@sgtbeatdown/pi-tasks 0.1.15 → 0.1.16

package/src/task-core.ts

@@ -2,6 +2,7 @@ import {
 	MAX_RELAY_PAYLOAD_BYTES,
 	ORIGIN_CANCELLATION_OPERATION,
 	PARENT_ACKNOWLEDGMENT_OPERATION,
+	TASK_EVENT_TYPES,
 	TASK_PROTOCOL_VERSION,
 	TERMINAL_INTENT_OPERATION,
 	TaskDeliveryEvidenceState,
@@ -10,6 +11,7 @@ import {
 	TaskOutboxDeliveryError,
 	TaskProtocolError,
 	isBlockedOutboxDeliveryCode,
+	taskEventTypes,
 } from "./task-protocol";
 import type {
 	RelayDelivery,
@@ -21,30 +23,30 @@ import type {
 	TaskRelay,
 	TaskSnapshot,
 } from "./task-protocol";
-import type { TaskStore, OutboxRecord } from "./task-store";
-import { TASK_WORK_LIMITS, capacityRetryAt, createTaskWorkScope, deferredTaskDelivery } from "./task-work-scope";
-import type { TaskWorkScope } from "./task-work-scope";
+import type { TaskStore, OutboxRecord, OutboxQuarantineRecord } from "./task-store";
+import { SYSTEM_TASK_TIMERS, TASK_WORK_LIMITS, capacityRetryAt, createTaskWorkScope, deferredTaskDelivery } from "./task-work-scope";
+import type { TaskShipment, TaskTimers, TaskWorkScope } from "./task-work-scope";
 
 const RECEIVE_PAGE_SIZE = TASK_WORK_LIMITS.pageItems;
 const DELIVERY_EVIDENCE_OPERATION = "delivery_evidence";
 const RECEIVED_INTENT_OPERATION = "received_intent";
-const TERMINAL_STATUSES = new Set<TaskRecord["status"]>(["completed", "failed", "cancelled", "timed_out"]);
-const TERMINAL_EVENTS = new Set(["task.completed", "task.failed", "task.cancelled", "task.timed_out"]);
-const CONVERSATIONAL_EVENTS = new Set(["task.information", "task.question", "task.answer"]);
-const CANONICAL_EVENTS = new Set([
-	"task.created", "task.completed", "task.failed", "task.cancelled", "task.timed_out",
-	"task.information", "task.question", "task.answer", "task.delivery_receipt", "task.parent_acknowledged", "task.late_terminal",
-]);
-const RECEIVER_INTENT_TYPES = new Set<TaskIntent["type"]>([
-	"task.completed", "task.failed", "task.cancelled", "task.information", "task.question", "task.answer", "task.delivery_receipt",
-]);
+const TERMINAL_STATUSES: ReadonlySet<TaskRecord["status"]> = new Set(Object.values(TASK_EVENT_TYPES).flatMap(type => type.status ?? []));
+const TERMINAL_EVENTS = taskEventTypes(type => type.terminal);
+const CONVERSATIONAL_EVENTS = taskEventTypes(type => type.conversational);
+const CANONICAL_EVENTS = taskEventTypes(() => true);
+const RECEIVER_INTENT_TYPES = taskEventTypes(type => type.intent);
 const IGNORE_OUTBOX_FAILURES: ReadonlySet<string> = new Set();
+/** The blocked-send code that records a target loss, the precondition of a reassignment. */
+const TARGET_LOSS_CODE = "TARGET_NOT_REGISTERED";
+const REASSIGNED_EVENT = "task.reassigned";
 
 export interface TaskCoreOptions {
 	readonly endpoint: TaskEndpoint;
 	readonly relay: TaskRelay;
 	readonly store: TaskStore;
 	readonly clock?: { readonly now: () => number };
+	/** Delivery budget time (deadline, slices, cooldowns); defaults to system time. Separate from `clock`, which stamps task records. */
+	readonly timers?: TaskTimers;
 	readonly ids?: () => string;
 }
 
@@ -64,21 +66,41 @@ export type SubmitIntentOutcome =
 	| { readonly authority: "origin"; readonly canonicalEvent: { readonly type: string; readonly reused: boolean } }
 	| { readonly authority: "receiver" };
 
-/** Local wake-request evidence is persisted before Pi wake emission; relay delivery is flushed afterward. */
+/** Local `wake_accepted` evidence is persisted before Pi wake emission; flush delivers it once the wake is observed. */
 export interface WakeRequest {
 	flush(signal?: AbortSignal): Promise<void>;
+	/** Withdraws the never-sent record when Pi did not accept the wake; call synchronously after the wake attempt. */
+	discard(): void;
 }
 
+/** One presentable inbox item, merged by store arrival order. Local items are origin-canonicalized events that never travel through the relay to the origin. */
+export type TaskInboxItem =
+	| { readonly kind: "relay"; readonly delivery: RelayDelivery; readonly order: number }
+	| { readonly kind: "local"; readonly event: TaskEvent; readonly order: number };
+
 export interface TaskCore {
 	readonly endpoint: TaskEndpoint;
 	connect(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
 	createTask(input: CreateTaskInput, signal?: AbortSignal, work?: TaskWorkScope): Promise<{ readonly taskId: string }>;
 	getTask(taskId: string): TaskSnapshot | undefined;
 	listTasks(): readonly TaskSnapshot[];
+	/** True while any task is active or the outbox holds pending envelopes; drives the background poll cadence. */
+	hasPendingWork(): boolean;
+	/** Synchronous notification after each committed store change; returns the unsubscribe function. */
+	onChange(listener: () => void): () => void;
 	/** Correlate a receiver conversation with a locally recorded outbound intent, never session history or payload author claims. */
 	isSelfAuthoredConversation(event: TaskEvent): boolean;
+	/** Offers pending mail with bounded old-work retry; in a phased pass this is the explicit final retry phase. */
 	flushOutbox(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
-	receive(signal?: AbortSignal, work?: TaskWorkScope): Promise<readonly RelayDelivery[]>;
+	receive(signal?: AbortSignal, work?: TaskWorkScope): Promise<readonly TaskInboxItem[]>;
+	/** Intake phase of a phased pass: persists and canonicalizes without sending or ACKing; required fan-out joins `work.shipments`. */
+	intakeInbox(signal?: AbortSignal, work?: TaskWorkScope): Promise<readonly TaskInboxItem[]>;
+	/** Ship phase of a phased pass: sends `work.shipments` in persist order and records each outcome; only abort throws. */
+	shipRequired(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	/** Acknowledge-phase repair: retries staged raw ACKs, then reports local deferral of a raw intent still pending. */
+	repairAcknowledgements(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	/** Retire a local item after its Pi insertion and wake evidence exist; no relay ACK or receipt. */
+	completeLocalPresentation(eventId: string): void;
 	acknowledgeRelayDelivery(cursor: string, signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
 	submitIntent(input: SubmitIntentInput, signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
 	submitIntentWithOutcome?(input: SubmitIntentInput, signal?: AbortSignal, work?: TaskWorkScope): Promise<SubmitIntentOutcome>;
@@ -86,15 +108,22 @@ export interface TaskCore {
 	recordWakeRequest(input: { readonly taskId: string; readonly eventId: string }, work?: TaskWorkScope): WakeRequest;
 	evaluateTimeouts(signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
 	acknowledgeParent(taskId: string, signal?: AbortSignal, work?: TaskWorkScope): Promise<void>;
+	/**
+	 * Origin-only: after a recorded TARGET_NOT_REGISTERED loss of the current target, resolves the lost
+	 * target's successor and sends it a `task.reassigned` assignment carrying the task history.
+	 */
+	reassignTask?(taskId: string, signal?: AbortSignal, work?: TaskWorkScope): Promise<{ readonly taskId: string; readonly target: TaskEndpoint }>;
 }
 
 type ReceivedEnvelope =
-	| { readonly kind: "assignment"; readonly task: Omit<TaskRecord, "events">; readonly event: TaskEvent }
+	| { readonly kind: "assignment"; readonly task: Omit<TaskRecord, "events">; readonly event: TaskEvent; readonly history: readonly TaskEvent[] }
 	| { readonly kind: "intent"; readonly task: TaskRecord; readonly intent: TaskIntent }
 	| { readonly kind: "canonical_event"; readonly task: TaskRecord; readonly event: TaskEvent };
 
 export function createTaskCore(options: TaskCoreOptions): TaskCore {
 	const clock = options.clock ?? { now: (): number => Date.now() };
+	const timers = options.timers ?? SYSTEM_TASK_TIMERS;
+	const workScope = (signal?: AbortSignal, mode?: "background" | "foreground" | "phased") => createTaskWorkScope(signal, mode, timers);
 	const ids = options.ids ?? (() => crypto.randomUUID());
 	const flush = createOutboxFlusher(options);
 	const acknowledgeWithSignal = async (cursor: string, signal: AbortSignal, work: TaskWorkScope): Promise<void> => {
@@ -102,7 +131,7 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 		const envelopeId = options.store.pendingRelayEnvelopeId(options.endpoint, cursor);
 		if (envelopeId === undefined) throw new TaskProtocolError("INVALID_CURSOR", "relay delivery is not pending in this endpoint scope");
 		const retryAt = options.store.relayAcknowledgementRetryAt(options.endpoint, cursor);
-		if (retryAt > Date.now() || !work.claimAcknowledgement(cursor)) throw deferredTaskDelivery({ cursor, retryAfterMs: Math.max(0, retryAt - Date.now()) });
+		if (retryAt > timers.now() || !work.claimAcknowledgement(cursor)) throw deferredTaskDelivery({ cursor, retryAfterMs: Math.max(0, retryAt - timers.now()) });
 		options.store.transaction(() => options.store.requestRelayAcknowledgement(options.endpoint, cursor));
 		try {
 			await waitForRelayOperation(options.relay.acknowledgeDelivery({ endpoint: options.endpoint, cursor, envelopeId }, signal), signal);
@@ -110,19 +139,106 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 			options.store.transaction(() => options.store.acknowledgeRelayCursor(options.endpoint, cursor));
 		} catch (error) {
 			if (signal.aborted) throw error;
-			const retryAt = capacityRetryAt(error);
+			const retryAt = capacityRetryAt(error, timers.now());
 			if (retryAt !== undefined) options.store.transaction(() => options.store.requestRelayAcknowledgement(options.endpoint, cursor, retryAt));
 			throw error;
 		}
 	};
-	const acknowledgeRelayDelivery = (cursor: string, signal?: AbortSignal, work = createTaskWorkScope(signal)): Promise<void> => acknowledgeWithSignal(cursor, work.signal, work);
+	const acknowledgeRelayDelivery = (cursor: string, signal?: AbortSignal, work = workScope(signal)): Promise<void> => acknowledgeWithSignal(cursor, work.signal, work);
 	const retryRequestedAcknowledgements = async (work: TaskWorkScope): Promise<void> => {
-		for (const cursor of options.store.requestedRelayAcknowledgements(options.endpoint, TASK_WORK_LIMITS.acknowledgements, Date.now())) {
+		for (const cursor of options.store.requestedRelayAcknowledgements(options.endpoint, TASK_WORK_LIMITS.acknowledgements, timers.now())) {
 			if (!work.canAcknowledge() || !work.canRepairAcknowledgement()) break;
 			if (!work.attemptedAcknowledgements.has(cursor) && options.store.pendingRelayEnvelopeId(options.endpoint, cursor) !== undefined) await acknowledgeWithSignal(cursor, work.backgroundSignal(), work);
 		}
 	};
-	const submitIntentWithOutcome = async (input: SubmitIntentInput, signal?: AbortSignal, work = createTaskWorkScope(signal, "foreground")): Promise<SubmitIntentOutcome> => {
+	/** Sends required envelopes now, or defers them to the ship phase of a phased pass. */
+	const ship = async (signal: AbortSignal, envelopeIds: readonly string[], work: TaskWorkScope, verify?: () => void): Promise<void> => {
+		if (work.phased) { work.shipments.push({ envelopeIds, verify, shipped: false }); return; }
+		try {
+			if (envelopeIds.length > 0) await flush(signal, new Set(envelopeIds), work);
+		} catch (error) {
+			verify?.();
+			throw error;
+		}
+		verify?.();
+	};
+	/** Ship phase: sends each shipment in persist order and records its outcome; only abort throws. */
+	const shipAll = async (shipments: readonly TaskShipment[], work: TaskWorkScope): Promise<void> => {
+		for (const shipment of shipments) {
+			if (shipment.shipped) continue;
+			let failure: unknown;
+			try { if (shipment.envelopeIds.length > 0) await flush(work.signal, new Set(shipment.envelopeIds), work, false); } catch (error) {
+				if (work.signal.aborted) throw error;
+				failure = error;
+			}
+			// A blocked-delivery error replaces the send failure, as for an immediate send.
+			try { shipment.verify?.(); } catch (error) { failure = error; }
+			shipment.shipped = true;
+			shipment.failure = failure;
+			if (failure === undefined) shipment.accepted?.();
+		}
+	};
+	/** Acknowledge-phase repair of staged raw ACKs; a raw intent still pending afterwards reports local deferral. */
+	const repairAcknowledgements = async (work: TaskWorkScope): Promise<void> => {
+		await retryRequestedAcknowledgements(work);
+		const pendingRaw = options.store.pendingRelayDeliveries(options.endpoint).find(pending => options.store.inboxEnvelope(pending.envelopeId)?.kind === TaskEnvelopeKind.intent);
+		if (pendingRaw) throw deferredTaskDelivery({ cursor: pendingRaw.cursor,
+			retryAfterMs: Math.max(0, options.store.relayAcknowledgementRetryAt(options.endpoint, pendingRaw.cursor) - timers.now()) });
+	};
+	/**
+	 * Intake phase: re-drives tracked, unacknowledged relay deliveries from the local inbox, then fetches
+	 * after the intake cursor while the pending set has room. It persists and canonicalizes without sending:
+	 * each raw intent's required fan-out becomes a shipment whose acceptance stages that intent's ACK.
+	 */
+	const intake = async (signal: AbortSignal, shipments: TaskShipment[]): Promise<readonly TaskInboxItem[]> => {
+		const visibleDeliveries: RelayDelivery[] = [];
+		const settle = (delivery: RelayDelivery, received: ReceivedEnvelope, persistedEnvelopeIds: readonly string[]): void => {
+			if (received.kind !== "intent") { visibleDeliveries.push(delivery); return; }
+			// Accepted fan-out authorizes the ACK; the checkpoint owns the staged request.
+			shipments.push({ envelopeIds: persistedEnvelopeIds, shipped: false, accepted: () => options.store.transaction(() => options.store.requestRelayAcknowledgement(
+				options.endpoint, delivery.cursor, options.store.relayAcknowledgementRetryAt(options.endpoint, delivery.cursor))) });
+		};
+		// A staged ACK request already proves accepted fanout; re-drive the rest.
+		const staged = new Set(options.store.requestedRelayAcknowledgements(options.endpoint, Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER));
+		for (const pending of options.store.pendingRelayDeliveries(options.endpoint)) {
+			if (staged.has(pending.cursor)) continue;
+			const envelope = options.store.inboxEnvelope(pending.envelopeId);
+			if (envelope === undefined) throw new Error("pending relay delivery was not persisted");
+			const received = validateReceivedEnvelope(options, envelope);
+			const persistedEnvelopeIds = received.kind === "intent" ? options.store.transaction(() => persistReceivedEnvelope(options, clock.now, ids, received, envelope.envelopeId)) : [];
+			settle({ cursor: pending.cursor, envelope }, received, persistedEnvelopeIds);
+		}
+		let cursor = options.store.relayIntakeCursor(options.endpoint);
+		for (let room = TASK_WORK_LIMITS.pendingDeliveries - options.store.pendingRelayDeliveries(options.endpoint).length; room > 0;
+			room = TASK_WORK_LIMITS.pendingDeliveries - options.store.pendingRelayDeliveries(options.endpoint).length) {
+			const limit = Math.min(RECEIVE_PAGE_SIZE, room);
+			const page = await options.relay.receive({ endpoint: options.endpoint, cursor, limit }, signal);
+			throwIfAborted(signal);
+			if (!isInboxPage(page) || page.deliveries.length > limit) throw new TaskProtocolError("INVALID_INBOX", "relay returned an invalid inbox page");
+			let previous = BigInt(cursor);
+			for (const delivery of page.deliveries) {
+				if (!isDelivery(delivery) || !sameEndpoint(delivery.envelope.target, options.endpoint) || BigInt(delivery.cursor) <= previous) throw new TaskProtocolError("INVALID_DELIVERY", "relay returned an invalid or unordered delivery");
+				previous = BigInt(delivery.cursor);
+			}
+			if (page.nextCursor !== (page.deliveries.at(-1)?.cursor ?? cursor) || (!page.deliveries.length && page.hasMore)) throw new TaskProtocolError("INVALID_INBOX", "relay page cursor does not describe its deliveries");
+			for (const delivery of page.deliveries) {
+				const received = validateReceivedEnvelope(options, delivery.envelope);
+				let persistedEnvelopeIds: readonly string[] = [];
+				options.store.transaction(() => {
+					// Track only with persistence: the intake cursor never passes an unpersisted delivery,
+					// so an abort or a rejected envelope leaves the suffix to be fetched again.
+					options.store.trackRelayDeliveries(options.endpoint, [{ cursor: delivery.cursor, envelopeId: delivery.envelope.envelopeId }]);
+					if (!options.store.persistInbox(delivery.envelope, delivery.cursor) && received.kind !== "intent") return;
+					persistedEnvelopeIds = persistReceivedEnvelope(options, clock.now, ids, received, delivery.envelope.envelopeId);
+				});
+				settle(delivery, received, persistedEnvelopeIds);
+			}
+			cursor = page.nextCursor;
+			if (!page.hasMore) break;
+		}
+		return inboxItems(options.store, visibleDeliveries);
+	};
+	const submitIntentWithOutcome = async (input: SubmitIntentInput, signal?: AbortSignal, work = workScope(signal, "foreground")): Promise<SubmitIntentOutcome> => {
 		signal = work.signal;
 		if (!RECEIVER_INTENT_TYPES.has(input.type) || !isRecord(input.payload)) throw new TaskProtocolError("INVALID_INTENT", "intent type or payload is invalid");
 		let persistedEnvelopeIds: readonly string[] = [];
@@ -139,7 +255,7 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 			outcome = persisted.outcome;
 		});
 		if (evidence !== undefined) {
-			await flushDeliveryEvidence(options, signal, input.taskId, persistedEnvelopeIds, evidence, work, flush);
+			await ship(signal, persistedEnvelopeIds, work, () => throwIfDeliveryEvidenceBlocked(options.store, input.taskId, persistedEnvelopeIds, evidence));
 		} else {
 			try {
 				await flush(signal, new Set(persistedEnvelopeIds), work);
@@ -156,15 +272,15 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 
 	return {
 		endpoint: options.endpoint,
-		async connect(signal, work = createTaskWorkScope(signal)) {
+		async connect(signal, work = workScope(signal)) {
 			signal = work.signal;
 			const connection = await options.relay.connect({ endpoint: options.endpoint, protocolVersion: TASK_PROTOCOL_VERSION, receiveCursor: options.store.getReceiveCursor() }, signal);
 			if (!sameEndpoint(connection.endpoint, options.endpoint)) throw new TaskProtocolError("INVALID_CONNECTION", "relay connected a different endpoint");
 			throwIfAborted(signal);
-			// A reserved refresh repairs only after the initial page has been intaken.
-			if (work.retryAllowed) await retryRequestedAcknowledgements(work);
+			// A phased pass repairs in its acknowledge phase, after intake.
+			if (!work.phased) await retryRequestedAcknowledgements(work);
 		},
-		async createTask(input, signal, work = createTaskWorkScope(signal, "foreground")) {
+		async createTask(input, signal, work = workScope(signal, "foreground")) {
 			signal = work.signal;
 			if (input.task.length === 0 || !Number.isInteger(input.timeoutMs) || input.timeoutMs < 1) throw new TaskProtocolError("INVALID_TASK", "task and a positive timeout are required");
 			const target = await options.relay.resolve({ relay: input.target.relay, reference: input.target.id }, signal);
@@ -190,8 +306,42 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 			}
 			return { taskId };
 		},
+		async reassignTask(taskId, signal, work = workScope(signal, "foreground")) {
+			signal = work.signal;
+			const lost = lostTarget(options, taskId).target;
+			const target = await options.relay.resolve({ relay: lost.relay, reference: lost.id }, signal);
+			throwIfAborted(signal);
+			if (!isEndpoint(target)) throw new TaskProtocolError("INVALID_TARGET", "relay resolved an invalid task endpoint");
+			if (sameEndpoint(target, lost)) throw reassignmentRefused(taskId, "the lost target resolved to itself");
+			const assignmentId = ids();
+			options.store.transaction(() => {
+				// Re-checked here: a concurrent reassignment already moved the target, so one loss allows one reassignment.
+				const task = lostTarget(options, taskId);
+				if (!sameEndpoint(task.target, lost)) throw reassignmentRefused(taskId, "the task target changed during resolution");
+				const now = clock.now();
+				const record: Omit<TaskRecord, "events"> = {
+					taskId, protocolVersion: task.protocolVersion, origin: task.origin, target, task: task.task,
+					createdAt: task.createdAt, expiresAt: task.expiresAt, status: task.status,
+				};
+				const reassigned = event(record, ids(), REASSIGNED_EVENT, String(task.events.length + 1), options.endpoint, target, now, { task: task.task, previousTarget: lost });
+				// Origin-local delivery evidence never travels to a target.
+				const history = task.events.filter(candidate => TASK_EVENT_TYPES[candidate.type]?.evidence !== true);
+				options.store.setTarget(taskId, target);
+				options.store.appendEvent(reassigned);
+				options.store.putOutbox(envelope(assignmentId, options.endpoint, target, taskId, TaskEnvelopeKind.assignment, reassignmentPayload(record, reassigned, history), now));
+				if (!sameEndpoint(target, options.endpoint)) options.store.enqueuePresentation({ taskId, eventId: reassigned.eventId });
+			});
+			try {
+				await flush(signal, new Set([assignmentId]), work);
+			} catch (error) {
+				throw operationError(error, taskId);
+			}
+			return { taskId, target };
+		},
 		getTask(taskId) { return options.store.getTask(taskId); },
 		listTasks() { return options.store.listTasks(); },
+		onChange(listener) { return options.store.onChange(listener); },
+		hasPendingWork() { return options.store.hasPendingOutbox() || options.store.hasActiveTasks(); },
 		isSelfAuthoredConversation(event) {
 			if (!CONVERSATIONAL_EVENTS.has(event.type) || typeof event.payload.intentId !== "string") return false;
 			const task = options.store.getTask(event.taskId);
@@ -203,60 +353,34 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 			const intent = parsePayload(localEnvelope);
 			return isTaskIntent(intent) && intent.taskId === event.taskId && intent.type === event.type && intent.intentId === event.payload.intentId;
 		},
-		async flushOutbox(signal, work = createTaskWorkScope(signal)) { await flush(work.signal, undefined, work); },
-		async receive(signal, work = createTaskWorkScope(signal)) {
-			signal = work.signal;
-			const retryAllowed = work.retryAllowed;
-			work.retryAllowed = false; // Nested fanout must finish this page before unrelated retries.
+		async flushOutbox(signal, work = workScope(signal)) { await flush(work.signal, undefined, work, true); },
+		async receive(signal, work = workScope(signal)) {
+			// The phases of a pass without presentation; the first fan-out or repair failure surfaces after them.
+			const shipments: TaskShipment[] = [];
+			let items: readonly TaskInboxItem[], failure: unknown;
 			try {
-				const cursor = options.store.getReceiveCursor();
-				const page = await options.relay.receive({ endpoint: options.endpoint, cursor, limit: RECEIVE_PAGE_SIZE }, signal);
-				throwIfAborted(signal);
-				if (!isInboxPage(page) || page.deliveries.length > RECEIVE_PAGE_SIZE) throw new TaskProtocolError("INVALID_INBOX", "relay returned an invalid inbox page");
-				let previous = BigInt(cursor);
-				for (const delivery of page.deliveries) {
-					if (!isDelivery(delivery) || !sameEndpoint(delivery.envelope.target, options.endpoint) || BigInt(delivery.cursor) <= previous) throw new TaskProtocolError("INVALID_DELIVERY", "relay returned an invalid or unordered delivery");
-					previous = BigInt(delivery.cursor);
-				}
-				if (page.nextCursor !== (page.deliveries.at(-1)?.cursor ?? cursor) || (!page.deliveries.length && page.hasMore)) throw new TaskProtocolError("INVALID_INBOX", "relay page cursor does not describe its deliveries");
-				// Track the entire observed prefix before an intent can ACK a later
-				// delivery. Keep only pending IDs plus a high-water mark, durably.
-				options.store.transaction(() => options.store.trackRelayDeliveries(options.endpoint, page.deliveries.map(delivery => ({ cursor: delivery.cursor, envelopeId: delivery.envelope.envelopeId }))));
-				const visibleDeliveries: RelayDelivery[] = [];
-				for (const delivery of page.deliveries) {
-					if (options.store.pendingRelayEnvelopeId(options.endpoint, delivery.cursor) === undefined) continue;
-					const received = validateReceivedEnvelope(options, delivery.envelope);
-					let persistedEnvelopeIds: readonly string[] = [];
-					options.store.transaction(() => {
-						if (!options.store.persistInbox(delivery.envelope, delivery.cursor) && received.kind !== "intent") return;
-						persistedEnvelopeIds = persistReceivedEnvelope(options, clock.now, ids, received, delivery.envelope.envelopeId);
-					});
-					if (persistedEnvelopeIds.length > 0) await flush(signal, new Set(persistedEnvelopeIds), work);
-					if (received.kind === "intent") {
-						// Accepted fanout authorizes ACK, but raw repair must not gate later
-						// facts in this fetched page. The checkpoint owns the staged request.
-						options.store.transaction(() => options.store.requestRelayAcknowledgement(options.endpoint, delivery.cursor,
-							options.store.relayAcknowledgementRetryAt(options.endpoint, delivery.cursor)));
-						continue;
-					}
-					visibleDeliveries.push(delivery);
+				items = await intake(work.signal, shipments);
+				await shipAll(shipments, work);
+				failure = shipments.find(shipment => shipment.failure !== undefined)?.failure;
+				try { await repairAcknowledgements(work); } catch (error) {
+					if (work.signal.aborted) throw error;
+					failure ??= error;
 				}
-				// Repair failure remains visible, but cannot gate this page's protocol intake.
-				await retryRequestedAcknowledgements(work);
-				const pendingRaw = page.deliveries.find(delivery => delivery.envelope.kind === "intent" && options.store.pendingRelayEnvelopeId(options.endpoint, delivery.cursor) !== undefined);
-				if (pendingRaw) throw deferredTaskDelivery({ cursor: pendingRaw.cursor,
-					retryAfterMs: Math.max(0, options.store.relayAcknowledgementRetryAt(options.endpoint, pendingRaw.cursor) - Date.now()) });
-				return visibleDeliveries;
 			} finally {
-				work.retryAllowed = retryAllowed;
-				// Inbox delivery owns the later retry share; direct receive retains its own.
-				if (retryAllowed && !work.signal.aborted) await flush(work.signal, IGNORE_OUTBOX_FAILURES, work);
+				// A phased driver owns the later retry share; direct receive retains its own.
+				if (!work.phased && !work.signal.aborted) await flush(work.signal, IGNORE_OUTBOX_FAILURES, work, true);
 			}
+			if (failure !== undefined) throw failure;
+			return items;
 		},
+		async intakeInbox(signal, work = workScope(signal, "phased")) { return intake(work.signal, work.shipments); },
+		async shipRequired(signal, work = workScope(signal, "phased")) { await shipAll(work.shipments, work); },
+		async repairAcknowledgements(signal, work = workScope(signal)) { await repairAcknowledgements(work); },
 		acknowledgeRelayDelivery,
+		completeLocalPresentation(eventId) { options.store.completePresentation(eventId); },
 		async submitIntent(input, signal, work) { await submitIntentWithOutcome(input, signal, work); },
 		submitIntentWithOutcome,
-		async recordInsertion(input, signal, work = createTaskWorkScope(signal)) {
+		async recordInsertion(input, signal, work = workScope(signal)) {
 			signal = work.signal;
 			const task = requiredTask(options.store, input.taskId);
 			const evidence: DeliveryEvidence = { eventId: input.eventId, stage: TaskDeliveryStage.piInserted, state: TaskDeliveryEvidenceState.confirmed };
@@ -269,25 +393,36 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 					payload: { eventId: input.eventId, stage: evidence.stage, state: evidence.state },
 				}, deliveryEvidenceOperation(evidence)).envelopeIds;
 			});
-			await flushDeliveryEvidence(options, signal, input.taskId, persistedEnvelopeIds, evidence, work, flush);
+			await ship(signal, persistedEnvelopeIds, work, () => throwIfDeliveryEvidenceBlocked(options.store, input.taskId, persistedEnvelopeIds, evidence));
 		},
 		recordWakeRequest(input, work) {
-			const task = requiredTask(options.store, input.taskId);
-			const evidence: DeliveryEvidence = { eventId: input.eventId, stage: TaskDeliveryStage.wakeRequested, state: TaskDeliveryEvidenceState.confirmed };
-			let persistedEnvelopeIds: readonly string[] = [];
-			options.store.transaction(() => {
-				persistedEnvelopeIds = persistIntent(options, clock.now, ids, task, {
+			const evidence: DeliveryEvidence = { eventId: input.eventId, stage: TaskDeliveryStage.wakeAccepted, state: TaskDeliveryEvidenceState.confirmed };
+			const operation = deliveryEvidenceOperation(evidence);
+			const persist = () => options.store.transaction(() => {
+				options.store.putInsertionReceipt(input.taskId, input.eventId);
+				return persistIntent(options, clock.now, ids, requiredTask(options.store, input.taskId), {
 					taskId: input.taskId,
 					type: "task.delivery_receipt",
 					payload: { eventId: input.eventId, stage: evidence.stage, state: evidence.state },
-				}, deliveryEvidenceOperation(evidence)).envelopeIds;
+				}, operation);
 			});
-			return { flush: async (signal?: AbortSignal): Promise<void> => {
-				const activeWork = work ?? createTaskWorkScope(signal);
-				await flushDeliveryEvidence(options, activeWork.signal, input.taskId, persistedEnvelopeIds, evidence, activeWork, flush);
-			} };
+			// An origin canonicalizes evidence straight into its task log, which cannot be withdrawn,
+			// so it records on flush; a receiver writes its outbound record before the wake.
+			let persisted = sameEndpoint(options.endpoint, requiredTask(options.store, input.taskId).origin) ? undefined : persist();
+			return {
+				flush: async (signal?: AbortSignal): Promise<void> => {
+					const { envelopeIds } = persisted ??= persist();
+					const activeWork = work ?? workScope(signal);
+					await ship(activeWork.signal, envelopeIds, activeWork, () => throwIfDeliveryEvidenceBlocked(options.store, input.taskId, envelopeIds, evidence));
+				},
+				discard: () => {
+					// No await separates the write from this call, so the envelope was never offered to the relay.
+					if (persisted?.created) options.store.discardUnsentOperation(input.taskId, operation);
+					persisted = undefined;
+				},
+			};
 		},
-		async evaluateTimeouts(signal, work = createTaskWorkScope(signal)) {
+		async evaluateTimeouts(signal, work = workScope(signal)) {
 			signal = work.signal;
 			const persistedEnvelopeIds: string[] = [];
 			for (const candidate of options.store.listTasks()) {
@@ -298,9 +433,9 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 					persistedEnvelopeIds.push(...canonicalize(options, clock.now, ids, task, { intentId: ids(), taskId: task.taskId, type: "task.cancelled", payload: {} }, "task.timed_out").envelopeIds);
 				});
 			}
-			if (persistedEnvelopeIds.length > 0) await flush(signal, new Set(persistedEnvelopeIds), work);
+			if (persistedEnvelopeIds.length > 0) await ship(signal, persistedEnvelopeIds, work);
 		},
-		async acknowledgeParent(taskId, signal, work = createTaskWorkScope(signal)) {
+		async acknowledgeParent(taskId, signal, work = workScope(signal)) {
 			signal = work.signal;
 			let persistedEnvelopeIds: readonly string[] = [];
 			options.store.transaction(() => {
@@ -326,6 +461,7 @@ function validateReceivedEnvelope(options: TaskCoreOptions, relayEnvelope: unkno
 
 function validateAssignment(envelope: RelayEnvelope, payload: unknown): ReceivedEnvelope {
 	if (!isRecord(payload) || !isTaskRecordInput(payload.task) || !isTaskEvent(payload.event)) throw new TaskProtocolError("INVALID_ASSIGNMENT", "assignment payload is malformed");
+	if (payload.event.type === REASSIGNED_EVENT) return validateReassignment(envelope, payload, payload.task, payload.event);
 	const task = payload.task;
 	const created = payload.event;
 	if (envelope.taskId !== task.taskId || envelope.taskId !== created.taskId || task.protocolVersion !== TASK_PROTOCOL_VERSION
@@ -334,7 +470,66 @@ function validateAssignment(envelope: RelayEnvelope, payload: unknown): Received
 		|| !sameEndpoint(created.source, task.origin) || !sameEndpoint(created.target, task.target)) {
 		throw new TaskProtocolError("INVALID_ASSIGNMENT", "assignment envelope headers do not match its payload");
 	}
-	return { kind: "assignment", task, event: created };
+	return { kind: "assignment", task, event: created, history: [] };
+}
+
+/**
+ * A reassignment carries history addressed to earlier targets, so each carried event is checked
+ * against the task and its origin, not the current target. Without `historyTruncated` it starts at `task.created`.
+ */
+function validateReassignment(envelope: RelayEnvelope, payload: Record<string, unknown>, task: Omit<TaskRecord, "events">, reassigned: TaskEvent): ReceivedEnvelope {
+	const truncated = payload.historyTruncated === true;
+	const history = payload.history;
+	if (!Array.isArray(history) || !history.every(isTaskEvent) || (payload.historyTruncated !== undefined && !truncated)) throw new TaskProtocolError("INVALID_ASSIGNMENT", "reassignment payload is malformed");
+	let previous = 0n;
+	const carried = history.every(event => {
+		const ordered = BigInt(event.sequence) > previous;
+		previous = BigInt(event.sequence);
+		return ordered && event.taskId === task.taskId && CANONICAL_EVENTS.has(event.type) && TASK_EVENT_TYPES[event.type]?.evidence !== true && sameEndpoint(event.source, task.origin);
+	});
+	const first = history[0];
+	if (envelope.taskId !== task.taskId || envelope.taskId !== reassigned.taskId || task.protocolVersion !== TASK_PROTOCOL_VERSION
+		|| task.status !== "active" || task.expiresAt < task.createdAt || reassigned.payload.task !== task.task
+		|| !sameEndpoint(envelope.source, task.origin) || !sameEndpoint(envelope.target, task.target)
+		|| !sameEndpoint(reassigned.source, task.origin) || !sameEndpoint(reassigned.target, task.target)
+		|| !carried || previous >= BigInt(reassigned.sequence)
+		|| (!truncated && (first?.type !== "task.created" || first.sequence !== "1" || first.payload.task !== task.task))) {
+		throw new TaskProtocolError("INVALID_ASSIGNMENT", "reassignment headers, payload or history do not match");
+	}
+	return { kind: "assignment", task, event: reassigned, history };
+}
+
+/** The task, its reassignment and as much of the latest history as fits the relay payload limit. */
+function reassignmentPayload(task: Omit<TaskRecord, "events">, reassigned: TaskEvent, history: readonly TaskEvent[]): unknown {
+	const bytes = (value: unknown): number => new TextEncoder().encode(JSON.stringify(value)).byteLength;
+	const complete = { task, event: reassigned, history };
+	if (bytes(complete) <= MAX_RELAY_PAYLOAD_BYTES) return complete;
+	// Keep the newest suffix: each kept event costs its JSON plus a separating comma.
+	let size = bytes({ task, event: reassigned, history: [], historyTruncated: true });
+	let start = history.length;
+	while (start > 0) {
+		const next = size + bytes(history[start - 1]) + (start === history.length ? 0 : 1);
+		if (next > MAX_RELAY_PAYLOAD_BYTES) break;
+		size = next;
+		start--;
+	}
+	if (size > MAX_RELAY_PAYLOAD_BYTES) throw new TaskProtocolError("PAYLOAD_TOO_LARGE", "reassignment exceeds the relay payload limit", { retryable: false });
+	return { task, event: reassigned, history: history.slice(start), historyTruncated: true };
+}
+
+/** The origin's active task whose current target has a recorded TARGET_NOT_REGISTERED loss. */
+function lostTarget(options: TaskCoreOptions, taskId: string): TaskSnapshot {
+	const task = requiredTask(options.store, taskId);
+	if (!sameEndpoint(task.origin, options.endpoint)) throw new TaskProtocolError("NOT_ORIGIN", "only the origin may reassign a task", { retryable: false });
+	if (task.status !== "active") throw reassignmentRefused(taskId, "the task is not active");
+	// Keyed on the current target: leftover envelopes to an earlier target never re-trigger.
+	const lost = options.store.quarantinedOutbox().some(record => record.errorCode === TARGET_LOSS_CODE && record.envelope.taskId === taskId && sameEndpoint(record.envelope.target, task.target));
+	if (!lost) throw reassignmentRefused(taskId, "no loss of the current target is recorded");
+	return task;
+}
+
+function reassignmentRefused(taskId: string, reason: string): TaskProtocolError {
+	return new TaskProtocolError("REASSIGNMENT_REFUSED", `task cannot be reassigned: ${reason}`, { retryable: false, details: { taskId } });
 }
 
 function validateIntent(options: TaskCoreOptions, envelope: RelayEnvelope, payload: unknown): ReceivedEnvelope {
@@ -362,6 +557,9 @@ function validateCanonicalEvent(options: TaskCoreOptions, envelope: RelayEnvelop
 function persistReceivedEnvelope(options: TaskCoreOptions, now: () => number, ids: () => string, received: ReceivedEnvelope, envelopeId: string): readonly string[] {
 	if (received.kind === "assignment") {
 		options.store.putTask(received.task);
+		// A known task follows the reassignment; carried history is append-only and skips events already held.
+		if (received.event.type === REASSIGNED_EVENT) options.store.setTarget(received.task.taskId, received.task.target);
+		for (const carried of received.history) options.store.appendEvent(carried);
 		options.store.appendEvent(received.event);
 		return [];
 	}
@@ -373,16 +571,18 @@ function persistReceivedEnvelope(options: TaskCoreOptions, now: () => number, id
 interface PersistedIntent {
 	readonly envelopeIds: readonly string[];
 	readonly outcome: SubmitIntentOutcome;
+	/** False when an existing operation reservation was reused. */
+	readonly created: boolean;
 }
 
 function persistIntent(options: TaskCoreOptions, now: () => number, ids: () => string, task: TaskRecord, input: SubmitIntentInput, reservedOperation?: string): PersistedIntent {
 	if (!sameEndpoint(options.endpoint, task.origin) && !sameEndpoint(options.endpoint, task.target)) throw new TaskProtocolError("NOT_PARTICIPANT", "historical task belongs to a different endpoint", { retryable: false });
 	if (sameEndpoint(options.endpoint, task.origin)) {
 		const operation = input.type === "task.cancelled" ? ORIGIN_CANCELLATION_OPERATION : reservedOperation;
-		// The origin already recorded its own conversational event; echo only peer-authored conversations back for model incorporation.
-		const echoCanonicalEventToOrigin = !CONVERSATIONAL_EVENTS.has(input.type);
-		const canonical = canonicalize(options, now, ids, task, { intentId: ids(), taskId: input.taskId, type: input.type, payload: input.payload }, input.type, operation, echoCanonicalEventToOrigin);
-		return { envelopeIds: canonical.envelopeIds, outcome: { authority: "origin", canonicalEvent: { type: canonical.eventType, reused: canonical.reused } } };
+		// The origin already recorded its own conversational event; present only peer-authored conversations for model incorporation.
+		const presentToOrigin = !CONVERSATIONAL_EVENTS.has(input.type);
+		const canonical = canonicalize(options, now, ids, task, { intentId: ids(), taskId: input.taskId, type: input.type, payload: input.payload }, input.type, operation, presentToOrigin);
+		return { envelopeIds: canonical.envelopeIds, outcome: { authority: "origin", canonicalEvent: { type: canonical.eventType, reused: canonical.reused } }, created: !canonical.reused };
 	}
 	const envelopeId = ids();
 	const intent: TaskIntent = { intentId: ids(), taskId: input.taskId, type: input.type, payload: input.payload };
@@ -402,12 +602,12 @@ function persistIntent(options: TaskCoreOptions, now: () => number, ids: () => s
 					details: { taskId: input.taskId, existingType: reservation.record.logicalType, requestedType: intent.type },
 				});
 			}
-			return { envelopeIds: reservation.record.envelopeIds, outcome: { authority: "receiver" } };
+			return { envelopeIds: reservation.record.envelopeIds, outcome: { authority: "receiver" }, created: false };
 		}
 	}
 	options.store.putIntent(intent.intentId, input.taskId, envelopeId);
 	options.store.putOutbox(envelope(envelopeId, options.endpoint, task.origin, input.taskId, TaskEnvelopeKind.intent, intent, now()));
-	return { envelopeIds: [envelopeId], outcome: { authority: "receiver" } };
+	return { envelopeIds: [envelopeId], outcome: { authority: "receiver" }, created: true };
 }
 
 interface DeliveryEvidence {
@@ -441,15 +641,18 @@ interface Canonicalization {
 	readonly reused: boolean;
 }
 
-function canonicalize(options: TaskCoreOptions, now: () => number, ids: () => string, task: TaskRecord, intent: TaskIntent, requestedType: string, operation?: string, echoCanonicalEventToOrigin = true): Canonicalization {
+/** Origin-only. The origin sees its canonical event through the local presentation queue, never a relay envelope to itself. */
+function canonicalize(options: TaskCoreOptions, now: () => number, ids: () => string, task: TaskRecord, intent: TaskIntent, requestedType: string, operation?: string, presentToOrigin = true): Canonicalization {
 	const terminal = TERMINAL_EVENTS.has(requestedType);
 	const type = terminal && TERMINAL_STATUSES.has(task.status) ? "task.late_terminal" : requestedType;
 	const sequence = String(task.events.length + 1);
 	const canonical = event(task, ids(), type, sequence, options.endpoint, task.target, now(), { ...intent.payload, intentId: intent.intentId });
-	const suppressSelfTargetConversationEcho = !echoCanonicalEventToOrigin && sameEndpoint(task.origin, task.target);
-	const targetEnvelope = suppressSelfTargetConversationEcho ? undefined : envelope(ids(), options.endpoint, task.target, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical, canonical.occurredAt);
-	const originEnvelope = !echoCanonicalEventToOrigin || sameEndpoint(task.origin, task.target) ? undefined : envelope(ids(), options.endpoint, task.origin, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical, canonical.occurredAt);
-	const persistedEnvelopeIds = [targetEnvelope, originEnvelope].flatMap((item) => item === undefined ? [] : [item.envelopeId]);
+	// A self-targeted task presents through its target envelope; suppress that for its own conversations.
+	const selfTarget = sameEndpoint(task.origin, task.target);
+	// Delivery evidence is origin-local status: no fan-out to the target and no presentation.
+	const originLocal = TASK_EVENT_TYPES[requestedType]?.evidence === true;
+	const targetEnvelope = originLocal || (!presentToOrigin && selfTarget) ? undefined : envelope(ids(), options.endpoint, task.target, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical, canonical.occurredAt);
+	const persistedEnvelopeIds = targetEnvelope === undefined ? [] : [targetEnvelope.envelopeId];
 	if (operation !== undefined) {
 		const reservation = options.store.reserveTaskOperation({ taskId: task.taskId, operation, logicalId: canonical.eventId, logicalType: canonical.type, envelopeIds: persistedEnvelopeIds });
 		if (!reservation.created) return { envelopeIds: reservation.record.envelopeIds, eventType: reservation.record.logicalType, reused: true };
@@ -457,30 +660,43 @@ function canonicalize(options: TaskCoreOptions, now: () => number, ids: () => st
 	options.store.appendEvent(canonical);
 	if (TERMINAL_EVENTS.has(type)) options.store.setStatus(task.taskId, statusFor(type));
 	if (targetEnvelope !== undefined) options.store.putOutbox(targetEnvelope);
-	if (originEnvelope !== undefined) options.store.putOutbox(originEnvelope);
+	if (presentToOrigin && !selfTarget && !originLocal) options.store.enqueuePresentation({ taskId: task.taskId, eventId: canonical.eventId });
 	return { envelopeIds: persistedEnvelopeIds, eventType: type, reused: false };
 }
 
-async function flushDeliveryEvidence(options: TaskCoreOptions, signal: AbortSignal | undefined, taskId: string, envelopeIds: readonly string[], evidence: DeliveryEvidence, work: TaskWorkScope, flush: OutboxFlusher): Promise<void> {
-	try {
-		if (envelopeIds.length > 0) await flush(signal, new Set(envelopeIds), work);
-	} catch (error) {
-		throwIfDeliveryEvidenceBlocked(options.store, taskId, envelopeIds, evidence);
-		throw error;
+function inboxItems(store: TaskStore, deliveries: readonly RelayDelivery[]): readonly TaskInboxItem[] {
+	const items: TaskInboxItem[] = deliveries.map((delivery) => {
+		const order = store.inboxOrder(delivery.envelope.envelopeId);
+		if (order === undefined) throw new Error("visible relay delivery was not persisted");
+		return { kind: "relay", delivery, order };
+	});
+	for (const pending of store.pendingPresentations()) {
+		const event = store.getTask(pending.taskId)?.events.find((candidate) => candidate.eventId === pending.eventId);
+		if (event === undefined) throw new Error("local presentation event is not in the task log");
+		items.push({ kind: "local", event, order: pending.order });
 	}
-	throwIfDeliveryEvidenceBlocked(options.store, taskId, envelopeIds, evidence);
+	return items.sort((left, right) => left.order - right.order);
 }
 
-type OutboxFlusher = (signal: AbortSignal | undefined, reportedEnvelopeIds: ReadonlySet<string> | undefined, work: TaskWorkScope) => Promise<void>;
+/** Sends the reported envelopes, then at most once per scope offers bounded old-work retry when `retry` (default: outside a phased pass). */
+type OutboxFlusher = (signal: AbortSignal | undefined, reportedEnvelopeIds: ReadonlySet<string> | undefined, work: TaskWorkScope, retry?: boolean) => Promise<void>;
 
 function createOutboxFlusher(options: TaskCoreOptions): OutboxFlusher {
+	const timers = options.timers ?? SYSTEM_TASK_TIMERS;
 	const inFlight = new Map<string, Promise<void>>();
 	const send = async (record: OutboxRecord, retry: boolean, work: TaskWorkScope): Promise<void> => {
 		const id = record.envelope.envelopeId;
+		// Per-target FIFO: older pending mail to the same target goes first. Wait out an
+		// older send already in flight instead of racing it; otherwise defer behind it.
+		for (let ahead = options.store.pendingOutboxAhead(id); ahead.length; ahead = options.store.pendingOutboxAhead(id)) {
+			const older = ahead.map(olderId => inFlight.get(olderId)).find(Boolean);
+			if (!older) throw deferredTaskDelivery({ envelopeId: id, blockedBy: ahead[0], retryAfterMs: Math.max(0, options.store.outboxRetryAt(ahead[0]!) - timers.now()) });
+			await waitForRelayOperation(older.catch(() => undefined), work.signal);
+		}
 		const joined = inFlight.get(id);
 		if (joined) { await waitForRelayOperation(joined, work.signal); return; }
 		const retryAt = options.store.outboxRetryAt(id);
-		if (retryAt > Date.now() || !work.claimSend(id, retry)) throw deferredTaskDelivery({ envelopeId: id, retryAfterMs: Math.max(0, retryAt - Date.now()) });
+		if (retryAt > timers.now() || !work.claimSend(id, retry)) throw deferredTaskDelivery({ envelopeId: id, retryAfterMs: Math.max(0, retryAt - timers.now()) });
 		const signal = retry ? work.backgroundSignal() : work.signal;
 		const delivery = (async (): Promise<void> => {
 			try {
@@ -489,14 +705,14 @@ function createOutboxFlusher(options: TaskCoreOptions): OutboxFlusher {
 				options.store.transaction(() => options.store.markOutboxAccepted(id));
 			} catch (error) {
 				if (signal.aborted) throw error;
-				const retryAt = capacityRetryAt(error);
+				const retryAt = capacityRetryAt(error, timers.now());
 				if (retryAt !== undefined) {
 					options.store.postponeOutbox(id, retryAt);
 					// A large foreground refusal does not prove smaller old mail cannot fit.
 					if (retry) work.blockedRetryTargets.add(JSON.stringify(record.envelope.target));
 				}
 				if (error instanceof TaskProtocolError && isBlockedOutboxDeliveryCode(error.code) && !error.retryable) options.store.transaction(() => {
-					options.store.quarantineOutbox(id, { errorCode: error.code, reason: error.message, details: error.details ?? {}, quarantinedAt: Date.now() });
+					options.store.quarantineOutbox(id, { errorCode: error.code, reason: error.message, details: error.details ?? {}, quarantinedAt: timers.now() });
 				});
 				throw error;
 			}
@@ -504,30 +720,38 @@ function createOutboxFlusher(options: TaskCoreOptions): OutboxFlusher {
 		inFlight.set(id, delivery);
 		try { await delivery; } finally { if (inFlight.get(id) === delivery) inFlight.delete(id); }
 	};
-	return async (signal, reportedEnvelopeIds, work) => {
+	return async (signal, reportedEnvelopeIds, work, retry = !work.phased) => {
 		throwIfAborted(signal);
 		let failure: unknown;
 		if (reportedEnvelopeIds) for (const id of reportedEnvelopeIds) {
 			const record = options.store.getOutboxRecord(id);
 			if (record?.state === "accepted") continue;
 			if (!record) {
-				const quarantined = options.store.quarantinedOutbox().find(item => item.envelope.envelopeId === id);
+				const quarantined = options.store.getQuarantine(id);
 				failure ??= quarantined ? new TaskProtocolError(quarantined.errorCode, quarantined.reason, { retryable: false, details: quarantined.details }) : deferredTaskDelivery({ envelopeId: id });
 				continue;
 			}
+			// Offer older pending mail to the same target first, as bounded old work (retry
+			// budget and background window); its failure leaves this envelope deferred.
+			for (const olderId of options.store.pendingOutboxAhead(id)) {
+				const older = options.store.getOutboxRecord(olderId);
+				if (!older || inFlight.has(olderId)) continue;
+				if (work.blockedRetryTargets.has(JSON.stringify(older.envelope.target))) break;
+				try { await send(older, true, work); } catch (error) { if (work.signal.aborted) throw error; break; }
+			}
 			try { await send(record, false, work); } catch (error) {
 				if (work.signal.aborted) throw error;
 				failure ??= error;
 				if (error instanceof TaskProtocolError && error.code === "TASK_DELIVERY_DEFERRED") break;
 			}
 		}
-		if (work.retryAllowed && !work.retryStarted) {
+		if (retry && !work.retryStarted) {
 			work.retryStarted = true;
 			let attempts = 0;
 			for (let inspected = 0; inspected < TASK_WORK_LIMITS.retryInspections && attempts < TASK_WORK_LIMITS.retries; inspected++) {
 				if (!options.store.hasPendingOutbox() || !work.canRetry()) break;
 				// Advance one attempted/actually skipped ID, never an unattempted batch suffix.
-				const record = options.store.selectPendingOutbox(1, Date.now(), 1)[0];
+				const record = options.store.selectPendingOutbox(1, timers.now(), 1)[0];
 				if (!record) continue;
 				const id = record.envelope.envelopeId;
 				if (reportedEnvelopeIds?.has(id) || work.attemptedSends.has(id) || inFlight.has(id) || work.blockedRetryTargets.has(JSON.stringify(record.envelope.target))) continue;
@@ -544,6 +768,8 @@ function createOutboxFlusher(options: TaskCoreOptions): OutboxFlusher {
 }
 
 async function waitForRelayOperation(delivery: Promise<unknown>, signal: AbortSignal): Promise<void> {
+	// Observe the operation first: an abort found here must not leave its later rejection unhandled.
+	delivery.catch(() => undefined);
 	throwIfAborted(signal);
 	let abort!: () => void;
 	const cancelled = new Promise<never>((_, reject) => { abort = () => reject(new TaskProtocolError("ABORTED", "task operation aborted", { details: { mayHaveBeenDelivered: true } })); signal.addEventListener("abort", abort, { once: true }); });
@@ -577,9 +803,15 @@ function parsePayload(envelope: RelayEnvelope): unknown {
 	try { return JSON.parse(envelope.payload) as unknown; } catch { throw new TaskProtocolError("INVALID_PAYLOAD", "relay envelope payload is not valid task protocol JSON"); }
 }
 
+/** First of `envelopeIds`, in their order, that is quarantined and matches; indexed per id, not a quarantine scan. */
+function firstQuarantined(store: TaskStore, envelopeIds: readonly string[], matches: (record: OutboxQuarantineRecord) => boolean = () => true): OutboxQuarantineRecord | undefined {
+	for (const id of envelopeIds) { const record = store.getQuarantine(id); if (record && matches(record)) return record; }
+	return undefined;
+}
+
 function throwIfCancellationDeliveryBlocked(options: TaskCoreOptions, taskId: string, envelopeIds: readonly string[]): void {
 	const task = requiredTask(options.store, taskId);
-	const blocked = options.store.quarantinedOutbox().find((record) => envelopeIds.includes(record.envelope.envelopeId) && sameEndpoint(record.envelope.target, task.target));
+	const blocked = firstQuarantined(options.store, envelopeIds, (record) => sameEndpoint(record.envelope.target, task.target));
 	if (blocked === undefined) return;
 	throw new TaskOutboxDeliveryError(blocked.errorCode, blocked.reason, {
 		retryable: false,
@@ -588,7 +820,7 @@ function throwIfCancellationDeliveryBlocked(options: TaskCoreOptions, taskId: st
 }
 
 function throwIfDeliveryEvidenceBlocked(store: TaskStore, taskId: string, envelopeIds: readonly string[], evidence: DeliveryEvidence): void {
-	const blocked = store.quarantinedOutbox().find((record) => envelopeIds.includes(record.envelope.envelopeId));
+	const blocked = firstQuarantined(store, envelopeIds);
 	if (blocked === undefined) return;
 	throw new TaskOutboxDeliveryError(blocked.errorCode, "task delivery evidence is blocked", {
 		retryable: false,
@@ -621,10 +853,7 @@ function requiredTask(store: TaskStore, taskId: string): TaskSnapshot {
 }
 
 function statusFor(type: string): TaskRecord["status"] {
-	if (type === "task.completed") return "completed";
-	if (type === "task.failed") return "failed";
-	if (type === "task.cancelled") return "cancelled";
-	return "timed_out";
+	return TASK_EVENT_TYPES[type]?.status ?? "timed_out";
 }
 
 function isInboxPage(value: unknown): value is { readonly deliveries: readonly RelayDelivery[]; readonly nextCursor: string; readonly hasMore: boolean } {