@sigrun/ext-gateway 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-10-28
+
+### Fixed
+- The interaction notifier and chat answer correlation now inspect
+  records through core's non-consuming `peekInteraction` instead of the
+  one-shot delivery read. The early-answer race is closed: a secret
+  interaction answered in the webui before the notifier's first pass no
+  longer loses the owning extension's raw-secret delivery (the gateway
+  owns no delivery; regression-tested with a fixture owner).
+- Home-DM settled notices report failed/aborted runs truthfully:
+  `Reply ready` only for answered runs; unanswered runs read `Run ended
+  without a reply` with the settle reason (empty reasons included).
+  Recipient, dedup, bound-conversation suppression, and `notify.home`
+  gating are unchanged.
+
 ## [0.1.1] - 2026-10-27
 ### Fixed
 - First real publish. `0.1.0` was registered with the npm name bootstrap but

package/README.md

@@ -179,11 +179,34 @@ buttons; a later tap reports that outcome rather than answering again.
 Unbound conversations notify each write-access user's home DMs, while
 bound conversations prompt each bound chat once.
 
-**Known gap (secret timing):** a secret interaction answered in the
-webui before the gateway's notifier first runs can lose that one-shot
-secret delivery — the notifier's record read is the delivery-consuming
-read. Answering after the prompt rendered is safe. The durable fix is a
-core-provided non-consuming record read.
+Every gateway interaction read is a non-consuming `peekInteraction`:
+the gateway owns no secret delivery (secret records are webui-plan), so
+inspection can never eat the owning extension's one-shot raw-secret
+read. A secret interaction answered in the webui before the notifier's
+first pass is safe — the notifier peeks masked data and the owner still
+receives the secret exactly once.
+
+Home-DM settled notices are truthful about the outcome: an answered run
+reads `Reply ready`; a failed or aborted run reads `Run ended without a
+reply` with the settle reason, never reply-ready language.
+
+### Prompt retention
+
+Platform prompt messages are never deleted by the gateway. What the
+gateway retains locally is the correlation/edit metadata in
+`prompts.json`: message refs and answer plans expire seven days after
+the interaction settles, so a settlement edit (or a late delivery
+receipt's self-heal edit) is only possible inside that window. Compact
+settled tombstones — recipient identity, settlement time, and outcome
+text — persist permanently for replay suppression: a delayed receipt
+or replay after the row expired recreates nothing and can never make
+an answered prompt answerable again. Pending, unsettled prompts are
+never age-pruned. Refs/plans are therefore bounded by active prompts
+plus seven days of settled history; the small tombstone set grows with
+interaction history by design (the file as a whole is NOT bounded).
+Legacy unversioned state migrates on startup without losing refs or
+re-opening old prompts; a wholly malformed `prompts.json` fails loudly
+rather than silently resetting interaction state.
 
 ## Delivery, state, and shutdown
 

package/dist/engine.js

@@ -39,7 +39,7 @@ import { Ledger } from "./state/ledger.js";
 import { DeliveryWorker } from "./outbound/delivery.js";
 import { onRunSettled } from "./outbound/settled.js";
 import { createNotifier } from "./notify.js";
-import { SessionMetaDoc } from "./session-meta.js";
+import { SessionMetaDoc, readJobMeta } from "./session-meta.js";
 import { StreamRegistry } from "./outbound/stream.js";
 import { hashId } from "./log.js";
 import { collectAttachments } from "./inbound/media.js";
@@ -272,7 +272,7 @@ export function createEngine(host, deps = {}) {
         // The event bus's narrowed snapshot API works in harness-only
         // embedders; host.conversations.meta would wait for a server
         // bridge that those embedders never create.
-        readMeta: async (conversationId) => await api.document(SessionMetaDoc, conversationId, context),
+        readMeta: async (conversationId) => await readJobMeta(async () => await api.document(SessionMetaDoc, conversationId, context), (message) => { log.once("session-meta-read", "warn", message); }),
     });
     const notifyDeps = () => ({
         host,
@@ -511,7 +511,7 @@ export function createEngine(host, deps = {}) {
                     },
                     resolveFiles: (entry) => ledger.resolveFiles(host, entry),
                     onInteractionReceipt: async (entry, receipt) => {
-                        await receiptForInteraction(prompts, entry, receipt);
+                        await receiptForInteraction(prompts, entry, receipt, interactionDeps());
                     },
                 });
                 workers.set(id, worker);

package/dist/interactions/answer.js

@@ -15,9 +15,10 @@ export async function answerFromChat(deps, answer) {
     if (access !== "write")
         return "You do not have write access to this conversation.";
     // Terminal-snapshot invariant: secret-bearing records are webui-plan,
-    // so no chat answer reaches this consuming read. Widening the planner
-    // requires a non-consuming snapshot before any terminal path reads one.
-    const record = await deps.host.snapshotInteraction(answer.conversationId, answer.callId, deps.context ?? { abortSignal: new AbortController().signal });
+    // so no chat answer reaches a secret record. The gateway owns NO
+    // secret delivery regardless — this correlation/terminal read only
+    // INSPECTS, so it is a peek (non-consuming, masked) by construction.
+    const record = await deps.host.peekInteraction(answer.conversationId, answer.callId, deps.context ?? { abortSignal: new AbortController().signal });
     if (record !== undefined && TERMINAL.has(record.status)) {
         return `Already ${outcomeOf(record)}.`;
     }

package/dist/interactions/chat.d.ts

@@ -18,3 +18,11 @@ export interface InteractionChatDeps extends AnswerDeps {
 export declare function createInteractionNotifier(deps: InteractionChatDeps): NotifierContribution;
 /** Enqueue outcome edits/notices and retire numbered/reply-to matching. */
 export declare function onInteractionSettled(event: ExtensionLifecyclePayload["interactionSettled"], deps: InteractionChatDeps, context: HandlerContext): Promise<void>;
+/**
+ * Enqueue settlement edits and per-binding fallback outcome notices
+ * (a binding without an editable ref gets a notice). Called at settlement AND from the receipt
+ * path when a real delivery ref arrives for an ALREADY-settled prompt:
+ * settlement that beats the receipt leaves no editable ref, so the
+ * late receipt is the last chance to replace the live buttons.
+ */
+export declare function enqueueSettlementEdits(deps: InteractionChatDeps, conversationId: number, callId: string, outcome: string): Promise<void>;

package/dist/interactions/chat.js

@@ -39,24 +39,32 @@ async function notifyInteraction(event, deps) {
             targets.push({ key: `user:${event.user}`, channel: home.channel, chat: home.chat });
         }
     }
-    // Resolve and dedupe targets BEFORE reading the record. snapshotInteraction
-    // consumes a settled secret's one-shot delivery, even when we then return.
-    // Final-review follow-up: core should offer a non-consuming snapshot read.
+    // Resolve and dedupe targets BEFORE reading the record. The read is a
+    // PEEK: the gateway owns NO secret delivery (secret records are
+    // webui-plan), so it must never consume one — peekInteraction is the
+    // non-consuming inspection read (a settled secret's one-shot delivery
+    // belongs to the owning extension's snapshotInteraction alone).
     const pendingTargets = targets.filter((target) => !deps.prompts.has(event.conversationId, event.callId, target.key));
     if (pendingTargets.length === 0)
         return;
     const context = deps.context ?? { abortSignal: new AbortController().signal };
-    const record = await deps.host.snapshotInteraction(event.conversationId, event.callId, context);
+    const record = await deps.host.peekInteraction(event.conversationId, event.callId, context);
     if (record === undefined || record.status !== "pending")
         return;
+    // A settle can land while the render above awaited: re-check BEFORE
+    // the first enqueue so an already-settled interaction never gets a
+    // live prompt (the buttons would only answer "Already answered.").
+    const still = await deps.host.peekInteraction(event.conversationId, event.callId, context);
+    if (still === undefined || still.status !== "pending")
+        return;
     for (const target of pendingTargets) {
         const channel = deps.channelOf(target.channel);
         if (channel === undefined) {
             deps.log.warn(`interaction prompt skipped: no channel "${target.channel}"`);
             continue;
         }
-        const plan = planInteraction(record, channel.capabilities);
-        const rendered = renderInteraction(record, channel.capabilities, {
+        const plan = planInteraction(still, channel.capabilities);
+        const rendered = renderInteraction(still, channel.capabilities, {
             conversationId: event.conversationId,
             conversationName: (await deps.host.conversations.meta(event.conversationId)).name ?? `Conversation ${event.conversationId}`,
             ...(event.url === undefined ? {} : { link: event.url }),
@@ -64,8 +72,17 @@ async function notifyInteraction(event, deps) {
                 ? { ...action, conversationId: event.conversationId }
                 : action),
         });
-        await deps.prompts.markEnqueued(event.conversationId, event.callId, target.key, plan);
-        await deps.ledger.enqueue({
+        // The ledger enqueue precedes the prompt row: the ledger tag is
+        // the durable dedupe, so a throwing enqueue must NOT leave a row
+        // that would suppress this target on every replay.
+        // Re-check per target immediately before its enqueue: rendering
+        // and meta lookups await, and a settle in that window must not
+        // deliver another live prompt. markEnqueued independently checks
+        // the durable call-level settlement marker as the final guard.
+        const current = await deps.host.peekInteraction(event.conversationId, event.callId, context);
+        if (current === undefined || current.status !== "pending")
+            return;
+        const enqueued = await deps.ledger.enqueue({
             channel: target.channel,
             ...(target.bindingKey === undefined ? {} : { bindingKey: target.bindingKey }),
             chat: target.chat,
@@ -73,6 +90,15 @@ async function notifyInteraction(event, deps) {
             message: { chat: target.chat, ...rendered },
             tag: `interaction:${event.conversationId}:${event.callId}:${target.key}`,
         });
+        await deps.prompts.markEnqueued(event.conversationId, event.callId, target.key, plan);
+        // A settlement between the pending peek and markEnqueued writes the
+        // call-level tombstone, so no row was reserved. Compensate the lost
+        // reservation by cancelling the still-pending prompt: otherwise its
+        // delivery would leave live buttons and duplicate the outcome notice.
+        if (enqueued !== undefined && !deps.prompts.has(event.conversationId, event.callId, target.key)) {
+            await deps.ledger.cancel(enqueued.id);
+            return;
+        }
     }
 }
 /** Enqueue outcome edits/notices and retire numbered/reply-to matching. */
@@ -84,58 +110,76 @@ export async function onInteractionSettled(event, deps, context) {
         // the extension's only chance to receive the secret. The widened C6
         // event carries everything chat rendering needs (the stored answer
         // is masked by construction — secrets never persist).
-        const who = event.answeredByUser === undefined ? "" : ` by ${event.answeredByUser}`;
-        // SAFETY: the stored answer's values are validated JsonValue (the
-        // record's answer shape); the payload types them loosely because
-        // the contract cannot import the json module's runtime shape.
-        const answerValues = (event.answer ?? {});
-        const outcome = event.status === "answered"
-            ? `answered${who}: ${summarizeValues(answerValues)}`
-            : `${event.status}${who}`;
-        const editableChannels = new Set();
-        const refs = deps.prompts.refsOf(event.conversationId, event.callId);
-        for (const ref of refs) {
-            const id = channelForRef(deps, event.conversationId, event.callId, ref);
-            const channel = id === undefined ? undefined : deps.channelOf(id);
-            if (channel?.capabilities.edit !== undefined && channel.edit !== undefined && ref.messageId !== "") {
-                editableChannels.add(channel.id);
-                const bindingKey = deps.bindings.keysOf(event.conversationId).find((key) => {
-                    const binding = deps.bindings.get(key);
-                    return binding?.chat.chatId === ref.chat.chatId && binding.chat.threadId === ref.chat.threadId;
-                });
-                await deps.ledger.enqueue({
-                    channel: channel.id,
-                    ...(bindingKey === undefined ? {} : { bindingKey }),
-                    chat: ref.chat,
-                    kind: "edit",
-                    ref,
-                    message: { chat: ref.chat, text: truncateInteractionText(`Interaction ${outcome}.`, channel.capabilities.maxMessageLength) },
-                    tag: `interaction-settled:${event.conversationId}:${event.callId}:${channel.id}:${ref.messageId}`,
-                });
-            }
-        }
-        if (editableChannels.size === 0) {
-            for (const key of deps.bindings.keysOf(event.conversationId)) {
-                const binding = deps.bindings.get(key);
-                const channelId = key.split(":")[0];
-                if (binding === undefined || binding.dead === true)
-                    continue;
-                await deps.ledger.enqueue({
-                    channel: channelId,
-                    bindingKey: key,
-                    chat: binding.chat,
-                    kind: "notice",
-                    message: { chat: binding.chat, text: `Interaction ${outcome}.` },
-                    tag: `interaction-settled-notice:${event.conversationId}:${event.callId}:${key}`,
-                });
-            }
-        }
-        await deps.prompts.settle(event.conversationId, event.callId);
+        const outcome = outcomeText(event);
+        await enqueueSettlementEdits(deps, event.conversationId, event.callId, outcome);
+        await deps.prompts.settle(event.conversationId, event.callId, outcome);
     }
     catch (error) {
         deps.log.error(`interaction settlement delivery failed (${String(event.conversationId)}:${event.callId})`, error);
     }
 }
+/** The outcome summary the settlement edit/notice carries. */
+function outcomeText(event) {
+    const who = event.answeredByUser === undefined ? "" : ` by ${event.answeredByUser}`;
+    // SAFETY: the stored answer's values are validated JsonValue (the
+    // record's answer shape); the payload types them loosely because
+    // the contract cannot import the json module's runtime shape.
+    const answerValues = (event.answer ?? {});
+    return event.status === "answered"
+        ? `answered${who}: ${summarizeValues(answerValues)}`
+        : `${event.status}${who}`;
+}
+/**
+ * Enqueue settlement edits and per-binding fallback outcome notices
+ * (a binding without an editable ref gets a notice). Called at settlement AND from the receipt
+ * path when a real delivery ref arrives for an ALREADY-settled prompt:
+ * settlement that beats the receipt leaves no editable ref, so the
+ * late receipt is the last chance to replace the live buttons.
+ */
+export async function enqueueSettlementEdits(deps, conversationId, callId, outcome) {
+    const editableBindings = new Set();
+    const refs = deps.prompts.refsOf(conversationId, callId);
+    for (const ref of refs) {
+        const id = channelForRef(deps, conversationId, callId, ref);
+        const channel = id === undefined ? undefined : deps.channelOf(id);
+        const bindingKey = deps.bindings.keysOf(conversationId).find((key) => {
+            const binding = deps.bindings.get(key);
+            return binding?.chat.chatId === ref.chat.chatId && binding.chat.threadId === ref.chat.threadId;
+        });
+        if (channel?.capabilities.edit !== undefined && channel.edit !== undefined && ref.messageId !== "") {
+            if (bindingKey !== undefined)
+                editableBindings.add(bindingKey);
+            await deps.ledger.enqueue({
+                channel: channel.id,
+                ...(bindingKey === undefined ? {} : { bindingKey }),
+                chat: ref.chat,
+                kind: "edit",
+                ref,
+                message: { chat: ref.chat, text: truncateInteractionText(`Interaction ${outcome}.`, channel.capabilities.maxMessageLength) },
+                tag: `interaction-settled:${conversationId}:${callId}:${channel.id}:${ref.messageId}`,
+            });
+        }
+    }
+    // Fallback eligibility is PER BINDING: an editable ref on one channel
+    // must not suppress the outcome notice owed to another binding whose
+    // channel cannot edit (or whose prompt has no editable ref).
+    for (const key of deps.bindings.keysOf(conversationId)) {
+        if (editableBindings.has(key))
+            continue;
+        const binding = deps.bindings.get(key);
+        const channelId = key.split(":")[0];
+        if (binding === undefined || binding.dead === true)
+            continue;
+        await deps.ledger.enqueue({
+            channel: channelId,
+            bindingKey: key,
+            chat: binding.chat,
+            kind: "notice",
+            message: { chat: binding.chat, text: `Interaction ${outcome}.` },
+            tag: `interaction-settled-notice:${conversationId}:${callId}:${key}`,
+        });
+    }
+}
 /** Recover the channel from the binding key/home prompt target. */
 function channelForRef(deps, conversationId, callId, ref) {
     for (const key of deps.bindings.keysOf(conversationId)) {

package/dist/interactions/prompts.d.ts

@@ -1,21 +1,40 @@
 /**
  * Durable chat-prompt bookkeeping. Ledger delivery receipts become
  * MessageRefs here; pending reads stay synchronous for inbound stage 8.
- * Settled prompts stop matching numbered/reply-to answers; their refs
- * remain so settlement can edit the delivered platform message.
+ * Settled prompts stop matching numbered/reply-to answers.
+ *
+ * Retention (release-readiness spec 4 §§2–4): the persisted file is
+ * version 2 — `prompts` rows plus a `settled` tombstone map carrying
+ * the settlement timestamp and outcome text. Seven days after
+ * settlement the bulky row (refs/plan) expires; the compact tombstone
+ * persists PERMANENTLY so a delayed receipt or replay can never
+ * resurrect an answerable prompt. Pending rows are never age-pruned.
+ * Pruning runs at store initialization and at most once per write (no
+ * timer), through the one `prune` helper and its boundary predicate.
+ * Refs/plans are therefore bounded by active prompts plus seven days
+ * of settled history; the tombstone set is deliberately unbounded.
  */
 import type { MessageRef } from "@sigrun/sigrun/extension";
+import type { EngineLog } from "../log.js";
 import type { ChatAnswerPlan } from "./render.js";
+/** Settled-row retention (matches the delivery ledger's seven days). */
+export declare const PROMPT_RETENTION_MS = 604800000;
 export interface PendingPrompt {
     readonly conversationId: number;
     readonly callId: string;
     readonly plan: ChatAnswerPlan;
 }
+export interface PromptStoreOptions {
+    readonly now?: () => number;
+    readonly log?: EngineLog;
+}
 export declare class PromptStore {
     private readonly file;
+    private readonly now;
+    private readonly log;
     private rows;
     private settled;
-    constructor(path: string);
+    constructor(path: string, options?: PromptStoreOptions);
     /** Record a delivered prompt ref (idempotent for one recipient key). */
     record(conversationId: number, callId: string, key: string, ref: MessageRef, plan: ChatAnswerPlan): Promise<void>;
     /** All delivered message refs for settlement edits (including settled). */
@@ -37,6 +56,13 @@ export declare class PromptStore {
     markEnqueued(conversationId: number, callId: string, key: string, plan: ChatAnswerPlan): Promise<void>;
     /** Install the real refs after the interaction ledger entry is delivered. */
     recordReceipt(conversationId: number, callId: string, key: string, chat: MessageRef["chat"], messageIds: readonly string[]): Promise<void>;
-    /** Retire pending answers while preserving refs for the settlement edit. */
-    settle(conversationId: number, callId: string): Promise<void>;
+    /** Retire pending answers; the refs stay until retention expires them. */
+    settle(conversationId: number, callId: string, outcome?: string): Promise<void>;
+    /**
+     * The outcome text recorded at settlement, when this identity is
+     * settled. The receipt path reads it to self-heal the prompt edit;
+     * the tombstone outlives the bulky row, so the answer survives
+     * pruning even when no editable ref remains.
+     */
+    settledOutcome(conversationId: number, callId: string, key: string): string | undefined;
 }

package/dist/interactions/prompts.js

@@ -1,37 +1,90 @@
 /**
  * Durable chat-prompt bookkeeping. Ledger delivery receipts become
  * MessageRefs here; pending reads stay synchronous for inbound stage 8.
- * Settled prompts stop matching numbered/reply-to answers; their refs
- * remain so settlement can edit the delivered platform message.
+ * Settled prompts stop matching numbered/reply-to answers.
+ *
+ * Retention (release-readiness spec 4 §§2–4): the persisted file is
+ * version 2 — `prompts` rows plus a `settled` tombstone map carrying
+ * the settlement timestamp and outcome text. Seven days after
+ * settlement the bulky row (refs/plan) expires; the compact tombstone
+ * persists PERMANENTLY so a delayed receipt or replay can never
+ * resurrect an answerable prompt. Pending rows are never age-pruned.
+ * Pruning runs at store initialization and at most once per write (no
+ * timer), through the one `prune` helper and its boundary predicate.
+ * Refs/plans are therefore bounded by active prompts plus seven days
+ * of settled history; the tombstone set is deliberately unbounded.
  */
 import { JsonFile } from "../state/json-file.js";
+/** Settled-row retention (matches the delivery ledger's seven days). */
+export const PROMPT_RETENTION_MS = 604_800_000;
+/** The persisted schema version (v1 = unversioned, `settled: string[]`). */
+const PROMPT_FILE_VERSION = 2;
 export class PromptStore {
     file;
+    now;
+    log;
     rows;
     settled;
-    constructor(path) {
-        this.file = new JsonFile(path, () => ({ prompts: [], settled: [] }));
+    constructor(path, options = {}) {
+        this.now = options.now ?? (() => Date.now());
+        this.log = options.log;
+        this.file = new JsonFile(path, () => ({
+            version: PROMPT_FILE_VERSION,
+            prompts: [],
+            settled: {},
+        }));
         const state = this.file.readSync();
-        this.rows = state.prompts;
-        this.settled = new Set(state.settled);
+        const migrated = migrate(state, this.now(), this.log);
+        // Initialization pruning rides the same helper the writes use.
+        prune(migrated, this.now());
+        // Persist the normalized/pruned shape ONLY when something changed:
+        // a legacy or repaired file must not re-migrate on every boot,
+        // while a healthy v2 file needs no rewrite at construction.
+        if (JSON.stringify(state) !== JSON.stringify(migrated)) {
+            this.file.updateSync((draft) => {
+                draft.version = migrated.version;
+                draft.prompts = migrated.prompts;
+                draft.settled = migrated.settled;
+            });
+        }
+        this.rows = migrated.prompts;
+        this.settled = migrated.settled;
     }
     /** Record a delivered prompt ref (idempotent for one recipient key). */
     async record(conversationId, callId, key, ref, plan) {
         const state = await this.file.update((draft) => {
             const identity = `${conversationId}:${callId}:${key}`;
-            // A settlement raced the receipt: preserve the newly delivered
-            // ref for the edit, never re-open the prompt for answers.
-            if (draft.settled.includes(identity) && ref.messageId === "")
+            const tombstone = draft.settled[identity];
+            const existing = draft.prompts.find((row) => identityOf(row) === identity);
+            // Settlement is CALL-scoped, not only row-scoped. A settlement
+            // landing before the first row exists still records a marker;
+            // otherwise a later fan-out/receipt could create an answerable
+            // prompt for an already-settled interaction. A real receipt may
+            // still install refs on a surviving row for the settlement edit.
+            if (existing === undefined && draft.settled[`${conversationId}:${callId}:`] !== undefined)
                 return;
-            const existing = draft.prompts.find((row) => row.conversationId === conversationId && row.callId === callId && row.key === key);
+            if (tombstone !== undefined) {
+                // A settlement raced this record. An EMPTY ref never replaces
+                // a delivered one; a REAL ref still installs while the row
+                // survives so the late receipt can self-heal the edit. Once
+                // the row is pruned, BOTH shapes are ignored — no resurrection.
+                const existing = draft.prompts.find((row) => identityOf(row) === identity);
+                if (existing === undefined)
+                    return;
+                if (ref.messageId === "")
+                    return;
+                if (existing.ref.messageId !== "")
+                    return;
+            }
             const next = { conversationId, callId, key, ref, plan };
             if (existing === undefined)
                 draft.prompts.push(next);
             else
                 draft.prompts[draft.prompts.indexOf(existing)] = next;
+            prune(draft, this.now());
         });
         this.rows = state.prompts;
-        this.settled = new Set(state.settled);
+        this.settled = state.settled;
     }
     /** All delivered message refs for settlement edits (including settled). */
     refsOf(conversationId, callId) {
@@ -58,14 +111,14 @@ export class PromptStore {
     /** Unsettled choice/text prompts in one chat (bound key or user home key). */
     pendingInChat(bindingKey) {
         return this.rows
-            .filter((row) => row.key === bindingKey && !this.settled.has(identityOf(row)))
+            .filter((row) => row.key === bindingKey && this.settled[identityOf(row)] === undefined)
             .map((row) => ({ conversationId: row.conversationId, callId: row.callId, plan: row.plan }));
     }
     /** Find the prompt behind a reply-to platform message id. */
     byReplyTo(bindingKey, messageId) {
         const row = this.rows.find((candidate) => candidate.key === bindingKey &&
             candidate.ref.messageId === messageId &&
-            !this.settled.has(identityOf(candidate)));
+            this.settled[identityOf(candidate)] === undefined);
         return row === undefined
             ? undefined
             : { conversationId: row.conversationId, callId: row.callId, plan: row.plan };
@@ -79,18 +132,115 @@ export class PromptStore {
         const existing = this.rows.find((row) => row.conversationId === conversationId && row.callId === callId && row.key === key);
         await this.record(conversationId, callId, key, { chat, messageId: messageIds[0] ?? "" }, existing?.plan ?? { kind: "webui" });
     }
-    /** Retire pending answers while preserving refs for the settlement edit. */
-    async settle(conversationId, callId) {
+    /** Retire pending answers; the refs stay until retention expires them. */
+    async settle(conversationId, callId, outcome = "answered") {
         const state = await this.file.update((draft) => {
-            const keys = draft.prompts
-                .filter((row) => row.conversationId === conversationId && row.callId === callId)
-                .map(identityOf);
-            draft.settled = [...new Set([...draft.settled, ...keys])];
+            const keys = [
+                `${conversationId}:${callId}:`,
+                ...draft.prompts
+                    .filter((row) => row.conversationId === conversationId && row.callId === callId)
+                    .map(identityOf),
+            ];
+            for (const identity of keys) {
+                // Re-settling an already-settled interaction keeps the FIRST
+                // settlement's timestamp and outcome: retention is measured
+                // from settlement, never extended by later writes.
+                if (draft.settled[identity] !== undefined)
+                    continue;
+                draft.settled[identity] = { at: this.now(), outcome };
+            }
+            prune(draft, this.now());
         });
         this.rows = state.prompts;
-        this.settled = new Set(state.settled);
+        this.settled = state.settled;
+    }
+    /**
+     * The outcome text recorded at settlement, when this identity is
+     * settled. The receipt path reads it to self-heal the prompt edit;
+     * the tombstone outlives the bulky row, so the answer survives
+     * pruning even when no editable ref remains.
+     */
+    settledOutcome(conversationId, callId, key) {
+        return this.settled[`${conversationId}:${callId}:${key}`]?.outcome
+            ?? this.settled[`${conversationId}:${callId}:`]?.outcome;
+    }
+}
+/**
+ * THE retention helper (init and every write call this, at most once
+ * per write): a SETTLED row expires at `settledAt + RETENTION_MS <= now`.
+ * The tombstone itself is never pruned — it is what stops a delayed
+ * receipt from recreating an answerable prompt. Pending rows are
+ * never age-pruned.
+ */
+function prune(draft, now) {
+    draft.prompts = draft.prompts.filter((row) => {
+        const tombstone = draft.settled[identityOf(row)];
+        if (tombstone === undefined)
+            return true;
+        return tombstone.at + PROMPT_RETENTION_MS > now;
+    });
+}
+/**
+ * Normalize whatever was on disk to the v2 shape. An unversioned v1
+ * file keeps every prompt row and stamps its settled identities with
+ * the MIGRATION time (one cohort, expiring together seven days later).
+ * Individually malformed tombstones are dropped with a log line each;
+ * valid unrelated rows are never discarded. A wholly malformed JSON
+ * document never reaches here — JsonFile throws naming the path.
+ */
+function migrate(state, now, log) {
+    const prompts = Array.isArray(state.prompts) ? state.prompts : [];
+    const settled = {};
+    const raw = state.settled;
+    if (Array.isArray(raw)) {
+        // v1: bare identities, age unknown — the migration timestamp is
+        // the conservative choice (one further retention window).
+        for (const identity of raw) {
+            if (typeof identity !== "string")
+                continue;
+            settled[identity] = { at: now, outcome: "answered" };
+        }
+    }
+    else if (raw !== null && typeof raw === "object") {
+        for (const [identity, value] of Object.entries(raw)) {
+            const tombstone = value;
+            if (tombstone === null || typeof tombstone !== "object" ||
+                typeof tombstone.at !== "number" || !Number.isFinite(tombstone.at) ||
+                typeof tombstone.outcome !== "string") {
+                log?.warn(`prompts: dropping malformed settled tombstone "${identity}" (its row, if any, stays live)`);
+                continue;
+            }
+            if (!validIdentity(identity)) {
+                log?.warn(`prompts: dropping settled tombstone with a malformed identity "${identity}"`);
+                continue;
+            }
+            settled[identity] = { at: tombstone.at, outcome: tombstone.outcome };
+        }
+    }
+    else if (raw !== undefined) {
+        log?.warn("prompts: ignoring malformed settled container (expected an array or map)");
     }
+    return { version: PROMPT_FILE_VERSION, prompts, settled };
 }
 function identityOf(row) {
     return `${row.conversationId}:${row.callId}:${row.key}`;
 }
+/**
+ * An identity is `<conversationId>:<callId>:<key>` — a positive integer
+ * conversation id, a non-empty callId without colons, and a non-empty
+ * key (opaque binding/home keys may themselves contain colons).
+ */
+function validIdentity(identity) {
+    const separator = identity.indexOf(":");
+    if (separator <= 0)
+        return false;
+    if (!/^[1-9][0-9]*$/.test(identity.slice(0, separator)))
+        return false;
+    const rest = identity.slice(separator + 1);
+    const second = rest.indexOf(":");
+    // The empty key is the call-level settlement marker, written when
+    // settlement precedes prompt-row creation.
+    if (second === rest.length - 1)
+        return true;
+    return second > 0;
+}

package/dist/interactions/receipts.d.ts

@@ -1,6 +1,7 @@
 /** Map a delivered interaction ledger row back to its recipient key. */
 import type { LedgerEntry } from "../state/ledger.js";
 import type { PromptStore } from "./prompts.js";
+import { type InteractionChatDeps } from "./chat.js";
 export declare function receiptForInteraction(prompts: PromptStore, entry: LedgerEntry, receipt: {
     readonly messageIds: readonly string[];
-}): Promise<void>;
+}, deps?: InteractionChatDeps): Promise<void>;

package/dist/interactions/receipts.js

@@ -1,5 +1,6 @@
 /** Map a delivered interaction ledger row back to its recipient key. */
-export async function receiptForInteraction(prompts, entry, receipt) {
+import { enqueueSettlementEdits } from "./chat.js";
+export async function receiptForInteraction(prompts, entry, receipt, deps) {
     // The receipt is authoritative: an early settlement may have removed
     // the pending row, but the delivered message still needs an edit ref.
     if (entry.bindingKey !== undefined) {
@@ -10,7 +11,9 @@ export async function receiptForInteraction(prompts, entry, receipt) {
         if (!match[2].endsWith(suffix))
             return;
         const callId = match[2].slice(0, -suffix.length);
-        await prompts.recordReceipt(Number(match[1]), callId, entry.bindingKey, entry.chat, receipt.messageIds);
+        const conversationId = Number(match[1]);
+        await prompts.recordReceipt(conversationId, callId, entry.bindingKey, entry.chat, receipt.messageIds);
+        await healSettledPrompt(prompts, deps, conversationId, callId, entry.bindingKey, receipt.messageIds);
         return;
     }
     const tag = entry.tag;
@@ -31,6 +34,36 @@ export async function receiptForInteraction(prompts, entry, receipt) {
         if (afterConversation !== suffix)
             continue;
         await prompts.recordReceipt(conversationId, row.callId, row.key, entry.chat, receipt.messageIds);
+        await healSettledPrompt(prompts, deps, conversationId, row.callId, row.key, receipt.messageIds);
         return;
     }
 }
+/**
+ * A real receipt for an ALREADY-settled prompt self-heals the live
+ * buttons: settlement ran with an empty ref (no edit possible, so a
+ * notice went out), and this delivered message is the one that now
+ * needs the outcome edit. The edit tag is the same the settlement
+ * path would have used, so a repeat receipt stays a no-op.
+ */
+async function healSettledPrompt(prompts, deps, conversationId, callId, key, messageIds) {
+    if (deps === undefined)
+        return;
+    if (messageIds.length === 0 || messageIds[0] === "")
+        return;
+    const outcome = prompts.settledOutcome(conversationId, callId, key);
+    if (outcome === undefined)
+        return;
+    // Tombstones outlive their bulky rows. A receipt AFTER pruning must
+    // be a true no-op: with no surviving row/ref, the settlement helper
+    // would otherwise take its fallback and enqueue duplicate notices.
+    const ref = prompts.refsOf(conversationId, callId)
+        .find((candidate) => candidate.messageId === messageIds[0]);
+    if (ref === undefined)
+        return;
+    try {
+        await enqueueSettlementEdits(deps, conversationId, callId, outcome);
+    }
+    catch (error) {
+        deps.log.error(`settled prompt receipt heal failed (${conversationId}:${callId})`, error);
+    }
+}

package/dist/notify.js

@@ -32,19 +32,26 @@ async function notify(event, deps) {
         if (event.conversationId === undefined)
             return;
         // The settled fan-out owns bound conversations; a second notice
-        // here would duplicate the answer the chat just received.
-        if (deps.bindings.keysOf(event.conversationId).length > 0)
+        // here would duplicate the answer the chat just received. Only
+        // LIVE bindings suppress: a dead binding is skipped by the
+        // fan-out, so counting it would drop the answer with no log.
+        const live = deps.bindings.keysOf(event.conversationId)
+            .filter((key) => deps.bindings.get(key)?.dead !== true);
+        if (live.length > 0)
             return;
         const meta = await deps.host.conversations.meta(event.conversationId);
         // New-conversation jobs are unbound, but their delivery and
-        // job.failed paths own notices. Core's run.settled carries no
-        // outcome, so the false success notice on a failed job run needs
-        // a core-contract event change and is ledgered for final review.
+        // job.failed paths own notices. The settled outcome (Task 4) is
+        // structured on the event: only an ANSWERED run may read as a
+        // ready reply; a failed/aborted run is a truthful non-success
+        // notice carrying the run's own reason.
         if (meta.jobId !== undefined)
             return;
     }
     const text = event.type === "run.settled"
-        ? `Reply ready — ${event.body}${event.url === undefined ? "" : `\n${event.url}`}`
+        ? event.outcome.status === "answered"
+            ? `Reply ready — ${event.body}${event.url === undefined ? "" : `\n${event.url}`}`
+            : `Run ended without a reply — ${event.body}${event.outcome.reason === "" ? "" : ` (${event.outcome.reason})`}${event.url === undefined ? "" : `\n${event.url}`}`
         : `${event.title}\n${event.body}${event.url === undefined ? "" : `\n${event.url}`}`;
     for (const home of deps.identities.homesOf(event.user)) {
         await deps.ledger.enqueue({

package/dist/outbound/delivery.d.ts

@@ -42,6 +42,7 @@ export interface DeliveryDeps {
     readonly counts?: {
         delivered(): void;
         failed(): void;
+        cancelled?(): void;
     };
     /** Persist a delivered interaction prompt's platform refs for edits/replies. */
     readonly onInteractionReceipt?: (entry: LedgerEntry, receipt: {
@@ -110,7 +111,13 @@ export declare class DeliveryWorker {
      * Returns false when a retry wait was armed (the caller parks).
      */
     private onSendError;
-    /** A ledger mark with its own error isolation (never throws). */
+    /**
+     * A ledger mark with its own error isolation (never throws). Returns
+     * whether the transition APPLIED: a refusal means the entry left
+     * `pending` behind our back (a settlement cancelled it), so the caller
+     * must skip its failure/retry side effects rather than count a failure
+     * for a cancelled entry or arm a retry that re-pulls it.
+     */
     private markLedger;
     /**
      * The classification read (adapter's `classifyError` when present,

package/dist/outbound/delivery.js

@@ -160,7 +160,14 @@ export class DeliveryWorker {
             // failing ledger write is LOGGED and the send does not run (an
             // unmarked entry must not be sent — the crash window would
             // duplicate it on recovery).
-            await this.ledger.mark(entry.id, "attempting");
+            // A refused claim means the entry is no longer pending (a
+            // settlement cancelled it between the loop's read and here).
+            // Sending it anyway would deliver a live prompt for a decided
+            // interaction, so stop: the cancellation is the barrier.
+            if (!(await this.ledger.mark(entry.id, "attempting"))) {
+                this.deps.counts?.cancelled?.();
+                return true;
+            }
             const receipt = entry.kind === "edit"
                 ? await this.boundedEdit(entry, message)
                 : await this.boundedSend(message);
@@ -270,8 +277,8 @@ export class DeliveryWorker {
             }
             this.deps.log.warn(`delivery: chat gone for "${entry.channel}:${hashId(entry.chat.chatId)}" — binding marked dead`);
             this.deps.log.debug(`delivery: chat gone for "${entry.channel}:${entry.chat.chatId}" — binding marked dead`);
-            await this.markLedger(entry.id, "failed");
-            this.deps.counts?.failed();
+            if (await this.markLedger(entry.id, "failed"))
+                this.deps.counts?.failed();
             return true;
         }
         if (kind === "permanent") {
@@ -280,8 +287,8 @@ export class DeliveryWorker {
                 : "";
             this.deps.log.error(`delivery: permanent failure ("${entry.kind}" to "${hashId(entry.chat.chatId)}")${fileDetail}`, error);
             this.deps.log.debug(`delivery: permanent failure ("${entry.kind}" to "${entry.chat.chatId}")${fileDetail}`);
-            await this.markLedger(entry.id, "failed");
-            this.deps.counts?.failed();
+            if (await this.markLedger(entry.id, "failed"))
+                this.deps.counts?.failed();
             return true;
         }
         // Transient: the retry ladder. attempts was already incremented by
@@ -291,8 +298,8 @@ export class DeliveryWorker {
         if (retriesUsed >= this.deps.delays.length) {
             this.deps.log.error(`delivery: retries exhausted ("${entry.kind}" to "${hashId(entry.chat.chatId)}"): ${detail}`);
             this.deps.log.debug(`delivery: retries exhausted ("${entry.kind}" to "${entry.chat.chatId}"): ${detail}`);
-            await this.markLedger(entry.id, "failed");
-            this.deps.counts?.failed();
+            if (await this.markLedger(entry.id, "failed"))
+                this.deps.counts?.failed();
             return true;
         }
         const delay = this.deps.delays[retriesUsed] ?? 0;
@@ -300,7 +307,10 @@ export class DeliveryWorker {
         // The entry returns to pending (the retry re-pulls it); the timer
         // re-kicks the loop. A stop cancels the timer — the entry stays
         // pending for the next boot's recovery.
-        await this.markLedger(entry.id, "pending");
+        // A refused re-arm means the entry was cancelled while we were
+        // classifying the failure: do not arm a retry that would re-pull it.
+        if (!(await this.markLedger(entry.id, "pending")))
+            return true;
         if (this.stopped)
             return false;
         this.cancelRetry?.();
@@ -310,13 +320,20 @@ export class DeliveryWorker {
         }, delay);
         return false;
     }
-    /** A ledger mark with its own error isolation (never throws). */
+    /**
+     * A ledger mark with its own error isolation (never throws). Returns
+     * whether the transition APPLIED: a refusal means the entry left
+     * `pending` behind our back (a settlement cancelled it), so the caller
+     * must skip its failure/retry side effects rather than count a failure
+     * for a cancelled entry or arm a retry that re-pulls it.
+     */
     async markLedger(id, state) {
         try {
-            await this.ledger.mark(id, state);
+            return await this.ledger.mark(id, state);
         }
         catch (markError) {
             this.deps.log.error("delivery: ledger mark failed", markError);
+            return false;
         }
     }
     /**

package/dist/outbound/settled.d.ts

@@ -23,6 +23,7 @@
  */
 import type { ChannelContribution, RunSettledEvent, SigrunHost } from "@sigrun/sigrun/extension";
 import type { SubmissionId } from "@earendil-works/pi-durable";
+import type { SessionMeta } from "@sigrun/shared/session-meta";
 import type { ChannelConfig } from "../config.js";
 import type { BindingStore } from "../state/bindings.js";
 import type { Ledger } from "../state/ledger.js";
@@ -44,17 +45,17 @@ export interface Streams {
     finalize(conversationId: number, chunks: string[]): Promise<boolean>;
     abandon(conversationId: number): void;
 }
+/**
+ * The job-delivery metadata the settled fan-out reads. Derived from the
+ * canonical shared session-meta wire type (type-only: no runtime core
+ * dependency) so field drift fails the contract fixture's typecheck.
+ */
+export type GatewayJobMeta = Pick<SessionMeta, "owner" | "name" | "autoName" | "jobId" | "deliver">;
 /** onRunSettled's injectable dependencies. */
 export interface SettledDeps {
     readonly host: SigrunHost;
     /** The event bus's bridge-free document read (factory-supplied). */
-    readonly readMeta?: (conversationId: number) => Promise<{
-        readonly owner?: string;
-        readonly name?: string;
-        readonly autoName?: string;
-        readonly jobId?: string;
-        readonly deliver?: string[];
-    } | undefined>;
+    readonly readMeta?: (conversationId: number) => Promise<GatewayJobMeta | undefined>;
     /** The engine-wide bindings (the delivery fan-out read). */
     readonly bindings: BindingStore;
     /** The engine-wide identity links (the binding's user resolution). */

package/dist/session-meta.d.ts

@@ -2,7 +2,17 @@
  * The core session-meta document token, re-declared structurally from
  * the shared wire type. Standalone doc tokens compare by kind/scope;
  * declaring it here avoids a runtime import of core's server modules.
- * Core-contract follow-up: version drift here silently reads job meta as absent.
+ * Version drift is real: pi-durable's checkRecordVersion throws BOTH
+ * directions (a newer stored doc, or an older one with no migration),
+ * so the engine reads job meta through readJobMeta — a throwing read
+ * degrades to absent-meta (logged once) rather than failing the
+ * settled fan-out and losing the job delivery.
  */
 import type { SessionMeta } from "@sigrun/shared/views";
 export declare const SessionMetaDoc: import("@earendil-works/pi-durable").ConversationDocToken<SessionMeta>;
+/**
+ * Read job meta conservatively: a version-drift throw (or any other
+ * document-read failure) logs the cause ONCE and returns undefined,
+ * so job delivery skips cleanly instead of breaking the fan-out.
+ */
+export declare function readJobMeta<T>(read: () => Promise<T>, warn: (message: string) => void): Promise<T | undefined>;

package/dist/session-meta.js

@@ -2,7 +2,11 @@
  * The core session-meta document token, re-declared structurally from
  * the shared wire type. Standalone doc tokens compare by kind/scope;
  * declaring it here avoids a runtime import of core's server modules.
- * Core-contract follow-up: version drift here silently reads job meta as absent.
+ * Version drift is real: pi-durable's checkRecordVersion throws BOTH
+ * directions (a newer stored doc, or an older one with no migration),
+ * so the engine reads job meta through readJobMeta — a throwing read
+ * degrades to absent-meta (logged once) rather than failing the
+ * settled fan-out and losing the job delivery.
  */
 import { defineDoc } from "@earendil-works/pi-durable";
 export const SessionMetaDoc = defineDoc({
@@ -19,3 +23,17 @@ export const SessionMetaDoc = defineDoc({
         source: "user",
     }),
 });
+/**
+ * Read job meta conservatively: a version-drift throw (or any other
+ * document-read failure) logs the cause ONCE and returns undefined,
+ * so job delivery skips cleanly instead of breaking the fan-out.
+ */
+export async function readJobMeta(read, warn) {
+    try {
+        return await read();
+    }
+    catch (error) {
+        warn(`session-meta read failed; job meta treated as absent: ${String(error)}`);
+        return undefined;
+    }
+}

package/dist/state/identities.d.ts

@@ -14,7 +14,11 @@ import type { EngineLog } from "../log.js";
 export type LinkVia = "pairing" | "self";
 /** Core's one provider-key convention for platform senders. */
 export declare function chatProviderOf(channel: string): string;
-/** Core admits only this channel-id shape inside a chat provider. */
+/**
+ * Core admits only this channel-id shape inside a chat provider. This
+ * matches the loader's grammar exactly: every binding-key and target
+ * parse splits on ":", so a wider alphabet would mis-attribute chats.
+ */
 export declare const CHANNEL_ID_PATTERN: RegExp;
 /** The result of a `userFor` resolution. */
 export interface ResolvedUser {

package/dist/state/identities.js

@@ -12,8 +12,12 @@ import { JsonFile } from "./json-file.js";
 export function chatProviderOf(channel) {
     return `chat:${channel}`;
 }
-/** Core admits only this channel-id shape inside a chat provider. */
-export const CHANNEL_ID_PATTERN = /^[a-z0-9][a-z0-9._:-]*$/;
+/**
+ * Core admits only this channel-id shape inside a chat provider. This
+ * matches the loader's grammar exactly: every binding-key and target
+ * parse splits on ":", so a wider alphabet would mis-attribute chats.
+ */
+export const CHANNEL_ID_PATTERN = /^[a-z][a-z0-9-]*$/;
 /** Core-backed sender resolution and engine-owned home-chat persistence. */
 export class IdentityStore {
     host;

package/dist/state/ledger.d.ts

@@ -36,7 +36,7 @@ export interface SerializedOutbound {
     }[];
 }
 /** One ledger row's lifecycle. */
-export type LedgerState = "pending" | "attempting" | "delivered" | "failed";
+export type LedgerState = "pending" | "attempting" | "delivered" | "failed" | "cancelled";
 /** What the entry is for (the worker's send-shape discrimination). */
 export type LedgerKind = "final" | "notice" | "interaction" | "edit";
 /**
@@ -123,8 +123,32 @@ export declare class Ledger {
      * (the worker's loop is a tick, not an await point).
      */
     nextPending(channel: string): LedgerEntry | undefined;
-    /** Transition one entry's state (attempting/delivered/failed). */
-    mark(id: string, state: LedgerState, receipt?: readonly string[]): Promise<void>;
+    /**
+     * Cancel an entry that has not started delivery. The transition is
+     * atomic with the ledger write: an attempting/delivered entry cannot
+     * be cancelled after the platform may already have received it.
+     * Returns whether this call cancelled the pending entry.
+     */
+    cancel(id: string): Promise<boolean>;
+    /**
+     * Whether a transition may leave the entry's current state. The rule
+     * this exists for is narrow and deliberate: `cancelled` is TERMINAL,
+     * so a cancelled entry can never be resurrected by a late `mark` —
+     * that is what makes `cancel` a barrier rather than a request, and it
+     * is what stops a settlement-cancelled interaction prompt from being
+     * delivered anyway. Every other edge stays permissive, because the
+     * ledger is a state MACHINE with legitimate direct transitions
+     * (`pending → delivered` for a single-attempt success,
+     * `attempting → pending` for the retry ladder, `pending → failed`).
+     */
+    private static canLeave;
+    /**
+     * Transition one entry's state (attempting/delivered/failed). A
+     * transition out of `cancelled` is refused, and a refused transition
+     * reports `false` so the caller can stop before acting on the entry
+     * (the delivery worker must not send an entry it failed to claim).
+     */
+    mark(id: string, state: LedgerState, receipt?: readonly string[]): Promise<boolean>;
     /**
      * Restart recovery: every `attempting` entry becomes `pending` with
      * the `recovered` flag (the worker prefixes the marker at send time).

package/dist/state/ledger.js

@@ -83,13 +83,61 @@ export class Ledger {
     nextPending(channel) {
         return this.entries.find((entry) => entry.channel === channel && entry.state === "pending");
     }
-    /** Transition one entry's state (attempting/delivered/failed). */
+    /**
+     * Cancel an entry that has not started delivery. The transition is
+     * atomic with the ledger write: an attempting/delivered entry cannot
+     * be cancelled after the platform may already have received it.
+     * Returns whether this call cancelled the pending entry.
+     */
+    async cancel(id) {
+        let cancelled = false;
+        const state = await this.file.update((draft) => {
+            const index = draft.entries.findIndex((row) => row.id === id);
+            if (index === -1)
+                return;
+            const row = draft.entries[index];
+            if (row.state !== "pending")
+                return;
+            draft.entries[index] = {
+                ...row,
+                state: "cancelled",
+                stateSince: this.now(),
+            };
+            cancelled = true;
+        });
+        this.entries = state.entries;
+        return cancelled;
+    }
+    /**
+     * Whether a transition may leave the entry's current state. The rule
+     * this exists for is narrow and deliberate: `cancelled` is TERMINAL,
+     * so a cancelled entry can never be resurrected by a late `mark` —
+     * that is what makes `cancel` a barrier rather than a request, and it
+     * is what stops a settlement-cancelled interaction prompt from being
+     * delivered anyway. Every other edge stays permissive, because the
+     * ledger is a state MACHINE with legitimate direct transitions
+     * (`pending → delivered` for a single-attempt success,
+     * `attempting → pending` for the retry ladder, `pending → failed`).
+     */
+    static canLeave(from, to) {
+        return from !== "cancelled" || to === "cancelled";
+    }
+    /**
+     * Transition one entry's state (attempting/delivered/failed). A
+     * transition out of `cancelled` is refused, and a refused transition
+     * reports `false` so the caller can stop before acting on the entry
+     * (the delivery worker must not send an entry it failed to claim).
+     */
     async mark(id, state, receipt) {
+        let applied = false;
         await this.file.update((draft) => {
             const index = draft.entries.findIndex((row) => row.id === id);
             if (index === -1)
                 return;
             const row = draft.entries[index];
+            if (!Ledger.canLeave(row.state, state))
+                return;
+            applied = true;
             const next = {
                 ...row,
                 state,
@@ -104,6 +152,7 @@ export class Ledger {
             draft.entries[index] = next;
             this.entries = draft.entries;
         });
+        return applied;
     }
     /**
      * Restart recovery: every `attempting` entry becomes `pending` with

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sigrun/ext-gateway",
-	"version": "0.1.1",
+	"version": "0.1.2",
 	"description": "Gateway engine extension for sigrun (pi-durable): chat-transport supervision — channel adapters, inbound pipeline, delivery",
 	"type": "module",
 	"engines": {
@@ -27,7 +27,7 @@
 	"peerDependencies": {
 		"@earendil-works/chord": "1.3.0",
 		"@earendil-works/pi-durable": "1.3.0",
-		"@sigrun/shared": "0.2.0"
+		"@sigrun/shared": "0.2.1"
 	},
 	"devDependencies": {
 		"@earendil-works/chord": "1.3.0",