@sgtbeatdown/pi-tasks 0.1.2 → 0.1.4

package/README.md

@@ -1,21 +1,50 @@
 # pi-tasks
 
-`pi-tasks` is a Pi extension client for Wolfpack task transports. The retained v1 adapter uses Wolfpack's machine-global `~/.wolfpack/tasks` store; v2 keeps endpoint-owned Pi task state locally and uses Wolfpack as a content-blind relay. Neither adapter writes assignments to terminals. Read Wolfpack's [harness-neutral task adapter contract](https://github.com/almogdepaz/wolfpack/blob/main/docs/task-adapter-contract.md) for canonical adapter behavior and its [task gateway guide](https://github.com/almogdepaz/wolfpack/blob/main/docs/task-gateway.md) for routes and operations.
+`pi-tasks` is a Pi extension client for Wolfpack task transports. The default v2 adapter keeps endpoint-owned Pi task state locally and uses Wolfpack as a content-blind relay; the retained v1 adapter uses Wolfpack's machine-global `~/.wolfpack/tasks` store. Neither adapter writes assignments to terminals. Wolfpack's [relay v2 control-api contract](https://github.com/almogdepaz/wolfpack/blob/main/docs/control-api-schema.md#pi-tasks-relay-v2-boundary) is canonical for the default transport, while its [task gateway guide](https://github.com/almogdepaz/wolfpack/blob/main/docs/task-gateway.md) documents the explicit v1 compatibility transport.
 
 ## v2 endpoint-owned relay
 
 The default extension uses the configured local Wolfpack relay v2 adapter, never the in-memory conformance relay. It registers an opaque endpoint with `POST /api/task-relay/v2/connect`, stores endpoint-owned task state at the deterministic per-session path `~/.pi/tasks/v2/sessions/<sha256(WOLFPACK_SESSION_NAME)>/tasks.sqlite`, and exchanges opaque relay envelopes through Wolfpack. The adapter needs a Wolfpack release exposing the stable [relay v2 control-api contract](https://github.com/almogdepaz/wolfpack/blob/main/docs/control-api-schema.md#pi-tasks-relay-v2-boundary); a v1-only gateway is incompatible and does not silently fall back.
 
-Set `WOLFPACK_SESSION_NAME` for every Pi process. The adapter uses `WOLFPACK_PORT` when the local control port differs from `18790`; `WOLFPACK_SESSION_NAME` resolves the active Pi process to its relay endpoint. On startup, obtain a target's opaque `{ relay, id }` endpoint from its Wolfpack session-status projection after that target has registered, then send it through the endpoint-owned tool shape:
+Set `WOLFPACK_SESSION_NAME` for every Pi process. The adapter uses `WOLFPACK_PORT` when the local control port differs from `18790`; `WOLFPACK_SESSION_NAME` resolves the active Pi process to its relay endpoint. After the target extension registers, run `wolfpack session status <session> --json` and read its `taskEndpoint`. Pass that opaque `{ relay, id }` value unchanged; do not derive it from a session name, broker ID, terminal label, output, or prose.
+
+### minimal valid v2 send envelope
 
 ```json
 {
-  "to": { "relay": "wolfpack-pi-tasks-v2", "id": "target-opaque-endpoint-id" },
+  "to": {
+    "relay": "wolfpack-pi-tasks-v2",
+    "id": "target-opaque-endpoint-id"
+  },
   "task": "implement the narrow change and run focused tests"
 }
 ```
 
-Wolfpack's relay owns durable mailbox delivery and peer forwarding; Pi owns task lifecycle, logical event order, receipts, and its local SQLite state. Insertion receipts are idempotent by `{ taskId, eventId }`, so replay after Pi has structurally recorded an event cannot create an additional logical receipt. `createInMemoryTaskRelay` remains exported solely as a deterministic conformance fixture.
+The default `agent_task_send` schema is exactly `to`, `task`, and optional `timeoutMs`. v1-only context, role, metadata, preflight, idempotency, and completion-prompt fields are not silently accepted or translated.
+
+Wolfpack's relay owns durable mailbox delivery and peer forwarding; Pi owns task lifecycle, logical event order, receipts, and its local SQLite state. `agent_task_send` returns after relay acceptance only, not Pi insertion or model execution. The receiver inserts model-visible events as structured `pi-tasks-event` custom messages through Pi's safe `deliverAs: "followUp"` queue and records structured `{ taskId, eventId }` insertion evidence. Replay after Pi has structurally recorded an event cannot create an additional logical receipt. `createInMemoryTaskRelay` remains exported solely as a deterministic conformance fixture.
+
+### v2 delegation workflow
+
+1. create or select a role session. For a disposable worker, omit an initial model prompt: `wolfpack agent spawn <project> --name <task-role> --json`. Put all worker instructions in `agent_task_send.task` so the new Pi process can become idle before assignment.
+2. verify structured session readiness, wait for extension registration, and read `taskEndpoint` from `wolfpack session status <session> --json`.
+3. call `agent_task_send` with that endpoint and the complete task instructions. Keep working; use `agent_task_status` or `agent_task_inbox` for structured evidence, and call `agent_task_wait` only when the user explicitly asks to block.
+4. use `agent_task_message` for durable questions, answers, and information. The receiver calls `agent_task_done` as its final action; no completion prose follows.
+5. independently verify the result, call `agent_task_ack({ taskId })` once for that terminal task, then explicitly retain or close only the role sessions the parent spawned.
+
+### v2 worker-only execution gate
+
+Set `PI_TASK_WORKER=1` only when launching a task-only worker. The exact value enables a fail-closed model `tool_call` gate; an absent value or any other value leaves ordinary interactive Pi behavior unchanged. Before assignment, only `agent_task_inbox`, `agent_task_status`, and `agent_task_wait` are allowed. Other current and future model tools are blocked with the stable reason `PI_TASK_WORKER_ASSIGNMENT_REQUIRED`. Explicit user `!`/`!!` shell commands are outside Pi's model `tool_call` event and are not intercepted.
+
+The gate opens only when the current Pi session contains a structured `pi-tasks-event` entry for `task.created` and the same event belongs to a locally persisted active task targeted to the current endpoint. Rendered prompt text, terminal output, unknown events, foreign tasks, and stale terminal tasks do not authorize execution. On restart, durable session evidence reopens the gate only while the matching local task remains eligible.
+
+Preflighting `agent_task_done` marks that task as closing before sibling calls are preflighted. Ordinary tools remain blocked for a closing, pending-terminal, accepted-terminal, or `delivery_blocked` task; an idempotent `agent_task_done` retry for that same assigned task remains allowed. Another independently active assignment can still authorize work.
+
+### v2 terminal delivery and acknowledgment
+
+A receiver task snapshot reports terminal transport separately as `terminalDelivery`: `not_submitted`, `pending`, `accepted`, or `delivery_blocked`. The blocked variant includes the stable intent/envelope identities, origin endpoint, timestamp, and structured non-retryable relay error. Canonical task `status` remains origin-owned and is never changed to `delivery_blocked`. Retryable failures keep the same pending terminal intent and envelope; permanent failures remain inspectable and are not rebound to a successor endpoint without a separate authenticated Wolfpack contract.
+
+`agent_task_ack` is valid only for a terminal origin-owned task. Sequential, concurrent, and restart retries reuse one durable `task.parent_acknowledged` event and the same destination envelope identities while still retrying any pending physical delivery.
 
 ## v1 gateway adapter (retained)
 
@@ -48,7 +77,7 @@ A target is always `{ machine, sessionId }`, where `sessionId` is the stable opa
 }
 ```
 
-### minimal valid send envelope
+### v1 minimal valid send envelope
 
 ```json
 {
@@ -109,7 +138,7 @@ On start or resume it rebuilds incorporated IDs from the full durable session en
 
 ## parent workflow
 
-1. create or select a Wolfpack Pi session with the canonical session-control workflow and retain its stable broker ID. Spawn a disposable worker without an initial model prompt so it reaches idle before assignment; put worker instructions in `agent_task_send.task`.
+1. create or select a Wolfpack Pi session with the canonical session-control workflow and retain its stable broker ID. Spawn a disposable worker without an initial model prompt using `wolfpack agent spawn <project> --name <task-role> --json` so it reaches idle before assignment; put worker instructions in `agent_task_send.task`.
 2. before remote dispatch, complete Wolfpack's [Live-peer readiness checklist](https://github.com/almogdepaz/wolfpack/blob/main/docs/task-gateway.md#live-peer-readiness-checklist) and retain operator-recorded package/reload evidence; only then check the target's local requirements and send compact instructions with curated context and selected refs when they save receiver investigation.
 3. keep working; use `agent_task_status` or `agent_task_inbox` for structured follow-up, and `agent_task_message` for questions, answers, and decisions.
 4. verify cited files, diffs, tests, and paths-only artifact metadata independently before reporting success.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sgtbeatdown/pi-tasks",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Durable Pi agent delegation through the Wolfpack task gateway.",
   "module": "src/index.ts",
   "exports": {

package/skills/wolfpack-pi-task-delegation/SKILL.md

@@ -1,53 +1,81 @@
 ---
 name: wolfpack-pi-task-delegation
-description: Use when opening, selecting, delegating to, checking, or cleaning up a Wolfpack Pi subagent through the gateway-backed agent task tools.
+description: Use when opening, selecting, delegating to, checking, or cleaning up a Wolfpack Pi subagent through the endpoint-owned agent task tools.
 ---
 
 # wolfpack pi task delegation
 
-use `wolfpack-tailnet-control` for session control. this skill covers gateway task lifecycle, curated context, and parent verification. Pi is one conforming adapter. Wolfpack's [harness-neutral task adapter contract](https://github.com/almogdepaz/wolfpack/blob/main/docs/task-adapter-contract.md) is the canonical adapter reference; its [task gateway guide](https://github.com/almogdepaz/wolfpack/blob/main/docs/task-gateway.md) covers routes, trust, retention, and federation.
+use `wolfpack-tailnet-control` for session control. this skill covers endpoint-owned v2 task lifecycle, structured handoffs, and parent verification. The package default is the v2 extension described by Wolfpack's [relay v2 control-api contract](https://github.com/almogdepaz/wolfpack/blob/main/docs/control-api-schema.md#pi-tasks-relay-v2-boundary).
 
-## gateway requirements and addressing
+## v2 requirements and addressing
 
-- every participating Pi process needs this package and a reachable local Wolfpack v1 gateway.
-- `WOLFPACK_SESSION_NAME` is the caller selector; the local gateway resolves it to a stable broker ID. `WOLFPACK_PORT` selects the local port and defaults to `18790`.
-- address a target as `to: { machine, sessionId }`, retaining the stable broker `sessionId` from structured Wolfpack session control rather than a terminal label.
-- use `machine: "local"` for same-machine work. For remote work, use only the receiver's canonical HTTPS Tailnet origin, such as `https://worker.example.ts.net`; never a terminal name, arbitrary URL, path, query, fragment, credentials, or unexpected port.
-- v1 trusts local processes and trusted Tailnet machines. Pi calls only its local gateway; gateways use direct fetch federation. JWT federation is unsupported, so do not promise remote delivery where Wolfpack global JWT requires credentials.
+- load this package's default extension in every participating Pi process and set `WOLFPACK_SESSION_NAME`. Set `WOLFPACK_PORT` only when the local Wolfpack control port differs from `18790`.
+- address `agent_task_send` targets only as `to: { relay, id }`. For the default Wolfpack adapter, the relay is `wolfpack-pi-tasks-v2` and the ID is opaque.
+- create a disposable worker without an initial model prompt: `wolfpack agent spawn <project> --name <task-role> --json`. Do not start a disposable worker with a blocking “wait for assignments” prompt. Put the complete instructions in `agent_task_send.task`.
+- after the target extension registers, run structured session control (`wolfpack session status <session> --json`) and read its `taskEndpoint`. Do not derive endpoint IDs from session names, broker IDs, terminal labels, output, or prose.
+- pass the returned endpoint without translation:
+
+```json
+{
+  "to": { "relay": "wolfpack-pi-tasks-v2", "id": "target-opaque-endpoint-id" },
+  "task": "implement the narrow change and run focused tests",
+  "timeoutMs": 1800000
+}
+```
+
+The default `agent_task_send` schema is exactly `to`, `task`, and optional `timeoutMs`. v1-only fields such as context, role, metadata, preflight, idempotency keys, and completion prompts are not silently accepted or translated.
 
 ## phase roles and handoffs
 
-For a multi-step project phase, retain one persistent implementer and one persistent read-only reviewer. Reuse a healthy role session for corrections and follow-up review; a completed task is an assignment result, not a reason to replace its session. Do not rotate a healthy role session for routine corrections. Rotate only for explicit phase completion, material context saturation, harness failure, or a required independent specialist. Keep at most one active assignment per role unless the user explicitly asks for parallel work.
+For a multi-step project phase, retain one persistent implementer and one persistent read-only reviewer. Reuse a healthy role session for corrections and follow-up review; a completed task finishes one assignment, not the underlying session. Do not rotate a healthy role session for routine corrections. Rotate only for phase completion, material context degradation, harness failure, or required specialist independence. Keep at most one active assignment per role unless the user explicitly approves parallel work.
+
+After every verified and acknowledged terminal task, explicitly retain a parent-spawned session only when concrete follow-up is likely; otherwise close it through canonical Wolfpack session control. Workers never close their own sessions. terminal `send` is only for explicit human steering; it is not task state, completion evidence, or a substitute for `agent_task_message`.
+
+## delegation lifecycle
+
+| event | owner | command | session outcome |
+| --- | --- | --- | --- |
+| assignment completion | worker | `agent_task_done` | unchanged |
+| task acknowledgment | parent | `agent_task_ack` | unchanged |
+| role session retention | parent | `none` | retained for reuse |
+| role session teardown | parent | `wolfpack kill <session-or-id> --json` | exact stable session id terminated |
+| teardown verification | parent | `wolfpack list --json` | exact stable session id absent |
+| Pi exit | none | `/quit` | not Wolfpack teardown |
+
+Assignment completion ends the assigned task, not the reusable role session. When no further reuse is likely, the parent—not the worker—must pass the exact stable session ID to `wolfpack kill <session-or-id> --json`, then inspect `wolfpack list --json` and verify that ID is absent. `/quit` exits Pi; it is not Wolfpack teardown. Workers never close themselves.
+
+## v2 workflow
+
+1. create or select the role session, verify its structured project and terminal readiness, then obtain its registered `taskEndpoint`.
+2. call `agent_task_send` with the opaque endpoint and concise instructions in `task`. The tool returns after relay acceptance only, not Pi insertion or model execution. If submission reports a retryable delivery error after local persistence, use the structured task ID from the error and inspect it rather than creating an unrelated replacement.
+3. keep working. Use `agent_task_status` or `agent_task_inbox` for structured evidence. Call `agent_task_wait` only when the user explicitly asks to block.
+4. use `agent_task_message` for durable `question`, `answer`, or `information` flow. Do not use rendered text, terminal output, or logs as lifecycle evidence.
+5. assignees call `agent_task_done` as their final action with the assigned task ID, terminal status, concise summary, and optional structured result, error, and artifact declarations. Report source modifications in `result.changedFiles`; artifacts are receiver-project-relative regular files for a parent to inspect, not changed-file lists: `{ "result": { "changedFiles": ["src/extension.ts"] }, "artifacts": [{ "path": "verification/task-2.md" }] }`. No prose completion afterward.
+6. the parent independently verifies files, diff, tests, and artifacts. Then call `agent_task_ack({ taskId })` for that one terminal task and explicitly retain or close the spawned role session.
+
+## v2 delivery and recovery
 
-Persistence is a parent decision, not a default. After every verified and acknowledged terminal task, the parent must explicitly choose whether to retain or close a session it spawned. Retain it only when the parent expects concrete follow-up work; close it when the parent does not expect to use it again. Do not leave the cleanup decision implicit.
+Wolfpack v2 is a content-blind relay; each Pi endpoint owns task lifecycle, canonical event order, receipts, and SQLite state. Relay acceptance does not prove model execution. The receiver inserts model-visible events as structured `pi-tasks-event` custom messages with Pi's safe `deliverAs: "followUp"` queue, then records insertion through structured `{ taskId, eventId }` evidence. Restart recovery reads durable session entries and local task state; it never parses rendered prompts or terminal prose.
 
-Use gateway task tools for assignments, questions, decisions, completion, and acknowledgment. terminal `send` is only for explicit human steering; it is not task state, a completion channel, or a substitute for `agent_task_message`.
+Receiver terminal submission has one task-wide logical identity. Same-status retries reuse it; a conflicting terminal status fails closed. Canonical status remains origin-owned, while `terminalDelivery` separately exposes `not_submitted`, `pending`, `accepted`, or `delivery_blocked`. Parent acknowledgment is terminal-only and retries reuse one logical event and stable envelope identities.
 
-## workflow
+Set `PI_TASK_WORKER=1` only for task-only workers. Before a valid structured assignment matches a locally owned active task, the worker gate allows only inbox/status/wait inspection and blocks other model tools with `PI_TASK_WORKER_ASSIGNMENT_REQUIRED`.
 
-1. create or select an existing Pi session with canonical Wolfpack session control. Reuse the phase role session when it is healthy. For a disposable worker, omit `--prompt`: `wolfpack agent spawn <project> --name <task-role> --json`. Put all worker instructions in `agent_task_send.task` so the fresh Pi process can reach idle before assignment. Do not start a disposable worker with a blocking “wait for assignments” model prompt. Read the structured spawn response and retain the stable broker `sessionId`. Before remote dispatch, complete Wolfpack's [Live-peer readiness checklist](https://github.com/almogdepaz/wolfpack/blob/main/docs/task-gateway.md#live-peer-readiness-checklist), including operator-recorded package/reload evidence; if it cannot pass, stop before task creation and report fixture-only verification.
-2. send concise opaque task instructions with `agent_task_send`. Use `context.summary` only for constraints, decisions, and recovery state, and deliberately select `context.refs` with `path`, optional `selector`, and `purpose`; refs are metadata, not copied files or transcript. Use `task-context-summary` only for recovery/reuse.
-3. include `role`, `metadata`, enforceable `preflight.requiredProject`, bounded timeout, idempotency key, and `onCompletePrompt` only when they apply. Timeout is 1000ms through 24h; default is 30 minutes. Task/context limits are 16 KiB each, assignment envelope 48 KiB, and request body 64 KiB.
-4. after durable receipt, keep working. Do not call `agent_task_wait` unless the user explicitly asks to block. Use `agent_task_status` or `agent_task_inbox` for structured follow-up.
-5. use `agent_task_message` for durable `question`, `answer`, or `information` flow. One question may be unresolved globally; answers link to it. A receiver question accepted by the sender ends the receiver turn; a parent question does not end the parent turn.
-6. assignees call `agent_task_done` exactly once as their final action with `completed`, `failed`, or `cancelled`, concise summary, and optional structured result/error/artifact metadata. Report source modifications in `result.changedFiles`; artifacts are receiver-project-relative regular files for a parent to inspect, not changed-file lists: `{ "result": { "changedFiles": ["src/extension.ts"] }, "artifacts": [{ "path": "verification/task-2.md" }] }`. Follow the canonical Wolfpack artifact contract for provenance, containment, and warning behavior. No prose completion afterward.
-7. parent independently verifies files, diff, tests, and artifacts before reporting success. Then use `agent_task_ack({ taskId })` for that one verified terminal task; remote acknowledgment is two-phase and failed propagation leaves the task visible for explicit repair. After acknowledgment, explicitly decide whether the spawned session has a likely next assignment. Retain it while review, correction, or another concrete assignment is expected; otherwise close it through canonical Wolfpack session control. Cleanup applies only to sessions this parent spawned and only after result verification and acknowledgment.
+## v1 compatibility
 
-## delivery and recovery
+The retained v1 workflow is available only through the explicit `@sgtbeatdown/pi-tasks/v1-compat-extension` entrypoint. It does not load by default, and v2 never falls back or translates its targets.
 
-`agent_task_send` returns after durable receiver-gateway acceptance, not adapter insertion or model execution; delivery remains pending until `task.delivered`. A remote initial send gets one initial attempt. The receiver stores a provisional receipt, and Pi sees the assignment only after sender receipt confirmation. Later peer events get four total attempts: initial plus retries around 1, 2, and 4 seconds with jitter. Retry exhaustion is a surfaced local delivery failure; v1 has no gateway queue, scheduler, or offline dispatch.
+v1 uses a reachable local Wolfpack task gateway and addresses targets as `to: { machine, sessionId }`. Use `machine: "local"` for same-machine work; remote work uses only the receiver's canonical HTTPS Tailnet origin. v1 trusts local processes and trusted Tailnet machines, has no JWT federation, and follows Wolfpack's [task gateway guide](https://github.com/almogdepaz/wolfpack/blob/main/docs/task-gateway.md).
 
-The sender gateway owns canonical order, expiry, and terminal choice; the first accepted terminal event wins. Sender timeout causes best-effort remote cancellation. The local extension polls every five seconds. With no pending message, it submits visible events through Pi's safe `deliverAs: "followUp"` queue: idle sessions start immediately, active turns finish first, and task delivery never steers or interrupts them. It stores `{ taskId, eventId }` in structured custom messages, replays missing events after restart, and records delivery only after structural insertion. Do not call that exactly-once execution.
+Before v1 remote dispatch, complete the [Live-peer readiness checklist](https://github.com/almogdepaz/wolfpack/blob/main/docs/task-gateway.md#live-peer-readiness-checklist), including operator-recorded package/reload evidence. If it cannot pass, stop before task creation and report fixture-only verification. Isolated coverage is the deterministic acceptance gate, but it does not prove a specific live peer.
 
-Isolated coverage is the deterministic acceptance gate, but a specific live peer still requires current readiness at the time of use. Do not claim that a particular remote deployment is reachable without the checklist evidence.
+Only v1 supports curated `context.summary`/refs, role, metadata, preflight, idempotency keys, and completion prompts. Use `context.summary` only for constraints, decisions, and recovery state. Refs are metadata, not copied files or transcript. A v1 remote initial send gets one initial attempt; later peer events get four total attempts. Retry exhaustion is surfaced; v1 has no offline queue or background dispatch promise.
 
 ## do not
 
-- do not use terminal output as task state or completion evidence.
-- do not ask workers to complete in prose.
+- do not use terminal output, rendered prompts, logs, or error prose as task state.
+- do not ask workers to complete in prose or close their own sessions.
 - do not steer or interrupt an active Pi turn with task context; use the adapter's follow-up queue.
 - Do not copy plans, source contents, or transcripts into task context.
-- do not use filesystem task storage or retain old `mustReturn`, `rejected`, or semantic completion contracts.
-- do not promise JWT federation, artifact byte transfer, or background retry/offline dispatch.
-- do not make workers close their own sessions.
-- do not leave a parent-spawned session open after acknowledgment when the parent does not expect further work from it.
+- do not mix v1 and v2 target shapes or silently translate between them.
+- do not promise JWT federation, artifact byte transfer, exactly-once model execution, or successor endpoint rebinding.

package/src/abortable-sleep.ts

@@ -0,0 +1,16 @@
+export async function abortableSleep(milliseconds: number, signal: AbortSignal | undefined, cancellationError: () => Error): Promise<void> {
+	if (signal?.aborted) throw cancellationError();
+	await new Promise<void>((resolve, reject) => {
+		const removeAbortListener = (): void => signal?.removeEventListener("abort", abort);
+		const timeout = setTimeout(() => {
+			removeAbortListener();
+			resolve();
+		}, milliseconds);
+		const abort = (): void => {
+			clearTimeout(timeout);
+			removeAbortListener();
+			reject(cancellationError());
+		};
+		signal?.addEventListener("abort", abort, { once: true });
+	});
+}

package/src/extension.ts

@@ -3,10 +3,12 @@ import type { AgentToolResult, ExtensionAPI, ExtensionContext } from "@earendil-
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
-import { deliverTaskInbox } from "./task-inbox";
+import { abortableSleep } from "./abortable-sleep";
+import { deliverTaskInbox, incorporatedTaskEvents } from "./task-inbox";
 import { TaskOutboxDeliveryError, TaskProtocolError } from "./task-protocol";
 import { createWolfpackTaskCore } from "./wolfpack-task-relay";
 import type { TaskCore } from "./task-core";
+import type { TaskEndpoint, TaskSnapshot } from "./task-protocol";
 
 const DEFAULT_TASK_TIMEOUT_MS = 30 * 60 * 1_000;
 const MIN_TASK_TIMEOUT_MS = 1_000;
@@ -15,6 +17,8 @@ const BACKGROUND_POLL_MS = 5_000;
 const TARGET_NOT_REGISTERED_CODE = "TARGET_NOT_REGISTERED";
 const WAIT_POLL_MS = 250;
 const SUMMARY_MAX_CHARS = 1_200;
+const PRE_ASSIGNMENT_TOOLS = new Set(["agent_task_inbox", "agent_task_status", "agent_task_wait"]);
+export const WORKER_GATE_DENIAL_CODE = "PI_TASK_WORKER_ASSIGNMENT_REQUIRED";
 
 const EndpointParams = Type.Object({
 	relay: Type.String({ minLength: 1, description: "relay identifier" }),
@@ -58,6 +62,9 @@ export function registerAgentTaskTools(pi: ExtensionAPI, core: TaskCore | undefi
 	let inboxContext: ExtensionContext | undefined;
 	let backgroundTimer: ReturnType<typeof setInterval> | undefined;
 	let lifecycleEpoch = 0;
+	const pendingInsertions = new Set<string>();
+	const closingTaskIds = new Set<string>();
+	const workerGateEnabled = process.env.PI_TASK_WORKER === "1";
 	const configuredCore: ConfiguredCoreFactory = core === undefined ? createConfiguredCoreLoader(createCore) : async (): Promise<TaskCore> => core;
 	const refreshInbox = createSingleFlightInboxRefresh(async (signal) => {
 		const context = inboxContext;
@@ -97,7 +104,7 @@ export function registerAgentTaskTools(pi: ExtensionAPI, core: TaskCore | undefi
 		}, guardedCore, {
 			hasPendingMessages: (): boolean => !isCurrent() || context.hasPendingMessages(),
 			sessionManager: context.sessionManager,
-		}, signal);
+		}, pendingInsertions, signal);
 		return outboxError;
 	});
 	const refreshLifecycle = async (context: ExtensionContext, epoch: number): Promise<void> => {
@@ -121,7 +128,30 @@ export function registerAgentTaskTools(pi: ExtensionAPI, core: TaskCore | undefi
 		}
 	};
 
+	pi.on("tool_call", async (event, context) => {
+		if (!workerGateEnabled || PRE_ASSIGNMENT_TOOLS.has(event.toolName)) return undefined;
+		try {
+			const activeCore = await configuredCore(context.signal);
+			const assignments = assignedWorkerTasks(activeCore, context.sessionManager.getEntries());
+			if (event.toolName === "agent_task_done") {
+				const taskId = isRecord(event.input) && typeof event.input.taskId === "string" ? event.input.taskId : undefined;
+				const assigned = taskId === undefined ? undefined : assignments.find((task) => task.taskId === taskId);
+				if (assigned === undefined || (!eligibleWorkerTask(assigned, closingTaskIds) && assigned.terminalDelivery.state === "not_submitted" && !closingTaskIds.has(assigned.taskId))) {
+					return { block: true, reason: WORKER_GATE_DENIAL_CODE };
+				}
+				closingTaskIds.add(assigned.taskId);
+				return undefined;
+			}
+			if (assignments.some((task) => eligibleWorkerTask(task, closingTaskIds))) return undefined;
+		} catch {
+			// Authorization evidence unavailable or malformed: fail closed with the stable public reason.
+		}
+		return { block: true, reason: WORKER_GATE_DENIAL_CODE };
+	});
+
 	pi.on("session_start", async (_event, context) => {
+		pendingInsertions.clear();
+		closingTaskIds.clear();
 		const epoch = ++lifecycleEpoch;
 		inboxContext = context;
 		if (backgroundTimer) clearInterval(backgroundTimer);
@@ -137,6 +167,8 @@ export function registerAgentTaskTools(pi: ExtensionAPI, core: TaskCore | undefi
 		await refreshLifecycle(context, epoch);
 	});
 	pi.on("session_shutdown", () => {
+		pendingInsertions.clear();
+		closingTaskIds.clear();
 		lifecycleEpoch += 1;
 		if (backgroundTimer) clearInterval(backgroundTimer);
 		backgroundTimer = undefined;
@@ -174,7 +206,7 @@ export function registerAgentTaskTools(pi: ExtensionAPI, core: TaskCore | undefi
 					if (terminal(task.status)) return toolResult(task, `## task status\n- task: \`${task.taskId}\`\n- status: ${task.status}`);
 					if (Date.now() >= deadline) return toolResult({ taskId: params.taskId, status: task.status }, `## task wait\n- task: \`${params.taskId}\`\n- status: ${task.status}\n- wait timed out`);
 					onUpdate?.({ content: [{ type: "text", text: `waiting for ${params.taskId}...` }], details: {} });
-					await sleep(Math.min(WAIT_POLL_MS, deadline - Date.now()), signal);
+					await abortableSleep(Math.max(1, Math.min(WAIT_POLL_MS, deadline - Date.now())), signal, () => new Error("task wait was cancelled"));
 				}
 			} catch (error) { return taskError(error); }
 		}, renderResult(result, _options, theme) { return new Text(theme.fg("accent", text(result))); },
@@ -252,15 +284,31 @@ function terminal(status: string): boolean {
 	return ["completed", "failed", "cancelled", "timed_out"].includes(status);
 }
 
+function assignedWorkerTasks(core: TaskCore, entries: readonly unknown[]): readonly TaskSnapshot[] {
+	const assignments = new Map<string, TaskSnapshot>();
+	for (const evidence of incorporatedTaskEvents(entries)) {
+		const task = core.getTask(evidence.taskId);
+		if (!task || !sameEndpoint(task.target, core.endpoint)) continue;
+		const created = task.events.find((event) => event.eventId === evidence.eventId);
+		if (!created || created.type !== "task.created" || !sameEndpoint(created.target, core.endpoint) || !sameEndpoint(created.source, task.origin)) continue;
+		assignments.set(task.taskId, task);
+	}
+	return [...assignments.values()];
+}
+
+function eligibleWorkerTask(task: TaskSnapshot, closingTaskIds: ReadonlySet<string>): boolean {
+	return task.status === "active" && task.terminalDelivery.state === "not_submitted" && !closingTaskIds.has(task.taskId);
+}
+
+function sameEndpoint(left: TaskEndpoint, right: TaskEndpoint): boolean {
+	return left.relay === right.relay && left.id === right.id;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 function text(result: { readonly content?: readonly unknown[] }): string {
 	const first = result.content?.[0];
 	return first && typeof first === "object" && "type" in first && first.type === "text" && "text" in first && typeof first.text === "string" ? first.text : "";
 }
-
-async function sleep(milliseconds: number, signal: AbortSignal | undefined): Promise<void> {
-	if (signal?.aborted) throw new Error("task wait was cancelled");
-	await new Promise<void>((resolve, reject) => {
-		const timer = setTimeout(resolve, Math.max(1, milliseconds));
-		signal?.addEventListener("abort", () => { clearTimeout(timer); reject(new Error("task wait was cancelled")); }, { once: true });
-	});
-}

package/src/legacy-extension.ts

@@ -3,6 +3,7 @@ import type { AgentToolResult, ExtensionAPI, ExtensionContext } from "@earendil-
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
+import { abortableSleep } from "./abortable-sleep";
 import {
 	DEFAULT_TASK_TIMEOUT_MS,
 	GatewayClientError,
@@ -126,7 +127,7 @@ export function registerAgentTaskTools(pi: ExtensionAPI, client: WolfpackGateway
 					if (terminal(status.status)) return statusResult(status);
 					if (Date.now() >= deadline) return toolResult({ taskId: params.taskId, status: status.status, error: { code: "WAIT_TIMEOUT", retryable: true } }, `## task wait\n- task: \`${params.taskId}\`\n- status: ${status.status}\n- wait timed out`);
 					onUpdate?.({ content: [{ type: "text", text: `waiting for ${params.taskId}...` }], details: {} });
-					await sleep(Math.min(WAIT_POLL_MS, Math.max(1, deadline - Date.now())), signal);
+					await abortableSleep(Math.min(WAIT_POLL_MS, Math.max(1, deadline - Date.now())), signal, () => new GatewayClientError("ABORTED", "task wait was cancelled", true));
 				}
 			} catch (error) { return clientError(error); }
 		}, renderResult(result, _options, theme) { return new Text(theme.fg("accent", text(result))); },
@@ -238,11 +239,3 @@ function text(result: { readonly content?: readonly unknown[] }): string {
 function throwIfAborted(signal: AbortSignal | undefined): void {
 	if (signal?.aborted) throw new GatewayClientError("ABORTED", "task wait was cancelled", true);
 }
-
-async function sleep(milliseconds: number, signal: AbortSignal | undefined): Promise<void> {
-	await new Promise<void>((resolve, reject) => {
-		const timeout = setTimeout(resolve, milliseconds);
-		const abort = (): void => { clearTimeout(timeout); reject(new GatewayClientError("ABORTED", "task wait was cancelled", true)); };
-		signal?.addEventListener("abort", abort, { once: true });
-	});
-}

package/src/task-core.ts

@@ -1,6 +1,8 @@
 import {
 	MAX_RELAY_PAYLOAD_BYTES,
+	PARENT_ACKNOWLEDGMENT_OPERATION,
 	TASK_PROTOCOL_VERSION,
+	TERMINAL_INTENT_OPERATION,
 	TaskEnvelopeKind,
 	TaskOutboxDeliveryError,
 	TaskProtocolError,
@@ -13,10 +15,12 @@ import type {
 	TaskIntent,
 	TaskRecord,
 	TaskRelay,
+	TaskSnapshot,
 } from "./task-protocol";
 import type { TaskStore } from "./task-store";
 
 const RECEIVE_PAGE_SIZE = 100;
+const TARGET_NOT_REGISTERED_CODE = "TARGET_NOT_REGISTERED";
 const TERMINAL_STATUSES = new Set<TaskRecord["status"]>(["completed", "failed", "cancelled", "timed_out"]);
 const TERMINAL_EVENTS = new Set(["task.completed", "task.failed", "task.cancelled", "task.timed_out"]);
 const CANONICAL_EVENTS = new Set([
@@ -49,10 +53,11 @@ export interface SubmitIntentInput {
 }
 
 export interface TaskCore {
+	readonly endpoint: TaskEndpoint;
 	connect(signal?: AbortSignal): Promise<void>;
 	createTask(input: CreateTaskInput, signal?: AbortSignal): Promise<{ readonly taskId: string }>;
-	getTask(taskId: string): TaskRecord | undefined;
-	listTasks(): readonly TaskRecord[];
+	getTask(taskId: string): TaskSnapshot | undefined;
+	listTasks(): readonly TaskSnapshot[];
 	flushOutbox(signal?: AbortSignal): Promise<void>;
 	receive(signal?: AbortSignal): Promise<readonly RelayDelivery[]>;
 	acknowledgeRelayDelivery(cursor: string, signal?: AbortSignal): Promise<void>;
@@ -72,6 +77,7 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 	const ids = options.ids ?? (() => crypto.randomUUID());
 
 	return {
+		endpoint: options.endpoint,
 		async connect(signal) {
 			const connection = await options.relay.connect({ endpoint: options.endpoint, protocolVersion: TASK_PROTOCOL_VERSION, receiveCursor: options.store.getReceiveCursor() }, signal);
 			if (!sameEndpoint(connection.endpoint, options.endpoint)) throw new TaskProtocolError("INVALID_CONNECTION", "relay connected a different endpoint");
@@ -133,12 +139,15 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 		},
 		async submitIntent(input, signal) {
 			if (!RECEIVER_INTENT_TYPES.has(input.type) || !isRecord(input.payload)) throw new TaskProtocolError("INVALID_INTENT", "intent type or payload is invalid");
-			const task = requiredTask(options.store, input.taskId);
 			let persistedEnvelopeIds: readonly string[] = [];
+			let receiverTerminal = false;
 			options.store.transaction(() => {
+				const task = requiredTask(options.store, input.taskId);
+				receiverTerminal = !sameEndpoint(options.endpoint, task.origin) && TERMINAL_EVENTS.has(input.type);
 				persistedEnvelopeIds = persistIntent(options, clock.now, ids, task, input);
 			});
 			await flush(options, signal, new Set(persistedEnvelopeIds));
+			if (receiverTerminal) throwIfTerminalDeliveryBlocked(options.store, input.taskId);
 		},
 		async recordInsertion(input, signal) {
 			const task = requiredTask(options.store, input.taskId);
@@ -163,11 +172,12 @@ export function createTaskCore(options: TaskCoreOptions): TaskCore {
 			if (persistedEnvelopeIds.length > 0) await flush(options, signal, new Set(persistedEnvelopeIds));
 		},
 		async acknowledgeParent(taskId, signal) {
-			const task = requiredTask(options.store, taskId);
-			if (!sameEndpoint(task.origin, options.endpoint)) throw new TaskProtocolError("NOT_ORIGIN", "only origin may acknowledge a task");
 			let persistedEnvelopeIds: readonly string[] = [];
 			options.store.transaction(() => {
-				persistedEnvelopeIds = canonicalize(options, clock.now, ids, task, { intentId: ids(), taskId, type: "task.information", payload: {} }, "task.parent_acknowledged");
+				const task = requiredTask(options.store, taskId);
+				if (!sameEndpoint(task.origin, options.endpoint)) throw new TaskProtocolError("NOT_ORIGIN", "only origin may acknowledge a task");
+				if (!TERMINAL_STATUSES.has(task.status)) throw new TaskProtocolError("TASK_NOT_TERMINAL", "only a terminal task may be acknowledged", { retryable: false });
+				persistedEnvelopeIds = canonicalize(options, clock.now, ids, task, { intentId: ids(), taskId, type: "task.information", payload: {} }, "task.parent_acknowledged", PARENT_ACKNOWLEDGMENT_OPERATION);
 			});
 			await flush(options, signal, new Set(persistedEnvelopeIds));
 		},
@@ -236,27 +246,45 @@ function persistIntent(options: TaskCoreOptions, now: () => number, ids: () => s
 	}
 	const envelopeId = ids();
 	const intent: TaskIntent = { intentId: ids(), taskId: input.taskId, type: input.type, payload: input.payload };
+	if (TERMINAL_EVENTS.has(input.type)) {
+		const reservation = options.store.reserveTaskOperation({
+			taskId: input.taskId,
+			operation: TERMINAL_INTENT_OPERATION,
+			logicalId: intent.intentId,
+			logicalType: intent.type,
+			envelopeIds: [envelopeId],
+		});
+		if (!reservation.created) {
+			if (reservation.record.logicalType !== intent.type) {
+				throw new TaskProtocolError("TERMINAL_INTENT_CONFLICT", "terminal task intent conflicts with the existing terminal action", {
+					retryable: false,
+					details: { taskId: input.taskId, existingType: reservation.record.logicalType, requestedType: intent.type },
+				});
+			}
+			return reservation.record.envelopeIds;
+		}
+	}
 	options.store.putIntent(intent.intentId, input.taskId, envelopeId);
 	options.store.putOutbox(envelope(envelopeId, options.endpoint, task.origin, input.taskId, TaskEnvelopeKind.intent, intent));
 	return [envelopeId];
 }
 
-function canonicalize(options: TaskCoreOptions, now: () => number, ids: () => string, task: TaskRecord, intent: TaskIntent, requestedType: string): readonly string[] {
+function canonicalize(options: TaskCoreOptions, now: () => number, ids: () => string, task: TaskRecord, intent: TaskIntent, requestedType: string, operation?: string): readonly string[] {
 	const terminal = TERMINAL_EVENTS.has(requestedType);
 	const type = terminal && TERMINAL_STATUSES.has(task.status) ? "task.late_terminal" : requestedType;
 	const sequence = String(task.events.length + 1);
 	const canonical = event(task, ids(), type, sequence, options.endpoint, task.target, now(), { intentId: intent.intentId, ...intent.payload });
-	const persistedEnvelopeIds: string[] = [];
+	const targetEnvelope = envelope(ids(), options.endpoint, task.target, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical);
+	const originEnvelope = sameEndpoint(task.origin, task.target) ? undefined : envelope(ids(), options.endpoint, task.origin, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical);
+	const persistedEnvelopeIds = originEnvelope === undefined ? [targetEnvelope.envelopeId] : [targetEnvelope.envelopeId, originEnvelope.envelopeId];
+	if (operation !== undefined) {
+		const reservation = options.store.reserveTaskOperation({ taskId: task.taskId, operation, logicalId: canonical.eventId, logicalType: canonical.type, envelopeIds: persistedEnvelopeIds });
+		if (!reservation.created) return reservation.record.envelopeIds;
+	}
 	options.store.appendEvent(canonical);
 	if (TERMINAL_EVENTS.has(type)) options.store.setStatus(task.taskId, statusFor(type));
-	const targetEnvelope = envelope(ids(), options.endpoint, task.target, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical);
 	options.store.putOutbox(targetEnvelope);
-	persistedEnvelopeIds.push(targetEnvelope.envelopeId);
-	if (!sameEndpoint(task.origin, task.target)) {
-		const originEnvelope = envelope(ids(), options.endpoint, task.origin, task.taskId, TaskEnvelopeKind.canonicalEvent, canonical);
-		options.store.putOutbox(originEnvelope);
-		persistedEnvelopeIds.push(originEnvelope.envelopeId);
-	}
+	if (originEnvelope !== undefined) options.store.putOutbox(originEnvelope);
 	return persistedEnvelopeIds;
 }
 
@@ -268,6 +296,16 @@ async function flush(options: TaskCoreOptions, signal: AbortSignal | undefined,
 			options.store.transaction(() => { options.store.markOutboxAccepted(record.envelope.envelopeId); });
 		} catch (error) {
 			if (signal?.aborted || (error instanceof TaskProtocolError && error.code === "ABORTED")) throw error;
+			if (error instanceof TaskProtocolError && error.code === TARGET_NOT_REGISTERED_CODE && !error.retryable) {
+				options.store.transaction(() => {
+					options.store.quarantineOutbox(record.envelope.envelopeId, {
+						errorCode: error.code,
+						reason: error.message,
+						details: error.details ?? {},
+						quarantinedAt: Date.now(),
+					});
+				});
+			}
 			failures.push({ envelopeId: record.envelope.envelopeId, error });
 		}
 	}
@@ -301,7 +339,16 @@ function parsePayload(envelope: RelayEnvelope): unknown {
 	try { return JSON.parse(envelope.payload) as unknown; } catch { throw new TaskProtocolError("INVALID_PAYLOAD", "relay envelope payload is not valid task protocol JSON"); }
 }
 
-function requiredTask(store: TaskStore, taskId: string): TaskRecord {
+function throwIfTerminalDeliveryBlocked(store: TaskStore, taskId: string): void {
+	const delivery = requiredTask(store, taskId).terminalDelivery;
+	if (delivery.state !== "delivery_blocked") return;
+	throw new TaskOutboxDeliveryError(delivery.error.code, "terminal task delivery is blocked", {
+		retryable: false,
+		details: { ...delivery.error.details, taskId, envelopeId: delivery.envelopeId, origin: delivery.origin, blockedAt: delivery.blockedAt },
+	});
+}
+
+function requiredTask(store: TaskStore, taskId: string): TaskSnapshot {
 	const task = store.getTask(taskId);
 	if (!task) throw new TaskProtocolError("UNKNOWN_TASK", `unknown task: ${taskId}`);
 	return task;

package/src/task-inbox.ts

@@ -15,13 +15,13 @@ interface InboxPi {
 	appendEntry(customType: string, data: { readonly cursor: string }): void;
 }
 
-interface TaskEventDetails {
+export interface TaskEventDetails {
 	readonly taskId: string;
 	readonly eventId: string;
 }
 
 /** Inserts durable Pi evidence before allowing the relay mailbox cursor to advance. */
-export async function deliverTaskInbox(pi: InboxPi, core: TaskCore, context: InboxContext, signal?: AbortSignal): Promise<void> {
+export async function deliverTaskInbox(pi: InboxPi, core: TaskCore, context: InboxContext, pendingInsertions: Set<string>, signal?: AbortSignal): Promise<void> {
 	if (context.hasPendingMessages()) return;
 	const deliveries = await core.receive(signal);
 	for (const delivery of deliveries) {
@@ -34,14 +34,20 @@ export async function deliverTaskInbox(pi: InboxPi, core: TaskCore, context: Inb
 		if (!isKnownEvent(event.type)) throw new TaskProtocolError("UNKNOWN_EVENT", `unknown task inbox event type: ${event.type}`);
 		if (context.hasPendingMessages()) return;
 		const eventKey = key(event.taskId, event.eventId);
-		if (!incorporatedEvents(context.sessionManager.getEntries()).has(eventKey) && isModelVisible(event.type)) {
-			pi.sendMessage({
-				customType: TASK_EVENT_CUSTOM_TYPE,
-				content: renderTaskEvent(event),
-				display: true,
-				details: { taskId: event.taskId, eventId: event.eventId },
-			}, { triggerTurn: true, deliverAs: "followUp" });
+		const incorporated = incorporatedEvents(context.sessionManager.getEntries()).has(eventKey);
+		if (incorporated) pendingInsertions.delete(eventKey);
+		if (!incorporated && isModelVisible(event.type)) {
+			if (!pendingInsertions.has(eventKey)) {
+				pi.sendMessage({
+					customType: TASK_EVENT_CUSTOM_TYPE,
+					content: renderTaskEvent(event),
+					display: true,
+					details: { taskId: event.taskId, eventId: event.eventId },
+				}, { triggerTurn: true, deliverAs: "followUp" });
+				pendingInsertions.add(eventKey);
+			}
 			if (!incorporatedEvents(context.sessionManager.getEntries()).has(eventKey)) return;
+			pendingInsertions.delete(eventKey);
 		}
 		if (isModelVisible(event.type)) await core.recordInsertion({ taskId: event.taskId, eventId: event.eventId }, signal);
 		await core.acknowledgeRelayDelivery(delivery.cursor, signal);
@@ -49,15 +55,6 @@ export async function deliverTaskInbox(pi: InboxPi, core: TaskCore, context: Inb
 	}
 }
 
-export function restoredInboxCursor(entries: readonly unknown[]): string {
-	let cursor = "0";
-	for (const entry of entries) {
-		if (!isRecord(entry) || entry.type !== "custom" || entry.customType !== TASK_CURSOR_CUSTOM_TYPE || !isRecord(entry.data) || !decimal(entry.data.cursor)) continue;
-		cursor = entry.data.cursor;
-	}
-	return cursor;
-}
-
 function inboxEvent(delivery: RelayDelivery): TaskEvent {
 	try {
 		const payload = JSON.parse(delivery.envelope.payload) as unknown;
@@ -83,15 +80,19 @@ function renderTaskEvent(event: TaskEvent): string {
 	return `## task ${event.type.replace(/^task\./, "").replaceAll("_", " ")}\ntask: \`${event.taskId}\` · event: \`${event.eventId}\`${body}${summary}`;
 }
 
-function incorporatedEvents(entries: readonly unknown[]): Set<string> {
-	const events = new Set<string>();
+export function incorporatedTaskEvents(entries: readonly unknown[]): readonly TaskEventDetails[] {
+	const events: TaskEventDetails[] = [];
 	for (const entry of entries) {
 		if (!isRecord(entry) || entry.type !== "custom_message" || entry.customType !== TASK_EVENT_CUSTOM_TYPE || !isRecord(entry.details) || typeof entry.details.taskId !== "string" || typeof entry.details.eventId !== "string") continue;
-		events.add(key(entry.details.taskId, entry.details.eventId));
+		events.push({ taskId: entry.details.taskId, eventId: entry.details.eventId });
 	}
 	return events;
 }
 
+function incorporatedEvents(entries: readonly unknown[]): Set<string> {
+	return new Set(incorporatedTaskEvents(entries).map((event) => key(event.taskId, event.eventId)));
+}
+
 function isTaskEvent(value: unknown): value is TaskEvent {
 	return isRecord(value) && typeof value.eventId === "string" && typeof value.taskId === "string" && typeof value.type === "string" && typeof value.sequence === "string" && isRecord(value.source) && isRecord(value.target) && typeof value.occurredAt === "number" && isRecord(value.payload);
 }
@@ -103,7 +104,3 @@ function key(taskId: string, eventId: string): string {
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-
-function decimal(value: unknown): value is string {
-	return typeof value === "string" && /^(0|[1-9][0-9]*)$/.test(value);
-}

package/src/task-protocol.ts

@@ -1,5 +1,7 @@
 export const TASK_PROTOCOL_VERSION = "pi-tasks/v2" as const;
 export const MAX_RELAY_PAYLOAD_BYTES = 48 * 1024;
+export const PARENT_ACKNOWLEDGMENT_OPERATION = "parent_acknowledgment";
+export const TERMINAL_INTENT_OPERATION = "terminal_intent";
 
 export interface TaskEndpoint {
 	readonly relay: string;
@@ -100,13 +102,46 @@ export interface TaskRecord {
 	readonly events: readonly TaskEvent[];
 }
 
+export type TerminalTaskIntentType = "task.completed" | "task.failed" | "task.cancelled";
+
 export interface TaskIntent {
 	readonly intentId: string;
 	readonly taskId: string;
-	readonly type: "task.completed" | "task.failed" | "task.cancelled" | "task.information" | "task.question" | "task.answer" | "task.delivery_receipt";
+	readonly type: TerminalTaskIntentType | "task.information" | "task.question" | "task.answer" | "task.delivery_receipt";
 	readonly payload: Record<string, unknown>;
 }
 
+interface TerminalDeliveryIdentity {
+	readonly intentId: string;
+	readonly intentType: TerminalTaskIntentType;
+	readonly envelopeId: string;
+	readonly origin: TaskEndpoint;
+}
+
+interface TerminalDeliveryPending extends TerminalDeliveryIdentity {
+	readonly state: "pending";
+}
+
+interface TerminalDeliveryAccepted extends TerminalDeliveryIdentity {
+	readonly state: "accepted";
+}
+
+interface TerminalDeliveryBlocked extends TerminalDeliveryIdentity {
+	readonly state: "delivery_blocked";
+	readonly blockedAt: number;
+	readonly error: { readonly code: string; readonly retryable: false; readonly details: Readonly<Record<string, unknown>> };
+}
+
+export type TerminalDeliveryState =
+	| { readonly state: "not_submitted" }
+	| TerminalDeliveryPending
+	| TerminalDeliveryAccepted
+	| TerminalDeliveryBlocked;
+
+export interface TaskSnapshot extends TaskRecord {
+	readonly terminalDelivery: TerminalDeliveryState;
+}
+
 export class TaskProtocolError extends Error {
 	readonly code: string;
 	readonly retryable: boolean;

package/src/task-store.ts

@@ -4,12 +4,14 @@ import { dirname, join } from "node:path";
 
 import { openSqliteDatabase } from "./sqlite-database";
 import type { SqliteDatabase } from "./sqlite-database";
-import type { RelayEnvelope, TaskEvent, TaskRecord } from "./task-protocol";
+import { PARENT_ACKNOWLEDGMENT_OPERATION, TERMINAL_INTENT_OPERATION } from "./task-protocol";
+import type { RelayEnvelope, TaskEndpoint, TaskEvent, TaskRecord, TaskSnapshot, TerminalDeliveryState, TerminalTaskIntentType } from "./task-protocol";
 
-const SCHEMA_VERSION = 3;
+const SCHEMA_VERSION = 5;
 const OWNER_ONLY_MODE = 0o700;
 const OWNER_ONLY_FILE_MODE = 0o600;
 const ENDPOINT_GENERATION_STATE_KEY = "endpoint_generation";
+const ENDPOINT_BINDING_STATE_KEY = "endpoint_binding";
 
 export interface TaskStoreOptions {
 	readonly path?: string;
@@ -20,23 +22,48 @@ export interface OutboxRecord {
 	readonly state: "pending" | "accepted";
 }
 
+export interface OutboxQuarantineInput {
+	readonly errorCode: string;
+	readonly reason: string;
+	readonly details: Readonly<Record<string, unknown>>;
+	readonly quarantinedAt: number;
+}
+
+export interface OutboxQuarantineRecord extends OutboxQuarantineInput {
+	readonly envelope: RelayEnvelope;
+	readonly priorState: OutboxRecord["state"];
+}
+
+export interface TaskOperationRecord {
+	readonly taskId: string;
+	readonly operation: string;
+	readonly logicalId: string;
+	readonly logicalType: string;
+	readonly envelopeIds: readonly string[];
+}
+
 export interface TaskStore {
 	transaction<T>(operation: () => T): T;
 	putTask(task: Omit<TaskRecord, "events">): void;
-	getTask(taskId: string): TaskRecord | undefined;
-	listTasks(): readonly TaskRecord[];
+	getTask(taskId: string): TaskSnapshot | undefined;
+	listTasks(): readonly TaskSnapshot[];
 	setStatus(taskId: string, status: TaskRecord["status"]): void;
 	appendEvent(event: TaskEvent): boolean;
 	putOutbox(envelope: RelayEnvelope): void;
 	outbox(state: OutboxRecord["state"]): readonly OutboxRecord[];
 	markOutboxAccepted(envelopeId: string): void;
+	quarantineOutbox(envelopeId: string, input: OutboxQuarantineInput): void;
+	quarantinedOutbox(): readonly OutboxQuarantineRecord[];
 	persistInbox(envelope: RelayEnvelope, cursor: string): boolean;
 	getReceiveCursor(): string;
 	setReceiveCursor(cursor: string): void;
 	putIntent(intentId: string, taskId: string, envelopeId: string): void;
 	putInsertionReceipt(taskId: string, eventId: string): boolean;
+	reserveTaskOperation(input: TaskOperationRecord): { readonly created: boolean; readonly record: TaskOperationRecord };
 	getEndpointGeneration(): string | undefined;
 	setEndpointGeneration(generation: string): void;
+	getEndpointBinding(): TaskEndpoint | undefined;
+	setEndpointBinding(endpoint: TaskEndpoint): void;
 	close(): void;
 }
 
@@ -60,7 +87,7 @@ export function createTaskStore(options: TaskStoreOptions = {}): TaskStore {
 			const row = database.query("SELECT * FROM tasks WHERE task_id = ?").get(taskId) as TaskRow | null;
 			if (!row) return undefined;
 			const eventRows = database.query("SELECT * FROM events WHERE task_id = ? ORDER BY CAST(sequence AS INTEGER), event_id").all(taskId) as EventRow[];
-			return taskFromRow(row, eventRows);
+			return taskFromRow(database, row, eventRows);
 		},
 		listTasks() {
 			const rows = database.query("SELECT * FROM tasks ORDER BY created_at, task_id").all() as TaskRow[];
@@ -71,7 +98,7 @@ export function createTaskStore(options: TaskStoreOptions = {}): TaskStore {
 				current.push(event);
 				eventsByTask.set(event.task_id, current);
 			}
-			return rows.map((row) => taskFromRow(row, eventsByTask.get(row.task_id) ?? []));
+			return rows.map((row) => taskFromRow(database, row, eventsByTask.get(row.task_id) ?? []));
 		},
 		setStatus(taskId, status) {
 			database.query("UPDATE tasks SET status = ? WHERE task_id = ?").run(status, taskId);
@@ -92,6 +119,26 @@ export function createTaskStore(options: TaskStoreOptions = {}): TaskStore {
 		markOutboxAccepted(envelopeId) {
 			database.query("UPDATE outbox SET state = 'accepted' WHERE envelope_id = ?").run(envelopeId);
 		},
+		quarantineOutbox(envelopeId, input) {
+			const row = database.query("SELECT envelope, state FROM outbox WHERE envelope_id = ?").get(envelopeId) as { readonly envelope: string; readonly state: OutboxRecord["state"] } | null;
+			if (!row) return;
+			database.query(`INSERT INTO outbox_quarantine (envelope, error_code, reason, details, quarantined_at, prior_state, envelope_id)
+				VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT(envelope_id) DO NOTHING`).run(
+				row.envelope, input.errorCode, input.reason, JSON.stringify(input.details), input.quarantinedAt, row.state, envelopeId,
+			);
+			database.query("DELETE FROM outbox WHERE envelope_id = ?").run(envelopeId);
+		},
+		quarantinedOutbox() {
+			const rows = database.query("SELECT envelope, error_code, reason, details, quarantined_at, prior_state FROM outbox_quarantine ORDER BY rowid").all() as OutboxQuarantineRow[];
+			return rows.map((row) => ({
+				envelope: parseEnvelope(row.envelope),
+				errorCode: row.error_code,
+				reason: row.reason,
+				details: parseRecord(row.details),
+				quarantinedAt: row.quarantined_at,
+				priorState: row.prior_state,
+			}));
+		},
 		persistInbox(envelope, cursor) {
 			const result = database.query("INSERT INTO inbox (envelope_id, cursor, envelope) VALUES (?, ?, ?) ON CONFLICT(envelope_id) DO NOTHING").run(envelope.envelopeId, cursor, JSON.stringify(envelope));
 			return result.changes === 1;
@@ -110,6 +157,13 @@ export function createTaskStore(options: TaskStoreOptions = {}): TaskStore {
 			const result = database.query("INSERT INTO insertion_receipts (task_id, event_id) VALUES (?, ?) ON CONFLICT(task_id, event_id) DO NOTHING").run(taskId, eventId);
 			return result.changes === 1;
 		},
+		reserveTaskOperation(input) {
+			const result = database.query(`INSERT INTO task_operations (task_id, operation, logical_id, logical_type, envelope_ids)
+				VALUES (?, ?, ?, ?, ?) ON CONFLICT(task_id, operation) DO NOTHING`).run(input.taskId, input.operation, input.logicalId, input.logicalType, JSON.stringify(input.envelopeIds));
+			const row = database.query("SELECT task_id, operation, logical_id, logical_type, envelope_ids FROM task_operations WHERE task_id = ? AND operation = ?").get(input.taskId, input.operation) as TaskOperationRow | null;
+			if (!row) throw new Error("task operation reservation was not persisted");
+			return { created: result.changes === 1, record: taskOperationFromRow(row) };
+		},
 		getEndpointGeneration() {
 			const row = database.query("SELECT value FROM relay_state WHERE name = ?").get(ENDPOINT_GENERATION_STATE_KEY) as { readonly value: string } | null;
 			return row?.value;
@@ -117,6 +171,13 @@ export function createTaskStore(options: TaskStoreOptions = {}): TaskStore {
 		setEndpointGeneration(generation) {
 			database.query("INSERT INTO relay_state (name, value) VALUES (?, ?) ON CONFLICT(name) DO UPDATE SET value = excluded.value").run(ENDPOINT_GENERATION_STATE_KEY, generation);
 		},
+		getEndpointBinding() {
+			const row = database.query("SELECT value FROM relay_state WHERE name = ?").get(ENDPOINT_BINDING_STATE_KEY) as { readonly value: string } | null;
+			return row ? parseEndpoint(row.value) : undefined;
+		},
+		setEndpointBinding(endpoint) {
+			database.query("INSERT INTO relay_state (name, value) VALUES (?, ?) ON CONFLICT(name) DO UPDATE SET value = excluded.value").run(ENDPOINT_BINDING_STATE_KEY, JSON.stringify(endpoint));
+		},
 		close() { database.close(); },
 	};
 	return store;
@@ -135,6 +196,34 @@ interface TaskRow {
 	readonly status: string;
 }
 
+interface OutboxQuarantineRow {
+	readonly envelope: string;
+	readonly error_code: string;
+	readonly reason: string;
+	readonly details: string;
+	readonly quarantined_at: number;
+	readonly prior_state: OutboxRecord["state"];
+}
+
+interface TaskOperationRow {
+	readonly task_id: string;
+	readonly operation: string;
+	readonly logical_id: string;
+	readonly logical_type: string;
+	readonly envelope_ids: string;
+}
+
+interface LegacyIntentRow {
+	readonly intent_id: string;
+	readonly task_id: string;
+	readonly envelope_id: string;
+}
+
+interface LegacyEnvelopeRow {
+	readonly envelope_id: string;
+	readonly envelope: string;
+}
+
 interface EventRow {
 	readonly event_id: string;
 	readonly task_id: string;
@@ -175,6 +264,121 @@ function migrate(database: SqliteDatabase): void {
 			PRAGMA user_version = 3;
 		`);
 	}
+	if (version.user_version <= 3) {
+		database.exec(`CREATE TABLE IF NOT EXISTS outbox_quarantine (
+			envelope_id TEXT PRIMARY KEY,
+			envelope TEXT NOT NULL,
+			reason TEXT NOT NULL,
+			quarantined_at INTEGER NOT NULL,
+			error_code TEXT NOT NULL DEFAULT 'UNKNOWN',
+			details TEXT NOT NULL DEFAULT '{}',
+			prior_state TEXT NOT NULL DEFAULT 'pending'
+		);`);
+		ensureColumn(database, "outbox_quarantine", "envelope", "TEXT NOT NULL DEFAULT '{}'");
+		ensureColumn(database, "outbox_quarantine", "reason", "TEXT NOT NULL DEFAULT 'operator quarantine'");
+		ensureColumn(database, "outbox_quarantine", "quarantined_at", "INTEGER NOT NULL DEFAULT 0");
+		ensureColumn(database, "outbox_quarantine", "error_code", "TEXT NOT NULL DEFAULT 'UNKNOWN'");
+		ensureColumn(database, "outbox_quarantine", "details", "TEXT NOT NULL DEFAULT '{}'");
+		ensureColumn(database, "outbox_quarantine", "prior_state", "TEXT NOT NULL DEFAULT 'pending'");
+		database.exec("PRAGMA user_version = 4;");
+	}
+	if (version.user_version <= 4) {
+		database.transaction(() => {
+			database.exec(`CREATE TABLE IF NOT EXISTS task_operations (
+				task_id TEXT NOT NULL REFERENCES tasks(task_id),
+				operation TEXT NOT NULL,
+				logical_id TEXT NOT NULL,
+				logical_type TEXT NOT NULL,
+				envelope_ids TEXT NOT NULL,
+				PRIMARY KEY (task_id, operation)
+			);`);
+			backfillTaskOperations(database);
+			database.exec("PRAGMA user_version = 5;");
+		})();
+	}
+}
+
+function backfillTaskOperations(database: SqliteDatabase): void {
+	const envelopes = legacyEnvelopes(database);
+	const terminalTasks = new Set<string>();
+	const intents = database.query("SELECT intent_id, task_id, envelope_id FROM intents ORDER BY rowid").all() as LegacyIntentRow[];
+	for (const intent of intents) {
+		if (terminalTasks.has(intent.task_id)) continue;
+		const serializedEnvelope = envelopes.get(intent.envelope_id);
+		if (!serializedEnvelope) throw new Error(`legacy intent ${intent.intent_id} has no durable envelope`);
+		const envelope = legacyEnvelope(intent.envelope_id, serializedEnvelope);
+		const payload = legacyEnvelopePayload(envelope);
+		if (envelope.kind !== "intent" || envelope.taskId !== intent.task_id || !isRecord(payload) || payload.intentId !== intent.intent_id || payload.taskId !== intent.task_id || typeof payload.type !== "string") {
+			throw new Error(`legacy intent ${intent.intent_id} has malformed structured state`);
+		}
+		if (!isTerminalIntentType(payload.type)) continue;
+		insertTaskOperation(database, { taskId: intent.task_id, operation: TERMINAL_INTENT_OPERATION, logicalId: intent.intent_id, logicalType: payload.type, envelopeIds: [intent.envelope_id] });
+		terminalTasks.add(intent.task_id);
+	}
+
+	const acknowledgments = database.query("SELECT * FROM events WHERE type = 'task.parent_acknowledged' ORDER BY task_id, CAST(sequence AS INTEGER), rowid").all() as EventRow[];
+	const acknowledgedTasks = new Set<string>();
+	for (const acknowledgment of acknowledgments) {
+		if (acknowledgedTasks.has(acknowledgment.task_id)) continue;
+		const envelopeIds = [...envelopes]
+			.flatMap(([envelopeId, serializedEnvelope]) => {
+				const envelope = optionalLegacyEnvelope(envelopeId, serializedEnvelope);
+				return envelope?.kind === "canonical_event" && envelope.taskId === acknowledgment.task_id && eventIdFromLegacyEnvelope(envelope) === acknowledgment.event_id ? [envelopeId] : [];
+			})
+			.sort();
+		if (envelopeIds.length === 0) throw new Error(`legacy parent acknowledgment ${acknowledgment.event_id} has no durable envelope`);
+		insertTaskOperation(database, { taskId: acknowledgment.task_id, operation: PARENT_ACKNOWLEDGMENT_OPERATION, logicalId: acknowledgment.event_id, logicalType: acknowledgment.type, envelopeIds });
+		acknowledgedTasks.add(acknowledgment.task_id);
+	}
+}
+
+function legacyEnvelopes(database: SqliteDatabase): Map<string, string> {
+	const envelopes = new Map<string, string>();
+	const live = database.query("SELECT envelope_id, envelope FROM outbox ORDER BY rowid").all() as LegacyEnvelopeRow[];
+	const quarantined = database.query("SELECT envelope_id, envelope FROM outbox_quarantine ORDER BY rowid").all() as LegacyEnvelopeRow[];
+	for (const row of [...live, ...quarantined]) {
+		if (row.envelope_id.length === 0) throw new Error("legacy durable envelope identity is malformed");
+		if (!envelopes.has(row.envelope_id)) envelopes.set(row.envelope_id, row.envelope);
+	}
+	return envelopes;
+}
+
+function legacyEnvelope(envelopeId: string, serializedEnvelope: string): RelayEnvelope {
+	const envelope = parseEnvelope(serializedEnvelope);
+	if (envelope.envelopeId !== envelopeId) throw new Error(`legacy envelope ${envelopeId} identity is malformed`);
+	return envelope;
+}
+
+function optionalLegacyEnvelope(envelopeId: string, serializedEnvelope: string): RelayEnvelope | undefined {
+	try {
+		return legacyEnvelope(envelopeId, serializedEnvelope);
+	} catch {
+		// Unrelated operator quarantine rows are audit data, not lifecycle state.
+		return undefined;
+	}
+}
+
+function legacyEnvelopePayload(envelope: RelayEnvelope): unknown {
+	try {
+		return JSON.parse(envelope.payload) as unknown;
+	} catch {
+		throw new Error(`legacy envelope ${envelope.envelopeId} payload is malformed`);
+	}
+}
+
+function eventIdFromLegacyEnvelope(envelope: RelayEnvelope): string | undefined {
+	const payload = legacyEnvelopePayload(envelope);
+	return isRecord(payload) && typeof payload.eventId === "string" ? payload.eventId : undefined;
+}
+
+function insertTaskOperation(database: SqliteDatabase, input: TaskOperationRecord): void {
+	database.query(`INSERT INTO task_operations (task_id, operation, logical_id, logical_type, envelope_ids)
+		VALUES (?, ?, ?, ?, ?) ON CONFLICT(task_id, operation) DO NOTHING`).run(input.taskId, input.operation, input.logicalId, input.logicalType, JSON.stringify(input.envelopeIds));
+}
+
+function ensureColumn(database: SqliteDatabase, table: string, name: string, definition: string): void {
+	const columns = database.query(`PRAGMA table_info(${table})`).all() as Array<{ readonly name: string }>;
+	if (!columns.some((column) => column.name === name)) database.exec(`ALTER TABLE ${table} ADD COLUMN ${name} ${definition}`);
 }
 
 function preparePath(path: string): void {
@@ -199,7 +403,7 @@ function taskRow(task: Omit<TaskRecord, "events">): Record<string, string | numb
 	};
 }
 
-function taskFromRow(row: TaskRow, events: readonly EventRow[]): TaskRecord {
+function taskFromRow(database: SqliteDatabase, row: TaskRow, events: readonly EventRow[]): TaskSnapshot {
 	return {
 		taskId: row.task_id,
 		protocolVersion: row.protocol_version,
@@ -210,6 +414,7 @@ function taskFromRow(row: TaskRow, events: readonly EventRow[]): TaskRecord {
 		expiresAt: row.expires_at,
 		status: row.status as TaskRecord["status"],
 		events: events.map(eventFromRow),
+		terminalDelivery: terminalDeliveryFromDatabase(database, row),
 	};
 }
 
@@ -233,6 +438,54 @@ function parseEnvelope(value: string): RelayEnvelope {
 	return JSON.parse(value) as RelayEnvelope;
 }
 
+function taskOperationFromRow(row: TaskOperationRow): TaskOperationRecord {
+	const envelopeIds = JSON.parse(row.envelope_ids) as unknown;
+	if (!Array.isArray(envelopeIds) || !envelopeIds.every((value) => typeof value === "string" && value.length > 0)) throw new Error("task operation envelope identities are malformed");
+	return { taskId: row.task_id, operation: row.operation, logicalId: row.logical_id, logicalType: row.logical_type, envelopeIds };
+}
+
+function terminalDeliveryFromDatabase(database: SqliteDatabase, task: TaskRow): TerminalDeliveryState {
+	const operation = database.query("SELECT task_id, operation, logical_id, logical_type, envelope_ids FROM task_operations WHERE task_id = ? AND operation = ?").get(task.task_id, TERMINAL_INTENT_OPERATION) as TaskOperationRow | null;
+	if (!operation) return { state: "not_submitted" };
+	const record = taskOperationFromRow(operation);
+	if (!isTerminalIntentType(record.logicalType) || record.envelopeIds.length !== 1) throw new Error("terminal task operation is malformed");
+	const envelopeId = record.envelopeIds[0];
+	if (envelopeId === undefined) throw new Error("terminal task operation has no envelope identity");
+	const identity = {
+		intentId: record.logicalId,
+		intentType: record.logicalType,
+		envelopeId,
+		origin: { relay: task.origin_relay, id: task.origin_id },
+	};
+	const outbox = database.query("SELECT state FROM outbox WHERE envelope_id = ?").get(identity.envelopeId) as { readonly state: OutboxRecord["state"] } | null;
+	if (outbox?.state === "pending") return { state: "pending", ...identity };
+	if (outbox?.state === "accepted") return { state: "accepted", ...identity };
+	const blocked = database.query("SELECT error_code, details, quarantined_at FROM outbox_quarantine WHERE envelope_id = ?").get(identity.envelopeId) as Pick<OutboxQuarantineRow, "error_code" | "details" | "quarantined_at"> | null;
+	if (!blocked) throw new Error("terminal task operation has no durable delivery record");
+	return {
+		state: "delivery_blocked",
+		...identity,
+		blockedAt: blocked.quarantined_at,
+		error: { code: blocked.error_code, retryable: false, details: parseRecord(blocked.details) },
+	};
+}
+
+function isTerminalIntentType(value: string): value is TerminalTaskIntentType {
+	return value === "task.completed" || value === "task.failed" || value === "task.cancelled";
+}
+
+function parseEndpoint(value: string): TaskEndpoint {
+	const endpoint = JSON.parse(value) as unknown;
+	if (!isRecord(endpoint) || typeof endpoint.relay !== "string" || endpoint.relay.length === 0 || typeof endpoint.id !== "string" || endpoint.id.length === 0) {
+		throw new Error("task store endpoint binding is malformed");
+	}
+	return { relay: endpoint.relay, id: endpoint.id };
+}
+
 function parseRecord(value: string): Record<string, unknown> {
 	return JSON.parse(value) as Record<string, unknown>;
 }
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}

package/src/wolfpack-task-relay.ts

@@ -18,7 +18,7 @@ import type {
 	TaskRelay,
 } from "./task-protocol";
 import type { TaskCoreOptions } from "./task-core";
-import type { TaskStoreOptions } from "./task-store";
+import type { TaskStore, TaskStoreOptions } from "./task-store";
 
 export const WOLFPACK_TASK_RELAY_ID = "wolfpack-pi-tasks-v2";
 export const WOLFPACK_TASK_RELAY_PROTOCOL_VERSION = 2;
@@ -28,6 +28,7 @@ const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
 const MAX_REQUEST_TIMEOUT_MS = 60_000;
 const REGISTRATION_POLL_MARGIN_MS = 10_000;
 const SESSION_STORE_DIRECTORY = "sessions";
+const ENDPOINT_ROTATED_CODE = "ENDPOINT_ROTATED";
 
 export interface WolfpackTaskRelayOptions {
 	readonly baseUrl?: string;
@@ -182,6 +183,7 @@ export async function createWolfpackTaskCore(options: WolfpackTaskCoreOptions =
 	const relay = createWolfpackTaskRelay({ ...options, sessionName, generation });
 	try {
 		const endpoint = await relay.endpoint(signal);
+		bindRegisteredEndpoint(store, endpoint, options.clock?.now() ?? Date.now());
 		return createTaskCore({ endpoint, relay, store, ...(options.clock === undefined ? {} : { clock: options.clock }), ...(options.ids === undefined ? {} : { ids: options.ids }) });
 	} catch (error) {
 		store.close();
@@ -189,6 +191,28 @@ export async function createWolfpackTaskCore(options: WolfpackTaskCoreOptions =
 	}
 }
 
+function bindRegisteredEndpoint(store: TaskStore, endpoint: TaskEndpoint, now: number): void {
+	const priorEndpoint = store.getEndpointBinding();
+	if (!priorEndpoint) {
+		store.transaction(() => { store.setEndpointBinding(endpoint); });
+		return;
+	}
+	if (sameEndpoint(priorEndpoint, endpoint)) return;
+	store.transaction(() => {
+		store.setEndpointBinding(endpoint);
+		store.setReceiveCursor("0");
+		for (const record of store.outbox("pending")) {
+			if (!sameEndpoint(record.envelope.source, priorEndpoint)) continue;
+			store.quarantineOutbox(record.envelope.envelopeId, {
+				errorCode: ENDPOINT_ROTATED_CODE,
+				reason: "source endpoint rotated before delivery",
+				details: { priorEndpoint, endpoint },
+				quarantinedAt: now,
+			});
+		}
+	});
+}
+
 function toWolfpackEnvelope(envelope: RelayEnvelope): WolfpackRelayEnvelope {
 	let payload: unknown;
 	try {