;
+    }
+  }
+  // ── C2: pending-commit records ────────────────────────────────────────────
+  //
+  // A commit is written to a durable record BEFORE /distribute, resolved only
+  // by proof (a 2xx, a coded definite rejection, or a receive-side proof), and
+  // RESENT byte-for-byte, never rebuilt. See spec §4 and the plan's Task T3.
+  //
+  // ⛔ IRREVERSIBILITY. Nothing below builds a commit, adds a member or removes
+  // one. Recovery only resends `rec.request`, whose bytes were built, and
+  // checked by the admission rule (duplicate-leaf) and the own-leaf guard
+  // (C3), at the site that created the record, against the tree they apply
+  // to. A resend that lands can land only on that tree: the server's
+  // expected_epoch compare-and-set (one commit per (group, epoch), H4/T1a) and
+  // the superseded refusal (§3.2) reject it anywhere else.
+  nowMs() {
+    return this.o.now?.() ?? Date.now();
+  }
+  /** The (group, epoch) of the DURABLE MAIN, or null when there is none. Read
+   *  from the store, not the cache: promotion compares against what is at
+   *  rest. */
+  async durableMainTag(channelId) {
+    const saved = await this.o.store.load(channelId);
+    return saved ? tagOfState(saved) : null;
+  }
+  /** Start the provider-start re-run of owed follow-ups once per process,
+   *  detached (see {@link resumePendingCommits}). A failure is logged and the
+   *  memo clears, so the next call retries it. Synchronous: callers never wait
+   *  on the hook. */
+  kickOwedRerun() {
+    if (this.owedRerun)
+      return;
+    void this.resumePendingCommits().catch((e) => writeServiceLog("warn", "mls.pending_commit.owed_rerun_failed", {}, e));
+  }
+  /**
+   * C2 (MEDIUM-3): provider-start work, idempotent per process (a rejected
+   * run clears its memo). Re-runs every owed follow-up (the post-commit work
+   * of a commit that landed and was promoted, whose hook had not yet returned)
+   * through `onPendingCommitResolved` with `via: "resolver"`, clearing each
+   * slot only after its hook returns. The provider starts this itself,
+   * detached, on the first send-fence check or receive pass; a host may call
+   * it at startup to run the owed work before anything else. The hook is
+   * at-least-once, hence required to be idempotent.
+   */
+  async resumePendingCommits() {
+    this.owedRerun ??= (async () => {
+      for (const { channelId, owed } of await this.o.store.listOwedFollowUps()) {
+        await this.runFollowUpHook(channelId, owed.op, owed.followUp, "resolver", owed.createdAt);
+      }
+    })().catch((e) => {
+      this.owedRerun = null;
+      throw e;
+    });
+    await this.owedRerun;
+  }
+  /** Run the hook for a landed commit that owes a follow-up, then clear the
+   *  owed slot. A throwing hook KEEPS the slot (re-run at the next provider
+   *  start) and is logged, never propagated: the commit itself landed and
+   *  MAIN is promoted, so failing the op would misreport it.
+   *
+   *  C2 T3c (M1): the clear is keyed on the slot's `createdAt`, so it removes
+   *  only the slot whose hook just ran. The provider-start re-run is detached
+   *  and holds no channel lock; a newer commit's slot written meanwhile (it
+   *  overwrites the channel's slot) is kept for its own hook. */
+  async runFollowUpHook(channelId, op, followUp, via, slotCreatedAt) {
+    try {
+      await this.o.onPendingCommitResolved(channelId, { op, outcome: "landed", followUp, via });
+    } catch (e) {
+      writeServiceLog("warn", "mls.pending_commit.hook_failed", {}, e);
+      return;
+    }
+    await this.o.store.clearOwedFollowUp(channelId, slotCreatedAt);
+  }
+  /**
+   * C2 (coordinator ruling on T2, MEDIUM-3): run and clear any follow-up still
+   * OWED on this channel, and THROW if that fails. Called before a commit that
+   * will itself carry a follow-up is built: every store's `commitPending`
+   * overwrites the channel's owed slot, so promoting the new commit over an
+   * undrained slot would silently drop the older owed work. Fail closed: a
+   * hook that throws (or an unreadable slot) refuses the new commit and keeps
+   * the old slot. Caller holds the channel lock.
+   *
+   * C2 T3c (M2): reads ONLY this channel's slot (`getOwedFollowUp`), so an
+   * unreadable slot of another channel cannot refuse this channel's commit.
+   * With `abandon` (the owner's explicit Reset), an UNREADABLE slot of this
+   * channel is discarded (logged `mls.pending_commit.owed_abandoned`) rather
+   * than blocking the owner's one way out; a hook that throws still refuses.
+   */
+  async drainOwedFollowUpUnlocked(channelId, abandon = false) {
+    let owed;
+    try {
+      owed = await this.o.store.getOwedFollowUp(channelId);
+    } catch (e) {
+      if (!abandon)
+        throw e;
+      writeServiceLog("warn", "mls.pending_commit.owed_abandoned", {}, e);
+      await this.o.store.clearOwedFollowUp(channelId);
+      return;
+    }
+    if (!owed)
+      return;
+    await this.o.onPendingCommitResolved(channelId, {
+      op: owed.op,
+      outcome: "landed",
+      followUp: owed.followUp,
+      via: "resolver"
+    });
+    await this.o.store.clearOwedFollowUp(channelId, owed.createdAt);
+  }
+  /** Tell the host how a record resolved (no follow-up owed). A throwing hook
+   *  is logged and swallowed for the same reason as above. */
+  async notifyPendingResolved(channelId, ev) {
+    try {
+      await this.o.onPendingCommitResolved(channelId, ev);
+    } catch (e) {
+      writeServiceLog("warn", "mls.pending_commit.hook_failed", {}, e);
+    }
+  }
+  /** Persist the record BEFORE `/distribute`. A throw here propagates and the
+   *  commit is never sent (spec §4.1).
+   *
+   *  C2 T3c: CREATE-ONLY, atomically in the store. This instance resolved the
+   *  channel's record at lock entry, but another tab or process holds its own
+   *  lock and may have staged a commit since. Overwriting that record would
+   *  orphan a commit that may land (the other instance could then never
+   *  promote it). So a present record refuses this commit with
+   *  `PendingCommitUnresolvedError` before anything is sent. */
+  async stagePendingCommit(channelId, rec, replacing) {
+    const opts = replacing ? { replacing } : { onlyIfAbsent: true };
+    let wrote;
+    try {
+      wrote = await this.o.store.savePendingCommit(channelId, rec, opts);
+    } catch (e) {
+      if (replacing)
+        await this.o.store.clearPendingCommit(channelId, replacing).catch(() => false);
+      throw e;
+    }
+    if (!wrote)
+      throw new PendingCommitUnresolvedError(channelId);
+  }
+  /** Send `rec.request` byte-for-byte, then up to `resends` more times while
+   *  the outcome stays ambiguous (spec §4.3). Never rebuilds the commit. */
+  async sendPendingCommit(rec, resends) {
+    const delays = this.o.pendingResendDelaysMs ?? DEFAULT_PENDING_RESEND_DELAYS_MS;
+    let last;
+    for (let attempt = 0; attempt <= resends; attempt++) {
+      if (attempt > 0)
+        await sleepMs(delays[Math.min(attempt - 1, delays.length - 1)] ?? 0);
+      try {
+        await this.o.backend.distribute(rec.groupId, rec.request);
+        return { kind: "landed" };
+      } catch (e) {
+        if (classifyDistributeError(e) === "definite")
+          return { kind: "definite", error: e };
+        last = e;
+      }
+    }
+    return { kind: "ambiguous", error: last };
+  }
+  /**
+   * Apply a send outcome to the channel's record. Called under the channel lock.
+   *  - landed: custody of the epoch-N rows (C1b; skipped when there is no
+   *    prior MAIN), then conditional promotion.
+   *  - definite: the commit did not land. Clear the record, evict the cache,
+   *    tell the hook `not_landed`.
+   *  - ambiguous: KEEP the record, evict the cache (MAIN is still `prior`),
+   *    log the unresolved age (rate-limited). Nothing auto-discards on age.
+   */
+  async settlePendingCommit(channelId, rec, out, via, built) {
+    if (out.kind === "landed") {
+      if (rec.prior !== null)
+        await this.custodyAppRowsBeforeOwnCommit(channelId, rec.prior.epoch);
+      const p = await this.promotePendingUnlocked(channelId, via, rec, built);
+      return p === "none" ? "vanished" : p;
+    }
+    if (out.kind === "definite") {
+      await this.o.store.clearPendingCommit(channelId, pendingCommitKey(rec));
+      this.managers.delete(channelId);
+      await this.notifyPendingResolved(channelId, { op: rec.op, outcome: "not_landed", via });
+      return "not_landed";
+    }
+    this.managers.delete(channelId);
+    this.logPendingUnresolved(channelId, rec);
+    return "ambiguous";
+  }
+  logPendingUnresolved(channelId, rec) {
+    const now = this.nowMs();
+    const last = this.unresolvedLoggedAt.get(channelId);
+    if (last !== void 0 && now - last < PENDING_UNRESOLVED_LOG_INTERVAL_MS)
+      return;
+    this.unresolvedLoggedAt.set(channelId, now);
+    writeServiceLog("warn", "mls.pending_commit.unresolved", {
+      age_s: Math.max(0, Math.floor((now - rec.createdAt) / 1e3))
+    });
+  }
+  /**
+   * C2 (spec §4.2, H2): promote the record `proven` (whose landing this caller
+   * PROVED: a 2xx for its bytes, or a trial decrypt under its state) ONLY if MAIN
+   * is still the state the commit was built on. Caller holds the channel lock
+   * (the receive path calls this inside the lock it already holds: LOW-4, the
+   * queue is not reentrant).
+   *
+   * `prior` is compared by STRICT equality, and `null` means "no MAIN" (ruling
+   * 2026-09-25): MAIN absent → promote; MAIN present at any group or epoch →
+   * the record is stale. Match → `commitPending` (MAIN := rec.state, record
+   * deleted, owed follow-up slot written, one atomic store step), install the
+   * promoted manager, run the hook. Mismatch → discard the record, keep MAIN,
+   * log `mls.pending_commit.stale_prior`: MAIN moved out of band (a v8 store
+   * write after a downgrade, say), and promoting would rewind it.
+   *
+   * ⛔ C2 T3c (security review C1): EVERY store step here names `proven`'s key
+   * (group, commit epoch, commit bytes) and the store checks it INSIDE the
+   * step, together with "MAIN is exactly the state this caller just checked
+   * against `prior`". A store shared by two tabs or processes may by now hold
+   * ANOTHER record (the other instance resolved ours and staged its own, still
+   * in flight). Promoting that record would make MAIN a state no server
+   * accepted (a fork); clearing it would strand a commit that then lands.
+   *
+   * When `proven` is no longer in the store: it was resolved by another
+   * instance. If MAIN is at or past `proven` in its group, that instance
+   * promoted it (`proven` landed, so no foreign commit can hold its epoch):
+   * report `landed` and drop the cache so MAIN reloads. Otherwise `none`.
+   *
+   * A throw from the store propagates with MAIN and the record unchanged (the
+   * store's all-or-nothing contract).
+   *
+   * `built`: the manager an INLINE commit site built the commit with. Its state
+   * IS `rec.state` (exported from it when the record was written, not mutated
+   * since), so it is installed as the cached manager instead of a re-import,
+   * exactly as the pre-C2 sites cached it after their save.
+   */
+  async promotePendingUnlocked(channelId, via, proven, built) {
+    const key = pendingCommitKey(proven);
+    for (let attempt = 0; attempt < 3; attempt++) {
+      const mainState = await this.o.store.load(channelId);
+      const main = mainState ? tagOfState(mainState) : null;
+      const matches = proven.prior === null ? main === null : main !== null && main.groupId === proven.prior.groupId && main.epoch === proven.prior.epoch;
+      if (!matches) {
+        if (await this.o.store.clearPendingCommit(channelId, key)) {
+          writeServiceLog("warn", "mls.pending_commit.stale_prior");
+          await this.notifyPendingResolved(channelId, { op: proven.op, outcome: "stale_prior", via });
+          return "stale_prior";
+        }
+        return this.provenRecordGone(channelId, proven);
+      }
+      const r = await this.o.store.commitPending(channelId, { ...key, main: mainState });
+      if (r === "record_mismatch")
+        return this.provenRecordGone(channelId, proven);
+      if (r === "main_moved")
+        continue;
+      let mgr = built;
+      if (!mgr) {
+        mgr = new MLSGroupManager2(proven.state.ciphersuite);
+        mgr.importState(proven.state);
+      }
+      this.managers.set(channelId, mgr);
+      if (proven.followUp)
+        await this.runFollowUpHook(channelId, proven.op, proven.followUp, via, proven.createdAt);
+      else
+        await this.notifyPendingResolved(channelId, { op: proven.op, outcome: "landed", via });
+      return "landed";
+    }
+    throw new PendingCommitUnresolvedError(channelId);
+  }
+  /** C2 T3c (C1): the proven record is not in the store. See
+   *  {@link promotePendingUnlocked}. */
+  async provenRecordGone(channelId, proven) {
+    const mainState = await this.o.store.load(channelId);
+    const main = mainState ? tagOfState(mainState) : null;
+    if (main !== null && main.groupId === proven.groupId && main.epoch >= proven.commitEpoch) {
+      this.managers.delete(channelId);
+      writeServiceLog("info", "mls.pending_commit.promoted_elsewhere");
+      return "landed";
+    }
+    return "none";
+  }
+  /**
+   * C2 (spec §4.4 "Commit", plan step 3.6): resolve the channel's record at
+   * lock entry, before a committer op, `ensureSession`, a reset or a supersede
+   * builds anything. Resends the stored bytes and settles the outcome with
+   * `via: "resolver"`. Returns `none` when there was no record (after
+   * discarding any legacy pre-C2 staging slot once per channel per process:
+   * MAIN is authoritative, and a staged state with no request cannot be
+   * resent). The CALLER decides what `ambiguous` means; most throw
+   * `PendingCommitUnresolvedError`.
+   */
+  async resolvePendingCommitUnlocked(channelId, resends = PENDING_INLINE_RESENDS, saw) {
+    const rec = await this.o.store.loadPendingCommit(channelId);
+    saw?.(rec);
+    if (!rec) {
+      if (!this.legacyStagingChecked.has(channelId)) {
+        await this.o.store.discardStaging(channelId);
+        this.legacyStagingChecked.add(channelId);
+      }
+      return "none";
+    }
+    if (isPendingReservation(rec)) {
+      this.logPendingUnresolved(channelId, rec);
+      return "ambiguous";
+    }
+    const out = await this.sendPendingCommit(rec, resends);
+    const r = await this.settlePendingCommit(channelId, rec, out, "resolver");
+    return r === "vanished" ? "none" : r;
+  }
+  /** {@link resolvePendingCommitUnlocked}, then refuse to continue while the
+   *  record stays ambiguous. The standard lock-entry guard. */
+  async requirePendingResolvedUnlocked(channelId) {
+    const r = await this.resolvePendingCommitUnlocked(channelId);
+    if (r === "ambiguous")
+      throw new PendingCommitUnresolvedError(channelId);
+    return r;
+  }
+  /**
+   * C2 (OQ-C2-1 ruling): the owner's explicit abandon, reached ONLY through
+   * `resetSessionSupersede(..., { abandonPending: true })`. Discards the
+   * record without knowing whether its commit landed; the attested reset that
+   * follows is the correct recovery either way. Logs
+   * `mls.pending_commit.abandoned` and tells the hook `abandoned`.
+   */
+  /**
+   * C2 T3d (MEDIUM-1): `seen` is the record the owner's resolve ACTUALLY saw
+   * and found ambiguous, or "unreadable" when that load threw. A seen record
+   * is cleared KEYED: if another instance meanwhile proved it landed, promoted
+   * it and staged a newer, unproven record, that newer record is not the one
+   * the owner abandoned, and clearing it would strand a commit that may land.
+   * Then nothing is cleared and this returns false (the caller refuses; the
+   * owner retries). Only an UNREADABLE record is cleared unkeyed: nothing can
+   * read its key, and this is the owner's one way out of it.
+   */
+  async abandonPendingCommitUnlocked(channelId, seen) {
+    if (seen === "unreadable") {
+      writeServiceLog("warn", "mls.pending_commit.abandon_unreadable");
+      await this.o.store.clearPendingCommit(channelId);
+      this.managers.delete(channelId);
+      writeServiceLog("warn", "mls.pending_commit.abandoned");
+      return true;
+    }
+    if (!await this.o.store.clearPendingCommit(channelId, pendingCommitKey(seen))) {
+      writeServiceLog("warn", "mls.pending_commit.abandon_raced");
+      return false;
+    }
+    this.managers.delete(channelId);
+    writeServiceLog("warn", "mls.pending_commit.abandoned");
+    await this.notifyPendingResolved(channelId, { op: seen.op, outcome: "abandoned", via: "resolver" });
+    return true;
+  }
+  /**
+   * The commit tail shared by the six commit sites (spec §4.1): persist the
+   * record, send, settle inline. Returns `{ landed: true }` after promotion,
+   * or the definite rejection for the site's own existing path. Throws
+   * `PendingCommitUnresolvedError` when the outcome stays ambiguous after the
+   * inline resends (the record is kept and the channel fenced), and a plain
+   * content-free `Error` when promotion found MAIN moved out of band.
+   */
+  async commitWithPendingRecord(channelId, rec, built, replacing) {
+    await this.stagePendingCommit(channelId, rec, replacing);
+    const out = await this.sendPendingCommit(rec, PENDING_INLINE_RESENDS);
+    const r = await this.settlePendingCommit(channelId, rec, out, "inline", built);
+    if (r === "landed")
+      return { landed: true };
+    if (r === "not_landed")
+      return { landed: false, error: out.error };
+    if (r === "ambiguous")
+      throw new PendingCommitUnresolvedError(channelId);
+    throw new Error(`mls.pending_commit.${r}: the commit's prior state moved before promotion; not applied locally`);
+  }
+  /** Build the record for a commit about to be sent. `prior` is the MAIN the
+   *  commit was built on (null: none). */
+  pendingRecord(op, groupId, request, mgr, prior, followUp) {
+    return {
+      groupId,
+      op,
+      request,
+      state: mgr.exportState(),
+      commitEpoch: Number(mgr.epoch),
+      prior,
+      ...followUp ? { followUp } : {},
+      createdAt: this.nowMs()
+    };
+  }
+  /**
+   * C2 (spec §4.4 "Send", HIGH-3, MEDIUM-1): the send fence. Throws
+   * `PendingCommitUnresolvedError` while the channel holds a pending record,
+   * so no key is derived for SEND (message, vault KEK seal, 1:1 voice) at an
+   * epoch a landed Remove may already have rotated away from. Re-reads the
+   * DURABLE record on every call, so a record another tab or process wrote is
+   * seen the first time, and a record another tab resolved no longer fences.
+   * Receive never calls this: it derives through {@link exporterKeyUnfenced}.
+   */
+  async assertNotPending(channelId) {
+    this.kickOwedRerun();
+    if (await this.o.store.loadPendingCommit(channelId)) {
+      this.scheduleAutoResolve(channelId);
+      throw new PendingCommitUnresolvedError(channelId);
+    }
+  }
+  /**
+   * C2 T3c (H1): resolve the channel's pending record in the background, at
+   * most once per minute per channel. Deferred to a later tick and run under
+   * the channel lock like any lock-entry resolve (never inside the receive
+   * lock that noticed it; the queue is not reentrant). It only RESENDS the
+   * stored bytes, exactly as a committer's lock entry does. Failures are
+   * logged, rate-limited, and otherwise ignored: the record stays and the
+   * next trigger tries again.
+   */
+  scheduleAutoResolve(channelId) {
+    const now = this.nowMs();
+    const last = this.autoResolveAt.get(channelId);
+    if (last !== void 0 && now - last < PENDING_AUTO_RESOLVE_INTERVAL_MS)
+      return;
+    this.autoResolveAt.set(channelId, now);
+    const job = (async () => {
+      await Promise.resolve();
+      try {
+        await this.locks.run(channelId, () => this.resolvePendingCommitUnlocked(channelId));
+      } catch (e) {
+        writeServiceLog("warn", "mls.pending_commit.auto_resolve_failed", {}, e);
+      }
+    })();
+    this.backgroundResolves.add(job);
+    void job.finally(() => this.backgroundResolves.delete(job));
+  }
+  /** C2 (for T6's stuck state): ms since the channel's pending record was
+   *  written, or null when it has none. A durable read; never throws on
+   *  absence. */
+  async pendingCommitAgeMs(channelId) {
+    const rec = await this.o.store.loadPendingCommit(channelId);
+    return rec ? Math.max(0, this.nowMs() - rec.createdAt) : null;
+  }
+  /** Drop `channelId`'s cached manager only if it is still `mgr` (a concurrent
+   * supersede may already have installed a different one, which must survive). */
+  evictIfCached(channelId, mgr) {
+    if (this.managers.get(channelId) === mgr)
+      this.managers.delete(channelId);
+  }
   async evictOnThrow(channelId, op) {
     try {
       return await op();
@@ -2883,7 +3689,33 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       throw e;
     }
   }
+  /**
+   * The public exporter key. C2 (HIGH-3): fenced. While the channel holds an
+   * unresolved pending commit this throws `PendingCommitUnresolvedError`, so
+   * nothing is sealed at an epoch a landed Remove may have rotated away from.
+   *
+   * ⚠️ C2 T3c (review M4) CORRECTED THIS COMMENT: not every external caller
+   * SEALS. Its callers are the envelope builder and the fake's
+   * `sendApplication` (seal), the vault KEK seal in connect-web (seal), AND
+   * connect-web's vault OPEN (`useVault.ts` `openVaultKekset`, which peeks and
+   * opens the sealed KEK set with it). The fence cannot tell a seal from an
+   * open, so a pending record also fails the vault open closed (the accepted
+   * HIGH-3 consequence; T6 maps it to the retryable not-ready outcome). The
+   * same holds for {@link voiceMediaKey}: BOTH ends of a 1:1 call derive the
+   * media key through it, so the callee's join fails closed too while a record
+   * is pending. Receive-side derivations inside this file use
+   * {@link exporterKeyUnfenced} and keep decrypting epoch N. A refused call
+   * starts the automatic resolve (T3c, H1), so the fence lifts on its own
+   * once the outcome is known.
+   */
   async exporterKey(enclaveId, channelId, epoch) {
+    await this.assertNotPending(channelId);
+    return this.exporterKeyUnfenced(enclaveId, channelId, epoch);
+  }
+  /** C2: the unfenced exporter read, for RECEIVE derivations only
+   *  (`decryptApplicationRow`, `replayMissedApplicationMessages`). Reads MAIN,
+   *  which never moves past a pending record. */
+  async exporterKeyUnfenced(enclaveId, channelId, epoch) {
     const mgr = await this.manager(channelId);
     return mgr.exportSecret(LABEL, buildExporterContext(enclaveId, channelId, epoch), 32);
   }
@@ -2904,6 +3736,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * inside another `locks.run(channelId, ...)` for the same channel.
    */
   async voiceMediaKey(enclaveId, channelId, epoch, callId) {
+    await this.assertNotPending(channelId);
     return this.locks.run(channelId, async () => {
       const mgr = await this.manager(channelId);
       return mgr.exportSecret(VOICE_MEDIA_EXPORTER_LABEL, buildVoiceExporterContext(enclaveId, channelId, epoch, callId), 32);
@@ -3060,13 +3893,13 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       const exp = kpId === "" ? null : await this.o.backend.fetchKeyPackageExpiry(kpId);
       const expired = exp !== null && isServerExpired(exp, this.o.now?.() ?? Date.now());
       if (!expired) {
-        console.warn("publishKeyPackage: pending bundle exists; skipping republish");
+        writeServiceLog("warn", "keypackage.publish_skipped_pending");
         return kpId;
       }
-      console.warn(`publishKeyPackage: server KeyPackage expired for device ${this.o.deviceId.slice(0, 8)}; rotating`);
+      writeServiceLog("warn", "keypackage.expired_rotation");
       await this.o.store.deletePendingBundle(this.o.deviceId);
     }
-    console.warn(`publishKeyPackage: minting a fresh KeyPackage (rotation) for device ${this.o.deviceId.slice(0, 8)}`);
+    writeServiceLog("warn", "keypackage.minting_fresh");
     const mgr = new MLSGroupManager2();
     const bundle = await mgr.generateKeyPackage(this.o.identity);
     const hex = bytesToHex2(MLSGroupManager2.serializeKeyPackage(bundle.publicPackage));
@@ -3081,7 +3914,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     return this.o.store.loadLastKpId(this.o.deviceId);
   }
   async ensureSession(channelId, opts) {
-    return this.locks.run(channelId, () => this.ensureSessionUnlocked(channelId, opts));
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      await this.requirePendingResolvedUnlocked(channelId);
+      return this.ensureSessionUnlocked(channelId, opts);
+    }));
   }
   async ensureSessionUnlocked(channelId, opts) {
     if (!opts.forceReinit && await this.o.store.load(channelId))
@@ -3115,16 +3951,11 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         member_device_ids: [this.o.deviceId, ...others],
         welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex2(welcome) })) : []
       });
-      await this.o.store.save(channelId, mgr.exportState());
+      await this.saveMain(channelId, mgr);
       this.managers.set(channelId, mgr);
       return;
     }
     if (opts.bootstrap) {
-      const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
-      if (init.created === false)
-        throw new BootstrapRaceLostError();
-      const mgr = new MLSGroupManager2();
-      await mgr.createGroup(new TextEncoder().encode(init.group_id), bundle);
       const others = [...new Set(opts.otherDeviceIds ?? [])].filter((d) => d !== this.o.deviceId);
       const kps = await this.o.backend.fetchKeyPackages(others);
       const pkgs = others.map((d) => {
@@ -3133,20 +3964,36 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           throw new Error(`ensureSession: no published KeyPackage for device ${d}`);
         return MLSGroupManager2.deserializeKeyPackage(hexToBytes(hex));
       });
+      const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+      if (init.created === false) {
+        if (!this.isAdoptableOrphan(init, others)) {
+          if (this.isOrphanShape(init, others))
+            throw new AttestedOrphanRefusedError(channelId);
+          throw new BootstrapRaceLostError();
+        }
+        writeServiceLog("warn", "session.bootstrap_orphan_adopted");
+      }
+      const mgr = new MLSGroupManager2();
+      await mgr.createGroup(new TextEncoder().encode(init.group_id), bundle);
       const { commit, welcome } = await mgr.addMembers(pkgs);
-      await this.o.backend.distribute(init.group_id, {
+      const rec = this.pendingRecord("bootstrap", init.group_id, {
         device_id: this.o.deviceId,
         commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: init.current_epoch,
         member_device_ids: [this.o.deviceId, ...others],
         welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex2(welcome) })) : []
-      });
-      this.managers.set(channelId, mgr);
-      await this.o.store.save(channelId, mgr.exportState());
+      }, mgr, null);
+      const res = await this.commitWithPendingRecord(channelId, rec, mgr);
+      if (!res.landed) {
+        const e = res.error;
+        if (e instanceof MlsBackendHttpError && e.status === 409 && e.code === "EPOCH_CONFLICT")
+          throw new BootstrapRaceLostError();
+        throw e;
+      }
     } else {
       const rows = await this.o.backend.pullDelivery(this.o.deviceId);
-      const w = rows.find((r) => r.message_type === "welcome" && (r.connect_channel_id === channelId || r.connect_channel_id == null));
+      const w = rows.find((r) => r.message_type === "welcome" && r.connect_channel_id === channelId);
       if (!w)
         throw new Error("ensureSession(join): no Welcome available yet for this channel");
       const mgr = new MLSGroupManager2();
@@ -3154,15 +4001,36 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         await mgr.joinFromWelcome(hexToBytes(w.payload), bundle);
       } catch (err) {
         this.recordDecryptError(w, err);
-        console.warn(`ensureSession(join): discarding un-openable Welcome for channel ${channelId} (queue_id=${w.queue_id}); private KeyPackage key no longer held`);
+        writeServiceLog("warn", "session.unopenable_welcome_discarded", {}, err);
         await this.o.backend.ackDelivery(this.o.deviceId, [w.queue_id]);
         return;
       }
       this.managers.set(channelId, mgr);
-      await this.o.store.save(channelId, mgr.exportState());
+      await this.saveMain(channelId, mgr);
       await this.o.backend.ackDelivery(this.o.deviceId, [w.queue_id]);
     }
   }
+  /**
+   * C5 (Phase 3): may a bootstrap ADOPT the existing server group `init`
+   * returned (created=false)? Only an orphan of the right SHAPE
+   * ({@link isOrphanShape}) that the server reports as NOT owner-attested:
+   * `reset_attested === false`, strictly. C2 T3b: `true` and ABSENT both refuse
+   * (fail closed; an older backend omits the field).
+   */
+  isAdoptableOrphan(init, others) {
+    return this.isOrphanShape(init, others) && init.reset_attested === false;
+  }
+  /** C5: still at epoch 0 (no commit ever accepted, so nobody holds usable
+   *  state), with a roster that is exactly this device plus devices this
+   *  bootstrap Adds. Fails closed on a missing roster. Says nothing about
+   *  attestation (see {@link isAdoptableOrphan}). */
+  isOrphanShape(init, others) {
+    if (init.current_epoch !== 0)
+      return false;
+    if (!Array.isArray(init.member_device_ids))
+      return false;
+    return init.member_device_ids.every((d) => d === this.o.deviceId || others.includes(d));
+  }
   /**
    * FileSafe vault owner bootstrap (Task 7, P4/P5 wiring): create the LOCAL
    * ts-mls group bound to a group_id the backend ALREADY minted, WITHOUT
@@ -3211,7 +4079,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     const mgr = new MLSGroupManager2();
     await mgr.createGroup(new TextEncoder().encode(groupId), bundle);
     this.managers.set(channelId, mgr);
-    await this.o.store.save(channelId, mgr.exportState());
+    await this.saveMain(channelId, mgr);
   }
   /**
    * Committer-side: add a member to an ALREADY-bootstrapped (live) group.
@@ -3227,7 +4095,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * parallel group_id-by-channel resolver.
    */
   async addMemberToLiveGroup(channelId, newDeviceId, opts) {
-    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, 0, opts)));
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      await this.requirePendingResolvedUnlocked(channelId);
+      return this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, 0, opts);
+    }));
   }
   /**
    * Committer-side (owner): add a member to an already-bootstrapped VAULT
@@ -3248,7 +4119,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     if (!opts.expectedCredentialPubKey) {
       throw new VaultCredentialMismatchError(opts.expectedCredentialPubKey, "");
     }
-    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, 0, { vaultAdd: true, ...opts })));
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      await this.requirePendingResolvedUnlocked(channelId);
+      return this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, 0, { vaultAdd: true, ...opts });
+    }));
   }
   async addMemberToLiveGroupUnlocked(channelId, newDeviceId, _attempt, opts) {
     const isVault = !!opts && "vaultAdd" in opts && opts.vaultAdd === true;
@@ -3303,13 +4177,17 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       deltaVouches
     });
     if (hasMalformedBinding(identityLeaves)) {
-      console.warn(`addMemberToLiveGroup: channel ${channelId} has a leaf with an unreadable device binding for identity ${claimedIdentity ?? "?"} \u2014 treated as UNBOUND, never as absent`);
+      writeServiceLog("warn", "admission.malformed_leaf_binding");
     }
     if (targetLeaves.length > 0 && deltaVouches) {
-      console.warn(`addMemberToLiveGroup: channel ${channelId} \u2014 the server's add-delta vouches for device ${newDeviceId} while its published KeyPackage is ALREADY a leaf here (indices ${targetLeaves.join(",")}). An honest retry cannot produce this pair: attempt 0's init unions the device into the roster, so the delta can never list it again. Treat as a possible KeyPackage substitution, or as a lost race against a peer's Add that will self-heal on the next sweep pass.`);
+      writeServiceLog("warn", "admission.possible_keypackage_substitution", {
+        leaf_count: targetLeaves.length
+      });
     }
     if (targetLeaves.length > 1) {
-      console.warn(`addMemberToLiveGroup: channel ${channelId} \u2014 device ${newDeviceId}'s published KeyPackage already occupies ${targetLeaves.length} leaves (indices ${targetLeaves.join(",")}). This is a pre-existing duplicate leaf; nothing on this path can repair it and heal refuses an identity holding more than one leaf.`);
+      writeServiceLog("warn", "admission.duplicate_device_leaves", {
+        leaf_count: targetLeaves.length
+      });
     }
     switch (verdict.decision) {
       case "admit":
@@ -3336,21 +4214,26 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       groupId = init.group_id;
       members = [.../* @__PURE__ */ new Set([...init.member_device_ids ?? [this.o.deviceId], newDeviceId])];
     }
+    if (new TextDecoder().decode(mgr.groupId) !== groupId) {
+      throw new Error("addMemberToLiveGroup: group binding mismatch");
+    }
     const priorEpoch = Number(mgr.epoch);
+    const prior = tagOf(mgr);
     const { commit, welcome } = await mgr.addMembers([pkg]);
-    try {
-      await this.o.backend.distribute(groupId, {
-        device_id: this.o.deviceId,
-        commit: bytesToHex2(commit),
-        commit_epoch: Number(mgr.epoch),
-        expected_epoch: priorEpoch,
-        member_device_ids: members,
-        op: "add",
-        welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex2(welcome) }] : []
-      });
-    } catch (e) {
-      this.managers.delete(channelId);
-      if (_attempt >= 2)
+    const res = await this.commitWithPendingRecord(channelId, this.pendingRecord("add", groupId, {
+      device_id: this.o.deviceId,
+      commit: bytesToHex2(commit),
+      commit_epoch: Number(mgr.epoch),
+      expected_epoch: priorEpoch,
+      member_device_ids: members,
+      op: "add",
+      welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex2(welcome) }] : []
+    }, mgr, prior), mgr);
+    if (!res.landed) {
+      const e = res.error;
+      if (isSupersededRefusal(e))
+        throw new GroupSupersededError(channelId, groupId);
+      if (_attempt >= 2 || !isEpochConflict(e))
         throw e;
       try {
         await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
@@ -3358,7 +4241,6 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       }
       return this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, _attempt + 1, opts);
     }
-    await this.o.store.save(channelId, mgr.exportState());
     return "committed";
   }
   /**
@@ -3381,36 +4263,43 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * of this group.
    */
   async removeMemberFromLiveGroup(channelId, identityId) {
-    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeMemberFromLiveGroupUnlocked(channelId, identityId, 0)));
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      await this.requirePendingResolvedUnlocked(channelId);
+      return this.removeMemberFromLiveGroupUnlocked(channelId, identityId, 0);
+    }));
   }
   async removeMemberFromLiveGroupUnlocked(channelId, identityId, _attempt) {
     const mgr = await this.manager(channelId);
     const indices = mgr.leafIndicesForIdentity(identityId);
     if (indices.length === 0)
       return;
+    this.refuseOwnLeafRemove(mgr, indices, "removeMember");
     const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+    if (new TextDecoder().decode(mgr.groupId) !== init.group_id) {
+      throw new Error("removeMemberFromLiveGroup: group binding mismatch");
+    }
     const priorEpoch = Number(mgr.epoch);
+    const prior = tagOf(mgr);
     const { commit } = await mgr.removeMembers(indices);
     if (Number(mgr.epoch) !== priorEpoch + 1) {
       throw new Error("removeMemberFromLiveGroup: unexpected epoch drift before distribute");
     }
-    await this.o.store.saveStaging(channelId, mgr.exportState());
     const members = init.member_device_ids ?? [this.o.deviceId];
-    try {
-      await this.o.backend.distribute(init.group_id, {
-        device_id: this.o.deviceId,
-        commit: bytesToHex2(commit),
-        commit_epoch: Number(mgr.epoch),
-        expected_epoch: priorEpoch,
-        member_device_ids: members,
-        op: "remove",
-        removed_identity_id: identityId,
-        welcomes: []
-      });
-    } catch (e) {
-      this.managers.delete(channelId);
-      await this.o.store.discardStaging(channelId);
-      if (_attempt >= 2)
+    const res = await this.commitWithPendingRecord(channelId, this.pendingRecord("remove", init.group_id, {
+      device_id: this.o.deviceId,
+      commit: bytesToHex2(commit),
+      commit_epoch: Number(mgr.epoch),
+      expected_epoch: priorEpoch,
+      member_device_ids: members,
+      op: "remove",
+      removed_identity_id: identityId,
+      welcomes: []
+    }, mgr, prior), mgr);
+    if (!res.landed) {
+      const e = res.error;
+      if (isSupersededRefusal(e))
+        throw new GroupSupersededError(channelId, init.group_id);
+      if (_attempt >= 2 || !isEpochConflict(e))
         throw e;
       try {
         await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
@@ -3418,7 +4307,6 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       }
       return this.removeMemberFromLiveGroupUnlocked(channelId, identityId, _attempt + 1);
     }
-    await this.o.store.promoteStaging(channelId);
   }
   /**
    * Committer-side: REMOVE a SINGLE device (one leaf) from a live group (MD-3
@@ -3457,27 +4345,38 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * should delegate to it.
    *
    * Returns null rather than throwing so every caller must decide explicitly what
-   * an unknown own-leaf means.
-   *
-   * ⚠️ The one caller today does NOT fail closed on null. In
-   * {@link removeDeviceFromLiveGroupUnlocked} the branch is
-   * `if (ownLeaf !== null && leaves.includes(ownLeaf))` — the `else` compares no
-   * identities at all, so a null return sends an OWN-identity removal down the
-   * positional `leaves[pos]` path, which is exactly the add-order guess the
-   * self-exclusion branch exists to avoid (RFC 9420 §7.1 leftmost-blank refill
-   * permutes that mapping after any Remove). Null is therefore currently
-   * indistinguishable from "foreign identity", and only the cardinality guard
-   * stands between it and evicting the wrong device of the same human.
-   * Correcting that is Phase 1b, not this comment.
+   * an unknown own-leaf means. Every remove path now decides the same way: null
+   * FAILS CLOSED (Phase 3 C3, {@link refuseOwnLeafRemove}). Before C3,
+   * {@link removeDeviceFromLiveGroupUnlocked} treated null as "foreign identity"
+   * and sent an own-identity removal down the positional add-order guess.
    */
   ownLeafIndex(mgr) {
     const idx = mgr.state?.privatePath?.leafIndex;
     return typeof idx === "number" ? idx : null;
   }
-  async removeDeviceFromLiveGroup(channelId, deviceId, opts) {
-    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, 0)));
+  /**
+   * Phase 3 C3: the shared own-leaf refusal for every remove path. Throws
+   * {@link OwnLeafRemoveRefusedError} when this committer's own leaf index is
+   * unknown (fail closed) or is among `targetLeaves`. Returns the own leaf index
+   * so a caller that needs it (self-exclusion) reads it from the same check.
+   * Synchronous and called before any commit is built: a refusal distributes
+   * nothing and leaves the cached manager untouched.
+   */
+  refuseOwnLeafRemove(mgr, targetLeaves, op) {
+    const ownLeaf = this.ownLeafIndex(mgr);
+    if (ownLeaf === null)
+      throw new OwnLeafRemoveRefusedError(op, "own_leaf_unknown");
+    if (targetLeaves.includes(ownLeaf))
+      throw new OwnLeafRemoveRefusedError(op, "own_leaf");
+    return ownLeaf;
   }
-  async removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, _attempt) {
+  async removeDeviceFromLiveGroup(channelId, deviceId, opts) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      await this.requirePendingResolvedUnlocked(channelId);
+      return this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, 0);
+    }));
+  }
+  async removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, _attempt) {
     const mgr = await this.manager(channelId);
     let shadowResolutionTaken;
     try {
@@ -3541,9 +4440,13 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     if (leaves.length !== opts.orderedDeviceIds.length) {
       throw new LeafRosterMismatchError();
     }
+    if (deviceId === this.o.deviceId)
+      throw new OwnLeafRemoveRefusedError("removeDevice", "own_device");
     let leafIndex;
     const ownLeaf = this.ownLeafIndex(mgr);
-    if (ownLeaf !== null && leaves.includes(ownLeaf)) {
+    if (ownLeaf === null)
+      throw new OwnLeafRemoveRefusedError("removeDevice", "own_leaf_unknown");
+    if (leaves.includes(ownLeaf)) {
       const others = leaves.filter((i) => i !== ownLeaf);
       if (others.length !== 1) {
         throw new AmbiguousOwnLeafError(deviceId, leaves.length, others.length);
@@ -3553,30 +4456,33 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       leafIndex = leaves[pos];
     }
     const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+    if (new TextDecoder().decode(mgr.groupId) !== init.group_id) {
+      throw new Error("removeDeviceFromLiveGroup: group binding mismatch");
+    }
     const priorEpoch = Number(mgr.epoch);
+    const prior = tagOf(mgr);
     const { commit } = await mgr.removeMembers([leafIndex]);
     if (Number(mgr.epoch) !== priorEpoch + 1) {
       throw new Error("removeDeviceFromLiveGroup: unexpected epoch drift before distribute");
     }
-    await this.o.store.saveStaging(channelId, mgr.exportState());
     const members = init.member_device_ids ?? [this.o.deviceId];
     const removedIdentity = typeof opts.identity === "string" ? opts.identity : bytesToHex2(opts.identity);
-    try {
-      await this.o.backend.distribute(init.group_id, {
-        device_id: this.o.deviceId,
-        commit: bytesToHex2(commit),
-        commit_epoch: Number(mgr.epoch),
-        expected_epoch: priorEpoch,
-        member_device_ids: members,
-        op: "remove",
-        removed_identity_id: removedIdentity,
-        removed_device_id: deviceId,
-        welcomes: []
-      });
-    } catch (e) {
-      this.managers.delete(channelId);
-      await this.o.store.discardStaging(channelId);
-      if (_attempt >= 2)
+    const res = await this.commitWithPendingRecord(channelId, this.pendingRecord("remove", init.group_id, {
+      device_id: this.o.deviceId,
+      commit: bytesToHex2(commit),
+      commit_epoch: Number(mgr.epoch),
+      expected_epoch: priorEpoch,
+      member_device_ids: members,
+      op: "remove",
+      removed_identity_id: removedIdentity,
+      removed_device_id: deviceId,
+      welcomes: []
+    }, mgr, prior), mgr);
+    if (!res.landed) {
+      const e = res.error;
+      if (isSupersededRefusal(e))
+        throw new GroupSupersededError(channelId, init.group_id);
+      if (_attempt >= 2 || !isEpochConflict(e))
         throw e;
       try {
         await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
@@ -3584,7 +4490,6 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       }
       return this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, _attempt + 1);
     }
-    await this.o.store.promoteStaging(channelId);
   }
   /**
    * Committer-side (owner): evict a SINGLE device leaf from a LIVE VAULT group,
@@ -3642,7 +4547,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * re-runs on every attempt.
    */
   async removeVaultLeafFromLiveGroup(channelId, expectedLeafSignaturePubKeyHex, opts) {
-    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeVaultLeafUnlocked(channelId, expectedLeafSignaturePubKeyHex, opts, 0)));
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      await this.requirePendingResolvedUnlocked(channelId);
+      return this.removeVaultLeafUnlocked(channelId, expectedLeafSignaturePubKeyHex, opts, 0);
+    }));
   }
   async removeVaultLeafUnlocked(channelId, expectedHex, opts, _attempt) {
     const mgr = await this.manager(channelId);
@@ -3668,33 +4576,37 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     const claimed = cred.credentialType === "basic" ? new TextDecoder().decode(cred.identity) : "";
     if (claimed !== opts.expectedIdentityId)
       throw new VaultLeafTOCTOUError();
+    this.refuseOwnLeafRemove(mgr, [leafIndex], "removeVaultLeaf");
+    const followUp = opts.deviceId && opts.enclaveId ? { kind: "vault-remove", enclaveId: opts.enclaveId, deviceId: opts.deviceId } : void 0;
+    if (followUp)
+      await this.drainOwedFollowUpUnlocked(channelId);
     const priorEpoch = Number(mgr.epoch);
+    const prior = tagOf(mgr);
     const { commit } = await mgr.removeMembers([leafIndex]);
     if (Number(mgr.epoch) !== priorEpoch + 1) {
       throw new Error("removeVaultLeafFromLiveGroup: unexpected epoch drift before distribute");
     }
     const groupId = new TextDecoder().decode(mgr.groupId);
-    await this.o.store.saveStaging(channelId, mgr.exportState());
-    try {
-      await this.o.backend.distribute(groupId, {
-        device_id: this.o.deviceId,
-        commit: bytesToHex2(commit),
-        commit_epoch: Number(mgr.epoch),
-        expected_epoch: priorEpoch,
-        member_device_ids: opts.vaultContext.memberDeviceIds,
-        op: "remove",
-        removed_identity_id: opts.expectedIdentityId,
-        // Device-granular distribute (C1): when opts.deviceId is empty (no
-        // owner-local leafSigKey->deviceId binding), OMIT removed_device_id —
-        // the server falls back to identity-level eviction. The crypto
-        // removal above already stands regardless; only delivery degrades.
-        ...opts.deviceId ? { removed_device_id: opts.deviceId } : {},
-        welcomes: []
-      });
-    } catch (e) {
-      this.managers.delete(channelId);
-      await this.o.store.discardStaging(channelId);
-      if (_attempt >= 2)
+    const res = await this.commitWithPendingRecord(channelId, this.pendingRecord("remove", groupId, {
+      device_id: this.o.deviceId,
+      commit: bytesToHex2(commit),
+      commit_epoch: Number(mgr.epoch),
+      expected_epoch: priorEpoch,
+      member_device_ids: opts.vaultContext.memberDeviceIds,
+      op: "remove",
+      removed_identity_id: opts.expectedIdentityId,
+      // Device-granular distribute (C1): when opts.deviceId is empty (no
+      // owner-local leafSigKey->deviceId binding), OMIT removed_device_id —
+      // the server falls back to identity-level eviction. The crypto
+      // removal above already stands regardless; only delivery degrades.
+      ...opts.deviceId ? { removed_device_id: opts.deviceId } : {},
+      welcomes: []
+    }, mgr, prior, followUp), mgr);
+    if (!res.landed) {
+      const e = res.error;
+      if (isSupersededRefusal(e))
+        throw new GroupSupersededError(channelId, groupId);
+      if (_attempt >= 2 || !isEpochConflict(e))
         throw e;
       try {
         await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
@@ -3702,7 +4614,6 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       }
       return this.removeVaultLeafUnlocked(channelId, expectedHex, opts, _attempt + 1);
     }
-    await this.o.store.promoteStaging(channelId);
   }
   /**
    * Committer-side: HEAL a permanently-diverged member by Remove(stale leaf) then
@@ -3793,6 +4704,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    */
   async healDivergedMember(channelId, memberDeviceId, opts) {
     return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      await this.requirePendingResolvedUnlocked(channelId);
       const kps = await this.o.backend.fetchKeyPackages([memberDeviceId]);
       const hex = kps[memberDeviceId];
       if (!hex)
@@ -3819,7 +4731,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         }
       }
       if (leaves.length === 1) {
-        console.warn(`[heal] channel ${channelId}: about to Remove the single leaf held by identity ${identity} in order to re-Add device ${memberDeviceId}, WITHOUT being able to prove that leaf is that device's. Leaf credentials encode the identity, not the device. If this member holds more than one device, the leaf being evicted may belong to a SIBLING device that was never diverged, and this call will still report a clean heal. Multi-device members are unhealable until leaf\u2192device attribution exists.`);
+        writeServiceLog("warn", "heal.single_leaf_device_unattributed");
       }
       let removeLanded = false;
       if (leaves.length === 1) {
@@ -3921,6 +4833,13 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    */
   async resetChannelForRejoin(channelId) {
     await this.locks.run(channelId, async () => {
+      const r = await this.resolvePendingCommitUnlocked(channelId);
+      if (r === "ambiguous")
+        throw new PendingCommitUnresolvedError(channelId);
+      if (r === "landed") {
+        writeServiceLog("info", "mls.pending_commit.resolved_pending");
+        return;
+      }
       this.evictChannelState(channelId);
       await this.o.store.delete(channelId);
       await this.o.store.discardStaging(channelId);
@@ -3945,7 +4864,26 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * (required subset of supplied) is still satisfied even though it never
    * goes through addMembers. */
   async resetSessionSupersede(channelId, opts) {
-    return this.locks.run(channelId, async () => {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      let resolved;
+      let seen = "unreadable";
+      try {
+        resolved = await this.resolvePendingCommitUnlocked(channelId, PENDING_INLINE_RESENDS, (r) => {
+          if (r)
+            seen = r;
+        });
+      } catch (e) {
+        if (opts.abandonPending !== true)
+          throw e;
+        resolved = "ambiguous";
+      }
+      if (resolved === "ambiguous") {
+        if (opts.abandonPending !== true)
+          throw new PendingCommitUnresolvedError(channelId);
+        if (!await this.abandonPendingCommitUnlocked(channelId, seen))
+          throw new PendingCommitUnresolvedError(channelId);
+      }
+      await this.drainOwedFollowUpUnlocked(channelId, opts.abandonPending === true);
       let bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
       if (!bundle) {
         await this.publishKeyPackage();
@@ -3954,9 +4892,6 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       if (!bundle)
         throw new Error("resetSessionSupersede: call publishKeyPackage() first");
       const others = [...new Set(opts.otherDeviceIds)].filter((d) => d !== this.o.deviceId);
-      const reinit = await this.o.backend.resetReinitConnectChannelGroup(channelId, [this.o.deviceId, ...others], { newGroupId: opts.newGroupId, signatureHex: opts.signatureHex, nonceHex: opts.nonceHex, signedContentHex: opts.signedContentHex });
-      const mgr = new MLSGroupManager2();
-      await mgr.createGroup(new TextEncoder().encode(reinit.group_id), bundle);
       const kps = await this.o.backend.fetchKeyPackages(others);
       const pkgs = others.map((d) => {
         const hex = kps[d];
@@ -3964,19 +4899,62 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           throw new Error(`resetSessionSupersede: no published KeyPackage for device ${d}`);
         return MLSGroupManager2.deserializeKeyPackage(hexToBytes(hex));
       });
-      const { commit, welcome } = await mgr.addMembers(pkgs);
-      await this.o.backend.distribute(reinit.group_id, {
+      const mainState0 = await this.o.store.load(channelId);
+      const prior0 = mainState0 ? tagOfState(mainState0) : null;
+      const reservation = pendingReservation({
+        groupId: opts.newGroupId,
+        deviceId: this.o.deviceId,
+        prior: prior0,
+        placeholder: mainState0 ?? RESERVATION_PLACEHOLDER_STATE,
+        createdAt: this.nowMs()
+      });
+      if (!await this.o.store.savePendingCommit(channelId, reservation, { onlyIfAbsent: true })) {
+        throw new PendingCommitUnresolvedError(channelId);
+      }
+      const reservationKey = pendingCommitKey(reservation);
+      const mainState1 = await this.o.store.load(channelId);
+      const prior1 = mainState1 ? tagOfState(mainState1) : null;
+      let prior = prior0;
+      if (!sameMainTag(prior0, prior1)) {
+        const corrected = { ...reservation, prior: prior1, state: mainState1 ?? RESERVATION_PLACEHOLDER_STATE };
+        if (!await this.o.store.savePendingCommit(channelId, corrected, { replacing: reservationKey })) {
+          await this.o.store.clearPendingCommit(channelId, reservationKey).catch(() => false);
+          throw new PendingCommitUnresolvedError(channelId);
+        }
+        prior = prior1;
+      }
+      let reinit;
+      try {
+        reinit = await this.o.backend.resetReinitConnectChannelGroup(channelId, [this.o.deviceId, ...others], { newGroupId: opts.newGroupId, signatureHex: opts.signatureHex, nonceHex: opts.nonceHex, signedContentHex: opts.signedContentHex });
+      } catch (e) {
+        if (isDefiniteReinitRefusal(e))
+          await this.o.store.clearPendingCommit(channelId, reservationKey);
+        throw e;
+      }
+      let mgr;
+      let commit;
+      let welcome;
+      try {
+        mgr = new MLSGroupManager2();
+        await mgr.createGroup(new TextEncoder().encode(reinit.group_id), bundle);
+        ({ commit, welcome } = await mgr.addMembers(pkgs));
+      } catch (e) {
+        await this.o.store.clearPendingCommit(channelId, reservationKey);
+        throw e;
+      }
+      const staleMemberDeviceIds = reinit.stale_member_device_ids ?? [];
+      const res = await this.commitWithPendingRecord(channelId, this.pendingRecord("supersede", reinit.group_id, {
         device_id: this.o.deviceId,
         commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: reinit.current_epoch,
         member_device_ids: [this.o.deviceId, ...others],
         welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex2(welcome) })) : []
-      });
-      await this.o.store.save(channelId, mgr.exportState());
-      this.managers.set(channelId, mgr);
-      return { staleMemberDeviceIds: reinit.stale_member_device_ids ?? [] };
-    });
+      }, mgr, prior, { kind: "supersede", staleMemberDeviceIds }), mgr, reservationKey);
+      if (!res.landed)
+        throw res.error;
+      return { staleMemberDeviceIds };
+    }));
   }
   /** Returns true when an in-memory MLS manager is live for the channel.
    * Cheap synchronous check; does NOT consult the store. */
@@ -4041,7 +5019,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         const envelope = JSON.parse(new TextDecoder().decode(hexToBytes(m.payload)));
         if (envelope.channel_id !== channelId)
           continue;
-        const key = await this.locks.run(channelId, () => this.exporterKey(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch));
+        const key = await this.locks.run(channelId, () => this.exporterKeyUnfenced(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch));
         const aad = await buildAssociatedData({
           message_id: envelope.message_id,
           channel_id: envelope.channel_id,
@@ -4238,7 +5216,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       } catch (err) {
         this.recordDecryptError(row, err);
         if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
-          console.warn(`[trace] supersede joinFromWelcome FAILED ch=${channelId.slice(0, 8)} g=${row.group_id.slice(0, 8)}: ${err instanceof Error ? err.message : String(err)} -> self-heal`);
+          writeServiceLog("debug", "supersede.welcome_open_failed", {}, err);
         }
         let requested = false;
         try {
@@ -4256,6 +5234,23 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       if (new TextDecoder().decode(mgr.groupId) !== row.group_id) {
         return refuse("supersede refused: post-join group id != attested new_group_id");
       }
+      let dead = null;
+      try {
+        dead = await this.o.store.loadPendingCommit(channelId);
+        await this.resolvePendingCommitUnlocked(channelId, 0);
+      } catch (e) {
+        writeServiceLog("warn", "mls.pending_commit.supersede_resolve_failed", {}, e);
+      }
+      if (dead)
+        await this.o.store.clearPendingCommit(channelId, pendingCommitKey(dead));
+      try {
+        const after = await this.o.store.loadPendingCommit(channelId);
+        if (after && after.groupId !== row.group_id) {
+          await this.o.store.clearPendingCommit(channelId, pendingCommitKey(after));
+        }
+      } catch (e) {
+        writeServiceLog("warn", "mls.pending_commit.supersede_resolve_failed", {}, e);
+      }
       this.evictChannelState(channelId);
       await this.o.store.delete(channelId);
       await this.o.store.discardStaging(channelId);
@@ -4263,13 +5258,21 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       this.errors.delete(channelId);
       this.supersedeRefusals.delete(`${channelId}:${row.group_id}`);
       this.managers.set(channelId, mgr);
-      await this.o.store.save(channelId, mgr.exportState());
+      await this.saveMain(channelId, mgr);
       await this.o.backend.ackDelivery(this.o.deviceId, [row.queue_id]);
       return true;
     });
   }
   async receiveOnce(deviceId) {
+    this.kickOwedRerun();
     const rows = await this.o.backend.pullDelivery(deviceId);
+    if (deviceId === this.o.deviceId && this.custody.size && rows.length < DELIVERY_PULL_PAGE) {
+      const pulledIds = new Set(rows.map((r) => r.queue_id));
+      for (const qid of this.custody.keys()) {
+        if (!pulledIds.has(qid))
+          this.custody.delete(qid);
+      }
+    }
     const appEntries = [];
     const handshakeAcked = [];
     const nackIds = [];
@@ -4278,7 +5281,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     const nonWelcomes = rows.filter((r) => r.message_type !== "welcome");
     const ordered = [...welcomes, ...nonWelcomes];
     if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY && ordered.length) {
-      console.warn(`[trace] receiveOnce pulled ${ordered.length}: ` + ordered.map((r) => `${r.message_type}@e${r.epoch}/ch${(r.connect_channel_id || "-").slice(0, 8)}/g${(r.group_id || "-").slice(0, 8)}`).join(", "));
+      writeServiceLog("debug", "delivery.rows_pulled", { count: ordered.length });
     }
     const classCtx = /* @__PURE__ */ new Map();
     const classCtxFor = async (cid) => {
@@ -4305,10 +5308,58 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       }
       return ctx;
     };
+    const pendingAtPull = /* @__PURE__ */ new Map();
+    const leftThisPull = /* @__PURE__ */ new Map();
+    const pullNow = this.nowMs();
+    const escalatedAtPull = (cid) => {
+      const st = this.leftStreak.get(cid);
+      return st !== void 0 && st.pulls >= PENDING_LEFT_ESCALATION_PULLS && pullNow - st.since >= PENDING_LEFT_ESCALATION_MS;
+    };
+    const hadPendingAtPull = async (cid) => {
+      let v = pendingAtPull.get(cid);
+      if (v === void 0) {
+        try {
+          v = await this.o.store.loadPendingCommit(cid) !== null;
+        } catch {
+          v = true;
+        }
+        pendingAtPull.set(cid, v);
+      }
+      return v;
+    };
     for (const row of ordered) {
       try {
         if (row.message_type !== "welcome" && row.connect_channel_id) {
           await classCtxFor(row.connect_channel_id);
+          if (await hadPendingAtPull(row.connect_channel_id)) {
+            const pcid = row.connect_channel_id;
+            let verdict;
+            try {
+              verdict = await this.resolveRowAgainstPending(pcid, row, classCtx.get(pcid));
+            } catch (e) {
+              const now = this.nowMs();
+              const last = this.receiveFailLoggedAt.get(pcid);
+              if (last === void 0 || now - last >= PENDING_RECEIVE_FAIL_LOG_INTERVAL_MS) {
+                this.receiveFailLoggedAt.set(pcid, now);
+                writeServiceLog("warn", "mls.pending_commit.receive_resolve_failed", {}, e);
+              }
+              verdict = { kind: "leave" };
+            }
+            if (verdict.kind === "leave") {
+              leftThisPull.set(pcid, (leftThisPull.get(pcid) ?? 0) + 1);
+              if (escalatedAtPull(pcid))
+                throw new PendingRowEscalatedError();
+              continue;
+            }
+            if (verdict.kind === "acked") {
+              handshakeAcked.push(row.queue_id);
+              continue;
+            }
+            if (verdict.kind === "entry") {
+              appEntries.push(verdict.entry);
+              continue;
+            }
+          }
         }
         if (row.message_type === "welcome") {
           const wcid = row.connect_channel_id;
@@ -4323,14 +5374,19 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
                 heldGroupId = null;
               }
               if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
-                console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} rowGroup=${(row.group_id || "-").slice(0, 8)} heldGroup=${heldGroupId ? heldGroupId.slice(0, 8) : "NULL"} -> ${heldGroupId === null ? "SKIP(manager-unloadable)" : heldGroupId === row.group_id ? "stray-ack" : "trySupersede"}`);
+                if (heldGroupId === null)
+                  writeServiceLog("debug", "delivery.welcome_manager_unloadable");
+                else if (heldGroupId === row.group_id)
+                  writeServiceLog("debug", "delivery.welcome_stray");
+                else
+                  writeServiceLog("debug", "delivery.welcome_supersede_candidate");
               }
               if (heldGroupId !== null && heldGroupId === row.group_id) {
                 handshakeAcked.push(row.queue_id);
               } else if (heldGroupId !== null && heldGroupId !== row.group_id) {
                 if (this.supersedeBackoffActive(wcid, row.group_id)) {
                   if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
-                    console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} g=${row.group_id.slice(0, 8)} -> SKIP(refusal back-off)`);
+                    writeServiceLog("debug", "delivery.welcome_refusal_backoff");
                   }
                 } else {
                   const ok = await this.trySupersede(wcid, row, heldGroupId);
@@ -4339,7 +5395,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
                 }
               }
             } else if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
-              console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} rowGroup=${(row.group_id || "-").slice(0, 8)} -> NO-LOCAL-STATE (leave un-acked for join path)`);
+              writeServiceLog("debug", "delivery.welcome_no_local_state");
             }
           }
         } else if (row.message_type === "commit") {
@@ -4350,7 +5406,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           await this.locks.run(cid, async () => {
             const mgr = await this.manager(cid);
             await mgr.decrypt(hexToBytes(row.payload));
-            await this.o.store.save(cid, mgr.exportState());
+            await this.saveAdvancedOrEvict(cid, mgr);
             advancedEpoch = Number(mgr.epoch);
           });
           this.recordDecryptSuccess(cid);
@@ -4361,36 +5417,18 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           }
           handshakeAcked.push(row.queue_id);
         } else {
-          const envelope = JSON.parse(new TextDecoder().decode(hexToBytes(row.payload)));
-          if (row.connect_channel_id != null && envelope.channel_id !== row.connect_channel_id) {
-            throw new Error(`envelope/row channel binding mismatch: row=${row.connect_channel_id} envelope=${envelope.channel_id}`);
-          }
-          const key = await this.locks.run(envelope.channel_id, () => this.exporterKey(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch));
-          const aad = await buildAssociatedData({
-            message_id: envelope.message_id,
-            channel_id: envelope.channel_id,
-            sender_id: envelope.sender_id,
-            mls_group_epoch: envelope.mls_group_epoch,
-            replay_nonce: envelope.replay_nonce,
-            policy_binding: envelope.policy_binding
-          });
-          const plaintext = openPayload({ ciphertext: base64ToBytes(envelope.payload_encrypted), key, associatedData: aad, suite: this.suite });
-          const appChannelId = row.connect_channel_id ?? envelope.channel_id;
-          this.recordDecryptSuccess(appChannelId);
-          appEntries.push({
-            queueId: row.queue_id,
-            messageId: envelope.message_id,
-            channelId: appChannelId,
-            plaintext,
-            envelope,
-            receivedAt: Date.now(),
-            retryCount: 0,
-            expires_at: row.expires_at,
-            voiceMode: row.voice_mode ?? void 0,
-            voiceDefaultResponder: row.voice_default_responder ?? void 0
-          });
+          const held = this.custody.get(row.queue_id);
+          appEntries.push(held ? { ...held } : await this.decryptApplicationRow(row, { lockHeld: false }));
         }
       } catch (err) {
+        const heldAfterWait = row.message_type === "application" ? this.custody.get(row.queue_id) : void 0;
+        if (heldAfterWait) {
+          appEntries.push({ ...heldAfterWait });
+          continue;
+        }
+        if (err instanceof PendingCommitUnresolvedError) {
+          continue;
+        }
         this.recordDecryptError(row, err);
         const cid = row.connect_channel_id;
         let drained = false;
@@ -4435,6 +5473,20 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         }
       }
     }
+    for (const [cid, had] of pendingAtPull) {
+      if (!had)
+        continue;
+      if ((leftThisPull.get(cid) ?? 0) === 0) {
+        this.leftStreak.delete(cid);
+        continue;
+      }
+      const st = this.leftStreak.get(cid);
+      if (st)
+        st.pulls += 1;
+      else
+        this.leftStreak.set(cid, { pulls: 1, since: pullNow });
+      this.scheduleAutoResolve(cid);
+    }
     if (handshakeAcked.length)
       await this.o.backend.ackDelivery(deviceId, handshakeAcked);
     if (nackIds.length) {
@@ -4448,6 +5500,195 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     }
     return appEntries;
   }
+  /**
+   * C2 (spec §4.4 "Receive resolves the record from the queue"; plan 3.8):
+   * decide one delivery row of a channel that holds a pending record. Runs
+   * under the channel lock and RE-READS the record inside it (a row earlier in
+   * the same pull may have resolved it).
+   *
+   * Device-wide pulls arrive in `seq` order, and C1c puts every epoch-N row
+   * before the commit that moves to N+1, so the first row for this channel past
+   * epoch N is decisive:
+   *  1. A row of the record's group at or below `prior.epoch` (an epoch-N app
+   *     row, an old duplicate) → `normal`: decrypt at MAIN and ack as usual.
+   *     Nothing at or below N can move MAIN.
+   *  2. A COMMIT at `commitEpoch` in the record's group is someone else's (the
+   *     server never fans a commit back to its sender). If it applies at MAIN,
+   *     that proves ours was lost: clear the record, THEN save MAIN (a crash
+   *     between them redelivers the commit), hook `not_landed`.
+   *  3. A row framed at `commitEpoch` (an app row at `commitEpoch`, or a commit
+   *     at `commitEpoch + 1`): trial it on a throwaway manager imported from
+   *     `rec.state`. If it applies, the group is provably on OUR epoch (a
+   *     cryptographic proof, stronger than a 2xx): promote with the UNLOCKED
+   *     promotion inside this held lock (LOW-4: the queue is not reentrant),
+   *     then process the row normally.
+   *  4. Anything else of the record's group (fits neither state, or is past
+   *     both) → `leave`: un-acked, no nack, no error count, no dead-letter.
+   *
+   * LOW-5: cases 2 and 3 key on `row.group_id === rec.groupId`. A supersede
+   * record targets the NEW group and a bootstrap record has no MAIN, so no row
+   * of ANOTHER group ever resolves either; case 2 needs MAIN in the record's
+   * group, so it applies to add and remove records only, and a supersede or
+   * bootstrap record resolves by case 3 or by resend. Rows of another group
+   * (the supersede's old group, a retired group) take the `normal` paths:
+   * `saveMainGuarded` keeps any of them from moving MAIN past the record.
+   *
+   * Throws propagate to the caller, which leaves the row un-acked and
+   * uncounted (a failed promotion included).
+   */
+  async resolveRowAgainstPending(channelId, row, ctx) {
+    return this.locks.run(channelId, async () => {
+      let rec;
+      try {
+        rec = await this.o.store.loadPendingCommit(channelId);
+      } catch (e) {
+        if (row.message_type === "application")
+          return { kind: "normal" };
+        throw e;
+      }
+      if (!rec) {
+        return { kind: "normal" };
+      }
+      if (row.group_id !== rec.groupId)
+        return { kind: "normal" };
+      if (isPendingReservation(rec))
+        return { kind: "leave" };
+      const rowEpoch = typeof row.epoch === "number" ? row.epoch : void 0;
+      if (rowEpoch === void 0)
+        return { kind: "leave" };
+      const mainInRecGroup = rec.prior !== null && rec.prior.groupId === rec.groupId;
+      if (row.message_type === "commit" && rowEpoch === rec.commitEpoch) {
+        if (!mainInRecGroup)
+          return { kind: "leave" };
+        const mgr = await this.manager(channelId);
+        const at = tagOf(mgr);
+        if (at.groupId !== rec.prior.groupId || at.epoch !== rec.prior.epoch)
+          return { kind: "leave" };
+        try {
+          await mgr.decrypt(hexToBytes(row.payload));
+        } catch {
+          return { kind: "leave" };
+        }
+        if (!await this.o.store.clearPendingCommit(channelId, pendingCommitKey(rec))) {
+          this.managers.delete(channelId);
+          return { kind: "leave" };
+        }
+        await this.saveAdvancedOrEvict(channelId, mgr);
+        this.recordDecryptSuccess(channelId);
+        if (ctx)
+          ctx.liveCommitEpoch = Number(mgr.epoch);
+        await this.notifyPendingResolved(channelId, { op: rec.op, outcome: "not_landed", via: "resolver" });
+        return { kind: "acked" };
+      }
+      const framedAtOurs = row.message_type === "application" && rowEpoch === rec.commitEpoch || row.message_type === "commit" && rowEpoch === rec.commitEpoch + 1;
+      if (framedAtOurs) {
+        const trial = new MLSGroupManager2(rec.state.ciphersuite);
+        trial.importState(rec.state);
+        let applies;
+        if (row.message_type === "application") {
+          applies = await this.trialOpenApplication(row, trial);
+        } else {
+          try {
+            await trial.decrypt(hexToBytes(row.payload));
+            applies = true;
+          } catch {
+            applies = false;
+          }
+        }
+        if (!applies)
+          return { kind: "leave" };
+        const p = await this.promotePendingUnlocked(channelId, "resolver", rec);
+        if (p !== "landed")
+          return { kind: "normal" };
+        if (row.message_type === "application") {
+          return { kind: "entry", entry: await this.decryptApplicationRow(row, { lockHeld: true }) };
+        }
+        const mgr = await this.manager(channelId);
+        await mgr.decrypt(hexToBytes(row.payload));
+        await this.saveAdvancedOrEvict(channelId, mgr);
+        this.recordDecryptSuccess(channelId);
+        if (ctx)
+          ctx.liveCommitEpoch = Number(mgr.epoch);
+        return { kind: "acked" };
+      }
+      if (mainInRecGroup && rowEpoch <= rec.prior.epoch)
+        return { kind: "normal" };
+      return { kind: "leave" };
+    });
+  }
+  /** C2 case 3: would this application row open under `mgr`'s exporter? A
+   *  pure trial: no custody, no success record, no ack. The SDK-5 binding
+   *  (envelope channel == server-attributed channel) is checked first. */
+  async trialOpenApplication(row, mgr) {
+    try {
+      const envelope = JSON.parse(new TextDecoder().decode(hexToBytes(row.payload)));
+      if (row.connect_channel_id != null && envelope.channel_id !== row.connect_channel_id)
+        return false;
+      const key = mgr.exportSecret(LABEL, buildExporterContext(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch), 32);
+      const aad = await buildAssociatedData({
+        message_id: envelope.message_id,
+        channel_id: envelope.channel_id,
+        sender_id: envelope.sender_id,
+        mls_group_epoch: envelope.mls_group_epoch,
+        replay_nonce: envelope.replay_nonce,
+        policy_binding: envelope.policy_binding
+      });
+      openPayload({ ciphertext: base64ToBytes(envelope.payload_encrypted), key: await key, associatedData: aad, suite: this.suite });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Decrypt one application delivery row into an {@link InboxEntry} and take
+   * {@link custody} of it. Throws on any parse / binding / AEAD failure; the
+   * caller decides what a failure means.
+   *
+   * `lockHeld`: the committer 409 drain and the own-commit drain run INSIDE the
+   * channel lock already (the queue is not reentrant), so they derive the key
+   * without re-taking it. The SDK-5 binding check below guarantees
+   * envelope.channel_id equals the row's server-attributed channel, which is
+   * the channel whose lock is held.
+   *
+   * `keyFrom`: derive the key from THIS manager instead of the cached live one.
+   * Only {@link custodyAppRowsBeforeOwnCommit} passes it: a transient manager
+   * rebuilt from the store's committed (pre-commit, epoch N) state while the
+   * cached manager is already advanced to N+1.
+   */
+  async decryptApplicationRow(row, opts) {
+    const envelope = JSON.parse(new TextDecoder().decode(hexToBytes(row.payload)));
+    if (row.connect_channel_id != null && envelope.channel_id !== row.connect_channel_id) {
+      throw new Error(`envelope/row channel binding mismatch: row=${row.connect_channel_id} envelope=${envelope.channel_id}`);
+    }
+    const keyFrom = opts.keyFrom;
+    const derive = keyFrom ? () => keyFrom.exportSecret(LABEL, buildExporterContext(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch), 32) : () => this.exporterKeyUnfenced(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch);
+    const key = opts.lockHeld ? await derive() : await this.locks.run(envelope.channel_id, derive);
+    const aad = await buildAssociatedData({
+      message_id: envelope.message_id,
+      channel_id: envelope.channel_id,
+      sender_id: envelope.sender_id,
+      mls_group_epoch: envelope.mls_group_epoch,
+      replay_nonce: envelope.replay_nonce,
+      policy_binding: envelope.policy_binding
+    });
+    const plaintext = openPayload({ ciphertext: base64ToBytes(envelope.payload_encrypted), key, associatedData: aad, suite: this.suite });
+    const appChannelId = row.connect_channel_id ?? envelope.channel_id;
+    this.recordDecryptSuccess(appChannelId);
+    const entry = {
+      queueId: row.queue_id,
+      messageId: envelope.message_id,
+      channelId: appChannelId,
+      plaintext,
+      envelope,
+      receivedAt: Date.now(),
+      retryCount: 0,
+      expires_at: row.expires_at,
+      voiceMode: row.voice_mode ?? void 0,
+      voiceDefaultResponder: row.voice_default_responder ?? void 0
+    };
+    this.custody.set(row.queue_id, entry);
+    return entry;
+  }
   /**
    * Channel-scoped, UNLOCKED commit drain for committer conflict-recovery.
    *
@@ -4457,22 +5698,39 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * (which would re-acquire the same channel lock for that channel's commit rows
    * and self-deadlock — the queue is not reentrant). This helper does the commit
    * half of receiveOnce for ONLY the committer's own channel, without taking the
-   * lock (the caller already holds it). Application rows are left untouched — the
-   * committer only needs to converge its handshake epoch — and welcome rows are
-   * left for the join path, exactly as receiveOnce leaves them.
+   * lock (the caller already holds it). Welcome rows are left for the join path,
+   * exactly as receiveOnce leaves them. Rows of OTHER channels are untouched:
+   * this drain never moves their epoch, so they stay decryptable.
+   *
+   * C1: application rows of THIS channel are decrypted in seq order, before
+   * any commit behind them applies, which puts them in {@link custody} (never
+   * acked here); the next receiveOnce serves them. Walking past them, as this
+   * drain used to, then applying the commit behind them destroyed their key:
+   * the redelivered row failed AEAD and was acked as permanentlySkipped. A row
+   * that fails to decrypt here is left exactly as before (un-acked, not
+   * counted), for receiveOnce to classify.
    */
   async drainChannelCommitsUnlocked(deviceId, channelId) {
     const rows = await this.o.backend.pullDelivery(deviceId);
     const acked = [];
     for (const row of rows) {
-      if (row.message_type !== "commit")
-        continue;
       if (row.connect_channel_id !== channelId)
         continue;
+      if (row.message_type === "application") {
+        if (this.custody.has(row.queue_id))
+          continue;
+        try {
+          await this.decryptApplicationRow(row, { lockHeld: true });
+        } catch {
+        }
+        continue;
+      }
+      if (row.message_type !== "commit")
+        continue;
       try {
         const mgr = await this.manager(channelId);
         await mgr.decrypt(hexToBytes(row.payload));
-        await this.o.store.save(channelId, mgr.exportState());
+        await this.saveAdvancedOrEvict(channelId, mgr);
         this.recordDecryptSuccess(channelId);
         acked.push(row.queue_id);
       } catch (err) {
@@ -4482,6 +5740,60 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     if (acked.length)
       await this.o.backend.ackDelivery(deviceId, acked);
   }
+  /**
+   * C1b: take custody of this channel's still-queued application rows at the
+   * COMMITTED epoch, before a committer's OWN commit is persisted locally.
+   *
+   * The message key comes from the live exporter secret only. A committer that
+   * persists its own commit N->N+1 while a peer's epoch-N application row sits
+   * un-pulled in its queue can never decrypt that row again: its next
+   * receiveOnce fails AEAD, classifies it permanentlySkipped and acks it.
+   *
+   * ORDERING (the committer-safety rule, B11): called only AFTER distribute has
+   * succeeded and BEFORE the local save/promote, still inside the channel lock.
+   *  - After distribute: the server's group epoch is N+1, and the send path
+   *    rejects any application message claiming epoch < N+1
+   *    (validate_application_epoch, connect_messages.py step 6). So the set of
+   *    epoch-N rows is closed; one pull sees all of them (residual: a send whose
+   *    request read epoch N before our commit landed but commits after this pull;
+   *    see the C1 report).
+   *  - It is NOT a receiveOnce and applies NO commit: it only reads the queue
+   *    and derives exporter keys. The in-flight commit is already accepted, so
+   *    nothing here can race it or move the tree between resolve and
+   *    distribute; the cached (advanced) manager is never touched.
+   *  - The key comes from a TRANSIENT manager rebuilt from the store's MAIN
+   *    slot, which still holds the pre-commit epoch-N state (add: saved only
+   *    after this; removes: load() never returns staging). It is dropped when
+   *    this returns; no epoch-N secret is retained beyond the state that is
+   *    already at rest until the save/promote below.
+   *
+   * Best effort: a failed pull is retried once, then the commit is persisted
+   * anyway (not persisting an accepted commit would diverge this device). Rows
+   * that do not decrypt at N are left untouched for receiveOnce.
+   */
+  async custodyAppRowsBeforeOwnCommit(channelId, committedEpoch) {
+    try {
+      const saved = await this.o.store.load(channelId);
+      if (!saved)
+        return;
+      const atCommitted = new MLSGroupManager2(saved.ciphersuite);
+      atCommitted.importState(saved);
+      if (Number(atCommitted.epoch) !== committedEpoch)
+        return;
+      let rows;
+      for (let attempt = 0; attempt < 2 && !rows; attempt++) {
+        rows = await this.o.backend.pullDelivery(this.o.deviceId).catch(() => void 0);
+      }
+      for (const row of rows ?? []) {
+        if (row.message_type !== "application" || row.connect_channel_id !== channelId)
+          continue;
+        if (this.custody.has(row.queue_id))
+          continue;
+        await this.decryptApplicationRow(row, { lockHeld: true, keyFrom: atCommitted }).catch(() => void 0);
+      }
+    } catch {
+    }
+  }
   /** Delegate so the receive pump can ack without reaching the private backend. */
   async ackDelivery(deviceId, queueIds) {
     await this.o.backend.ackDelivery(deviceId, queueIds);
@@ -5005,6 +6317,12 @@ function describeType(v) {
     return "array";
   return typeof v;
 }
+function isAbsence404(err) {
+  return err instanceof MlsBackendHttpError && err.status === 404;
+}
+function failureFields(err) {
+  return err instanceof MlsBackendHttpError ? { status: err.status } : {};
+}
 function parseGroupRoster(endpoint, channelId, value) {
   if (!Array.isArray(value)) {
     throw new MalformedGroupRosterError(endpoint, channelId, describeType(value));
@@ -5040,7 +6358,7 @@ var RestMlsBackend = class {
   async get(path) {
     const res = await this.f(this.opts.baseUrl + path, { headers: this.headers() });
     if (!res.ok)
-      throw new Error(`${path} failed: ${res.status}`);
+      throw new MlsBackendHttpError(path, res.status);
     return await res.json();
   }
   async getRegisterChallenge() {
@@ -5095,25 +6413,68 @@ var RestMlsBackend = class {
       member_device_ids: parseGroupRoster("init", channelId, j.member_device_ids),
       // Back-compat: servers that predate the created field return nothing;
       // treat absence as true (they always created a fresh group).
-      created: j.created === void 0 ? true : Boolean(j.created)
+      created: j.created === void 0 ? true : Boolean(j.created),
+      // C2 T3b: passed through ONLY as a real boolean. Absent (a backend that
+      // predates the field) or any other type stays undefined, which the
+      // provider reads as ATTESTED (fail closed). Never coerced: `Boolean("false")`
+      // would read a malformed value as attested-true, and a default of `false`
+      // would read a missing one as adoptable.
+      ...typeof j.reset_attested === "boolean" ? { reset_attested: j.reset_attested } : {}
     };
   }
   async reinitConnectChannelGroup() {
     throw new Error("reinitConnectChannelGroup was removed (it minted unattested MLS groups that orphaned channel members permanently). Use resetReinitConnectChannelGroup with an owner attestation.");
   }
+  /**
+   * C2 T3e (item 1): does its own fetch, mirroring {@link distribute}, so a
+   * non-2xx becomes a typed {@link MlsBackendHttpError} instead of a plain
+   * `Error` whose status lives only in a `failed: <status>` message. Before
+   * this, `resetSessionSupersede`'s `isDefiniteReinitRefusal` classified the
+   * outcome by regex-parsing that text, which is safe only as long as
+   * neither `post()` nor the web's `makeAuthedFetch` ever retries this call —
+   * a retry would replay the request and the classifier has no way to know
+   * that happened. Typing the error lets the classifier read `instanceof
+   * MlsBackendHttpError` + `.status` directly, matching every other C2
+   * definite-refusal site (`isSupersededRefusal`, `isEpochConflict`). The
+   * message is `<path> failed: <status>` — no body text (ids stay out of
+   * logs) — which is SHORTER than what `post()` used to throw (that included
+   * the raw response body). PR #681 review: the web's `friendlyResetError`
+   * used to substring-match `surviving_device_exists` /
+   * `reset_member_set_incomplete` / `bad_reset_attestation` out of that body
+   * text; it now reads them off this error's typed `.code` field instead
+   * (with the old substring match kept as a fallback for other error shapes).
+   */
   async resetReinitConnectChannelGroup(channelId, memberDeviceIds, att) {
     const committer = memberDeviceIds[0];
     if (!committer)
       throw new Error("resetReinitConnectChannelGroup: empty member set");
-    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/reinit`, {
-      member_device_ids: memberDeviceIds,
-      committer_device_id: committer,
-      mode: "reset",
-      new_group_id: att.newGroupId,
-      reset_attestation_signature: att.signatureHex,
-      reset_attestation_nonce: att.nonceHex,
-      reset_attestation_content: att.signedContentHex
+    const path = `/api/v1/mls/connect-channels/${channelId}/reinit`;
+    const res = await this.f(this.opts.baseUrl + path, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({
+        member_device_ids: memberDeviceIds,
+        committer_device_id: committer,
+        mode: "reset",
+        new_group_id: att.newGroupId,
+        reset_attestation_signature: att.signatureHex,
+        reset_attestation_nonce: att.nonceHex,
+        reset_attestation_content: att.signedContentHex
+      })
     });
+    if (!res.ok) {
+      let code;
+      let reason;
+      try {
+        const body = JSON.parse(await res.text());
+        code = parseErrorCode(body);
+        const r = body !== null && typeof body === "object" ? body.reason : void 0;
+        reason = typeof r === "string" ? r : void 0;
+      } catch {
+      }
+      throw new MlsBackendHttpError(path, res.status, code, reason);
+    }
+    const j = res.status === 204 ? {} : await res.json();
     return {
       group_id: String(j.group_id),
       current_epoch: Number(j.current_epoch),
@@ -5136,7 +6497,10 @@ var RestMlsBackend = class {
     try {
       const j = await this.get(`/api/v1/mls/key-packages/by-id/${kpId}`);
       return String(j.key_package);
-    } catch {
+    } catch (err) {
+      if (!isAbsence404(err)) {
+        writeServiceLog("warn", "keypackage.by_id_fetch_failed", failureFields(err), err);
+      }
       return null;
     }
   }
@@ -5152,15 +6516,44 @@ var RestMlsBackend = class {
       if (Number.isNaN(ms))
         return null;
       return new Date(ms);
-    } catch {
+    } catch (err) {
+      if (!isAbsence404(err)) {
+        writeServiceLog("warn", "keypackage.expiry_fetch_failed", failureFields(err), err);
+      }
       return null;
     }
   }
+  /**
+   * C2 T3 (spec §4.3): `/distribute` does its own fetch so a non-2xx becomes a
+   * typed {@link MlsBackendHttpError} carrying the body's error `code` (and a
+   * 409's `reason`), which the pending-commit outcome classifier reads. `post()`
+   * is left alone: its other callers keep their current plain-`Error` shape.
+   *
+   * The message is `<path> failed: <status>` with NO body text (ids stay out of
+   * logs; `friendlyResetError` matches the status substring). A network failure
+   * or abort propagates as the fetch threw it, which the classifier reads as
+   * ambiguous. A 2xx resolves whatever its body is (`replayed: true` included):
+   * 2xx means landed, and the SDK never reads the success body.
+   */
   async distribute(groupId, req) {
-    await this.post(`/api/v1/mls/groups/${groupId}/distribute`, {
-      ...req,
-      group_id: groupId
+    const path = `/api/v1/mls/groups/${groupId}/distribute`;
+    const res = await this.f(this.opts.baseUrl + path, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ ...req, group_id: groupId })
     });
+    if (res.ok)
+      return;
+    let code;
+    let reason;
+    try {
+      const body = JSON.parse(await res.text());
+      code = parseErrorCode(body);
+      const r = body !== null && typeof body === "object" ? body.reason : void 0;
+      reason = typeof r === "string" ? r : void 0;
+    } catch {
+    }
+    throw new MlsBackendHttpError(path, res.status, code, reason);
   }
   async pullDelivery(deviceId) {
     const j = await this.get(`/api/v1/mls/delivery?device_id=${deviceId}`);
@@ -5212,7 +6605,8 @@ var RestMlsBackend = class {
     return String(j.token);
   }
   async releaseCommitLease(channelId, token) {
-    await this.f(this.opts.baseUrl + `/api/v1/mls/connect-channels/${channelId}/commit-lease/release`, { method: "POST", headers: this.headers(), body: JSON.stringify({ token }) }).catch(() => {
+    await this.f(this.opts.baseUrl + `/api/v1/mls/connect-channels/${channelId}/commit-lease/release`, { method: "POST", headers: this.headers(), body: JSON.stringify({ token }) }).catch((err) => {
+      writeServiceLog("warn", "committer.lease_release_failed", {}, err);
     });
   }
   async fetchResetAttestation(groupId) {
@@ -5223,7 +6617,10 @@ var RestMlsBackend = class {
         signatureHex: String(j.signature_hex),
         signerIdentityId: String(j.signer_identity_id)
       };
-    } catch {
+    } catch (err) {
+      if (!isAbsence404(err)) {
+        writeServiceLog("warn", "supersede.attestation_fetch_failed", failureFields(err), err);
+      }
       return null;
     }
   }
@@ -5231,6 +6628,7 @@ var RestMlsBackend = class {
 
 // ../connect-sdk-ts/dist/mls/fake-backend.js
 import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes2 } from "@agentvault/crypto";
+var DELIVERY_PULL_LIMIT = 100;
 var FakeConnectBackend = class _FakeConnectBackend {
   // Key-package store: deviceId → hex-encoded KeyPackage
   kps = /* @__PURE__ */ new Map();
@@ -5361,7 +6759,10 @@ var FakeConnectBackend = class _FakeConnectBackend {
       // Real semantics: created=true on first call (group was just created),
       // created=false on idempotent return (group already existed). Without
       // this, race tests silently pass wrong (fake is laxer than the server).
-      created: !alreadyExists
+      created: !alreadyExists,
+      // C2 T3b: mirrors T1b's `reset_attested` (the group carries an owner
+      // reset attestation). Always present, as T1b's field has no default.
+      reset_attested: this.resetAttestations.has(groupId)
     };
   }
   async reinitConnectChannelGroup(channelId, memberDeviceIds) {
@@ -5429,16 +6830,58 @@ var FakeConnectBackend = class _FakeConnectBackend {
       }))
     };
   }
+  /** C2 T3: every `/distribute` request, in order, including resends and
+   *  injected failures, so a test can assert exactly what was sent. */
+  distributeCalls = [];
+  /** C2 T3: one fault per upcoming `distribute` call, FIFO. See
+   *  {@link failNextDistribute}. */
+  distributeFaults = [];
+  /**
+   * C2 T3 test seam: make the NEXT `distribute` call fail once.
+   *  - `{status, code?, reason?}`: a typed `MlsBackendHttpError`, exactly what
+   *    `RestMlsBackend.distribute` throws for that response body.
+   *  - `{network: true}`: a `TypeError`, what `fetch` throws on a network
+   *    failure.
+   *  - `afterApply: true` on either: the commit is APPLIED first (it landed)
+   *    and the failure is what the client sees, i.e. a lost 2xx.
+   * Call it several times to queue several faults.
+   */
+  failNextDistribute(fault) {
+    this.distributeFaults.push(fault);
+  }
+  static distributePath(groupId) {
+    return `/api/v1/mls/groups/${groupId}/distribute`;
+  }
   async distribute(groupId, req) {
+    this.distributeCalls.push({ groupId, req: structuredClone(req) });
+    const fault = this.distributeFaults.shift();
+    if (fault && !fault.afterApply)
+      throw _FakeConnectBackend.faultError(groupId, fault);
+    await this.distributeApply(groupId, req);
+    if (fault)
+      throw _FakeConnectBackend.faultError(groupId, fault);
+  }
+  static faultError(groupId, fault) {
+    if ("network" in fault)
+      return new TypeError("fetch failed");
+    return new MlsBackendHttpError(_FakeConnectBackend.distributePath(groupId), fault.status, fault.code, fault.reason);
+  }
+  async distributeApply(groupId, req) {
     const channelId = this.channelByGroup.get(groupId);
     if (!channelId)
       throw new Error(`FakeConnectBackend.distribute: unknown group ${groupId}`);
+    if (req.commit) {
+      const hit = (this.commitLog.get(groupId) ?? []).some((c) => c.epoch === Number(req.commit_epoch ?? 0) && c.sender_device_id === String(req.device_id ?? "") && c.payload === String(req.commit));
+      if (hit)
+        return;
+    }
+    if (req.commit && this.groupIdByChannel.get(channelId) !== groupId) {
+      throw new MlsBackendHttpError(_FakeConnectBackend.distributePath(groupId), 409, "EPOCH_CONFLICT", "superseded");
+    }
     if (req.commit && req.expected_epoch != null) {
       const current = this.epochByChannel.get(channelId) ?? 0;
       if (req.expected_epoch !== current) {
-        const e = new Error(`connect backend post failed: 409 EPOCH_CONFLICT (expected ${req.expected_epoch}, current ${current})`);
-        e.status = 409;
-        throw e;
+        throw new MlsBackendHttpError(_FakeConnectBackend.distributePath(groupId), 409, "EPOCH_CONFLICT", "stale_epoch");
       }
     }
     if (req.commit) {
@@ -5501,7 +6944,7 @@ var FakeConnectBackend = class _FakeConnectBackend {
     }
   }
   async pullDelivery(deviceId) {
-    return this.queues.get(deviceId) ?? [];
+    return (this.queues.get(deviceId) ?? []).slice(0, DELIVERY_PULL_LIMIT);
   }
   async ackDelivery(deviceId, queueIds) {
     const queue = this.queues.get(deviceId);
@@ -5684,8 +7127,10 @@ import { DatabaseSync } from "node:sqlite";
 import { MLSGroupManager as MLSGroupManager3, bytesToHex as bytesToHex4, hexToBytes as hexToBytes3 } from "@agentvault/crypto";
 
 // ../connect-mls-store/dist/schema.js
-var SCHEMA_VERSION = 7;
+var SCHEMA_VERSION = 9;
+var BUSY_TIMEOUT_MS = 5e3;
 function openSchema(db) {
+  db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);
   db.exec("PRAGMA journal_mode=WAL");
   const row = db.prepare("PRAGMA user_version").get();
   if (row.user_version === 0) {
@@ -5787,8 +7232,58 @@ function openSchema(db) {
       );
     `);
   }
+  if (row.user_version < 8) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS runtime_inbox (
+        seq            INTEGER PRIMARY KEY AUTOINCREMENT,
+        identity_id    TEXT NOT NULL,
+        message_id     TEXT NOT NULL,
+        sealed_message BLOB NOT NULL,
+        received_at    INTEGER NOT NULL,
+        UNIQUE (identity_id, message_id)
+      );
+    `);
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS runtime_reply_receipt (
+        identity_id     TEXT NOT NULL,
+        in_reply_to     TEXT NOT NULL,
+        channel_id      TEXT NOT NULL,
+        reply_message_id TEXT NOT NULL,
+        replied_at      INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, in_reply_to)
+      );
+    `);
+  }
+  if (row.user_version < 9) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS mls_pending_commit (
+        identity_id    TEXT NOT NULL,
+        channel_id     TEXT NOT NULL,
+        sealed_state   BLOB NOT NULL,
+        sealed_request BLOB NOT NULL,
+        created_at     INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, channel_id)
+      );
+    `);
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS mls_owed_followup (
+        identity_id     TEXT NOT NULL,
+        channel_id      TEXT NOT NULL,
+        sealed_followup BLOB NOT NULL,
+        created_at      INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, channel_id)
+      );
+    `);
+  }
+  ensureRuntimeInboxDeliveryAttempts(db);
   db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
 }
+function ensureRuntimeInboxDeliveryAttempts(db) {
+  const cols = db.prepare("PRAGMA table_info(runtime_inbox)").all();
+  if (cols.length === 0 || cols.some((c) => c.name === "delivery_attempts"))
+    return;
+  db.exec("ALTER TABLE runtime_inbox ADD COLUMN delivery_attempts INTEGER NOT NULL DEFAULT 0");
+}
 
 // ../connect-mls-store/dist/errors.js
 var MlsStoreCorruptError = class extends Error {
@@ -5826,10 +7321,24 @@ function decodeBundle(bytes) {
     }
   };
 }
+function sameRow(a, b) {
+  if (!a || !b)
+    return a === b;
+  return Buffer.compare(a.sealed_state, b.sealed_state) === 0 && Buffer.compare(a.sealed_request, b.sealed_request) === 0 && Number(a.created_at) === Number(b.created_at);
+}
+function sameBytes(a, b) {
+  if (!a || !b)
+    return a === b;
+  return Buffer.compare(a, b) === 0;
+}
+function sameTag(prior, tag) {
+  return prior !== null && prior.groupId === tag.groupId && prior.epoch === tag.epoch;
+}
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_MEMORY_RETENTION_MS = 30 * DAY_MS;
 var DEFAULT_MEMORY_FACT_RETENTION_K = 200;
 var DEFAULT_MEMORY_FACT_RETENTION_MS = 90 * DAY_MS;
+var RUNTIME_REPLY_RECEIPT_MAX = 5e3;
 var SqliteMlsStateStore = class {
   db;
   id;
@@ -5894,6 +7403,9 @@ var SqliteMlsStateStore = class {
     return this.cipher.seal(new TextEncoder().encode(JSON.stringify(state)));
   }
   async unseal(blob) {
+    return this.unsealJson(blob);
+  }
+  async unsealJson(blob) {
     let bytes;
     try {
       bytes = await this.cipher.open(blob);
@@ -5963,7 +7475,7 @@ var SqliteMlsStateStore = class {
     try {
       bundle = decodeBundle(await this.cipher.open(row.sealed_bundle));
     } catch (e) {
-      console.warn(`[trace] loadPendingBundle: unseal/decode FAILED for ref ${ref.slice(0, 8)}: ${e?.message}`);
+      writeServiceLog("warn", "store.pending_bundle_open_failed", {}, e);
       return null;
     }
     this.bundles.set(ref, bundle);
@@ -6078,6 +7590,96 @@ var SqliteMlsStateStore = class {
     const rows = this.db.prepare("SELECT DISTINCT enclave_id FROM channel_meta WHERE identity_id=? AND enclave_id IS NOT NULL").all(this.id);
     return rows.map((r) => r.enclave_id);
   }
+  /**
+   * Commit one decrypted daemon→runtime frame before the backend delivery row
+   * is acknowledged. The payload is sealed at rest. A redelivery is opened and
+   * compared so a same-id/different-payload collision becomes a loud refusal
+   * without persisting a plaintext-derived digest.
+   */
+  async stageRuntimeInbox(messageId, payload, receivedAt = Date.now()) {
+    const prior = this.db.prepare("SELECT sealed_message FROM runtime_inbox WHERE identity_id=? AND message_id=?").get(this.id, messageId);
+    if (prior) {
+      const priorPayload = await this.openRuntimeInboxPayload(prior.sealed_message);
+      if (!Buffer.from(priorPayload).equals(Buffer.from(payload))) {
+        throw new Error("runtime inbox message-id payload conflict");
+      }
+      return false;
+    }
+    const sealed = await this.cipher.seal(payload);
+    const info = this.db.prepare(`INSERT OR IGNORE INTO runtime_inbox
+         (identity_id, message_id, sealed_message, received_at)
+       VALUES (?, ?, ?, ?)`).run(this.id, messageId, sealed, receivedAt);
+    if (info.changes === 0) {
+      const raced = this.db.prepare("SELECT sealed_message FROM runtime_inbox WHERE identity_id=? AND message_id=?").get(this.id, messageId);
+      const racedPayload = await this.openRuntimeInboxPayload(raced.sealed_message);
+      if (!Buffer.from(racedPayload).equals(Buffer.from(payload))) {
+        throw new Error("runtime inbox message-id payload conflict");
+      }
+      return false;
+    }
+    return true;
+  }
+  async loadRuntimeInbox() {
+    const rows = this.db.prepare(`SELECT message_id, sealed_message, received_at, delivery_attempts
+       FROM runtime_inbox WHERE identity_id=? ORDER BY seq ASC`).all(this.id);
+    const out = [];
+    for (const row of rows) {
+      const payload = await this.openRuntimeInboxPayload(row.sealed_message);
+      out.push({
+        messageId: row.message_id,
+        payload,
+        receivedAt: row.received_at,
+        deliveryAttempts: Number(row.delivery_attempts)
+      });
+    }
+    return out;
+  }
+  /**
+   * Count one delivery of a staged runtime frame and return the new total.
+   * Returns 0 when the message is not staged (already acknowledged, or never
+   * durably handed off), so the caller can fall back to a process-local count.
+   * Content-free: only the counter changes, never the sealed payload.
+   */
+  noteRuntimeInboxDelivery(messageId) {
+    const row = this.db.prepare(`UPDATE runtime_inbox SET delivery_attempts = delivery_attempts + 1
+       WHERE identity_id=? AND message_id=?
+       RETURNING delivery_attempts`).get(this.id, messageId);
+    return row ? Number(row.delivery_attempts) : 0;
+  }
+  async openRuntimeInboxPayload(sealed) {
+    try {
+      return await this.cipher.open(sealed);
+    } catch (error) {
+      throw new MlsStoreSealError(String(error?.message ?? error));
+    }
+  }
+  ackRuntimeInbox(messageId) {
+    return this.db.prepare("DELETE FROM runtime_inbox WHERE identity_id=? AND message_id=?").run(this.id, messageId).changes === 1;
+  }
+  recordRuntimeReplyReceipt(inReplyTo, channelId, replyMessageId, repliedAt = Date.now()) {
+    this.db.prepare(`INSERT INTO runtime_reply_receipt
+         (identity_id, in_reply_to, channel_id, reply_message_id, replied_at)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(identity_id, in_reply_to) DO UPDATE SET
+         channel_id=excluded.channel_id,
+         reply_message_id=excluded.reply_message_id,
+         replied_at=excluded.replied_at`).run(this.id, inReplyTo, channelId, replyMessageId, repliedAt);
+    const receiptCount = this.db.prepare("SELECT COUNT(*) AS n FROM runtime_reply_receipt WHERE identity_id=?").get(this.id);
+    if (receiptCount.n > RUNTIME_REPLY_RECEIPT_MAX) {
+      this.db.prepare(`DELETE FROM runtime_reply_receipt
+         WHERE identity_id=? AND rowid IN (
+           SELECT rowid FROM runtime_reply_receipt
+           WHERE identity_id=?
+           ORDER BY replied_at DESC, rowid DESC
+           LIMIT -1 OFFSET ?
+         )`).run(this.id, this.id, RUNTIME_REPLY_RECEIPT_MAX);
+    }
+    return { in_reply_to: inReplyTo, channel_id: channelId, reply_message_id: replyMessageId, replied_at: repliedAt };
+  }
+  runtimeReplyReceipt(inReplyTo) {
+    return this.db.prepare(`SELECT in_reply_to, channel_id, reply_message_id, replied_at
+       FROM runtime_reply_receipt WHERE identity_id=? AND in_reply_to=?`).get(this.id, inReplyTo) ?? null;
+  }
   async recordMemory(input) {
     const dedupKey = input.messageId ?? input.idempotencyKey ?? null;
     if (!dedupKey)
@@ -6203,6 +7805,231 @@ var SqliteMlsStateStore = class {
       }
     }
   }
+  // ── C2 pending commit (schema v9) ─────────────────────────────────────
+  // One sealed record per (identity, channel) in mls_pending_commit, and the
+  // owed follow-up slot of a landed commit in mls_owed_followup. The
+  // reference semantics are InMemoryMlsStateStore (connect-sdk-ts
+  // src/mls/store.ts); the shared conformance suite pins them.
+  //
+  // THE AWAIT TRAP. seal/open are async. An await inside an open
+  // DatabaseSync transaction lets another async call on this connection run
+  // statements inside it, and another process can write between any read
+  // and BEGIN. So every guarded method reads the record bytes, does ALL of
+  // its crypto, and only then runs BEGIN IMMEDIATE, re-reads the record and
+  // compares BYTES with what it read before the await (a reseal of the same
+  // content has new bytes, so any rewrite is seen). Mismatch → ROLLBACK and
+  // retry the whole method once; a second mismatch refuses. Inside the
+  // transaction there is no await, so the decision and the write are one
+  // step against every writer (MEDIUM-1).
+  async sealJson(v) {
+    return this.cipher.seal(new TextEncoder().encode(JSON.stringify(v)));
+  }
+  readPendingRow(channelId) {
+    return this.db.prepare("SELECT sealed_state, sealed_request, created_at FROM mls_pending_commit WHERE identity_id=? AND channel_id=?").get(this.id, channelId);
+  }
+  async openPendingRow(row) {
+    const meta = await this.unsealJson(row.sealed_request);
+    const state = await this.unseal(row.sealed_state);
+    const rec = {
+      groupId: meta.groupId,
+      op: meta.op,
+      request: meta.request,
+      state,
+      commitEpoch: meta.commitEpoch,
+      prior: meta.prior,
+      createdAt: Number(row.created_at)
+    };
+    if (meta.followUp !== void 0)
+      rec.followUp = meta.followUp;
+    return rec;
+  }
+  /** Run `fn` inside BEGIN IMMEDIATE. `fn` is synchronous by type: nothing
+   *  can interleave with it. Any throw rolls back and propagates. */
+  immediate(fn) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const result = fn();
+      this.db.exec("COMMIT");
+      return result;
+    } catch (e) {
+      this.db.exec("ROLLBACK");
+      throw e;
+    }
+  }
+  async savePendingCommit(channelId, rec, opts) {
+    assertPendingCommitShape(rec);
+    const meta = {
+      groupId: rec.groupId,
+      op: rec.op,
+      request: rec.request,
+      commitEpoch: rec.commitEpoch,
+      prior: rec.prior,
+      followUp: rec.followUp
+    };
+    const sealedState = await this.seal(rec.state);
+    const sealedRequest = await this.sealJson(meta);
+    if (opts?.replacing) {
+      for (let attempt = 0; attempt < 2; attempt++) {
+        const row = this.readPendingRow(channelId);
+        if (!row)
+          return false;
+        if (!matchesPendingCommitKey(await this.openPendingRow(row), opts.replacing))
+          return false;
+        const outcome = this.immediate(() => {
+          if (!sameRow(row, this.readPendingRow(channelId)))
+            return "retry";
+          this.db.prepare(`UPDATE mls_pending_commit SET sealed_state=?, sealed_request=?, created_at=?
+             WHERE identity_id=? AND channel_id=?`).run(sealedState, sealedRequest, rec.createdAt, this.id, channelId);
+          return "written";
+        });
+        if (outcome === "written")
+          return true;
+      }
+      throw new PendingCommitUnresolvedError(channelId);
+    }
+    const res = this.db.prepare(opts?.onlyIfAbsent ? `INSERT INTO mls_pending_commit (identity_id, channel_id, sealed_state, sealed_request, created_at)
+           VALUES (?,?,?,?,?)
+           ON CONFLICT(identity_id, channel_id) DO NOTHING` : `INSERT INTO mls_pending_commit (identity_id, channel_id, sealed_state, sealed_request, created_at)
+           VALUES (?,?,?,?,?)
+           ON CONFLICT(identity_id, channel_id) DO UPDATE SET
+             sealed_state=excluded.sealed_state, sealed_request=excluded.sealed_request, created_at=excluded.created_at`).run(this.id, channelId, sealedState, sealedRequest, rec.createdAt);
+    return Number(res.changes) > 0;
+  }
+  async loadPendingCommit(channelId) {
+    const row = this.readPendingRow(channelId);
+    return row ? this.openPendingRow(row) : null;
+  }
+  async listPendingCommits() {
+    const rows = this.db.prepare(`SELECT channel_id, sealed_state, sealed_request, created_at FROM mls_pending_commit
+       WHERE identity_id=? ORDER BY channel_id`).all(this.id);
+    const out = [];
+    for (const row of rows)
+      out.push({ channelId: row.channel_id, rec: await this.openPendingRow(row) });
+    return out;
+  }
+  readMainBytes(channelId) {
+    const row = this.db.prepare("SELECT sealed_main FROM mls_group_state WHERE identity_id=? AND channel_id=?").get(this.id, channelId);
+    return row?.sealed_main ?? void 0;
+  }
+  /**
+   * C2 T3c (security review C1): promote ONLY the expected record, and only
+   * while MAIN is exactly the state the caller checked against its `prior`.
+   * Both checks are decided on bytes read BEFORE the await (the record opened
+   * and matched on its key; MAIN unsealed and compared to `expect.main`) and
+   * then re-proven INSIDE `BEGIN IMMEDIATE` by byte-comparing both rows, so
+   * no writer in this or another process can slip between check and write.
+   */
+  async commitPending(channelId, expect) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const row = this.readPendingRow(channelId);
+      if (!row)
+        return "record_mismatch";
+      const rec = await this.openPendingRow(row);
+      if (!matchesPendingCommitKey(rec, expect))
+        return "record_mismatch";
+      const mainBytes = this.readMainBytes(channelId);
+      const main = mainBytes ? await this.unseal(mainBytes) : null;
+      if (!sameMainState(main, expect.main))
+        return "main_moved";
+      const sealedOwed = rec.followUp ? await this.sealJson({ op: rec.op, followUp: rec.followUp }) : null;
+      const done = this.immediate(() => {
+        if (!sameRow(row, this.readPendingRow(channelId)))
+          return false;
+        if (!sameBytes(mainBytes, this.readMainBytes(channelId)))
+          return false;
+        this.db.prepare(`INSERT INTO mls_group_state (identity_id, channel_id, sealed_main, updated_at)
+           VALUES (?,?,?,?)
+           ON CONFLICT(identity_id, channel_id) DO UPDATE SET sealed_main=excluded.sealed_main, updated_at=excluded.updated_at`).run(this.id, channelId, row.sealed_state, Date.now());
+        this.db.prepare("DELETE FROM mls_pending_commit WHERE identity_id=? AND channel_id=?").run(this.id, channelId);
+        if (sealedOwed) {
+          this.db.prepare(`INSERT INTO mls_owed_followup (identity_id, channel_id, sealed_followup, created_at)
+             VALUES (?,?,?,?)
+             ON CONFLICT(identity_id, channel_id) DO UPDATE SET
+               sealed_followup=excluded.sealed_followup, created_at=excluded.created_at`).run(this.id, channelId, sealedOwed, rec.createdAt);
+        }
+        return true;
+      });
+      if (done)
+        return "committed";
+    }
+    throw new PendingCommitUnresolvedError(channelId);
+  }
+  /** C2 T3c (C1): with `expect`, delete only the record carrying that key
+   *  (matched on the opened record, re-proven by byte-compare inside
+   *  `BEGIN IMMEDIATE`); without it, delete whatever is there (the owner's
+   *  abandon, which must work even when the record does not unseal). */
+  async clearPendingCommit(channelId, expect) {
+    if (!expect) {
+      const res = this.db.prepare("DELETE FROM mls_pending_commit WHERE identity_id=? AND channel_id=?").run(this.id, channelId);
+      return Number(res.changes) > 0;
+    }
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const row = this.readPendingRow(channelId);
+      if (!row)
+        return false;
+      const rec = await this.openPendingRow(row);
+      if (!matchesPendingCommitKey(rec, expect))
+        return false;
+      const outcome = this.immediate(() => {
+        if (!sameRow(row, this.readPendingRow(channelId)))
+          return "retry";
+        this.db.prepare("DELETE FROM mls_pending_commit WHERE identity_id=? AND channel_id=?").run(this.id, channelId);
+        return "deleted";
+      });
+      if (outcome === "deleted")
+        return true;
+    }
+    throw new PendingCommitUnresolvedError(channelId);
+  }
+  async saveMainGuarded(channelId, state, tag) {
+    let row = this.readPendingRow(channelId);
+    const sealedMain = await this.seal(state);
+    for (let attempt = 0; attempt < 2; attempt++) {
+      if (attempt > 0)
+        row = this.readPendingRow(channelId);
+      const prior = row ? (await this.unsealJson(row.sealed_request)).prior : void 0;
+      const outcome = this.immediate(() => {
+        if (!sameRow(row, this.readPendingRow(channelId)))
+          return "retry";
+        if (row && !sameTag(prior ?? null, tag))
+          return "refused";
+        this.db.prepare(`INSERT INTO mls_group_state (identity_id, channel_id, sealed_main, updated_at)
+           VALUES (?,?,?,?)
+           ON CONFLICT(identity_id, channel_id) DO UPDATE SET sealed_main=excluded.sealed_main, updated_at=excluded.updated_at`).run(this.id, channelId, sealedMain, Date.now());
+        return "written";
+      });
+      if (outcome === "written")
+        return;
+      if (outcome === "refused")
+        throw new PendingCommitUnresolvedError(channelId);
+    }
+    throw new PendingCommitUnresolvedError(channelId);
+  }
+  async listOwedFollowUps() {
+    const rows = this.db.prepare(`SELECT channel_id, sealed_followup, created_at FROM mls_owed_followup
+       WHERE identity_id=? ORDER BY channel_id`).all(this.id);
+    const out = [];
+    for (const row of rows) {
+      const o = await this.unsealJson(row.sealed_followup);
+      out.push({ channelId: row.channel_id, owed: { op: o.op, followUp: o.followUp, createdAt: Number(row.created_at) } });
+    }
+    return out;
+  }
+  /** C2 T3c (M2): one channel's slot, so another channel's unreadable slot
+   *  cannot fail this read. */
+  async getOwedFollowUp(channelId) {
+    const row = this.db.prepare("SELECT sealed_followup, created_at FROM mls_owed_followup WHERE identity_id=? AND channel_id=?").get(this.id, channelId);
+    if (!row)
+      return null;
+    const o = await this.unsealJson(row.sealed_followup);
+    return { op: o.op, followUp: o.followUp, createdAt: Number(row.created_at) };
+  }
+  /** C2 T3c (M1): with `expectCreatedAt`, delete only that slot, in ONE
+   *  statement (a newer slot written meanwhile has another created_at). */
+  async clearOwedFollowUp(channelId, expectCreatedAt) {
+    const res = expectCreatedAt === void 0 ? this.db.prepare("DELETE FROM mls_owed_followup WHERE identity_id=? AND channel_id=?").run(this.id, channelId) : this.db.prepare("DELETE FROM mls_owed_followup WHERE identity_id=? AND channel_id=? AND created_at=?").run(this.id, channelId, expectCreatedAt);
+    return Number(res.changes) > 0;
+  }
   /** @internal test-only */
   _rawMainForTest(identityId, channelId) {
     const row = this.db.prepare("SELECT sealed_main FROM mls_group_state WHERE identity_id=? AND channel_id=?").get(identityId, channelId);
@@ -6299,12 +8126,13 @@ var LatencyRecorder = class {
 };
 
 // src/coordination.ts
+var TRAILING_PUNCT = /[^\w]+$/;
 function parseMentions(text) {
   const mentions = [];
-  const re = /@(\w[\w]*)/gi;
+  const re = /@(\w[\w.-]*)/g;
   let match;
   while ((match = re.exec(text)) !== null) {
-    mentions.push(match[1].toLowerCase());
+    mentions.push(match[1].replace(TRAILING_PUNCT, "").toLowerCase());
   }
   return mentions;
 }
@@ -6314,21 +8142,84 @@ function ownRoomNames(agentName, accountId, roomDisplayName) {
     if (!n) return;
     const lower = n.toLowerCase();
     names.add(lower);
-    names.add(lower.split(/[\s(]/)[0]);
+    const first = lower.split(/[\s(]/)[0];
+    names.add(first);
+    const trimmed = first.replace(TRAILING_PUNCT, "");
+    if (trimmed) names.add(trimmed);
   };
   add(agentName);
   add(accountId);
   add(roomDisplayName);
   return names;
 }
+var DEFAULT_MAX_AGENT_HOPS = 3;
+function agentHopAllowed(agentHops, maxAgentHops = DEFAULT_MAX_AGENT_HOPS) {
+  return agentHops < maxAgentHops;
+}
 function shouldProcessRoomMessage(plaintext, agentName, accountId, opts) {
   const mentions = parseMentions(plaintext);
+  const ownNames = ownRoomNames(agentName, accountId, opts?.roomDisplayName);
+  const mentionsMe = mentions.some((m) => ownNames.has(m));
+  if (opts?.senderIsAgent === true) {
+    if (!mentionsMe) return false;
+    return agentHopAllowed(opts.agentHops ?? 1, opts.maxAgentHops);
+  }
   if (mentions.length === 0) return true;
   if (mentions.includes("all") || mentions.includes("everyone")) return true;
-  const ownNames = ownRoomNames(agentName, accountId, opts?.roomDisplayName);
-  if (mentions.some((m) => ownNames.has(m))) return true;
+  if (mentionsMe) return true;
   return false;
 }
+var AGENT_HOP_QUIET_MS = 10 * 6e4;
+var AgentHopTracker = class {
+  constructor(maxChannels = 1e4, opts = {}) {
+    this.maxChannels = maxChannels;
+    this.now = opts.now ?? (() => Date.now());
+    this.quietMs = opts.quietMs ?? AGENT_HOP_QUIET_MS;
+  }
+  hops = /* @__PURE__ */ new Map();
+  now;
+  quietMs;
+  /** Record an inbound message; returns the consecutive agent hops including it. */
+  noteInbound(channelId, senderIsAgent) {
+    if (senderIsAgent !== true) {
+      this.set(channelId, { count: 0, lastAgentAt: 0 });
+      return 0;
+    }
+    return this.bump(channelId);
+  }
+  /**
+   * Record one of this agent's own SUBSTANTIVE sends (an agent turn in the
+   * channel). Callers do not report status frames, daily-limit or dead-letter
+   * notices, or continuation parts of one multi-part reply.
+   */
+  noteOwnSend(channelId) {
+    this.bump(channelId);
+  }
+  size() {
+    return this.hops.size;
+  }
+  bump(channelId) {
+    const now = this.now();
+    const prev = this.hops.get(channelId);
+    const base = prev && prev.count > 0 && now - prev.lastAgentAt < this.quietMs ? prev.count : 0;
+    const count = base + 1;
+    this.set(channelId, { count, lastAgentAt: now });
+    return count;
+  }
+  set(channelId, value) {
+    this.hops.delete(channelId);
+    this.hops.set(channelId, value);
+    if (this.hops.size > this.maxChannels) {
+      const oldest = this.hops.keys().next();
+      if (!oldest.done) this.hops.delete(oldest.value);
+    }
+  }
+};
+function isAgentTurn(receipts, frame) {
+  if (frame.notice === true) return false;
+  if (typeof frame.in_reply_to === "string" && receipts.runtimeReplyReceipt(frame.in_reply_to)) return false;
+  return true;
+}
 
 // src/rate-limit.ts
 var TokenBucketFloor = class {
@@ -6389,12 +8280,49 @@ var TokenBucketFloor = class {
   }
 };
 
+// src/service-log.ts
+var TOKEN2 = /^[a-z][a-z0-9_.-]{0,63}$/;
+var CLASS2 = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
+function errorClass2(error) {
+  if (error === null) return "NullThrown";
+  if (typeof error !== "object" && typeof error !== "function") {
+    const primitive = {
+      string: "StringThrown",
+      number: "NumberThrown",
+      boolean: "BooleanThrown",
+      bigint: "BigIntThrown",
+      symbol: "SymbolThrown",
+      undefined: "UndefinedThrown"
+    };
+    return primitive[typeof error] ?? "UnknownThrown";
+  }
+  try {
+    const name = Object.getPrototypeOf(error)?.constructor?.name;
+    return typeof name === "string" && CLASS2.test(name) ? name : "Error";
+  } catch {
+    return "Error";
+  }
+}
+function formatServiceLog2(level, event, fields = {}, error) {
+  const safeEvent = TOKEN2.test(event) ? event : "invalid_event";
+  const parts = [`[bridge] ${level} ${safeEvent}`];
+  for (const [key, value] of Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!TOKEN2.test(key)) continue;
+    if (typeof value === "boolean") parts.push(`${key}=${value}`);
+    else if (typeof value === "number" && Number.isFinite(value)) parts.push(`${key}=${value}`);
+  }
+  if (error !== void 0) parts.push(`error_class=${errorClass2(error)}`);
+  return parts.join(" ");
+}
+function writeServiceLog2(level, event, fields, error) {
+  const line = formatServiceLog2(level, event, fields, error);
+  process.stderr.write(`${line}
+`);
+}
+
 // src/decrypt-error-log-limiter.ts
 var DEFAULT_DECRYPT_ERROR_LOG_WINDOW_MS = 6e4;
 var MAX_DISTINCT_PER_WINDOW = 4;
-function normalizeMessage(m) {
-  return m.replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "<id>").replace(/[0-9a-f]{16,}/gi, "<hex>");
-}
 var DecryptErrorLogLimiter = class {
   windowMs;
   now;
@@ -6403,63 +8331,56 @@ var DecryptErrorLogLimiter = class {
   constructor(opts = {}) {
     this.windowMs = opts.windowMs ?? DEFAULT_DECRYPT_ERROR_LOG_WINDOW_MS;
     this.now = opts.now ?? Date.now;
-    this.log = opts.log ?? ((line) => console.warn(line));
+    this.log = opts.log ?? writeServiceLog2;
   }
-  /**
-   * Record one decrypt error for `channelId`. Logs immediately if this is
-   * the channel's first error since its window opened (or its prior window
-   * had already elapsed, in which case a summary for that just-closed
-   * window is flushed first); otherwise the error is counted silently
-   * toward the window's eventual summary line.
-   */
   record(channelId, info) {
     const t = this.now();
+    const kind = errorClass2(info.error);
     const w = this.windows.get(channelId);
     if (!w) {
-      this.logFirst(channelId, info);
-      this.windows.set(channelId, { windowStart: t, count: 1, lastEpoch: info.epoch, lastMessage: info.message, loggedKeys: /* @__PURE__ */ new Set([normalizeMessage(info.message)]) });
+      this.logFirst(info);
+      this.windows.set(channelId, {
+        windowStart: t,
+        count: 1,
+        lastEpoch: info.epoch,
+        loggedClasses: /* @__PURE__ */ new Set([kind])
+      });
       return;
     }
     if (t - w.windowStart >= this.windowMs) {
-      this.flushSummary(channelId, w);
-      this.logFirst(channelId, info);
-      this.windows.set(channelId, { windowStart: t, count: 1, lastEpoch: info.epoch, lastMessage: info.message, loggedKeys: /* @__PURE__ */ new Set([normalizeMessage(info.message)]) });
+      this.flushSummary(w);
+      this.logFirst(info);
+      this.windows.set(channelId, {
+        windowStart: t,
+        count: 1,
+        lastEpoch: info.epoch,
+        loggedClasses: /* @__PURE__ */ new Set([kind])
+      });
       return;
     }
     w.count += 1;
     w.lastEpoch = info.epoch;
-    w.lastMessage = info.message;
-    const key = normalizeMessage(info.message);
-    if (!w.loggedKeys.has(key) && w.loggedKeys.size < MAX_DISTINCT_PER_WINDOW) {
-      this.logFirst(channelId, info);
-      w.loggedKeys.add(key);
+    if (!w.loggedClasses.has(kind) && w.loggedClasses.size < MAX_DISTINCT_PER_WINDOW) {
+      this.logFirst(info);
+      w.loggedClasses.add(kind);
     }
   }
-  /**
-   * Clear a channel's window (e.g. once the caller learns the channel
-   * cleared/healed) so its NEXT error logs immediately as a fresh "first"
-   * rather than being folded into a stale window's summary. There is
-   * currently no onDecryptSuccess-style hook from the SDK to wire this to
-   * automatically (see bridge-agent.ts's onDecryptError wiring comment) —
-   * exposed here so a future success signal (or a caller with its own
-   * channel-cleared signal) can reset explicitly. In its absence, the
-   * window simply rolls over on interval elapse, which is an accepted
-   * simplification (see report).
-   */
   reset(channelId) {
     this.windows.delete(channelId);
   }
-  logFirst(channelId, info) {
-    this.log(
-      `[bridge] decrypt error on channel ${channelId} (queue ${info.queueId ?? "?"}, epoch ${info.epoch ?? "?"}): ${info.message}`
-    );
+  logFirst(info) {
+    const fields = {};
+    if (typeof info.epoch === "number" && Number.isFinite(info.epoch)) fields.epoch = info.epoch;
+    this.log("warn", "decrypt.failed", fields, info.error);
   }
-  flushSummary(channelId, w) {
+  flushSummary(w) {
     if (w.count <= 1) return;
-    const seconds = Math.round(this.windowMs / 1e3);
-    this.log(
-      `[bridge] decrypt errors on channel ${channelId}: ${w.count} in last ${seconds}s (epoch ${w.lastEpoch ?? "?"}, ${w.lastMessage})`
-    );
+    const fields = {
+      count: w.count,
+      window_seconds: Math.round(this.windowMs / 1e3)
+    };
+    if (typeof w.lastEpoch === "number" && Number.isFinite(w.lastEpoch)) fields.epoch = w.lastEpoch;
+    this.log("warn", "decrypt.suppressed", fields);
   }
 };
 
@@ -6663,8 +8584,7 @@ var HermesMemoryProvider = class {
     try {
       this.store.probeWrite();
     } catch (e) {
-      process.stderr.write(`[bridge] HERMES MEMORY WRITE-BACK NON-FUNCTIONAL (schema probe failed): ${String(e)}
-`);
+      writeServiceLog2("error", "memory.hermes_writeback_unavailable", {}, e);
     }
   }
   store;
@@ -7357,9 +9277,7 @@ function parseSummarizeBody(parsed, selfIdentityId, log = () => {
     return null;
   }
   if (typeof body.requested_by !== "string" || body.requested_by !== transcript.host_identity_id) {
-    log(
-      `summarize_not_host: ${String(body.requested_by)} is not the host of ${body.transcript_message_id}`
-    );
+    log("warn", "summarize.requester_not_host");
     return null;
   }
   return {
@@ -7414,9 +9332,8 @@ async function runSummarize(opts) {
     );
   } catch (e) {
     const aborted = controller.signal.aborted;
-    opts.log(
-      aborted ? `summarize_timeout after ${timeoutMs}ms for ${opts.request.transcriptMessageId}` : `summarize_failed for ${opts.request.transcriptMessageId}: ${String(e)}`
-    );
+    if (aborted) opts.log("warn", "summarize.timeout", { timeout_ms: timeoutMs });
+    else opts.log("warn", "summarize.failed", {}, e);
     return null;
   } finally {
     clearTimeout(timer);
@@ -7690,51 +9607,24 @@ function pruneManagedMemory(home, identityId, hashes, deps = REAL_FS) {
 
 // src/bridge-agent.ts
 import { homedir as homedir2 } from "node:os";
-
-// src/reply-receipts.ts
-var DEFAULT_TTL_MS = 15 * 60 * 1e3;
-var DEFAULT_CAPACITY2 = 256;
-var RuntimeReplyReceiptLedger = class {
-  receipts = /* @__PURE__ */ new Map();
-  ttlMs;
-  capacity;
-  now;
-  constructor(opts = {}) {
-    this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
-    this.capacity = opts.capacity ?? DEFAULT_CAPACITY2;
-    this.now = opts.now ?? Date.now;
-    if (!Number.isFinite(this.ttlMs) || this.ttlMs <= 0) throw new Error("reply receipt ttlMs must be positive");
-    if (!Number.isInteger(this.capacity) || this.capacity <= 0) throw new Error("reply receipt capacity must be positive");
-  }
-  record(inReplyTo, channelId, replyMessageId) {
-    const receipt = Object.freeze({
-      in_reply_to: inReplyTo,
-      reply_message_id: replyMessageId,
-      channel_id: channelId,
-      replied_at: this.now()
-    });
-    this.prune(receipt.replied_at);
-    this.receipts.delete(inReplyTo);
-    this.receipts.set(inReplyTo, receipt);
-    while (this.receipts.size > this.capacity) {
-      const oldest = this.receipts.keys().next().value;
-      if (oldest === void 0) break;
-      this.receipts.delete(oldest);
-    }
-    return receipt;
-  }
-  get(inReplyTo) {
-    this.prune(this.now());
-    return this.receipts.get(inReplyTo) ?? null;
-  }
-  prune(now) {
-    for (const [key, receipt] of this.receipts) {
-      if (now - receipt.replied_at >= this.ttlMs) this.receipts.delete(key);
-    }
+function logPendingCommitResolved(outcome) {
+  switch (outcome) {
+    case "landed":
+      writeServiceLog2("info", "mls.pending_commit.resolved.landed");
+      return;
+    case "not_landed":
+      writeServiceLog2("info", "mls.pending_commit.resolved.not_landed");
+      return;
+    case "stale_prior":
+      writeServiceLog2("info", "mls.pending_commit.resolved.stale_prior");
+      return;
+    case "abandoned":
+      writeServiceLog2("info", "mls.pending_commit.resolved.abandoned");
+      return;
+    default:
+      writeServiceLog2("info", "mls.pending_commit.resolved.unknown");
   }
-};
-
-// src/bridge-agent.ts
+}
 var VOICE_MODE_GUIDANCE = "Reply immediately and conversationally, one short sentence per message; never bundle multiple points into one message.";
 var FAST_PATH_SPOKEN_GUIDANCE = "A one-sentence spoken acknowledgement has already been sent for this turn. Reply only with information it did not contain, in one or two short sentences; if there is nothing to add, send nothing.";
 var ROOM_VOICE_GUIDANCE_MENTION_ONLY = "You are in a group voice room. Reply ONLY when a message @mentions your display name. Keep replies to one short sentence. When you should not reply, send nothing.";
@@ -7746,6 +9636,14 @@ function selectVoiceGuidance(isDm, voiceDefaultResponder) {
   return VOICE_MODE_GUIDANCE;
 }
 var DEFAULT_MAX_BUFFER = 1e3;
+var DEFAULT_MAX_DELIVERY_ATTEMPTS = 5;
+var REDELIVERY_BACKOFF_BASE_MS = 5e3;
+function redeliveryDelayMs(attempts) {
+  return 2 ** Math.min(Math.max(attempts, 0), 16) * REDELIVERY_BACKOFF_BASE_MS;
+}
+var DEAD_LETTER_NOTICE = "I couldn't process a message. Please resend it.";
+var DEAD_LETTER_NOTICE_INTERVAL_MS = 60 * 6e4;
+var PAUSE_RECHECK_MS = 3e4;
 var CHANNEL_META_TTL_MS = 5 * 6e4;
 var CHANNEL_ROSTER_TTL_MS = 5 * 6e4;
 var ZERO_TRACEPARENT = "00-" + "0".repeat(32) + "-" + "0".repeat(16) + "-01";
@@ -7825,6 +9723,13 @@ var AgentPausedSendError = class extends Error {
     this.name = "AgentPausedSendError";
   }
 };
+var SendForbiddenError = class extends Error {
+  constructor(channelId) {
+    super(`send refused for channel ${channelId} (credential revoked or not a member); no retry`);
+    this.channelId = channelId;
+    this.name = "SendForbiddenError";
+  }
+};
 var UnknownActionRunError = class extends Error {
   constructor(runId) {
     super(`unknown or already-settled agent action run: ${runId}`);
@@ -7855,8 +9760,13 @@ var BridgeAgent = class _BridgeAgent {
       // half-open + wake + auth war-cap). On by default for the daemon;
       // SECURECOMS_WS_HARDENED=false reverts to the legacy 4001-terminal path.
       hardenedReconnect: process.env.SECURECOMS_WS_HARDENED !== "false",
-      onWsLifecycle: (event, detail) => process.stderr.write(`[bridge] delivery-ping ${event}${detail ? ` (${detail})` : ""}
-`)
+      onWsLifecycle: (event) => {
+        if (event === "wake") writeServiceLog2("warn", "transport.delivery_ping_wake");
+        else if (event === "halfopen") writeServiceLog2("warn", "transport.delivery_ping_halfopen");
+        else if (event === "terminal") writeServiceLog2("error", "transport.delivery_ping_terminal");
+        else if (event === "reconnect") writeServiceLog2("warn", "transport.delivery_ping_reconnect");
+        else writeServiceLog2("warn", "transport.delivery_ping_lifecycle_unknown");
+      }
     });
     this.backend = deps.backend ?? new RestMlsBackend({ baseUrl: cfg.apiBase, bearerToken: cfg.apiKey });
     this.store = new SqliteMlsStateStore({
@@ -7873,11 +9783,17 @@ var BridgeAgent = class _BridgeAgent {
       backend: this.backend,
       deviceId: cfg.deviceId,
       identity: new TextEncoder().encode(cfg.identityId),
+      // C2 T0: required by the SDK. This host never commits (no committer
+      // entry is reachable from its src/), so the hook only records the
+      // outcome (see logPendingCommitResolved).
+      onPendingCommitResolved: (_channelId, ev) => {
+        logPendingCommitResolved(ev.outcome);
+      },
       // ADR-0002: count + log agent-side decrypt failures. Without this hook the
       // daemon was 100% blind to a wedged channel (it "looked idle"); the
       // provider's errorStats() snapshot is surfaced on GET /v1/metrics below.
       // P0b (daemon-stability): logging is routed through decryptErrorLogLimiter
-      // rather than a raw console.warn per failure — a wedged channel used to
+      // rather than a raw diagnostic per failure — a wedged channel used to
       // redeliver the same undecryptable row on every pullDelivery cycle and
       // produced a 114 MB / 765,000-line daemon log in a single day. The
       // limiter still logs the first failure immediately and collapses every
@@ -7887,8 +9803,7 @@ var BridgeAgent = class _BridgeAgent {
         const cid = row.connect_channel_id ?? "(unmapped)";
         this.decryptErrorLogLimiter.record(cid, {
           epoch: row.epoch,
-          queueId: row.queue_id,
-          message: err instanceof Error ? err.message : String(err)
+          error: err
         });
       },
       // P0b (daemon-stability): fired EXACTLY ONCE by the SDK (P0a) when a
@@ -7899,9 +9814,7 @@ var BridgeAgent = class _BridgeAgent {
       // healWedgedChannel below) — never throws back into the SDK caller.
       onWedged: (channelId) => {
         try {
-          console.warn(
-            `[bridge] channel ${channelId} quarantined after persistent decrypt failures \u2014 signalling re-Welcome`
-          );
+          writeServiceLog2("warn", "decrypt.channel_quarantined");
           void this.healWedgedChannel(channelId);
         } catch {
         }
@@ -7926,6 +9839,8 @@ var BridgeAgent = class _BridgeAgent {
     this.voiceSettingsSource = cfg.voice ? "file" : "none";
     this.latency = deps.latency ?? new LatencyRecorder();
     this.maxBuffer = deps.maxBuffer ?? DEFAULT_MAX_BUFFER;
+    this.maxDeliveryAttempts = deps.maxDeliveryAttempts ?? DEFAULT_MAX_DELIVERY_ATTEMPTS;
+    this.maxAgentHops = deps.maxAgentHops ?? DEFAULT_MAX_AGENT_HOPS;
     this.rateFloor = new TokenBucketFloor({
       capacity: cfg.rateLimitCapacity ?? 20,
       refillPerMinute: cfg.rateLimitRefillPerMinute ?? 20
@@ -7993,6 +9908,15 @@ var BridgeAgent = class _BridgeAgent {
    * per channel on a miss.
    */
   channelRoster = /* @__PURE__ */ new Map();
+  /**
+   * 2026-09-25: this agent's own display_name (`ConnectIdentity.display_name`,
+   * identity-level, so the same in every channel) from the MOST RECENT roster
+   * refresh that listed it. Read by the room @mention filter as its
+   * `roomDisplayName`. Kept across a later failed refresh, so a transient
+   * members-fetch error does not make the agent deaf to its own name; a
+   * successful refresh after a rename replaces it.
+   */
+  lastOwnDisplayName;
   /**
    * Task 8 (owner-attested Reset Secure Session): per-channel STRUCTURAL owner
    * cache, fed by resolveAndPinOwner() on every roster refresh and consumed by
@@ -8003,13 +9927,37 @@ var BridgeAgent = class _BridgeAgent {
    */
   channelOwner = /* @__PURE__ */ new Map();
   buffer = [];
+  /** Message ids durably staged for the attached runtime but not yet acked. */
+  runtimePendingIds = /* @__PURE__ */ new Set();
   maxBuffer;
+  /** Phase 3 F1: deliveries so far per pending runtime message (seeded from the store). */
+  deliveryAttempts = /* @__PURE__ */ new Map();
+  maxDeliveryAttempts;
+  /** Phase 3 F1: cumulative messages dead-lettered at the delivery cap. */
+  deadLetteredMessages = 0;
+  /** Final-wave I1(a): message id → earliest redelivery time (epoch ms). */
+  redeliverNotBefore = /* @__PURE__ */ new Map();
+  /** Final-wave I1(a): one timer poking consumers when the earliest backoff ends. */
+  redeliveryTimer = null;
+  redeliveryTimerAt = Number.POSITIVE_INFINITY;
+  /** Final-wave I1(c): channel → when its last dead-letter notice was posted. */
+  deadLetterNoticeAt = /* @__PURE__ */ new Map();
+  /** Phase 3 F1: channel → when a pause was last confirmed (send 403 or probe). */
+  pausedChannels = /* @__PURE__ */ new Map();
   /**
-   * Short-lived, content-free runtime reply correlations. The attached runtime
-   * supplies the inbound message id only when an outbound send is its reply;
-   * ws-server/http-server record the receipt after send() publishes.
+   * Phase 3 F1: runtime messages retired by a TERMINAL reply failure reported
+   * outside the /v1/ws socket that holds them in flight (HTTP /v1/send). The
+   * socket consults this so it neither redelivers them nor stays busy on them.
+   * Bounded; oldest forgotten first.
    */
-  runtimeReplyReceipts = new RuntimeReplyReceiptLedger();
+  retiredRuntimeIds = /* @__PURE__ */ new Set();
+  /** Phase 3 F1: one pending membership recheck per paused channel holding work. */
+  pauseRecheckTimers = /* @__PURE__ */ new Map();
+  /** Phase 3 F3: consecutive agent turns per channel. */
+  agentHops = new AgentHopTracker();
+  maxAgentHops;
+  /** Phase 3 F3: cumulative agent-authored messages not answered (no explicit mention / hop limit). */
+  agentLoopSuppressed = 0;
   /** Cumulative count of messages shed by the buffer cap (surfaced on health()/metrics()). */
   droppedMessages = 0;
   /**
@@ -8147,7 +10095,7 @@ var BridgeAgent = class _BridgeAgent {
   // H1: bound the graceful-shutdown drain so a hung in-flight op can't block exit.
   static GRACEFUL_DRAIN_MS = 5e3;
   /**
-   * P0b (daemon-stability): collapses the onDecryptError console.warn from
+   * P0b (daemon-stability): collapses the onDecryptError diagnostic from
    * "one line per failure" (the 114 MB/765k-line-in-a-day log source) to at
    * most one line immediately + one summary line per 60s per channel. LOG
    * OUTPUT ONLY — does not touch errorStats()/quarantine counters, which
@@ -8311,16 +10259,13 @@ var BridgeAgent = class _BridgeAgent {
       if (!this.injectedFastLlm) {
         this.fastLlm = new FastLlmClient(this.cfg.voice.fastPath, this.fetchImpl);
       }
-      process.stderr.write(
-        `[bridge] voice settings v${this.voiceSettingsVersion} loaded (source: ${this.voiceSettingsSource})
-`
-      );
+      writeServiceLog2("info", "voice.settings_loaded", {
+        version: this.voiceSettingsVersion,
+        source_backend: this.voiceSettingsSource === "backend"
+      });
     } catch (e) {
       if (this.voiceSettingsSource === "backend") return;
-      process.stderr.write(
-        `[bridge] voice settings unavailable (${e.message}); using ${this.voiceSettingsSource}
-`
-      );
+      writeServiceLog2("warn", "voice.settings_unavailable", {}, e);
     }
   }
   /**
@@ -8346,23 +10291,17 @@ var BridgeAgent = class _BridgeAgent {
       if (!res.ok) throw new Error(`runtime-config ${res.status}`);
       const payload = await res.json();
       if (!payload) {
-        process.stderr.write("[bridge] runtime config not applied (empty response)\n");
+        writeServiceLog2("warn", "runtime_config.empty_response");
         return;
       }
       if (typeof payload.version !== "number") {
-        process.stderr.write(
-          `[bridge] runtime config not applied (version ${JSON.stringify(payload.version ?? null)} \u2014 invalid response)
-`
-        );
+        writeServiceLog2("warn", "runtime_config.invalid_version");
         return;
       }
       const version = payload.version;
       if (!version) {
         writeManagedFiles(this.home, this.cfg.identityId, {});
-        process.stderr.write(
-          `[bridge] runtime config not applied (version ${JSON.stringify(payload?.version ?? null)} \u2014 no saved config)
-`
-        );
+        writeServiceLog2("info", "runtime_config.not_saved");
       }
       const skillsJson = payload.skills_json ?? {};
       if (version) {
@@ -8395,10 +10334,10 @@ var BridgeAgent = class _BridgeAgent {
           }
         );
         if (result.sourcesDeleted > 0) {
-          process.stderr.write(
-            `[bridge] legacy-memory disposition applied (sources=${result.sourcesDeleted}, assigned=${result.factsAssigned})
-`
-          );
+          writeServiceLog2("info", "runtime_config.legacy_memory_disposition_applied", {
+            assigned: result.factsAssigned,
+            sources: result.sourcesDeleted
+          });
         }
       }
       const local = readLocalReport(this.home, this.cfg.identityId);
@@ -8437,22 +10376,17 @@ var BridgeAgent = class _BridgeAgent {
         body: JSON.stringify(report)
       });
       if (!posted.ok) {
-        process.stderr.write(
-          version ? `[bridge] runtime config v${version} written, but reporting it failed (${posted.status}) \u2014 the console will keep showing it as not applied until the next cycle
-` : `[bridge] legacy-memory inventory report failed (${posted.status}); no saved runtime config was applied
-`
-        );
+        if (version) {
+          writeServiceLog2("warn", "runtime_config.report_failed", { status: posted.status, version });
+        } else {
+          writeServiceLog2("warn", "runtime_config.legacy_memory_report_failed", { status: posted.status });
+        }
         return;
       }
-      process.stderr.write(
-        version ? `[bridge] runtime config v${version} applied
-` : "[bridge] legacy-memory inventory reported; no saved runtime config was applied\n"
-      );
+      if (version) writeServiceLog2("info", "runtime_config.applied", { version });
+      else writeServiceLog2("info", "runtime_config.legacy_memory_reported");
     } catch (e) {
-      process.stderr.write(
-        `[bridge] runtime config refetch failed: ${e?.message ?? e}
-`
-      );
+      writeServiceLog2("warn", "runtime_config.refetch_failed", {}, e);
     }
   }
   /**
@@ -8470,12 +10404,13 @@ var BridgeAgent = class _BridgeAgent {
     if (this.maxBuffer <= 0) return;
     const overflow = this.buffer.length - this.maxBuffer;
     if (overflow > 0) {
-      this.buffer.splice(0, overflow);
+      for (const shed of this.buffer.splice(0, overflow)) this.deliveryAttempts.delete(shed.message_id);
       this.droppedMessages += overflow;
     }
   }
   async start() {
     this.startedAt = Date.now();
+    await this.restoreRuntimeInbox();
     try {
       await this.ingestOnce();
     } catch {
@@ -8494,7 +10429,7 @@ var BridgeAgent = class _BridgeAgent {
           // See the safetyTimer/selfHealTimer comment near close(): swallow the
           // expected post-close store-access rejection, log anything else.
           void this.selfHealSweep().catch((e) => {
-            if (!this.closingDown) console.error("[bridge] self-heal sweep failed:", e);
+            if (!this.closingDown) writeServiceLog2("error", "self_heal.sweep_failed", {}, e);
           })
         ),
         this.sweepJitter()
@@ -8521,8 +10456,7 @@ var BridgeAgent = class _BridgeAgent {
     if (mapped) return mapped;
     if (!this.enclaveFallbackWarned.has(channelId)) {
       this.enclaveFallbackWarned.add(channelId);
-      process.stderr.write(`[bridge] send.enclave_fallback channel=${channelId} stamped=home
-`);
+      writeServiceLog2("warn", "send.enclave_fallback");
     }
     return this.cfg.enclaveId;
   }
@@ -8533,7 +10467,7 @@ var BridgeAgent = class _BridgeAgent {
       this.joinState.set(channelId, "JOINED");
       return true;
     } catch (e) {
-      console.warn(`[bridge] reconcileJoin ${channelId} failed:`, e);
+      writeServiceLog2("warn", "join.reconcile_failed", {}, e);
       this.joinState.set(channelId, "PENDING");
       return false;
     }
@@ -8606,15 +10540,14 @@ var BridgeAgent = class _BridgeAgent {
         }
         this.lastWipe.set(channelId, now);
       } else {
-        console.warn(
-          `[bridge] healWedgedChannel ${channelId}: wipe suppressed by ${provenForked ? "proven-fork re-wipe floor" : "anti-thrash bound"} (${Math.round((floor - (now - lastWipe)) / 1e3)}s remaining) \u2014 NOT repudiated`
-        );
+        writeServiceLog2("warn", "self_heal.wipe_suppressed", {
+          proven_forked: provenForked,
+          remaining_seconds: Math.round((floor - (now - lastWipe)) / 1e3)
+        });
       }
       this.joinState.delete(channelId);
       if (!repudiated && await this.provider.hasPersistedChannelState(channelId)) {
-        console.warn(
-          `[bridge] healWedgedChannel ${channelId}: wipe suppressed and state still held \u2014 NOT requesting (the answer would be stray-acked and would cost the group two commits)`
-        );
+        writeServiceLog2("warn", "self_heal.request_suppressed_state_held");
         return false;
       }
       const last = this.lastWelcomeRequest.get(channelId) ?? -Infinity;
@@ -8623,7 +10556,7 @@ var BridgeAgent = class _BridgeAgent {
       await this.signalHeldKpWelcome(g.group_id);
       return repudiated;
     } catch (e) {
-      console.warn(`[bridge] healWedgedChannel ${channelId} failed:`, e);
+      writeServiceLog2("warn", "self_heal.channel_failed", {}, e);
       return false;
     }
   }
@@ -8650,7 +10583,8 @@ var BridgeAgent = class _BridgeAgent {
       this.lastWelcomeRequest.set(channelId, now);
       await this.signalHeldKpWelcome(groupId);
       return true;
-    } catch {
+    } catch (e) {
+      writeServiceLog2("warn", "self_heal.supersede_signal_failed", {}, e);
       return false;
     }
   }
@@ -8722,40 +10656,50 @@ var BridgeAgent = class _BridgeAgent {
    * reads `null` and therefore degraded.
    */
   keypackageExpired = null;
+  /** #335: dedupes the expiry-measurement warning to once per failure STREAK —
+   * any non-throwing resolution (including the known-unknown `null` returns,
+   * which are answers, not failures) re-arms it. Mirrors `enclaveListWarned`. */
+  keypackageExpiryUnknownWarned = false;
   /** Resolve the flag from the SAME two inputs the guard uses, with every unknown
    * mapped to `null`. Never throws: a failure to measure is itself unknown. */
   async resolveKeypackageExpired() {
     try {
       const kpId = await this.provider.getLastPublishedKpId();
-      if (kpId === null || kpId === "") return null;
+      if (kpId === null || kpId === "") return this.kpExpiryResolved(null);
       const exp = await this.backend.fetchKeyPackageExpiry(kpId);
-      if (exp === null) return null;
-      return isServerExpired(exp, Date.now());
-    } catch {
+      if (exp === null) return this.kpExpiryResolved(null);
+      return this.kpExpiryResolved(isServerExpired(exp, Date.now()));
+    } catch (e) {
+      if (!this.keypackageExpiryUnknownWarned) {
+        this.keypackageExpiryUnknownWarned = true;
+        writeServiceLog2("warn", "self_heal.keypackage_expiry_unknown", {}, e);
+      }
       return null;
     }
   }
+  /** Every non-throwing resolution ends the failure streak (the next throw is
+   * a NEW streak and warns again) and passes the value through unchanged. */
+  kpExpiryResolved(value) {
+    this.keypackageExpiryUnknownWarned = false;
+    return value;
+  }
   async rotateDeviceKeyPackage() {
     try {
       await this.provider.publishKeyPackage();
     } catch (e) {
-      console.error("[bridge] selfHealSweep: device KeyPackage rotation failed (continuing):", e);
+      writeServiceLog2("error", "self_heal.keypackage_rotation_failed", {}, e);
     }
   }
   async selfHealSweep() {
     if (this.closingDown) return;
     if (typeof this.provider.resyncByReplay !== "function" || typeof this.provider.heldGroupIdFor !== "function") {
       this.providerCapabilityMissing = true;
-      console.error(
-        "[bridge] selfHealSweep ABORTED: provider is missing required capabilities (resyncByReplay/heldGroupIdFor) \u2014 stale SDK dist? Rebuild SDK dist THEN bridge dist. Healing is NOT running; observations are reported STALE."
-      );
+      writeServiceLog2("error", "self_heal.provider_capability_missing");
       return;
     }
     if (typeof this.backend?.fetchKeyPackageExpiry !== "function") {
       this.providerCapabilityMissing = true;
-      console.error(
-        "[bridge] selfHealSweep ABORTED: backend is missing fetchKeyPackageExpiry \u2014 the SDK dist is STALE (it predates KeyPackage expiry rotation). Rebuild the SDK dist THEN the bridge dist. KeyPackage rotation and healing are NOT running; observations are reported STALE."
-      );
+      writeServiceLog2("error", "self_heal.backend_capability_missing");
       return;
     }
     this.providerCapabilityMissing = false;
@@ -8782,13 +10726,13 @@ var BridgeAgent = class _BridgeAgent {
         failed.push(encId);
         if (!this.enclaveListWarned.has(encId)) {
           this.enclaveListWarned.add(encId);
-          console.warn(`[bridge] selfHealSweep: listChannels failed for enclave ${encId}; skipping (warn-once per streak):`, e);
+          writeServiceLog2("warn", "self_heal.enclave_listing_failed", {}, e);
         }
       }
     }
     this.sweepEnclavesFailed = failed;
     if (!listedAny) {
-      console.warn("[bridge] selfHealSweep aborted: every enclave listing failed");
+      writeServiceLog2("warn", "self_heal.all_enclave_listings_failed", { count: failed.length });
       return;
     }
     for (const c of chans) {
@@ -8839,26 +10783,20 @@ var BridgeAgent = class _BridgeAgent {
                   }
                   obs.state = "healthy";
                   obs.diverged = false;
-                  console.warn(
-                    `[bridge] selfHealSweep: ${c.channel_id} caught up by REPLAY to epoch ${obs.held_epoch} (no re-admit, no epoch churn)`
-                  );
+                  writeServiceLog2("info", "self_heal.replay_succeeded", { epoch: obs.held_epoch });
                   continue;
                 }
                 const repudiated = await this.healWedgedChannel(c.channel_id, true);
-                console.warn(
-                  `[bridge] selfHealSweep: ${c.channel_id} STUCK at epoch ${obs.held_epoch} (server=${obs.server_epoch}) across two sweeps \u2014 ${repudiated ? "repudiated and re-requested" : "repair SUPPRESSED (anti-thrash); state unchanged"}`
-                );
+                writeServiceLog2("warn", "self_heal.stuck_channel", { repudiated });
               }
               continue;
             }
-            console.debug(
-              `[bridge] selfHealSweep: ${c.channel_id} ${behind ? `BEHIND (held=${obs.held_epoch} server=${obs.server_epoch}) \u2014 reporting only, action predicate is group-id` : "healthy, held group matches server"} \u2014 skipping`
-            );
+            writeServiceLog2("debug", "self_heal.channel_healthy");
             continue;
           }
           obs.state = "diverged";
           obs.diverged = true;
-          console.warn(`[bridge] selfHealSweep: ${c.channel_id} holds STALE group state \u2014 signalling re-Welcome`);
+          writeServiceLog2("warn", "self_heal.stale_group_state");
         } else {
           obs.state = "no_local_state";
           obs.diverged = false;
@@ -8881,7 +10819,7 @@ var BridgeAgent = class _BridgeAgent {
         this.lastWelcomeRequest.set(c.channel_id, now);
         await this.signalHeldKpWelcome(g.group_id);
       } catch (e) {
-        console.warn(`[bridge] selfHealSweep: channel ${c.channel_id} failed:`, e);
+        writeServiceLog2("warn", "self_heal.channel_probe_failed", {}, e);
       } finally {
         this.observations.set(c.channel_id, obs);
       }
@@ -8924,16 +10862,28 @@ var BridgeAgent = class _BridgeAgent {
   async sendWithSelfHealTerminal(...args2) {
     const [, channelId] = args2;
     try {
-      return await sendWithSelfHeal(...args2);
+      const result = await sendWithSelfHeal(...args2);
+      if (this.pausedChannels.has(channelId)) this.clearPause(channelId);
+      return result;
     } catch (e) {
       if (e instanceof AgentPausedError) {
-        console.warn(`[bridge] send suppressed: agent paused in channel ${channelId}`);
+        writeServiceLog2("warn", "send.agent_paused");
+        this.pausedChannels.set(channelId, Date.now());
         throw new AgentPausedSendError(channelId);
       }
+      if (e instanceof Error && /^publish failed: 40[13]$/.test(e.message)) {
+        writeServiceLog2("warn", "send.forbidden");
+        throw new SendForbiddenError(channelId);
+      }
       throw e;
     }
   }
-  async send(channelId, text, messageId) {
+  /**
+   * `opts.agentTurn` (default true): whether this send is a SUBSTANTIVE agent
+   * turn for the Phase 3 F3 hop count. Notices (daily limit, dead letter) and
+   * continuation parts of one multi-part reply pass false (final-wave I2).
+   */
+  async send(channelId, text, messageId, opts = {}) {
     const meta = this.freshMeta(channelId);
     if (meta && !meta.is_dm) this.enforceRateFloor("room", channelId);
     const joined = await this.reconcileJoin(channelId);
@@ -8968,10 +10918,11 @@ var BridgeAgent = class _BridgeAgent {
       (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
     );
     this.latency.record("send.total", performance.now() - sendStart);
+    if (opts.agentTurn !== false) this.agentHops.noteOwnSend(channelId);
     void recordOutboundMemory(this.memory, channelId, text, id);
     return { message_id: id, status: "sent" };
   }
-  async sendA2A(channelId, a2a, messageId) {
+  async sendA2A(channelId, a2a, messageId, opts = {}) {
     this.enforceRateFloor("a2a", channelId);
     const joined = await this.reconcileJoin(channelId);
     if (!joined) throw new ChannelPendingError(channelId);
@@ -9005,6 +10956,7 @@ var BridgeAgent = class _BridgeAgent {
       (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
     );
     this.latency.record("send.total", performance.now() - sendStart);
+    if (opts.agentTurn !== false) this.agentHops.noteOwnSend(channelId);
     return { message_id: id, status: "sent" };
   }
   sendDeps() {
@@ -9070,6 +11022,7 @@ var BridgeAgent = class _BridgeAgent {
       (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
     );
     this.latency.record("send.total", performance.now() - sendStart);
+    this.agentHops.noteOwnSend(channelId);
     return { message_id: id, status: "sent" };
   }
   // ── B7: FileSafe vault commands (loopback boundary) ──────────────────────
@@ -9398,10 +11351,7 @@ var BridgeAgent = class _BridgeAgent {
       return defer ? "deferred" : "answered";
     } catch (e) {
       this.fastPathFailed++;
-      process.stderr.write(
-        `[bridge] voice fast path failed for ${m.channelId}/${m.messageId}: ${e.message ?? "unknown error"}
-`
-      );
+      writeServiceLog2("warn", "voice.fast_path_failed", {}, e);
       return "failed";
     }
   }
@@ -9590,10 +11540,7 @@ var BridgeAgent = class _BridgeAgent {
       } catch (e) {
         if (!this.enclaveEnumWarned) {
           this.enclaveEnumWarned = true;
-          console.warn(
-            "[bridge] enclave enumeration failed; sweep coverage degraded to home+learned enclaves:",
-            e
-          );
+          writeServiceLog2("warn", "self_heal.enclave_enumeration_failed", {}, e);
         }
       }
     }
@@ -9641,6 +11588,8 @@ var BridgeAgent = class _BridgeAgent {
         });
       }
       this.channelRoster.set(channelId, { members, at: Date.now() });
+      const self = members.get(this.cfg.identityId);
+      if (self?.name) this.lastOwnDisplayName = self.name;
       await this.resolveAndPinOwner(channelId, rows);
     } catch {
     }
@@ -9701,9 +11650,7 @@ var BridgeAgent = class _BridgeAgent {
           keyAlgo: owner.key_algo ?? "ed25519"
         });
       } else if (existing.publicKeyHex !== publicKeyHex) {
-        console.warn(
-          `[bridge] pin mismatch for owner ${owner.identity_id} on channel ${channelId}: pinned != roster`
-        );
+        writeServiceLog2("warn", "identity.owner_pin_mismatch");
         this.channelOwner.set(channelId, "anomalous");
       }
     } catch {
@@ -9721,19 +11668,20 @@ var BridgeAgent = class _BridgeAgent {
     const cached = this.channelOwner.get(channelId);
     const TRACE = typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY;
     if (!cached || cached === "anomalous") {
-      if (TRACE) console.warn(`[trace] resolvePinnedOwner ch=${channelId.slice(0, 8)} -> NULL: cache ${!cached ? "MISSING (cold)" : "anomalous"}`);
+      if (TRACE && !cached) writeServiceLog2("debug", "identity.owner_cache_missing");
+      else if (TRACE) writeServiceLog2("debug", "identity.owner_cache_anomalous");
       return null;
     }
     const pin = await this.store.loadPinnedIdentityKey(cached.identityId);
     if (!pin) {
-      if (TRACE) console.warn(`[trace] resolvePinnedOwner ch=${channelId.slice(0, 8)} -> NULL: NO PERSISTED PIN for owner ${cached.identityId.slice(0, 8)} (cache had ${cached.publicKeyHex.slice(0, 8)})`);
+      if (TRACE) writeServiceLog2("debug", "identity.owner_pin_missing");
       return null;
     }
     if (pin.publicKeyHex !== cached.publicKeyHex) {
-      if (TRACE) console.warn(`[trace] resolvePinnedOwner ch=${channelId.slice(0, 8)} -> NULL: PIN MISMATCH pin=${pin.publicKeyHex.slice(0, 8)} cache=${cached.publicKeyHex.slice(0, 8)}`);
+      if (TRACE) writeServiceLog2("debug", "identity.owner_pin_mismatch");
       return null;
     }
-    if (TRACE) console.warn(`[trace] resolvePinnedOwner ch=${channelId.slice(0, 8)} -> OK owner=${cached.identityId.slice(0, 8)}`);
+    if (TRACE) writeServiceLog2("debug", "identity.owner_pin_resolved");
     return { identityId: cached.identityId, publicKeyHex: pin.publicKeyHex };
   }
   async reportStatus(channelId, state, detail) {
@@ -9824,13 +11772,13 @@ var BridgeAgent = class _BridgeAgent {
     const body = await runSummarize({
       request,
       complete: (prompt, o) => this.completeForSummary(prompt, o.signal),
-      log: (message) => this.log(message)
+      log: writeServiceLog2
     });
     if (body === null) return;
     try {
       await this.sendSummary(channelId, body);
     } catch (e) {
-      this.log(`summarize_send_failed: ${String(e)}`);
+      writeServiceLog2("warn", "summarize.send_failed", {}, e);
     }
   }
   /**
@@ -9847,7 +11795,7 @@ var BridgeAgent = class _BridgeAgent {
    */
   async completeForSummary(prompt, signal) {
     if (!this.fastLlm) {
-      this.log("summarize_no_runtime: no fast-path LLM configured for this agent");
+      writeServiceLog2("warn", "summarize.runtime_unavailable");
       throw new Error("summarize_no_runtime");
     }
     const messages = [{ role: "user", content: prompt }];
@@ -9896,12 +11844,6 @@ var BridgeAgent = class _BridgeAgent {
       (envelope) => this.transport.publish(envelope)
     );
   }
-  /** Minimal stderr logger for non-fatal daemon events (mirrors the ad hoc
-   *  `process.stderr.write` calls elsewhere in this file). */
-  log(message) {
-    process.stderr.write(`[bridge] ${message}
-`);
-  }
   /**
    * The coalescing throttle (review H4 / Global Constraint: ~1/sec per run).
    * If the run has no dirty nodes, no-op. If the per-run bucket has no token,
@@ -10043,7 +11985,7 @@ var BridgeAgent = class _BridgeAgent {
         for await (const ping of sub.pings) {
           this.pingsReceived++;
           if (ping?.reconnected) {
-            process.stderr.write("[bridge] delivery-ping WS (re)connected \u2014 push inbound active\n");
+            writeServiceLog2("info", "transport.delivery_ping_connected");
             await this.refetchRuntimeConfig();
           }
           if (ping?.voiceSettingsChanged) {
@@ -10059,21 +12001,19 @@ var BridgeAgent = class _BridgeAgent {
       } catch {
       }
       if (!this.closingDown) {
-        process.stderr.write(
-          "[bridge] delivery-ping stream ENDED (terminal WS close, e.g. 4001) \u2014 inbound reduced to the 25s safety-floor drain until the daemon restarts\n"
-        );
+        writeServiceLog2("error", "transport.delivery_ping_stream_ended");
       }
     })();
     this.safetyTimer = setInterval(() => {
       void this.ingestOnce().catch((e) => {
-        if (!this.closingDown) console.error("[bridge] ingestOnce failed:", e);
+        if (!this.closingDown) writeServiceLog2("error", "receive.ingest_failed", {}, e);
       });
     }, 25e3);
     if (this.selfHealSweepEnabled) {
       const scheduleSweep = () => {
         this.selfHealTimer = setTimeout(() => {
           void this.selfHealSweep().catch((e) => {
-            if (!this.closingDown) console.error("[bridge] self-heal sweep failed:", e);
+            if (!this.closingDown) writeServiceLog2("error", "self_heal.sweep_failed", {}, e);
           });
           scheduleSweep();
         }, _BridgeAgent.SELF_HEAL_SWEEP_INTERVAL_MS + this.sweepJitter());
@@ -10113,7 +12053,7 @@ var BridgeAgent = class _BridgeAgent {
         try {
           await this.signalHeldKpWelcome(gid);
         } catch (e) {
-          console.warn(`[bridge] ingestOnce: signalHeldKpWelcome for ${cid} failed:`, e);
+          writeServiceLog2("warn", "self_heal.welcome_signal_failed", {}, e);
         }
       }
     } catch {
@@ -10154,11 +12094,7 @@ var BridgeAgent = class _BridgeAgent {
         );
         if (parsed.type && parsed.type !== "text") {
           if (parsed.type === "summarize") {
-            const request = parseSummarizeBody(
-              parsed,
-              this.cfg.identityId,
-              (msg) => this.log(msg)
-            );
+            const request = parseSummarizeBody(parsed, this.cfg.identityId, writeServiceLog2);
             if (request !== null) {
               void this.handleSummarize(m.channelId, request);
             }
@@ -10171,12 +12107,38 @@ var BridgeAgent = class _BridgeAgent {
               const senderType = m.envelope.sender_type;
               const senderIsAgent = senderType === "agent" ? true : senderType === "human" ? false : void 0;
               const chanMeta = this.freshMeta(m.channelId);
+              const loopSenderIsAgent = this.loopSenderIsAgent(
+                m.channelId,
+                m.envelope.sender_id,
+                senderIsAgent,
+                false
+              );
+              const agentHops = this.agentHops.noteInbound(m.channelId, loopSenderIsAgent);
+              if (loopSenderIsAgent === true) {
+                const shareText = typeof parsed.text === "string" ? parsed.text : "";
+                const answerable = chanMeta && chanMeta.is_dm === false ? shouldProcessRoomMessage(
+                  shareText,
+                  this.cfg.agentName ?? this.cfg.identityId,
+                  this.cfg.identityId,
+                  {
+                    senderIsAgent: true,
+                    roomDisplayName: this.ownRoomDisplayName(),
+                    agentHops,
+                    maxAgentHops: this.maxAgentHops
+                  }
+                ) : agentHopAllowed(agentHops, this.maxAgentHops);
+                if (!answerable) {
+                  this.noteAgentTurnSuppressed(agentHops);
+                  acked.push(m.queueId);
+                  continue;
+                }
+              }
               const attachment = await materializeAttachment(
                 parsed,
                 { attachmentsDir: this.attachmentsDirImpl, channelId: m.channelId, messageId: m.messageId },
                 this.receiveDeps()
               );
-              this.buffer.push({
+              const runtimeMessage = {
                 channel_id: m.channelId,
                 message_id: m.messageId,
                 sender_id: m.envelope.sender_id,
@@ -10190,14 +12152,11 @@ var BridgeAgent = class _BridgeAgent {
                   voice: true,
                   guidance: selectVoiceGuidance(chanMeta?.is_dm, m.voiceDefaultResponder)
                 } : {}
-              });
-              this.capBuffer();
+              };
+              if (!await this.stageRuntimeMessage(runtimeMessage)) continue;
             } catch (e) {
               this.failedAttachments++;
-              process.stderr.write(
-                `[bridge] attachment failed on ${m.messageId}: ${e.message}
-`
-              );
+              writeServiceLog2("warn", "attachment.materialize_failed", {}, e);
             }
           }
           acked.push(m.queueId);
@@ -10207,16 +12166,35 @@ var BridgeAgent = class _BridgeAgent {
           const meta = this.freshMeta(m.channelId);
           const senderType = m.envelope.sender_type;
           const senderIsAgent = senderType === "agent" ? true : senderType === "human" ? false : void 0;
+          const speaker = parsed.relay === true && typeof parsed.speaker_identity_id === "string" && typeof parsed.speaker_display_name === "string" ? {
+            identityId: parsed.speaker_identity_id,
+            displayName: parsed.speaker_display_name
+          } : void 0;
+          const loopSenderIsAgent = this.loopSenderIsAgent(
+            m.channelId,
+            m.envelope.sender_id,
+            senderIsAgent,
+            speaker !== void 0
+          );
+          const agentHops = this.agentHops.noteInbound(m.channelId, loopSenderIsAgent);
           let shouldBuffer = true;
           if (meta && meta.is_dm === false) {
             shouldBuffer = shouldProcessRoomMessage(
               parsed.text,
               this.cfg.agentName ?? this.cfg.identityId,
               this.cfg.identityId,
-              { senderIsAgent, roomDisplayName: meta.name ?? void 0 }
+              {
+                senderIsAgent: loopSenderIsAgent,
+                roomDisplayName: this.ownRoomDisplayName(),
+                agentHops,
+                maxAgentHops: this.maxAgentHops
+              }
             );
             if (!shouldBuffer) this.filteredRoomMessages++;
+          } else if (loopSenderIsAgent === true && !agentHopAllowed(agentHops, this.maxAgentHops)) {
+            shouldBuffer = false;
           }
+          if (!shouldBuffer && loopSenderIsAgent === true) this.noteAgentTurnSuppressed(agentHops);
           if (shouldBuffer) {
             const senderName = this.freshRoster(m.channelId)?.get(
               m.envelope.sender_id
@@ -10226,10 +12204,6 @@ var BridgeAgent = class _BridgeAgent {
               m.envelope.sender_id
             );
             const runtimeMemory = this.memoryForTurn(m.channelId, turnAuthorization);
-            const speaker = parsed.relay === true && typeof parsed.speaker_identity_id === "string" && typeof parsed.speaker_display_name === "string" ? {
-              identityId: parsed.speaker_identity_id,
-              displayName: parsed.speaker_display_name
-            } : void 0;
             const voiceGuidance = m.voiceMode ? selectVoiceGuidance(meta?.is_dm, m.voiceDefaultResponder) : void 0;
             const humanTurn = senderIsAgent !== true || speaker !== void 0;
             const fastPathEligible = Boolean(m.voiceMode && humanTurn && this.fastLlm && voiceGuidance);
@@ -10238,7 +12212,7 @@ var BridgeAgent = class _BridgeAgent {
               if (this.rateFloor.available(`room:${m.channelId}`) < 2) fastPathRoomBlocked = true;
             }
             if (fastPathRoomBlocked) this.fastPathSkipped++;
-            const fastPathFiring = fastPathEligible && !fastPathRoomBlocked;
+            const fastPathFiring = fastPathEligible && !fastPathRoomBlocked && !this.pausedChannels.has(m.channelId);
             const turnText = parsed.text;
             const isCallStart = turnText.trim() === VOICE_CALL_START_MARKER;
             const fastGreeting = isCallStart && fastPathFiring;
@@ -10262,7 +12236,7 @@ var BridgeAgent = class _BridgeAgent {
             });
             if (fastPathFiring) {
               const fastSpeaker = speaker ?? (senderName ? { identityId: m.envelope.sender_id, displayName: senderName } : void 0);
-              void this.runFastPath(
+              const outcome = await this.runFastPath(
                 {
                   channelId: m.channelId,
                   messageId: m.messageId,
@@ -10272,16 +12246,15 @@ var BridgeAgent = class _BridgeAgent {
                 fastGreeting ? greetingTurnFor(this.voiceSettings ?? DEFAULT_VOICE_SETTINGS, fastSpeaker?.displayName) : parsed.text,
                 voiceGuidance,
                 fastSpeaker
-              ).then(async (outcome) => {
-                if (outcome === "answered") return;
-                this.buffer.push(runtimeEntry(outcome === "deferred", await runtimeMemory));
-                this.capBuffer();
-                this.wakeListeners();
-              });
+              );
+              if (outcome !== "answered") {
+                if (!await this.stageRuntimeMessage(runtimeEntry(outcome === "deferred", await runtimeMemory))) {
+                  continue;
+                }
+              }
             } else {
-              this.buffer.push(runtimeEntry(false, await runtimeMemory));
+              if (!await this.stageRuntimeMessage(runtimeEntry(false, await runtimeMemory))) continue;
             }
-            this.capBuffer();
             void recordInboundMemory(
               this.memory,
               m.channelId,
@@ -10312,7 +12285,10 @@ var BridgeAgent = class _BridgeAgent {
   }
   async drain(channelId, waitSeconds) {
     let got = this.takeBuffered(channelId);
-    if (got.length || waitSeconds <= 0) return got;
+    if (got.length || waitSeconds <= 0) {
+      this.ackRuntimeMessages(got.map((message) => message.message_id));
+      return got;
+    }
     const cap = Math.min(waitSeconds, 50) * 1e3;
     await new Promise((resolve) => {
       let fired = false;
@@ -10328,7 +12304,9 @@ var BridgeAgent = class _BridgeAgent {
       timer = setTimeout(wake, cap);
       this.waiters.push(wake);
     });
-    return this.takeBuffered(channelId);
+    got = this.takeBuffered(channelId);
+    this.ackRuntimeMessages(got.map((message) => message.message_id));
+    return got;
   }
   /** Notify-only SSE signal: fired after a buffer push. Listener pulls via takeBuffered. */
   subscribe(listener) {
@@ -10337,19 +12315,319 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** Synchronous splice of buffered messages (all, or one channel). Shared by drain + SSE. */
   takeBuffered(channelId) {
-    if (channelId === void 0) return this.buffer.splice(0);
+    if (channelId === void 0 && this.pausedChannels.size === 0) return this.buffer.splice(0);
     const keep = [];
     const out = [];
-    for (const m of this.buffer) (m.channel_id === channelId ? out : keep).push(m);
+    for (const m of this.buffer) {
+      const wanted = channelId === void 0 || m.channel_id === channelId;
+      (wanted && !this.heldForPause(m.channel_id) ? out : keep).push(m);
+    }
     this.buffer.length = 0;
     this.buffer.push(...keep);
     return out;
   }
+  /**
+   * Phase 3 F2: per-channel ordered delivery for the /v1/ws runtime consumer.
+   * Splices out, oldest first, at most ONE buffered message per channel that
+   * is not in `busyChannels` (the channels the consumer still holds a message
+   * in flight for); everything else stays buffered in order. A runtime is
+   * therefore never handed a second message for a channel it is still
+   * working on — which it used to refuse with a "busy" reply and ack — and a
+   * backlog replays one message per channel at a time after a restart.
+   */
+  takeDeliverable(busyChannels) {
+    const picked = /* @__PURE__ */ new Set();
+    const out = [];
+    const keep = [];
+    const backingOff = /* @__PURE__ */ new Set();
+    const now = Date.now();
+    let wakeAt = Number.POSITIVE_INFINITY;
+    for (const m of this.buffer) {
+      const ch = m.channel_id;
+      if (busyChannels.has(ch) || picked.has(ch) || backingOff.has(ch) || this.heldForPause(ch)) {
+        keep.push(m);
+        continue;
+      }
+      const notBefore = this.redeliverNotBefore.get(m.message_id);
+      if (notBefore !== void 0 && notBefore > now) {
+        backingOff.add(ch);
+        wakeAt = Math.min(wakeAt, notBefore);
+        keep.push(m);
+        continue;
+      }
+      picked.add(ch);
+      out.push(m);
+    }
+    if (wakeAt !== Number.POSITIVE_INFINITY) this.armRedeliveryWake(wakeAt);
+    if (out.length) {
+      this.buffer.length = 0;
+      this.buffer.push(...keep);
+    }
+    return out;
+  }
+  /**
+   * Phase 3 F1: gate ONE delivery of `message` to the runtime consumer. Returns
+   * true when it may be sent (and counts the attempt durably), false when the
+   * message already reached the delivery cap — then it is dead-lettered:
+   * acknowledged, never redelivered, never reaching a model. (Paused channels
+   * never get here: takeDeliverable holds them, so a pause spends no attempts.)
+   * Logs are content-free (event + counts only).
+   */
+  admitRuntimeDelivery(message) {
+    const prior = this.deliveryAttempts.get(message.message_id) ?? 0;
+    if (prior >= this.maxDeliveryAttempts) {
+      this.deadLetter(message, prior);
+      return false;
+    }
+    this.redeliverNotBefore.delete(message.message_id);
+    let durable = 0;
+    try {
+      durable = this.store.noteRuntimeInboxDelivery(message.message_id);
+    } catch (e) {
+      writeServiceLog2("warn", "runtime_inbox.attempt_persist_failed", {}, e);
+    }
+    this.deliveryAttempts.set(message.message_id, Math.max(durable, prior + 1));
+    return true;
+  }
+  /**
+   * Final-wave I1: put back runtime deliveries that FAILED — the runtime sent a
+   * `nack` for the message, or the socket closed while it was in flight (an
+   * older runtime closes on any failed turn). Each one's attempt was already
+   * counted durably at delivery; here it either dead-letters (cap reached) or
+   * is requeued at the front behind a 2^attempts × 5 s redelivery backoff.
+   * Messages that were never handed to the runtime go back via requeueFront
+   * instead and are not affected.
+   */
+  requeueFailedRuntimeDeliveries(messages) {
+    const back = [];
+    const now = Date.now();
+    for (const m of messages) {
+      const attempts = this.deliveryAttempts.get(m.message_id) ?? 0;
+      if (attempts >= this.maxDeliveryAttempts) {
+        this.deadLetter(m, attempts);
+        continue;
+      }
+      if (attempts > 0) this.redeliverNotBefore.set(m.message_id, now + redeliveryDelayMs(attempts));
+      back.push(m);
+    }
+    this.requeueFront(back);
+  }
+  /**
+   * Phase 3 F1 dead letter: acknowledged, never redelivered, never reaching a
+   * model — plus (final-wave I1(c)) one content-free notice to the channel,
+   * at most once per channel per hour. Logs carry counts only.
+   */
+  deadLetter(message, attempts) {
+    this.deadLetteredMessages++;
+    writeServiceLog2("warn", "runtime_inbox.dead_letter", { attempts });
+    this.ackRuntimeMessages([message.message_id]);
+    this.noticeDeadLetter(message.channel_id);
+  }
+  noticeDeadLetter(channelId) {
+    if (this.closingDown) return;
+    const now = Date.now();
+    const last = this.deadLetterNoticeAt.get(channelId);
+    if (last !== void 0 && now - last < DEAD_LETTER_NOTICE_INTERVAL_MS) return;
+    this.deadLetterNoticeAt.delete(channelId);
+    this.deadLetterNoticeAt.set(channelId, now);
+    if (this.deadLetterNoticeAt.size > 5e3) {
+      const oldest = this.deadLetterNoticeAt.keys().next();
+      if (!oldest.done) this.deadLetterNoticeAt.delete(oldest.value);
+    }
+    let pending;
+    try {
+      pending = this.send(channelId, DEAD_LETTER_NOTICE, void 0, { agentTurn: false });
+    } catch (e) {
+      pending = Promise.reject(e);
+    }
+    void pending.then(
+      () => writeServiceLog2("info", "runtime_inbox.dead_letter_notice_sent"),
+      (e) => writeServiceLog2("warn", "runtime_inbox.dead_letter_notice_failed", {}, e)
+    );
+  }
+  /** Poke consumers once the earliest redelivery backoff ends. */
+  armRedeliveryWake(at) {
+    if (this.closingDown) return;
+    if (this.redeliveryTimer !== null && this.redeliveryTimerAt <= at) return;
+    if (this.redeliveryTimer !== null) clearTimeout(this.redeliveryTimer);
+    this.redeliveryTimerAt = at;
+    const timer = setTimeout(() => {
+      this.redeliveryTimer = null;
+      this.redeliveryTimerAt = Number.POSITIVE_INFINITY;
+      this.wakeListeners();
+    }, Math.max(0, at - Date.now()));
+    timer.unref?.();
+    this.redeliveryTimer = timer;
+  }
+  /**
+   * 2026-09-25: this agent's OWN display_name for the room @mention filter
+   * (`roomDisplayName`). Never the channel's name: a channel called
+   * "Hermesav, Cortina011" must not make `@hermesav` address this agent. A pure
+   * field read; the roster refresh that fills it runs once per ingest cycle,
+   * TTL-gated, before the filter. Undefined until any roster has listed this
+   * agent, in which case the filter still matches the credential agentName and
+   * the identity id.
+   */
+  ownRoomDisplayName() {
+    return this.lastOwnDisplayName;
+  }
+  /** Phase 3 F3: the loop guard's view of the sender — server roster first. */
+  loopSenderIsAgent(channelId, senderId, envelopeSaysAgent, relayedHumanTurn) {
+    if (relayedHumanTurn) return false;
+    const row = this.freshRoster(channelId)?.get(senderId);
+    if (row) return row.is_agent;
+    return envelopeSaysAgent;
+  }
+  noteAgentTurnSuppressed(agentHops) {
+    this.agentLoopSuppressed++;
+    writeServiceLog2("info", "inbound.agent_turn_suppressed", { agent_hops: agentHops });
+  }
+  /**
+   * Phase 3 F1: whether `channelId`'s buffered work must be HELD because the
+   * agent is paused there. Held work stays durably pending (never acked, no
+   * delivery attempt spent) and is released by {@link recheckPause} once the
+   * owner resumes the agent. Only a channel whose send was refused with
+   * `agent_paused` is ever held. Holding arms a recheck at the end of the
+   * PAUSE_RECHECK_MS window, so release does not depend on new traffic.
+   */
+  heldForPause(channelId) {
+    const at = this.pausedChannels.get(channelId);
+    if (at === void 0) return false;
+    this.schedulePauseRecheck(channelId, at);
+    return true;
+  }
+  schedulePauseRecheck(channelId, confirmedAt) {
+    if (this.closingDown || this.pauseRecheckTimers.has(channelId)) return;
+    const delay = Math.max(0, confirmedAt + PAUSE_RECHECK_MS - Date.now());
+    const timer = setTimeout(() => {
+      void this.recheckPause(channelId).catch((e) => {
+        writeServiceLog2("warn", "pause.recheck_failed", {}, e);
+      });
+    }, delay);
+    timer.unref?.();
+    this.pauseRecheckTimers.set(channelId, timer);
+  }
+  /**
+   * Re-read this agent's own membership row. Still paused → keep holding and
+   * re-arm while work is held. Resumed — or a failed/inconclusive probe, which
+   * fails OPEN so a channel is never left deaf (the worst case is one model
+   * call whose reply is refused again, re-arming the pause) — releases the
+   * held work and pokes consumers to drain it now.
+   */
+  async recheckPause(channelId) {
+    const timer = this.pauseRecheckTimers.get(channelId);
+    if (timer) clearTimeout(timer);
+    this.pauseRecheckTimers.delete(channelId);
+    if (!this.pausedChannels.has(channelId) || this.closingDown) return;
+    if (await this.probeOwnPause(channelId) === true) {
+      const now = Date.now();
+      this.pausedChannels.set(channelId, now);
+      if (this.buffer.some((m) => m.channel_id === channelId)) this.schedulePauseRecheck(channelId, now);
+      return;
+    }
+    this.clearPause(channelId);
+  }
+  clearPause(channelId) {
+    this.pausedChannels.delete(channelId);
+    const timer = this.pauseRecheckTimers.get(channelId);
+    if (timer) clearTimeout(timer);
+    this.pauseRecheckTimers.delete(channelId);
+    writeServiceLog2("info", "pause.released");
+    this.wakeListeners();
+  }
+  /** Read this agent's own `paused_at` from the enclave roster; undefined = unknown. */
+  async probeOwnPause(channelId) {
+    try {
+      const url = `${this.cfg.apiBase}/api/v1/enclaves/${encodeURIComponent(
+        this.resolveEnclave(channelId)
+      )}/members?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+      const res = await this.fetchImpl(url, {
+        headers: { authorization: `Bearer ${this.cfg.apiKey}` }
+      });
+      if (!res.ok) return void 0;
+      const rows = await res.json();
+      if (!Array.isArray(rows)) return void 0;
+      const own = rows.find(
+        (r) => r?.identity_id === this.cfg.identityId
+      );
+      if (!own) return void 0;
+      return typeof own.paused_at === "string" && own.paused_at.length > 0;
+    } catch (e) {
+      writeServiceLog2("warn", "pause.probe_failed", {}, e);
+      return void 0;
+    }
+  }
   recordRuntimeReply(inReplyTo, channelId, replyMessageId) {
-    return this.runtimeReplyReceipts.record(inReplyTo, channelId, replyMessageId);
+    return this.store.recordRuntimeReplyReceipt(inReplyTo, channelId, replyMessageId);
   }
   runtimeReplyReceipt(inReplyTo) {
-    return this.runtimeReplyReceipts.get(inReplyTo);
+    return this.store.runtimeReplyReceipt(inReplyTo);
+  }
+  /**
+   * Phase 3 F1: retire a runtime message whose reply failed TERMINALLY
+   * (agent_paused / send_forbidden): acknowledged durably, never redelivered,
+   * so the model is not run again for it. Pokes consumers so a socket holding
+   * it in flight frees the channel for its next message.
+   */
+  retireRuntimeMessage(messageId) {
+    this.ackRuntimeMessages([messageId]);
+    if (this.retiredRuntimeIds.size >= 5e3) {
+      const oldest = this.retiredRuntimeIds.values().next();
+      if (!oldest.done) this.retiredRuntimeIds.delete(oldest.value);
+    }
+    this.retiredRuntimeIds.add(messageId);
+    this.wakeListeners();
+  }
+  isRuntimeMessageRetired(messageId) {
+    return this.retiredRuntimeIds.has(messageId);
+  }
+  /** Complete the durable handoff only after the runtime explicitly acks. */
+  ackRuntimeMessages(messageIds) {
+    for (const messageId of messageIds) {
+      this.store.ackRuntimeInbox(messageId);
+      this.runtimePendingIds.delete(messageId);
+      this.deliveryAttempts.delete(messageId);
+      this.redeliverNotBefore.delete(messageId);
+    }
+  }
+  async restoreRuntimeInbox() {
+    const rows = await this.store.loadRuntimeInbox();
+    for (const row of rows) {
+      const message = JSON.parse(new TextDecoder().decode(row.payload));
+      if (!message || message.message_id !== row.messageId || typeof message.channel_id !== "string") {
+        throw new Error("restored runtime inbox row has an invalid message binding");
+      }
+      this.runtimePendingIds.add(message.message_id);
+      if (row.deliveryAttempts > 0) {
+        this.deliveryAttempts.set(message.message_id, row.deliveryAttempts);
+        if (row.deliveryAttempts < this.maxDeliveryAttempts) {
+          this.redeliverNotBefore.set(message.message_id, Date.now() + redeliveryDelayMs(row.deliveryAttempts));
+        }
+      }
+      this.buffer.push(message);
+    }
+  }
+  /**
+   * Seal a runtime frame before the backend queue id may be acknowledged.
+   * Returning false is backpressure: the caller leaves the backend row unacked
+   * so it remains the durable queue rather than shedding accepted work.
+   */
+  async stageRuntimeMessage(message) {
+    if (this.runtimePendingIds.has(message.message_id)) return true;
+    if (this.runtimePendingIds.size >= this.maxBuffer) {
+      writeServiceLog2("warn", "runtime_inbox.full");
+      return false;
+    }
+    try {
+      const payload = new TextEncoder().encode(JSON.stringify(message));
+      await this.store.stageRuntimeInbox(message.message_id, payload, message.ts);
+      this.runtimePendingIds.add(message.message_id);
+      this.buffer.push(message);
+      return true;
+    } catch (error) {
+      writeServiceLog2("error", "runtime_inbox.stage_failed", {}, error);
+      return false;
+    }
   }
   /**
    * Put messages back at the front (SSE/disconnect write-failure recovery).
@@ -10437,6 +12715,9 @@ var BridgeAgent = class _BridgeAgent {
       buffered: this.buffer.length,
       dropped: this.droppedMessages,
       filtered_room: this.filteredRoomMessages,
+      dead_lettered: this.deadLetteredMessages,
+      paused_channels: this.pausedChannels.size,
+      agent_loop_suppressed: this.agentLoopSuppressed,
       rate_limited: this.rateLimitedSends,
       permanently_skipped: this.provider.permanentlySkippedCount(),
       quarantine_drained: this.provider.quarantineDrainedCount(),
@@ -10489,6 +12770,9 @@ var BridgeAgent = class _BridgeAgent {
       errors: this.provider.errorStats(),
       dropped: this.droppedMessages,
       filteredRoomMessages: this.filteredRoomMessages,
+      deadLetteredMessages: this.deadLetteredMessages,
+      pausedChannels: this.pausedChannels.size,
+      agentLoopSuppressed: this.agentLoopSuppressed,
       rateLimitedSends: this.rateLimitedSends,
       permanentlySkipped: this.provider.permanentlySkippedCount(),
       quarantineDrained: this.provider.quarantineDrainedCount(),
@@ -10500,6 +12784,10 @@ var BridgeAgent = class _BridgeAgent {
   }
   async close() {
     this.closingDown = true;
+    for (const t of this.pauseRecheckTimers.values()) clearTimeout(t);
+    this.pauseRecheckTimers.clear();
+    if (this.redeliveryTimer !== null) clearTimeout(this.redeliveryTimer);
+    this.redeliveryTimer = null;
     this.pingHandle?.close();
     if (this.safetyTimer) clearInterval(this.safetyTimer);
     if (this.runtimeConfigTimer) clearInterval(this.runtimeConfigTimer);
@@ -10518,8 +12806,7 @@ function loadConfig(opts) {
   const raw = readFileSync6(opts.credentialPath, "utf8");
   try {
     const mode = statSync3(opts.credentialPath).mode & 511;
-    if (mode & 63) process.stderr.write(`[bridge] WARNING: credential file ${opts.credentialPath} permission ${mode.toString(8)} is not 0600 \u2014 tighten it (chmod 600).
-`);
+    if (mode & 63) writeServiceLog2("warn", "config.credential_permissions_unsafe");
   } catch {
   }
   let json2;
@@ -10675,6 +12962,9 @@ var BRIDGE_ERRORS = {
   body_too_large: { http: 400, message: "request body exceeds the size limit" },
   channel_pending: { http: 503, message: "channel not yet admitted; retry shortly" },
   rate_limited: { http: 429, message: "rate limit exceeded; retry shortly" },
+  // Phase 3 F1: TERMINAL send outcomes — do not retry the turn.
+  agent_paused: { http: 403, message: "agent is paused in this channel; not sent" },
+  send_forbidden: { http: 403, message: "send refused (credential revoked or not a member); not sent" },
   unknown_action_run: { http: 404, message: "unknown or already-settled action run" },
   // FileSafe vault (B7): digest mismatch, DEK-wrap AEAD failure (bad/dropped
   // nonce, wrong KEK), owner-pin/signature/rollback rejection, or "no wrap
@@ -10697,7 +12987,7 @@ function wsErrorFrame(code, detail) {
 }
 
 // src/http-server.ts
-function writeSse(res, msgs) {
+function writeSse(res, msgs, onWriteError) {
   for (let i = 0; i < msgs.length; i++) {
     if (res.destroyed || res.writableEnded) return msgs.slice(i);
     try {
@@ -10705,12 +12995,24 @@ function writeSse(res, msgs) {
 data: ${JSON.stringify(msgs[i])}
 
 `);
-    } catch {
+    } catch (err) {
+      try {
+        onWriteError?.(err);
+      } catch {
+      }
       return msgs.slice(i);
     }
   }
   return [];
 }
+function sseWriteFailureReporter() {
+  let warned = false;
+  return (error) => {
+    if (warned) return;
+    warned = true;
+    writeServiceLog2("warn", "sse.write_failed", {}, error);
+  };
+}
 function capabilities(opts) {
   return {
     api_version: "1",
@@ -10737,6 +13039,8 @@ var sendSchema = z3.object({
   text: z3.string().optional(),
   idempotency_key: z3.string().optional(),
   in_reply_to: z3.string().min(1).max(200).optional(),
+  /** Final-wave I2: a notice (e.g. a daily-limit reply) is not an agent turn. */
+  notice: z3.boolean().optional(),
   a2a: a2aSchema.optional()
 }).refine((d) => typeof d.text === "string" || d.a2a !== void 0, {
   message: "send requires either text or a2a"
@@ -10862,7 +13166,16 @@ function createHttpServer(agent, opts) {
       if (method === "POST" && path === "/v1/send") {
         const parsed = sendSchema.safeParse(JSON.parse(await readBody(req, SEND_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
-        const r = parsed.data.a2a ? await agent.sendA2A(parsed.data.channel_id, parsed.data.a2a) : await agent.send(parsed.data.channel_id, parsed.data.text);
+        let r;
+        const turn = { agentTurn: isAgentTurn(agent, parsed.data) };
+        try {
+          r = parsed.data.a2a ? await agent.sendA2A(parsed.data.channel_id, parsed.data.a2a, void 0, turn) : await agent.send(parsed.data.channel_id, parsed.data.text, void 0, turn);
+        } catch (e) {
+          if (parsed.data.in_reply_to && (e instanceof AgentPausedSendError || e instanceof SendForbiddenError)) {
+            agent.retireRuntimeMessage(parsed.data.in_reply_to);
+          }
+          throw e;
+        }
         if (parsed.data.in_reply_to) {
           agent.recordRuntimeReply(parsed.data.in_reply_to, parsed.data.channel_id, r.message_id);
         }
@@ -10938,8 +13251,12 @@ function createHttpServer(agent, opts) {
           connection: "keep-alive"
         });
         res.write(":connected\n\n");
+        const onWriteError = sseWriteFailureReporter();
         const drainToClient = () => {
-          const left2 = writeSse(res, agent.takeBuffered(channel));
+          const batch = agent.takeBuffered(channel);
+          const left2 = writeSse(res, batch, onWriteError);
+          const leftIds = new Set(left2.map((message) => message.message_id));
+          agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
           if (left2.length) agent.requeueFront(left2);
         };
         const unsubscribe = agent.subscribe(drainToClient);
@@ -10967,11 +13284,12 @@ function createHttpServer(agent, opts) {
       }
       if (e instanceof ChannelPendingError) return jsonError(res, "channel_pending");
       if (e instanceof RateLimitedError) return jsonError(res, "rate_limited");
+      if (e instanceof AgentPausedSendError) return jsonError(res, "agent_paused");
+      if (e instanceof SendForbiddenError) return jsonError(res, "send_forbidden");
       if (e instanceof InvalidPathError) return jsonError(res, "invalid_request", e.message);
       if (e instanceof VaultIntegrityError) return jsonError(res, "vault_integrity_failed", e.message);
       if (e instanceof SyntaxError) return jsonError(res, "invalid_json");
-      process.stderr.write(`[bridge] request error: ${e?.message ?? e}
-`);
+      writeServiceLog2("error", "http.request_failed", {}, e);
       return jsonError(res, "internal");
     }
   };
@@ -11036,21 +13354,35 @@ function attachAgentWebSocket(server, agent, opts) {
     });
     const inflight = /* @__PURE__ */ new Map();
     const flush = () => {
-      if (sock.readyState !== WebSocket.OPEN) return;
-      const batch = agent.takeBuffered();
-      for (let i = 0; i < batch.length; i++) {
-        if (sock.readyState !== WebSocket.OPEN) {
-          agent.requeueFront(batch.slice(i));
-          return;
+      for (; ; ) {
+        if (sock.readyState !== WebSocket.OPEN) return;
+        const busy = /* @__PURE__ */ new Set();
+        for (const [id, m] of inflight) {
+          if (agent.isRuntimeMessageRetired(id)) inflight.delete(id);
+          else busy.add(m.channel_id);
         }
-        const frame = { type: "message", ...batch[i] };
-        try {
-          sock.send(JSON.stringify(frame));
-          inflight.set(batch[i].message_id, batch[i]);
-        } catch {
-          agent.requeueFront(batch.slice(i));
-          return;
+        const batch = agent.takeDeliverable(busy);
+        if (batch.length === 0) return;
+        let retired = false;
+        for (let i = 0; i < batch.length; i++) {
+          if (sock.readyState !== WebSocket.OPEN) {
+            agent.requeueFront(batch.slice(i));
+            return;
+          }
+          if (!agent.admitRuntimeDelivery(batch[i])) {
+            retired = true;
+            continue;
+          }
+          const frame = { type: "message", ...batch[i] };
+          try {
+            sock.send(JSON.stringify(frame));
+            inflight.set(batch[i].message_id, batch[i]);
+          } catch {
+            agent.requeueFront(batch.slice(i));
+            return;
+          }
         }
+        if (!retired) return;
       }
     };
     const unsubscribe = agent.subscribe(flush);
@@ -11061,7 +13393,9 @@ function attachAgentWebSocket(server, agent, opts) {
       agent.noteSessionClose();
       unsubscribe();
       if (inflight.size) {
-        agent.requeueFront([...inflight.values()]);
+        agent.requeueFailedRuntimeDeliveries(
+          [...inflight.values()].filter((m) => !agent.isRuntimeMessageRetired(m.message_id))
+        );
         inflight.clear();
         agent.wakeListeners();
       }
@@ -11071,7 +13405,7 @@ function attachAgentWebSocket(server, agent, opts) {
     sock.on("close", cleanup);
     sock.on("error", cleanup);
     sock.on("message", (data) => {
-      void handleInbound(sock, agent, data, inflight);
+      void handleInbound(sock, agent, data, inflight, flush);
     });
     flush();
   });
@@ -11095,7 +13429,14 @@ function sendJson(sock, body) {
   } catch {
   }
 }
-async function handleInbound(sock, agent, data, inflight) {
+function sendErrorCode(e) {
+  if (e instanceof ChannelPendingError) return "channel_pending";
+  if (e instanceof RateLimitedError) return "rate_limited";
+  if (e instanceof AgentPausedSendError) return "agent_paused";
+  if (e instanceof SendForbiddenError) return "send_forbidden";
+  return "invalid_request";
+}
+async function handleInbound(sock, agent, data, inflight, flush) {
   let msg;
   try {
     msg = JSON.parse(data.toString("utf8"));
@@ -11114,8 +13455,40 @@ async function handleInbound(sock, agent, data, inflight) {
       return;
     }
     inflight.delete(m.message_id);
+    agent.ackRuntimeMessages([m.message_id]);
+    flush();
+    return;
+  }
+  if (m.type === "hello") {
+    sendJson(sock, { type: "hello", features: ["nack"] });
+    return;
+  }
+  if (m.type === "nack") {
+    if (typeof m.message_id !== "string" || !m.message_id) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    const failed = inflight.get(m.message_id);
+    if (!failed) return;
+    inflight.delete(m.message_id);
+    if (agent.isRuntimeMessageRetired(m.message_id)) {
+      flush();
+      return;
+    }
+    writeServiceLog2("warn", "runtime_inbox.nack", { reply_failed: m.reason === "reply_failed" });
+    agent.requeueFailedRuntimeDeliveries([failed]);
+    flush();
     return;
   }
+  const replyFailed = (e, inReplyTo) => {
+    const code = sendErrorCode(e);
+    if ((code === "agent_paused" || code === "send_forbidden") && typeof inReplyTo === "string") {
+      inflight.delete(inReplyTo);
+      agent.ackRuntimeMessages([inReplyTo]);
+    }
+    sendJson(sock, { ...wsErrorFrame(code), ...typeof inReplyTo === "string" ? { in_reply_to: inReplyTo } : {} });
+    if (code === "agent_paused" || code === "send_forbidden") flush();
+  };
   if (m.type === "send") {
     if (typeof m.channel_id !== "string" || !m.channel_id) {
       sendJson(sock, wsErrorFrame("invalid_request"));
@@ -11132,19 +13505,18 @@ async function handleInbound(sock, agent, data, inflight) {
         return;
       }
       try {
-        const r = await agent.sendA2A(m.channel_id, { a2a_version: a.a2a_version, kind: a.kind, object: a.object });
+        const r = await agent.sendA2A(
+          m.channel_id,
+          { a2a_version: a.a2a_version, kind: a.kind, object: a.object },
+          void 0,
+          { agentTurn: isAgentTurn(agent, m) }
+        );
         if (typeof m.in_reply_to === "string") {
           agent.recordRuntimeReply(m.in_reply_to, m.channel_id, r.message_id);
         }
-        sendJson(sock, { type: "sent", message_id: r.message_id });
+        sendJson(sock, { type: "sent", message_id: r.message_id, in_reply_to: m.in_reply_to });
       } catch (e) {
-        if (e instanceof ChannelPendingError) {
-          sendJson(sock, wsErrorFrame("channel_pending"));
-        } else if (e instanceof RateLimitedError) {
-          sendJson(sock, wsErrorFrame("rate_limited"));
-        } else {
-          sendJson(sock, wsErrorFrame("invalid_request"));
-        }
+        replyFailed(e, m.in_reply_to);
       }
       return;
     }
@@ -11153,19 +13525,13 @@ async function handleInbound(sock, agent, data, inflight) {
       return;
     }
     try {
-      const r = await agent.send(m.channel_id, m.text);
+      const r = await agent.send(m.channel_id, m.text, void 0, { agentTurn: isAgentTurn(agent, m) });
       if (typeof m.in_reply_to === "string") {
         agent.recordRuntimeReply(m.in_reply_to, m.channel_id, r.message_id);
       }
-      sendJson(sock, { type: "sent", message_id: r.message_id });
+      sendJson(sock, { type: "sent", message_id: r.message_id, in_reply_to: m.in_reply_to });
     } catch (e) {
-      if (e instanceof ChannelPendingError) {
-        sendJson(sock, wsErrorFrame("channel_pending"));
-      } else if (e instanceof RateLimitedError) {
-        sendJson(sock, wsErrorFrame("rate_limited"));
-      } else {
-        sendJson(sock, wsErrorFrame("invalid_request"));
-      }
+      replyFailed(e, m.in_reply_to);
     }
     return;
   }