@sgtbeatdown/pi-tasks 0.1.14 → 0.1.16

package/src/task-core.ts

@@ -2,6 +2,7 @@ import {
 	MAX_RELAY_PAYLOAD_BYTES,
 	ORIGIN_CANCELLATION_OPERATION,
 	PARENT_ACKNOWLEDGMENT_OPERATION,
+	TASK_EVENT_TYPES,
 	TASK_PROTOCOL_VERSION,
 	TERMINAL_INTENT_OPERATION,
 	TaskDeliveryEvidenceState,
@@ -10,6 +11,7 @@ import {
 	TaskOutboxDeliveryError,
 	TaskProtocolError,
 	isBlockedOutboxDeliveryCode,
+	taskEventTypes,
 } from "./task-protocol";
 import type {
 	RelayDelivery,
@@ -21,27 +23,30 @@ import type {
 	TaskRelay,
 	TaskSnapshot,
 } from "./task-protocol";
-import type { TaskStore } from "./task-store";
+import type { TaskStore, OutboxRecord, OutboxQuarantineRecord } from "./task-store";
+import { SYSTEM_TASK_TIMERS, TASK_WORK_LIMITS, capacityRetryAt, createTaskWorkScope, deferredTaskDelivery } from "./task-work-scope";
+import type { TaskShipment, TaskTimers, TaskWorkScope } from "./task-work-scope";
 
-const RECEIVE_PAGE_SIZE = 100;
+const RECEIVE_PAGE_SIZE = TASK_WORK_LIMITS.pageItems;
 const DELIVERY_EVIDENCE_OPERATION = "delivery_evidence";
-const TERMINAL_STATUSES = new Set<TaskRecord["status"]>(["completed", "failed", "cancelled", "timed_out"]);
-const TERMINAL_EVENTS = new Set(["task.completed", "task.failed", "task.cancelled", "task.timed_out"]);
-const CONVERSATIONAL_EVENTS = new Set(["task.information", "task.question", "task.answer"]);
-const CANONICAL_EVENTS = new Set([
-	"task.created", "task.completed", "task.failed", "task.cancelled", "task.timed_out",
-	"task.information", "task.question", "task.answer", "task.delivery_receipt", "task.parent_acknowledged", "task.late_terminal",
-]);
-const RECEIVER_INTENT_TYPES = new Set<TaskIntent["type"]>([
-	"task.completed", "task.failed", "task.cancelled", "task.information", "task.question", "task.answer", "task.delivery_receipt",
-]);
+const RECEIVED_INTENT_OPERATION = "received_intent";
+const TERMINAL_STATUSES: ReadonlySet<TaskRecord["status"]> = new Set(Object.values(TASK_EVENT_TYPES).flatMap(type => type.status ?? []));
+const TERMINAL_EVENTS = taskEventTypes(type => type.terminal);
+const CONVERSATIONAL_EVENTS = taskEventTypes(type => type.conversational);
+const CANONICAL_EVENTS = taskEventTypes(() => true);
+const RECEIVER_INTENT_TYPES = taskEventTypes(type => type.intent);
 const IGNORE_OUTBOX_FAILURES: ReadonlySet<string> = new Set();
+/** The blocked-send code that records a target loss, the precondition of a reassignment. */
+const TARGET_LOSS_CODE = "TARGET_NOT_REGISTERED";
+const REASSIGNED_EVENT = "task.reassigned";
 
 export interface TaskCoreOptions {
 	readonly endpoint: TaskEndpoint;
 	readonly relay: TaskRelay;
 	readonly store: TaskStore;
 	readonly clock?: { readonly now: () => number };
+	/** Delivery budget time (deadline, slices, cooldowns); defaults to system time. Separate from `clock`, which stamps task records. */
+	readonly timers?: TaskTimers;
 	readonly ids?: () => string;
 }
 
@@ -61,50 +66,180 @@ export type SubmitIntentOutcome =
 	| { readonly authority: "origin"; readonly canonicalEvent: { readonly type: string; readonly reused: boolean } }
 	| { readonly authority: "receiver" };
 
-/** Local wake-request evidence is persisted before Pi wake emission; relay delivery is flushed afterward. */
+/** Local `wake_accepted` evidence is persisted before Pi wake emission; flush delivers it once the wake is observed. */
 export interface WakeRequest {
 	flush(signal?: AbortSignal): Promise<void>;
+	/** Withdraws the never-sent record when Pi did not accept the wake; call synchronously after the wake attempt. */
+	discard(): void;
 }
 
+/** One presentable inbox item, merged by store arrival order. Local items are origin-canonicalized events that never travel through the relay to the origin. */
+export type TaskInboxItem =
+	| { readonly kind: "relay"; readonly delivery: RelayDelivery; readonly order: number }
+	| { readonly kind: "local"; readonly event: TaskEvent; readonly order: number };
+
 export interface TaskCore {
 	readonly endpoint: TaskEndpoint;
-	connect(signal?: AbortSignal): Promise<void>;
-	createTask(input: CreateTaskInput, signal?: AbortSignal): Promise<{ readonly taskId: string }>;
+	connect(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	createTask(input: CreateTaskInput, signal?: AbortSignal, work?: TaskWorkScope): Promise<{ readonly taskId: string }>;
 	getTask(taskId: string): TaskSnapshot | undefined;
 	listTasks(): readonly TaskSnapshot[];
-	flushOutbox(signal?: AbortSignal): Promise<void>;
-	receive(signal?: AbortSignal): Promise<readonly RelayDelivery[]>;
-	acknowledgeRelayDelivery(cursor: string, signal?: AbortSignal): Promise<void>;
-	submitIntent(input: SubmitIntentInput, signal?: AbortSignal): Promise<void>;
-	submitIntentWithOutcome?(input: SubmitIntentInput, signal?: AbortSignal): Promise<SubmitIntentOutcome>;
-	recordInsertion(input: { readonly taskId: string; readonly eventId: string }, signal?: AbortSignal): Promise<void>;
-	recordWakeRequest(input: { readonly taskId: string; readonly eventId: string }): WakeRequest;
-	evaluateTimeouts(signal?: AbortSignal): Promise<void>;
-	acknowledgeParent(taskId: string, signal?: AbortSignal): Promise<void>;
+	/** True while any task is active or the outbox holds pending envelopes; drives the background poll cadence. */
+	hasPendingWork(): boolean;
+	/** Synchronous notification after each committed store change; returns the unsubscribe function. */
+	onChange(listener: () => void): () => void;
+	/** Correlate a receiver conversation with a locally recorded outbound intent, never session history or payload author claims. */
+	isSelfAuthoredConversation(event: TaskEvent): boolean;
+	/** Offers pending mail with bounded old-work retry; in a phased pass this is the explicit final retry phase. */
+	flushOutbox(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	receive(signal?: AbortSignal, work?: TaskWorkScope): Promise<readonly TaskInboxItem[]>;
+	/** Intake phase of a phased pass: persists and canonicalizes without sending or ACKing; required fan-out joins `work.shipments`. */
+	intakeInbox(signal?: AbortSignal, work?: TaskWorkScope): Promise<readonly TaskInboxItem[]>;
+	/** Ship phase of a phased pass: sends `work.shipments` in persist order and records each outcome; only abort throws. */
+	shipRequired(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	/** Acknowledge-phase repair: retries staged raw ACKs, then reports local deferral of a raw intent still pending. */
+	repairAcknowledgements(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	/** Retire a local item after its Pi insertion and wake evidence exist; no relay ACK or receipt. */
+	completeLocalPresentation(eventId: string): void;
+	acknowledgeRelayDelivery(cursor: string, signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	submitIntent(input: SubmitIntentInput, signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	submitIntentWithOutcome?(input: SubmitIntentInput, signal?: AbortSignal, work?: TaskWorkScope): Promise<SubmitIntentOutcome>;
+	recordInsertion(input: { readonly taskId: string; readonly eventId: string }, signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	recordWakeRequest(input: { readonly taskId: string; readonly eventId: string }, work?: TaskWorkScope): WakeRequest;
+	evaluateTimeouts(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	acknowledgeParent(taskId: string, signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	/**
+	 * Origin-only: after a recorded TARGET_NOT_REGISTERED loss of the current target, resolves the lost
+	 * target's successor and sends it a `task.reassigned` assignment carrying the task history.
+	 */
+	reassignTask?(taskId: string, signal?: AbortSignal, work?: TaskWorkScope): Promise<{ readonly taskId: string; readonly target: TaskEndpoint }>;
 }
 
 type ReceivedEnvelope =
-	| { readonly kind: "assignment"; readonly task: Omit<TaskRecord, "events">; readonly event: TaskEvent }
+	| { readonly kind: "assignment"; readonly task: Omit<TaskRecord, "events">; readonly event: TaskEvent; readonly history: readonly TaskEvent[] }
 	| { readonly kind: "intent"; readonly task: TaskRecord; readonly intent: TaskIntent }
 	| { readonly kind: "canonical_event"; readonly task: TaskRecord; readonly event: TaskEvent };
 
 export function createTaskCore(options: TaskCoreOptions): TaskCore {
 	const clock = options.clock ?? { now: (): number => Date.now() };
+	const timers = options.timers ?? SYSTEM_TASK_TIMERS;
+	const workScope = (signal?: AbortSignal, mode?: "background" | "foreground" | "phased") => createTaskWorkScope(signal, mode, timers);
 	const ids = options.ids ?? (() => crypto.randomUUID());
-	const acknowledgeRelayDelivery = async (cursor: string, signal?: AbortSignal): Promise<void> => {
+	const flush = createOutboxFlusher(options);
+	const acknowledgeWithSignal = async (cursor: string, signal: AbortSignal, work: TaskWorkScope): Promise<void> => {
 		if (!decimal(cursor)) throw new TaskProtocolError("INVALID_CURSOR", "relay cursor must be a non-negative integer");
 		const envelopeId = options.store.pendingRelayEnvelopeId(options.endpoint, cursor);
 		if (envelopeId === undefined) throw new TaskProtocolError("INVALID_CURSOR", "relay delivery is not pending in this endpoint scope");
+		const retryAt = options.store.relayAcknowledgementRetryAt(options.endpoint, cursor);
+		if (retryAt > timers.now() || !work.claimAcknowledgement(cursor)) throw deferredTaskDelivery({ cursor, retryAfterMs: Math.max(0, retryAt - timers.now()) });
 		options.store.transaction(() => options.store.requestRelayAcknowledgement(options.endpoint, cursor));
-		await options.relay.acknowledgeDelivery({ endpoint: options.endpoint, cursor, envelopeId }, signal);
-		options.store.transaction(() => options.store.acknowledgeRelayCursor(options.endpoint, cursor));
+		try {
+			await waitForRelayOperation(options.relay.acknowledgeDelivery({ endpoint: options.endpoint, cursor, envelopeId }, signal), signal);
+			throwIfAborted(signal);
+			options.store.transaction(() => options.store.acknowledgeRelayCursor(options.endpoint, cursor));
+		} catch (error) {
+			if (signal.aborted) throw error;
+			const retryAt = capacityRetryAt(error, timers.now());
+			if (retryAt !== undefined) options.store.transaction(() => options.store.requestRelayAcknowledgement(options.endpoint, cursor, retryAt));
+			throw error;
+		}
+	};
+	const acknowledgeRelayDelivery = (cursor: string, signal?: AbortSignal, work = workScope(signal)): Promise<void> => acknowledgeWithSignal(cursor, work.signal, work);
+	const retryRequestedAcknowledgements = async (work: TaskWorkScope): Promise<void> => {
+		for (const cursor of options.store.requestedRelayAcknowledgements(options.endpoint, TASK_WORK_LIMITS.acknowledgements, timers.now())) {
+			if (!work.canAcknowledge() || !work.canRepairAcknowledgement()) break;
+			if (!work.attemptedAcknowledgements.has(cursor) && options.store.pendingRelayEnvelopeId(options.endpoint, cursor) !== undefined) await acknowledgeWithSignal(cursor, work.backgroundSignal(), work);
+		}
+	};
+	/** Sends required envelopes now, or defers them to the ship phase of a phased pass. */
+	const ship = async (signal: AbortSignal, envelopeIds: readonly string[], work: TaskWorkScope, verify?: () => void): Promise<void> => {
+		if (work.phased) { work.shipments.push({ envelopeIds, verify, shipped: false }); return; }
+		try {
+			if (envelopeIds.length > 0) await flush(signal, new Set(envelopeIds), work);
+		} catch (error) {
+			verify?.();
+			throw error;
+		}
+		verify?.();
 	};
-	const retryRequestedAcknowledgements = async (signal?: AbortSignal): Promise<void> => {
-		for (const cursor of options.store.requestedRelayAcknowledgements(options.endpoint)) {
-			if (options.store.pendingRelayEnvelopeId(options.endpoint, cursor) !== undefined) await acknowledgeRelayDelivery(cursor, signal);
+	/** Ship phase: sends each shipment in persist order and records its outcome; only abort throws. */
+	const shipAll = async (shipments: readonly TaskShipment[], work: TaskWorkScope): Promise<void> => {
+		for (const shipment of shipments) {
+			if (shipment.shipped) continue;
+			let failure: unknown;
+			try { if (shipment.envelopeIds.length > 0) await flush(work.signal, new Set(shipment.envelopeIds), work, false); } catch (error) {
+				if (work.signal.aborted) throw error;
+				failure = error;
+			}
+			// A blocked-delivery error replaces the send failure, as for an immediate send.
+			try { shipment.verify?.(); } catch (error) { failure = error; }
+			shipment.shipped = true;
+			shipment.failure = failure;
+			if (failure === undefined) shipment.accepted?.();
+		}
+	};
+	/** Acknowledge-phase repair of staged raw ACKs; a raw intent still pending afterwards reports local deferral. */
+	const repairAcknowledgements = async (work: TaskWorkScope): Promise<void> => {
+		await retryRequestedAcknowledgements(work);
+		const pendingRaw = options.store.pendingRelayDeliveries(options.endpoint).find(pending => options.store.inboxEnvelope(pending.envelopeId)?.kind === TaskEnvelopeKind.intent);
+		if (pendingRaw) throw deferredTaskDelivery({ cursor: pendingRaw.cursor,
+			retryAfterMs: Math.max(0, options.store.relayAcknowledgementRetryAt(options.endpoint, pendingRaw.cursor) - timers.now()) });
+	};
+	/**
+	 * Intake phase: re-drives tracked, unacknowledged relay deliveries from the local inbox, then fetches
+	 * after the intake cursor while the pending set has room. It persists and canonicalizes without sending:
+	 * each raw intent's required fan-out becomes a shipment whose acceptance stages that intent's ACK.
+	 */
+	const intake = async (signal: AbortSignal, shipments: TaskShipment[]): Promise<readonly TaskInboxItem[]> => {
+		const visibleDeliveries: RelayDelivery[] = [];
+		const settle = (delivery: RelayDelivery, received: ReceivedEnvelope, persistedEnvelopeIds: readonly string[]): void => {
+			if (received.kind !== "intent") { visibleDeliveries.push(delivery); return; }
+			// Accepted fan-out authorizes the ACK; the checkpoint owns the staged request.
+			shipments.push({ envelopeIds: persistedEnvelopeIds, shipped: false, accepted: () => options.store.transaction(() => options.store.requestRelayAcknowledgement(
+				options.endpoint, delivery.cursor, options.store.relayAcknowledgementRetryAt(options.endpoint, delivery.cursor))) });
+		};
+		// A staged ACK request already proves accepted fanout; re-drive the rest.
+		const staged = new Set(options.store.requestedRelayAcknowledgements(options.endpoint, Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER));
+		for (const pending of options.store.pendingRelayDeliveries(options.endpoint)) {
+			if (staged.has(pending.cursor)) continue;
+			const envelope = options.store.inboxEnvelope(pending.envelopeId);
+			if (envelope === undefined) throw new Error("pending relay delivery was not persisted");
+			const received = validateReceivedEnvelope(options, envelope);
+			const persistedEnvelopeIds = received.kind === "intent" ? options.store.transaction(() => persistReceivedEnvelope(options, clock.now, ids, received, envelope.envelopeId)) : [];
+			settle({ cursor: pending.cursor, envelope }, received, persistedEnvelopeIds);
+		}
+		let cursor = options.store.relayIntakeCursor(options.endpoint);
+		for (let room = TASK_WORK_LIMITS.pendingDeliveries - options.store.pendingRelayDeliveries(options.endpoint).length; room > 0;
+			room = TASK_WORK_LIMITS.pendingDeliveries - options.store.pendingRelayDeliveries(options.endpoint).length) {
+			const limit = Math.min(RECEIVE_PAGE_SIZE, room);
+			const page = await options.relay.receive({ endpoint: options.endpoint, cursor, limit }, signal);
+			throwIfAborted(signal);
+			if (!isInboxPage(page) || page.deliveries.length > limit) throw new TaskProtocolError("INVALID_INBOX", "relay returned an invalid inbox page");
+			let previous = BigInt(cursor);
+			for (const delivery of page.deliveries) {
+				if (!isDelivery(delivery) || !sameEndpoint(delivery.envelope.target, options.endpoint) || BigInt(delivery.cursor) <= previous) throw new TaskProtocolError("INVALID_DELIVERY", "relay returned an invalid or unordered delivery");
+				previous = BigInt(delivery.cursor);
+			}
+			if (page.nextCursor !== (page.deliveries.at(-1)?.cursor ?? cursor) || (!page.deliveries.length && page.hasMore)) throw new TaskProtocolError("INVALID_INBOX", "relay page cursor does not describe its deliveries");
+			for (const delivery of page.deliveries) {
+				const received = validateReceivedEnvelope(options, delivery.envelope);
+				let persistedEnvelopeIds: readonly string[] = [];
+				options.store.transaction(() => {
+					// Track only with persistence: the intake cursor never passes an unpersisted delivery,
+					// so an abort or a rejected envelope leaves the suffix to be fetched again.
+					options.store.trackRelayDeliveries(options.endpoint, [{ cursor: delivery.cursor, envelopeId: delivery.envelope.envelopeId }]);
+					if (!options.store.persistInbox(delivery.envelope, delivery.cursor) && received.kind !== "intent") return;
+					persistedEnvelopeIds = persistReceivedEnvelope(options, clock.now, ids, received, delivery.envelope.envelopeId);
+				});
+				settle(delivery, received, persistedEnvelopeIds);
+			}
+			cursor = page.nextCursor;
+			if (!page.hasMore) break;
 		}
+		return inboxItems(options.store, visibleDeliveries);
 	};
-	const submitIntentWithOutcome = async (input: SubmitIntentInput, signal?: AbortSignal): Promise<SubmitIntentOutcome> => {
+	const submitIntentWithOutcome = async (input: SubmitIntentInput, signal?: AbortSignal, work = workScope(signal, "foreground")): Promise<SubmitIntentOutcome> => {
+		signal = work.signal;
 		if (!RECEIVER_INTENT_TYPES.has(input.type) || !isRecord(input.payload)) throw new TaskProtocolError("INVALID_INTENT", "intent type or payload is invalid");
 		let persistedEnvelopeIds: readonly string[] = [];
 		let outcome: SubmitIntentOutcome | undefined;
@@ -120,10 +255,10 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 			outcome = persisted.outcome;
 		});
 		if (evidence !== undefined) {
-			await flushDeliveryEvidence(options, signal, input.taskId, persistedEnvelopeIds, evidence);
+			await ship(signal, persistedEnvelopeIds, work, () => throwIfDeliveryEvidenceBlocked(options.store, input.taskId, persistedEnvelopeIds, evidence));
 		} else {
 			try {
-				await flush(options, signal, new Set(persistedEnvelopeIds));
+				await flush(signal, new Set(persistedEnvelopeIds), work);
 			} catch (error) {
 				if (originCancellation) throwIfCancellationDeliveryBlocked(options, input.taskId, persistedEnvelopeIds);
 				throw error;
@@ -137,15 +272,19 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 
 	return {
 		endpoint: options.endpoint,
-		async connect(signal) {
+		async connect(signal, work = workScope(signal)) {
+			signal = work.signal;
 			const connection = await options.relay.connect({ endpoint: options.endpoint, protocolVersion: TASK_PROTOCOL_VERSION, receiveCursor: options.store.getReceiveCursor() }, signal);
 			if (!sameEndpoint(connection.endpoint, options.endpoint)) throw new TaskProtocolError("INVALID_CONNECTION", "relay connected a different endpoint");
 			throwIfAborted(signal);
-			await retryRequestedAcknowledgements(signal);
+			// A phased pass repairs in its acknowledge phase, after intake.
+			if (!work.phased) await retryRequestedAcknowledgements(work);
 		},
-		async createTask(input, signal) {
+		async createTask(input, signal, work = workScope(signal, "foreground")) {
+			signal = work.signal;
 			if (input.task.length === 0 || !Number.isInteger(input.timeoutMs) || input.timeoutMs < 1) throw new TaskProtocolError("INVALID_TASK", "task and a positive timeout are required");
 			const target = await options.relay.resolve({ relay: input.target.relay, reference: input.target.id }, signal);
+			throwIfAborted(signal);
 			if (!isEndpoint(target)) throw new TaskProtocolError("INVALID_TARGET", "relay resolved an invalid task endpoint");
 			const now = clock.now();
 			const taskId = ids();
@@ -161,52 +300,88 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 				options.store.putOutbox(assignment);
 			});
 			try {
-				await flush(options, signal, new Set([assignment.envelopeId]));
+				await flush(signal, new Set([assignment.envelopeId]), work);
 			} catch (error) {
 				throw operationError(error, taskId);
 			}
 			return { taskId };
 		},
+		async reassignTask(taskId, signal, work = workScope(signal, "foreground")) {
+			signal = work.signal;
+			const lost = lostTarget(options, taskId).target;
+			const target = await options.relay.resolve({ relay: lost.relay, reference: lost.id }, signal);
+			throwIfAborted(signal);
+			if (!isEndpoint(target)) throw new TaskProtocolError("INVALID_TARGET", "relay resolved an invalid task endpoint");
+			if (sameEndpoint(target, lost)) throw reassignmentRefused(taskId, "the lost target resolved to itself");
+			const assignmentId = ids();
+			options.store.transaction(() => {
+				// Re-checked here: a concurrent reassignment already moved the target, so one loss allows one reassignment.
+				const task = lostTarget(options, taskId);
+				if (!sameEndpoint(task.target, lost)) throw reassignmentRefused(taskId, "the task target changed during resolution");
+				const now = clock.now();
+				const record: Omit<TaskRecord, "events"> = {
+					taskId, protocolVersion: task.protocolVersion, origin: task.origin, target, task: task.task,
+					createdAt: task.createdAt, expiresAt: task.expiresAt, status: task.status,
+				};
+				const reassigned = event(record, ids(), REASSIGNED_EVENT, String(task.events.length + 1), options.endpoint, target, now, { task: task.task, previousTarget: lost });
+				// Origin-local delivery evidence never travels to a target.
+				const history = task.events.filter(candidate => TASK_EVENT_TYPES[candidate.type]?.evidence !== true);
+				options.store.setTarget(taskId, target);
+				options.store.appendEvent(reassigned);
+				options.store.putOutbox(envelope(assignmentId, options.endpoint, target, taskId, TaskEnvelopeKind.assignment, reassignmentPayload(record, reassigned, history), now));
+				if (!sameEndpoint(target, options.endpoint)) options.store.enqueuePresentation({ taskId, eventId: reassigned.eventId });
+			});
+			try {
+				await flush(signal, new Set([assignmentId]), work);
+			} catch (error) {
+				throw operationError(error, taskId);
+			}
+			return { taskId, target };
+		},
 		getTask(taskId) { return options.store.getTask(taskId); },
 		listTasks() { return options.store.listTasks(); },
-		async flushOutbox(signal) { await flush(options, signal); },
-		async receive(signal) {
-			await retryRequestedAcknowledgements(signal);
-			await flush(options, signal, IGNORE_OUTBOX_FAILURES);
-			const cursor = options.store.getReceiveCursor();
-			const page = await options.relay.receive({ endpoint: options.endpoint, cursor, limit: RECEIVE_PAGE_SIZE }, signal);
-			if (!isInboxPage(page)) throw new TaskProtocolError("INVALID_INBOX", "relay returned an invalid inbox page");
-			let previous = BigInt(cursor);
-			for (const delivery of page.deliveries) {
-				if (!isDelivery(delivery) || !sameEndpoint(delivery.envelope.target, options.endpoint) || BigInt(delivery.cursor) <= previous) throw new TaskProtocolError("INVALID_DELIVERY", "relay returned an invalid or unordered delivery");
-				previous = BigInt(delivery.cursor);
-			}
-			if (BigInt(page.nextCursor) < previous) throw new TaskProtocolError("INVALID_INBOX", "relay page cursor precedes its deliveries");
-			// Track the entire observed prefix before an intent can ACK a later
-			// delivery. Keep only pending IDs plus a high-water mark, durably.
-			options.store.transaction(() => options.store.trackRelayDeliveries(options.endpoint, page.deliveries.map(delivery => ({ cursor: delivery.cursor, envelopeId: delivery.envelope.envelopeId }))));
-			const visibleDeliveries: RelayDelivery[] = [];
-			for (const delivery of page.deliveries) {
-				if (options.store.pendingRelayEnvelopeId(options.endpoint, delivery.cursor) === undefined) continue;
-				const received = validateReceivedEnvelope(options, delivery.envelope);
-				let persistedEnvelopeIds: readonly string[] = [];
-				options.store.transaction(() => {
-					if (!options.store.persistInbox(delivery.envelope, delivery.cursor)) return;
-					persistedEnvelopeIds = persistReceivedEnvelope(options, clock.now, ids, received);
-				});
-				if (persistedEnvelopeIds.length > 0) await flush(options, signal, new Set(persistedEnvelopeIds));
-				if (received.kind === "intent") {
-					await this.acknowledgeRelayDelivery(delivery.cursor, signal);
-					continue;
+		onChange(listener) { return options.store.onChange(listener); },
+		hasPendingWork() { return options.store.hasPendingOutbox() || options.store.hasActiveTasks(); },
+		isSelfAuthoredConversation(event) {
+			if (!CONVERSATIONAL_EVENTS.has(event.type) || typeof event.payload.intentId !== "string") return false;
+			const task = options.store.getTask(event.taskId);
+			if (!task || !sameEndpoint(options.endpoint, task.target) || sameEndpoint(options.endpoint, task.origin)
+				|| !sameEndpoint(event.source, task.origin) || !sameEndpoint(event.target, task.target)) return false;
+			const localEnvelope = options.store.getIntentEnvelope(event.payload.intentId);
+			if (!localEnvelope || localEnvelope.kind !== TaskEnvelopeKind.intent || localEnvelope.taskId !== task.taskId
+				|| !sameEndpoint(localEnvelope.source, options.endpoint) || !sameEndpoint(localEnvelope.target, task.origin)) return false;
+			const intent = parsePayload(localEnvelope);
+			return isTaskIntent(intent) && intent.taskId === event.taskId && intent.type === event.type && intent.intentId === event.payload.intentId;
+		},
+		async flushOutbox(signal, work = workScope(signal)) { await flush(work.signal, undefined, work, true); },
+		async receive(signal, work = workScope(signal)) {
+			// The phases of a pass without presentation; the first fan-out or repair failure surfaces after them.
+			const shipments: TaskShipment[] = [];
+			let items: readonly TaskInboxItem[], failure: unknown;
+			try {
+				items = await intake(work.signal, shipments);
+				await shipAll(shipments, work);
+				failure = shipments.find(shipment => shipment.failure !== undefined)?.failure;
+				try { await repairAcknowledgements(work); } catch (error) {
+					if (work.signal.aborted) throw error;
+					failure ??= error;
 				}
-				visibleDeliveries.push(delivery);
+			} finally {
+				// A phased driver owns the later retry share; direct receive retains its own.
+				if (!work.phased && !work.signal.aborted) await flush(work.signal, IGNORE_OUTBOX_FAILURES, work, true);
 			}
-			return visibleDeliveries;
+			if (failure !== undefined) throw failure;
+			return items;
 		},
+		async intakeInbox(signal, work = workScope(signal, "phased")) { return intake(work.signal, work.shipments); },
+		async shipRequired(signal, work = workScope(signal, "phased")) { await shipAll(work.shipments, work); },
+		async repairAcknowledgements(signal, work = workScope(signal)) { await repairAcknowledgements(work); },
 		acknowledgeRelayDelivery,
-		async submitIntent(input, signal) { await submitIntentWithOutcome(input, signal); },
+		completeLocalPresentation(eventId) { options.store.completePresentation(eventId); },
+		async submitIntent(input, signal, work) { await submitIntentWithOutcome(input, signal, work); },
 		submitIntentWithOutcome,
-		async recordInsertion(input, signal) {
+		async recordInsertion(input, signal, work = workScope(signal)) {
+			signal = work.signal;
 			const task = requiredTask(options.store, input.taskId);
 			const evidence: DeliveryEvidence = { eventId: input.eventId, stage: TaskDeliveryStage.piInserted, state: TaskDeliveryEvidenceState.confirmed };
 			let persistedEnvelopeIds: readonly string[] = [];
@@ -218,24 +393,37 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 					payload: { eventId: input.eventId, stage: evidence.stage, state: evidence.state },
 				}, deliveryEvidenceOperation(evidence)).envelopeIds;
 			});
-			await flushDeliveryEvidence(options, signal, input.taskId, persistedEnvelopeIds, evidence);
+			await ship(signal, persistedEnvelopeIds, work, () => throwIfDeliveryEvidenceBlocked(options.store, input.taskId, persistedEnvelopeIds, evidence));
 		},
-		recordWakeRequest(input) {
-			const task = requiredTask(options.store, input.taskId);
-			const evidence: DeliveryEvidence = { eventId: input.eventId, stage: TaskDeliveryStage.wakeRequested, state: TaskDeliveryEvidenceState.confirmed };
-			let persistedEnvelopeIds: readonly string[] = [];
-			options.store.transaction(() => {
-				persistedEnvelopeIds = persistIntent(options, clock.now, ids, task, {
+		recordWakeRequest(input, work) {
+			const evidence: DeliveryEvidence = { eventId: input.eventId, stage: TaskDeliveryStage.wakeAccepted, state: TaskDeliveryEvidenceState.confirmed };
+			const operation = deliveryEvidenceOperation(evidence);
+			const persist = () => options.store.transaction(() => {
+				options.store.putInsertionReceipt(input.taskId, input.eventId);
+				return persistIntent(options, clock.now, ids, requiredTask(options.store, input.taskId), {
 					taskId: input.taskId,
 					type: "task.delivery_receipt",
 					payload: { eventId: input.eventId, stage: evidence.stage, state: evidence.state },
-				}, deliveryEvidenceOperation(evidence)).envelopeIds;
+				}, operation);
 			});
-			return { flush: async (signal?: AbortSignal): Promise<void> => {
-				await flushDeliveryEvidence(options, signal, input.taskId, persistedEnvelopeIds, evidence);
-			} };
+			// An origin canonicalizes evidence straight into its task log, which cannot be withdrawn,
+			// so it records on flush; a receiver writes its outbound record before the wake.
+			let persisted = sameEndpoint(options.endpoint, requiredTask(options.store, input.taskId).origin) ? undefined : persist();
+			return {
+				flush: async (signal?: AbortSignal): Promise<void> => {
+					const { envelopeIds } = persisted ??= persist();
+					const activeWork = work ?? workScope(signal);
+					await ship(activeWork.signal, envelopeIds, activeWork, () => throwIfDeliveryEvidenceBlocked(options.store, input.taskId, envelopeIds, evidence));
+				},
+				discard: () => {
+					// No await separates the write from this call, so the envelope was never offered to the relay.
+					if (persisted?.created) options.store.discardUnsentOperation(input.taskId, operation);
+					persisted = undefined;
+				},
+			};
 		},
-		async evaluateTimeouts(signal) {
+		async evaluateTimeouts(signal, work = workScope(signal)) {
+			signal = work.signal;
 			const persistedEnvelopeIds: string[] = [];
 			for (const candidate of options.store.listTasks()) {
 				if (!sameEndpoint(candidate.origin, options.endpoint) || TERMINAL_STATUSES.has(candidate.status) || candidate.expiresAt > clock.now()) continue;
@@ -245,9 +433,10 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 					persistedEnvelopeIds.push(...canonicalize(options, clock.now, ids, task, { intentId: ids(), taskId: task.taskId, type: "task.cancelled", payload: {} }, "task.timed_out").envelopeIds);
 				});
 			}
-			if (persistedEnvelopeIds.length > 0) await flush(options, signal, new Set(persistedEnvelopeIds));
+			if (persistedEnvelopeIds.length > 0) await ship(signal, persistedEnvelopeIds, work);
 		},
-		async acknowledgeParent(taskId, signal) {
+		async acknowledgeParent(taskId, signal, work = workScope(signal)) {
+			signal = work.signal;
 			let persistedEnvelopeIds: readonly string[] = [];
 			options.store.transaction(() => {
 				const task = requiredTask(options.store, taskId);
@@ -255,7 +444,7 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 				if (!TERMINAL_STATUSES.has(task.status)) throw new TaskProtocolError("TASK_NOT_TERMINAL", "only a terminal task may be acknowledged", { retryable: false });
 				persistedEnvelopeIds = canonicalize(options, clock.now, ids, task, { intentId: ids(), taskId, type: "task.information", payload: {} }, "task.parent_acknowledged", PARENT_ACKNOWLEDGMENT_OPERATION).envelopeIds;
 			});
-			await flush(options, signal, new Set(persistedEnvelopeIds));
+			await flush(signal, new Set(persistedEnvelopeIds), work);
 		},
 	};
 }
@@ -272,6 +461,7 @@ function validateReceivedEnvelope(options: TaskCoreOptions, relayEnvelope: unkno
 
 function validateAssignment(envelope: RelayEnvelope, payload: unknown): ReceivedEnvelope {
 	if (!isRecord(payload) || !isTaskRecordInput(payload.task) || !isTaskEvent(payload.event)) throw new TaskProtocolError("INVALID_ASSIGNMENT", "assignment payload is malformed");
+	if (payload.event.type === REASSIGNED_EVENT) return validateReassignment(envelope, payload, payload.task, payload.event);
 	const task = payload.task;
 	const created = payload.event;
 	if (envelope.taskId !== task.taskId || envelope.taskId !== created.taskId || task.protocolVersion !== TASK_PROTOCOL_VERSION
@@ -280,7 +470,66 @@ function validateAssignment(envelope: RelayEnvelope, payload: unknown): Received
 		|| !sameEndpoint(created.source, task.origin) || !sameEndpoint(created.target, task.target)) {
 		throw new TaskProtocolError("INVALID_ASSIGNMENT", "assignment envelope headers do not match its payload");
 	}
-	return { kind: "assignment", task, event: created };
+	return { kind: "assignment", task, event: created, history: [] };
+}
+
+/**
+ * A reassignment carries history addressed to earlier targets, so each carried event is checked
+ * against the task and its origin, not the current target. Without `historyTruncated` it starts at `task.created`.
+ */
+function validateReassignment(envelope: RelayEnvelope, payload: Record<string, unknown>, task: Omit<TaskRecord, "events">, reassigned: TaskEvent): ReceivedEnvelope {
+	const truncated = payload.historyTruncated === true;
+	const history = payload.history;
+	if (!Array.isArray(history) || !history.every(isTaskEvent) || (payload.historyTruncated !== undefined && !truncated)) throw new TaskProtocolError("INVALID_ASSIGNMENT", "reassignment payload is malformed");
+	let previous = 0n;
+	const carried = history.every(event => {
+		const ordered = BigInt(event.sequence) > previous;
+		previous = BigInt(event.sequence);
+		return ordered && event.taskId === task.taskId && CANONICAL_EVENTS.has(event.type) && TASK_EVENT_TYPES[event.type]?.evidence !== true && sameEndpoint(event.source, task.origin);
+	});
+	const first = history[0];
+	if (envelope.taskId !== task.taskId || envelope.taskId !== reassigned.taskId || task.protocolVersion !== TASK_PROTOCOL_VERSION
+		|| task.status !== "active" || task.expiresAt < task.createdAt || reassigned.payload.task !== task.task
+		|| !sameEndpoint(envelope.source, task.origin) || !sameEndpoint(envelope.target, task.target)
+		|| !sameEndpoint(reassigned.source, task.origin) || !sameEndpoint(reassigned.target, task.target)
+		|| !carried || previous >= BigInt(reassigned.sequence)
+		|| (!truncated && (first?.type !== "task.created" || first.sequence !== "1" || first.payload.task !== task.task))) {
+		throw new TaskProtocolError("INVALID_ASSIGNMENT", "reassignment headers, payload or history do not match");
+	}
+	return { kind: "assignment", task, event: reassigned, history };
+}
+
+/** The task, its reassignment and as much of the latest history as fits the relay payload limit. */
+function reassignmentPayload(task: Omit<TaskRecord, "events">, reassigned: TaskEvent, history: readonly TaskEvent[]): unknown {
+	const bytes = (value: unknown): number => new TextEncoder().encode(JSON.stringify(value)).byteLength;
+	const complete = { task, event: reassigned, history };
+	if (bytes(complete) <= MAX_RELAY_PAYLOAD_BYTES) return complete;
+	// Keep the newest suffix: each kept event costs its JSON plus a separating comma.
+	let size = bytes({ task, event: reassigned, history: [], historyTruncated: true });
+	let start = history.length;
+	while (start > 0) {
+		const next = size + bytes(history[start - 1]) + (start === history.length ? 0 : 1);
+		if (next > MAX_RELAY_PAYLOAD_BYTES) break;
+		size = next;
+		start--;
+	}
+	if (size > MAX_RELAY_PAYLOAD_BYTES) throw new TaskProtocolError("PAYLOAD_TOO_LARGE", "reassignment exceeds the relay payload limit", { retryable: false });
+	return { task, event: reassigned, history: history.slice(start), historyTruncated: true };
+}
+
+/** The origin's active task whose current target has a recorded TARGET_NOT_REGISTERED loss. */
+function lostTarget(options: TaskCoreOptions, taskId: string): TaskSnapshot {
+	const task = requiredTask(options.store, taskId);
+	if (!sameEndpoint(task.origin, options.endpoint)) throw new TaskProtocolError("NOT_ORIGIN", "only the origin may reassign a task", { retryable: false });
+	if (task.status !== "active") throw reassignmentRefused(taskId, "the task is not active");
+	// Keyed on the current target: leftover envelopes to an earlier target never re-trigger.
+	const lost = options.store.quarantinedOutbox().some(record => record.errorCode === TARGET_LOSS_CODE && record.envelope.taskId === taskId && sameEndpoint(record.envelope.target, task.target));
+	if (!lost) throw reassignmentRefused(taskId, "no loss of the current target is recorded");
+	return task;
+}
+
+function reassignmentRefused(taskId: string, reason: string): TaskProtocolError {
+	return new TaskProtocolError("REASSIGNMENT_REFUSED", `task cannot be reassigned: ${reason}`, { retryable: false, details: { taskId } });
 }
 
 function validateIntent(options: TaskCoreOptions, envelope: RelayEnvelope, payload: unknown): ReceivedEnvelope {
@@ -305,13 +554,16 @@ function validateCanonicalEvent(options: TaskCoreOptions, envelope: RelayEnvelop
 	return { kind: "canonical_event", task, event: payload };
 }
 
-function persistReceivedEnvelope(options: TaskCoreOptions, now: () => number, ids: () => string, received: ReceivedEnvelope): readonly string[] {
+function persistReceivedEnvelope(options: TaskCoreOptions, now: () => number, ids: () => string, received: ReceivedEnvelope, envelopeId: string): readonly string[] {
 	if (received.kind === "assignment") {
 		options.store.putTask(received.task);
+		// A known task follows the reassignment; carried history is append-only and skips events already held.
+		if (received.event.type === REASSIGNED_EVENT) options.store.setTarget(received.task.taskId, received.task.target);
+		for (const carried of received.history) options.store.appendEvent(carried);
 		options.store.appendEvent(received.event);
 		return [];
 	}
-	if (received.kind === "intent") return canonicalize(options, now, ids, received.task, received.intent, received.intent.type).envelopeIds;
+	if (received.kind === "intent") return canonicalize(options, now, ids, received.task, received.intent, received.intent.type, `${RECEIVED_INTENT_OPERATION}:${envelopeId}`).envelopeIds;
 	if (options.store.appendEvent(received.event) && TERMINAL_EVENTS.has(received.event.type)) options.store.setStatus(received.task.taskId, statusFor(received.event.type));
 	return [];
 }
@@ -319,16 +571,18 @@ function persistReceivedEnvelope(options: TaskCoreOptions, now: () => number, id
 interface PersistedIntent {
 	readonly envelopeIds: readonly string[];
 	readonly outcome: SubmitIntentOutcome;
+	/** False when an existing operation reservation was reused. */
+	readonly created: boolean;
 }
 
 function persistIntent(options: TaskCoreOptions, now: () => number, ids: () => string, task: TaskRecord, input: SubmitIntentInput, reservedOperation?: string): PersistedIntent {
 	if (!sameEndpoint(options.endpoint, task.origin) && !sameEndpoint(options.endpoint, task.target)) throw new TaskProtocolError("NOT_PARTICIPANT", "historical task belongs to a different endpoint", { retryable: false });
 	if (sameEndpoint(options.endpoint, task.origin)) {
 		const operation = input.type === "task.cancelled" ? ORIGIN_CANCELLATION_OPERATION : reservedOperation;
-		// The origin already recorded its own conversational event; echo only peer-authored conversations back for model incorporation.
-		const echoCanonicalEventToOrigin = !CONVERSATIONAL_EVENTS.has(input.type);
-		const canonical = canonicalize(options, now, ids, task, { intentId: ids(), taskId: input.taskId, type: input.type, payload: input.payload }, input.type, operation, echoCanonicalEventToOrigin);
-		return { envelopeIds: canonical.envelopeIds, outcome: { authority: "origin", canonicalEvent: { type: canonical.eventType, reused: canonical.reused } } };
+		// The origin already recorded its own conversational event; present only peer-authored conversations for model incorporation.
+		const presentToOrigin = !CONVERSATIONAL_EVENTS.has(input.type);
+		const canonical = canonicalize(options, now, ids, task, { intentId: ids(), taskId: input.taskId, type: input.type, payload: input.payload }, input.type, operation, presentToOrigin);
+		return { envelopeIds: canonical.envelopeIds, outcome: { authority: "origin", canonicalEvent: { type: canonical.eventType, reused: canonical.reused } }, created: !canonical.reused };
 	}
 	const envelopeId = ids();
 	const intent: TaskIntent = { intentId: ids(), taskId: input.taskId, type: input.type, payload: input.payload };
@@ -348,12 +602,12 @@ function persistIntent(options: TaskCoreOptions, now: () => number, ids: () => s
 					details: { taskId: input.taskId, existingType: reservation.record.logicalType, requestedType: intent.type },
 				});
 			}
-			return { envelopeIds: reservation.record.envelopeIds, outcome: { authority: "receiver" } };
+			return { envelopeIds: reservation.record.envelopeIds, outcome: { authority: "receiver" }, created: false };
 		}
 	}
 	options.store.putIntent(intent.intentId, input.taskId, envelopeId);
 	options.store.putOutbox(envelope(envelopeId, options.endpoint, task.origin, input.taskId, TaskEnvelopeKind.intent, intent, now()));
-	return { envelopeIds: [envelopeId], outcome: { authority: "receiver" } };
+	return { envelopeIds: [envelopeId], outcome: { authority: "receiver" }, created: true };
 }
 
 interface DeliveryEvidence {
@@ -387,15 +641,18 @@ interface Canonicalization {
 	readonly reused: boolean;
 }
 
-function canonicalize(options: TaskCoreOptions, now: () => number, ids: () => string, task: TaskRecord, intent: TaskIntent, requestedType: string, operation?: string, echoCanonicalEventToOrigin = true): Canonicalization {
+/** Origin-only. The origin sees its canonical event through the local presentation queue, never a relay envelope to itself. */
+function canonicalize(options: TaskCoreOptions, now: () => number, ids: () => string, task: TaskRecord, intent: TaskIntent, requestedType: string, operation?: string, presentToOrigin = true): Canonicalization {
 	const terminal = TERMINAL_EVENTS.has(requestedType);
 	const type = terminal && TERMINAL_STATUSES.has(task.status) ? "task.late_terminal" : requestedType;
 	const sequence = String(task.events.length + 1);
-	const canonical = event(task, ids(), type, sequence, options.endpoint, task.target, now(), { intentId: intent.intentId, ...intent.payload });
-	const suppressSelfTargetConversationEcho = !echoCanonicalEventToOrigin && sameEndpoint(task.origin, task.target);
-	const targetEnvelope = suppressSelfTargetConversationEcho ? undefined : envelope(ids(), options.endpoint, task.target, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical, canonical.occurredAt);
-	const originEnvelope = !echoCanonicalEventToOrigin || sameEndpoint(task.origin, task.target) ? undefined : envelope(ids(), options.endpoint, task.origin, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical, canonical.occurredAt);
-	const persistedEnvelopeIds = [targetEnvelope, originEnvelope].flatMap((item) => item === undefined ? [] : [item.envelopeId]);
+	const canonical = event(task, ids(), type, sequence, options.endpoint, task.target, now(), { ...intent.payload, intentId: intent.intentId });
+	// A self-targeted task presents through its target envelope; suppress that for its own conversations.
+	const selfTarget = sameEndpoint(task.origin, task.target);
+	// Delivery evidence is origin-local status: no fan-out to the target and no presentation.
+	const originLocal = TASK_EVENT_TYPES[requestedType]?.evidence === true;
+	const targetEnvelope = originLocal || (!presentToOrigin && selfTarget) ? undefined : envelope(ids(), options.endpoint, task.target, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical, canonical.occurredAt);
+	const persistedEnvelopeIds = targetEnvelope === undefined ? [] : [targetEnvelope.envelopeId];
 	if (operation !== undefined) {
 		const reservation = options.store.reserveTaskOperation({ taskId: task.taskId, operation, logicalId: canonical.eventId, logicalType: canonical.type, envelopeIds: persistedEnvelopeIds });
 		if (!reservation.created) return { envelopeIds: reservation.record.envelopeIds, eventType: reservation.record.logicalType, reused: true };
@@ -403,43 +660,121 @@ function canonicalize(options: TaskCoreOptions, now: () => number, ids: () => st
 	options.store.appendEvent(canonical);
 	if (TERMINAL_EVENTS.has(type)) options.store.setStatus(task.taskId, statusFor(type));
 	if (targetEnvelope !== undefined) options.store.putOutbox(targetEnvelope);
-	if (originEnvelope !== undefined) options.store.putOutbox(originEnvelope);
+	if (presentToOrigin && !selfTarget && !originLocal) options.store.enqueuePresentation({ taskId: task.taskId, eventId: canonical.eventId });
 	return { envelopeIds: persistedEnvelopeIds, eventType: type, reused: false };
 }
 
-async function flushDeliveryEvidence(options: TaskCoreOptions, signal: AbortSignal | undefined, taskId: string, envelopeIds: readonly string[], evidence: DeliveryEvidence): Promise<void> {
-	try {
-		if (envelopeIds.length > 0) await flush(options, signal, new Set(envelopeIds));
-	} catch (error) {
-		throwIfDeliveryEvidenceBlocked(options.store, taskId, envelopeIds, evidence);
-		throw error;
+function inboxItems(store: TaskStore, deliveries: readonly RelayDelivery[]): readonly TaskInboxItem[] {
+	const items: TaskInboxItem[] = deliveries.map((delivery) => {
+		const order = store.inboxOrder(delivery.envelope.envelopeId);
+		if (order === undefined) throw new Error("visible relay delivery was not persisted");
+		return { kind: "relay", delivery, order };
+	});
+	for (const pending of store.pendingPresentations()) {
+		const event = store.getTask(pending.taskId)?.events.find((candidate) => candidate.eventId === pending.eventId);
+		if (event === undefined) throw new Error("local presentation event is not in the task log");
+		items.push({ kind: "local", event, order: pending.order });
 	}
-	throwIfDeliveryEvidenceBlocked(options.store, taskId, envelopeIds, evidence);
-}
-
-async function flush(options: TaskCoreOptions, signal: AbortSignal | undefined, reportedEnvelopeIds?: ReadonlySet<string>): Promise<void> {
-	const failures: Array<{ readonly envelopeId: string; readonly error: unknown }> = [];
-	for (const record of options.store.outbox("pending")) {
-		try {
-			await options.relay.send(record.envelope, signal);
-			options.store.transaction(() => { options.store.markOutboxAccepted(record.envelope.envelopeId); });
-		} catch (error) {
-			if (signal?.aborted || (error instanceof TaskProtocolError && error.code === "ABORTED")) throw error;
-			if (error instanceof TaskProtocolError && isBlockedOutboxDeliveryCode(error.code) && !error.retryable) {
-				options.store.transaction(() => {
-					options.store.quarantineOutbox(record.envelope.envelopeId, {
-						errorCode: error.code,
-						reason: error.message,
-						details: error.details ?? {},
-						quarantinedAt: Date.now(),
-					});
+	return items.sort((left, right) => left.order - right.order);
+}
+
+/** Sends the reported envelopes, then at most once per scope offers bounded old-work retry when `retry` (default: outside a phased pass). */
+type OutboxFlusher = (signal: AbortSignal | undefined, reportedEnvelopeIds: ReadonlySet<string> | undefined, work: TaskWorkScope, retry?: boolean) => Promise<void>;
+
+function createOutboxFlusher(options: TaskCoreOptions): OutboxFlusher {
+	const timers = options.timers ?? SYSTEM_TASK_TIMERS;
+	const inFlight = new Map<string, Promise<void>>();
+	const send = async (record: OutboxRecord, retry: boolean, work: TaskWorkScope): Promise<void> => {
+		const id = record.envelope.envelopeId;
+		// Per-target FIFO: older pending mail to the same target goes first. Wait out an
+		// older send already in flight instead of racing it; otherwise defer behind it.
+		for (let ahead = options.store.pendingOutboxAhead(id); ahead.length; ahead = options.store.pendingOutboxAhead(id)) {
+			const older = ahead.map(olderId => inFlight.get(olderId)).find(Boolean);
+			if (!older) throw deferredTaskDelivery({ envelopeId: id, blockedBy: ahead[0], retryAfterMs: Math.max(0, options.store.outboxRetryAt(ahead[0]!) - timers.now()) });
+			await waitForRelayOperation(older.catch(() => undefined), work.signal);
+		}
+		const joined = inFlight.get(id);
+		if (joined) { await waitForRelayOperation(joined, work.signal); return; }
+		const retryAt = options.store.outboxRetryAt(id);
+		if (retryAt > timers.now() || !work.claimSend(id, retry)) throw deferredTaskDelivery({ envelopeId: id, retryAfterMs: Math.max(0, retryAt - timers.now()) });
+		const signal = retry ? work.backgroundSignal() : work.signal;
+		const delivery = (async (): Promise<void> => {
+			try {
+				await waitForRelayOperation(options.relay.send(record.envelope, signal), signal);
+				throwIfAborted(signal);
+				options.store.transaction(() => options.store.markOutboxAccepted(id));
+			} catch (error) {
+				if (signal.aborted) throw error;
+				const retryAt = capacityRetryAt(error, timers.now());
+				if (retryAt !== undefined) {
+					options.store.postponeOutbox(id, retryAt);
+					// A large foreground refusal does not prove smaller old mail cannot fit.
+					if (retry) work.blockedRetryTargets.add(JSON.stringify(record.envelope.target));
+				}
+				if (error instanceof TaskProtocolError && isBlockedOutboxDeliveryCode(error.code) && !error.retryable) options.store.transaction(() => {
+					options.store.quarantineOutbox(id, { errorCode: error.code, reason: error.message, details: error.details ?? {}, quarantinedAt: timers.now() });
 				});
+				throw error;
+			}
+		})();
+		inFlight.set(id, delivery);
+		try { await delivery; } finally { if (inFlight.get(id) === delivery) inFlight.delete(id); }
+	};
+	return async (signal, reportedEnvelopeIds, work, retry = !work.phased) => {
+		throwIfAborted(signal);
+		let failure: unknown;
+		if (reportedEnvelopeIds) for (const id of reportedEnvelopeIds) {
+			const record = options.store.getOutboxRecord(id);
+			if (record?.state === "accepted") continue;
+			if (!record) {
+				const quarantined = options.store.getQuarantine(id);
+				failure ??= quarantined ? new TaskProtocolError(quarantined.errorCode, quarantined.reason, { retryable: false, details: quarantined.details }) : deferredTaskDelivery({ envelopeId: id });
+				continue;
+			}
+			// Offer older pending mail to the same target first, as bounded old work (retry
+			// budget and background window); its failure leaves this envelope deferred.
+			for (const olderId of options.store.pendingOutboxAhead(id)) {
+				const older = options.store.getOutboxRecord(olderId);
+				if (!older || inFlight.has(olderId)) continue;
+				if (work.blockedRetryTargets.has(JSON.stringify(older.envelope.target))) break;
+				try { await send(older, true, work); } catch (error) { if (work.signal.aborted) throw error; break; }
+			}
+			try { await send(record, false, work); } catch (error) {
+				if (work.signal.aborted) throw error;
+				failure ??= error;
+				if (error instanceof TaskProtocolError && error.code === "TASK_DELIVERY_DEFERRED") break;
 			}
-			failures.push({ envelopeId: record.envelope.envelopeId, error });
 		}
-	}
-	const reportedFailure = failures.find((failure) => reportedEnvelopeIds === undefined || reportedEnvelopeIds.has(failure.envelopeId));
-	if (reportedFailure) throw outboxDeliveryError(reportedFailure.error);
+		if (retry && !work.retryStarted) {
+			work.retryStarted = true;
+			let attempts = 0;
+			for (let inspected = 0; inspected < TASK_WORK_LIMITS.retryInspections && attempts < TASK_WORK_LIMITS.retries; inspected++) {
+				if (!options.store.hasPendingOutbox() || !work.canRetry()) break;
+				// Advance one attempted/actually skipped ID, never an unattempted batch suffix.
+				const record = options.store.selectPendingOutbox(1, timers.now(), 1)[0];
+				if (!record) continue;
+				const id = record.envelope.envelopeId;
+				if (reportedEnvelopeIds?.has(id) || work.attemptedSends.has(id) || inFlight.has(id) || work.blockedRetryTargets.has(JSON.stringify(record.envelope.target))) continue;
+				attempts++;
+				try { await send(record, true, work); } catch (error) {
+					if (work.signal.aborted) throw error;
+					if (reportedEnvelopeIds === undefined) failure ??= error;
+				}
+			}
+		}
+		if (failure === undefined && reportedEnvelopeIds === undefined && options.store.hasPendingOutbox()) failure = deferredTaskDelivery();
+		if (failure !== undefined) throw outboxDeliveryError(failure);
+	};
+}
+
+async function waitForRelayOperation(delivery: Promise<unknown>, signal: AbortSignal): Promise<void> {
+	// Observe the operation first: an abort found here must not leave its later rejection unhandled.
+	delivery.catch(() => undefined);
+	throwIfAborted(signal);
+	let abort!: () => void;
+	const cancelled = new Promise<never>((_, reject) => { abort = () => reject(new TaskProtocolError("ABORTED", "task operation aborted", { details: { mayHaveBeenDelivered: true } })); signal.addEventListener("abort", abort, { once: true }); });
+	try { await Promise.race([delivery, cancelled]); throwIfAborted(signal); }
+	finally { signal.removeEventListener("abort", abort); }
 }
 
 function outboxDeliveryError(error: unknown): TaskOutboxDeliveryError {
@@ -468,9 +803,15 @@ function parsePayload(envelope: RelayEnvelope): unknown {
 	try { return JSON.parse(envelope.payload) as unknown; } catch { throw new TaskProtocolError("INVALID_PAYLOAD", "relay envelope payload is not valid task protocol JSON"); }
 }
 
+/** First of `envelopeIds`, in their order, that is quarantined and matches; indexed per id, not a quarantine scan. */
+function firstQuarantined(store: TaskStore, envelopeIds: readonly string[], matches: (record: OutboxQuarantineRecord) => boolean = () => true): OutboxQuarantineRecord | undefined {
+	for (const id of envelopeIds) { const record = store.getQuarantine(id); if (record && matches(record)) return record; }
+	return undefined;
+}
+
 function throwIfCancellationDeliveryBlocked(options: TaskCoreOptions, taskId: string, envelopeIds: readonly string[]): void {
 	const task = requiredTask(options.store, taskId);
-	const blocked = options.store.quarantinedOutbox().find((record) => envelopeIds.includes(record.envelope.envelopeId) && sameEndpoint(record.envelope.target, task.target));
+	const blocked = firstQuarantined(options.store, envelopeIds, (record) => sameEndpoint(record.envelope.target, task.target));
 	if (blocked === undefined) return;
 	throw new TaskOutboxDeliveryError(blocked.errorCode, blocked.reason, {
 		retryable: false,
@@ -479,7 +820,7 @@ function throwIfCancellationDeliveryBlocked(options: TaskCoreOptions, taskId: st
 }
 
 function throwIfDeliveryEvidenceBlocked(store: TaskStore, taskId: string, envelopeIds: readonly string[], evidence: DeliveryEvidence): void {
-	const blocked = store.quarantinedOutbox().find((record) => envelopeIds.includes(record.envelope.envelopeId));
+	const blocked = firstQuarantined(store, envelopeIds);
 	if (blocked === undefined) return;
 	throw new TaskOutboxDeliveryError(blocked.errorCode, "task delivery evidence is blocked", {
 		retryable: false,
@@ -512,10 +853,7 @@ function requiredTask(store: TaskStore, taskId: string): TaskSnapshot {
 }
 
 function statusFor(type: string): TaskRecord["status"] {
-	if (type === "task.completed") return "completed";
-	if (type === "task.failed") return "failed";
-	if (type === "task.cancelled") return "cancelled";
-	return "timed_out";
+	return TASK_EVENT_TYPES[type]?.status ?? "timed_out";
 }
 
 function isInboxPage(value: unknown): value is { readonly deliveries: readonly RelayDelivery[]; readonly nextCursor: string; readonly hasMore: boolean } {