@songsid/agend 2.1.7-beta.4 → 2.1.7-beta.5

package/dist/delivery-outbox.d.ts

@@ -1,14 +1,16 @@
 import { EventEmitter } from "node:events";
+import type { QueueResumePolicy } from "./delivery-queue-evidence.js";
 export declare const DURABLE_DELIVERY_MAX_ATTEMPTS = 8;
 export declare const DURABLE_DELIVERY_MAX_AGE_MS: number;
 export declare const DURABLE_DELIVERY_ABORT_BACKOFF_MS = 5000;
 export interface DaemonDeliveryPort {
-    begin(deliveryId: string, targetBootId: string, attemptNo: number): "begun" | "duplicate" | "stale";
+    begin(deliveryId: string, targetBootId: string, attemptNo: number, evidence?: DeliveryAttemptEvidence): "begun" | "duplicate" | "stale";
+    markEnterStarted(deliveryId: string, targetBootId: string, attemptNo: number): boolean;
     abort(deliveryId: string, targetBootId: string, attemptNo: number, reason: string): boolean;
     complete(deliveryId: string, targetBootId: string, attemptNo: number, outcome: "delivered" | "failed" | "uncertain", evidence?: string): boolean;
     retryBeforeBegin(deliveryId: string, targetBootId: string, attemptNo: number, reason: string, delayMs?: number): boolean;
 }
-export type OutboxState = "queued" | "delivering" | "submission_started" | "retry_wait" | "delivered" | "failed" | "uncertain" | "cancelled";
+export type OutboxState = "queued" | "delivering" | "submission_started" | "reconciliation_pending" | "retry_wait" | "delivered" | "failed" | "uncertain" | "cancelled";
 export interface NewOutboxDelivery {
     operationId: string;
     sourceKey: string;
@@ -39,6 +41,72 @@ export interface OutboxDelivery {
     responseDeliveredAt: string | null;
     nextAttemptAt: string | null;
     lastError: string | null;
+    reconciliationPending: boolean;
+}
+export type DeliveryStatusSelector = {
+    deliveryId: string;
+    operationId?: never;
+    correlationId?: never;
+    limit?: never;
+    cursor?: never;
+} | {
+    operationId: string;
+    deliveryId?: never;
+    correlationId?: never;
+    limit?: number;
+    cursor?: string;
+} | {
+    correlationId: string;
+    deliveryId?: never;
+    operationId?: never;
+    limit?: number;
+    cursor?: string;
+};
+export interface DeliveryStatusItem {
+    delivery_id: string;
+    operation_id: string;
+    correlation_id: string | null;
+    source_instance: string;
+    target_instance: string;
+    kind: string;
+    state: OutboxState;
+    attempt_no: number;
+    created_at: string;
+    updated_at: string;
+    status_summary: string;
+    error_summary: string | null;
+    safe_to_retry: boolean;
+}
+export interface DeliveryStatusPage {
+    items: DeliveryStatusItem[];
+    next_cursor: string | null;
+}
+export type DurableSubmissionMode = "idle_submit" | "native_queue_handoff" | "steer" | "raw_paste";
+/** Checkpoint committed with begin, before any pane paste can occur. */
+export interface DeliveryAttemptEvidence {
+    backend: string;
+    backendVersion?: string | null;
+    windowId: string | null;
+    transcriptPath: string | null;
+    transcriptOffset: number | null;
+    transcriptSessionId: string | null;
+    submissionMode: DurableSubmissionMode;
+    queueResumePolicy?: QueueResumePolicy;
+}
+export interface DeliveryReconciliationCandidate extends OutboxDelivery {
+    attempt: {
+        targetDaemonBootId: string;
+        attemptNo: number;
+        backend: string | null;
+        backendVersion: string | null;
+        windowId: string | null;
+        transcriptPath: string | null;
+        transcriptOffset: number | null;
+        transcriptSessionId: string | null;
+        submissionMode: DurableSubmissionMode | null;
+        queueResumePolicy: QueueResumePolicy | null;
+        enterStartedAt: string | null;
+    };
 }
 export interface ClaimedOutboxDelivery extends OutboxDelivery {
     targetDaemonBootId: string;
@@ -48,6 +116,7 @@ export declare class DeliveryOutbox extends EventEmitter {
     private readonly db;
     readonly managerBootId: string;
     constructor(dbPath: string, managerBootId?: string);
+    private ensureColumn;
     /** Commit admission before returning success. Duplicate source keys return their original row. */
     admit(input: NewOutboxDelivery): {
         delivery: OutboxDelivery;
@@ -55,19 +124,29 @@ export declare class DeliveryOutbox extends EventEmitter {
     };
     get(deliveryId: string): OutboxDelivery | undefined;
     getByOperation(sourceInstance: string, operationId: string): OutboxDelivery[];
+    /**
+     * Query only rows owned by the authenticated instance as source or target.
+     * This method accepts caller identity separately from user arguments so a
+     * caller cannot widen its own visibility with a forged source name.
+     */
+    queryStatusForInstance(callerInstance: string, selector: DeliveryStatusSelector): DeliveryStatusPage;
+    /** Open the existing outbox without migrations or writes for the operator CLI. */
+    static queryStatusReadOnly(dbPath: string, selector: DeliveryStatusSelector): DeliveryStatusPage;
     listPending(): OutboxDelivery[];
     nextRetryAt(): string | null;
     /** Claim the earliest eligible target row; one caller owns each target lane. */
     claimNext(managerBootId: string, targetBootIdFor: (target: string) => string | null, blockedTargets: ReadonlySet<string>): ClaimedOutboxDelivery | undefined;
     /** Idempotent begin permit, committed immediately before the pane side effect. */
-    begin(deliveryId: string, targetBootId: string, attemptNo: number): "begun" | "duplicate" | "stale";
+    begin(deliveryId: string, targetBootId: string, attemptNo: number, evidence?: DeliveryAttemptEvidence): "begun" | "duplicate" | "stale";
+    /** Write-ahead fence: commit before tmux is allowed to receive Enter. */
+    markEnterStarted(deliveryId: string, targetBootId: string, attemptNo: number): boolean;
     /** Safe only when the caller can prove no pane write occurred for this attempt. */
     abort(deliveryId: string, targetBootId: string, attemptNo: number, reason: string): boolean;
     complete(deliveryId: string, targetBootId: string, attemptNo: number, outcome: "delivered" | "failed" | "uncertain", evidence?: string): boolean;
     /** Transient pre-submit failure: state is retryable and the same row keeps its FIFO position. */
     retryBeforeBegin(deliveryId: string, targetBootId: string, attemptNo: number, reason: string, delayMs?: number): boolean;
     failBeforeBegin(deliveryId: string, reason: string): boolean;
-    /** Expire unavailable/pre-submit rows instead of leaving them queued forever. */
+    /** Bound both unavailable rows and unresolved reconciliation without stealing a live lease. */
     expireStale(nowMs?: number, maxAgeMs?: number): number;
     /** Next queued/retry expiry for bounded maintenance scheduling. */
     nextExpiryAt(): string | null;
@@ -75,14 +154,19 @@ export declare class DeliveryOutbox extends EventEmitter {
     /** Old process leases are recoverable; an old submission attempt needs evidence reconciliation. */
     recoverForBoot(managerBootId: string): {
         queued: number;
-        uncertain: number;
+        reconciliationPending: number;
     };
     /** Atomically create a post-restart notice for an accepted operation whose response was not recorded. */
     admitPostRestartOutcomeNotice(parent: OutboxDelivery, currentSourceBootId: string): OutboxDelivery | undefined;
     recoverTargetGeneration(targetInstance: string, currentTargetBootId: string): {
         queued: number;
-        uncertain: number;
+        reconciliationPending: number;
     };
+    /** Fence in-flight writes before an in-process target stop begins. */
+    markTargetReconciliationPending(targetInstance: string, targetBootId: string): number;
+    getReconciliationCandidates(targetInstance: string): DeliveryReconciliationCandidate[];
+    /** Atomically settle one old attempt using only its boot/attempt fence. */
+    reconcileAttempt(deliveryId: string, targetBootId: string, attemptNo: number, outcome: "delivered" | "retry_wait" | "uncertain", evidence: string): boolean;
     getUnansweredAccepted(sourceInstance: string, currentBootId: string): OutboxDelivery[];
     close(): void;
     /** Must be called inside the same SQLite transaction as the terminal transition. */

package/dist/delivery-outbox.js

@@ -19,13 +19,115 @@ function mapRow(row) {
         kind: row.kind,
         correlationId: row.correlation_id,
         payload: JSON.parse(row.payload_json),
-        state: row.state,
+        state: row.state === "submission_started" && row.reconciliation_pending === 1
+            ? "reconciliation_pending"
+            : row.state,
         attemptNo: row.attempt_no,
         createdSeq: row.created_seq,
         managerBootId: row.manager_boot_id,
         responseDeliveredAt: row.response_delivered_at,
         nextAttemptAt: row.next_attempt_at,
         lastError: row.last_error,
+        reconciliationPending: row.reconciliation_pending === 1,
+    };
+}
+function safeErrorSummary(error) {
+    if (!error)
+        return null;
+    const normalized = error.toLowerCase();
+    if (normalized.includes("ttl expired"))
+        return "Delivery expired before the target became available.";
+    if (normalized.includes("attempt limit"))
+        return "Delivery exhausted its bounded retry attempts.";
+    if (normalized.includes("reconcil") || normalized.includes("uncertain") || normalized.includes("restart")) {
+        return "Submission may have occurred; do not resend until the outcome is reconciled.";
+    }
+    return "A delivery error was recorded; details are omitted for safety.";
+}
+function statusSummary(state) {
+    switch (state) {
+        case "queued": return "Accepted and waiting for delivery.";
+        case "delivering": return "Waiting for the target to become ready; submission has not started.";
+        case "retry_wait": return "Waiting for a bounded retry; submission has not started for the next attempt.";
+        case "submission_started":
+        case "reconciliation_pending": return "Submission may have occurred; do not resend.";
+        case "delivered": return "Delivery was confirmed; this does not mean the agent finished processing it.";
+        case "failed": return "Delivery failed after bounded retries or expiry.";
+        case "uncertain": return "Delivery may have occurred; do not resend blindly.";
+        case "cancelled": return "Delivery was cancelled.";
+    }
+}
+function safeToRetry(state) {
+    return state === "queued" || state === "delivering" || state === "retry_wait" || state === "failed";
+}
+function queryStatusPage(db, selector, callerInstance) {
+    const where = [];
+    const params = [];
+    if (selector.deliveryId) {
+        where.push("d.delivery_id = ?");
+        params.push(selector.deliveryId);
+    }
+    else if (selector.operationId) {
+        where.push("d.operation_id = ?");
+        params.push(selector.operationId);
+    }
+    else {
+        where.push("d.correlation_id = ?");
+        params.push(selector.correlationId);
+    }
+    if (callerInstance !== null) {
+        where.push("(d.source_instance = ? OR d.target_instance = ?)");
+        params.push(callerInstance, callerInstance);
+    }
+    if (selector.cursor) {
+        const cursorScope = ["c.delivery_id = ?"];
+        const cursorParams = [selector.cursor];
+        if (selector.operationId) {
+            cursorScope.push("c.operation_id = ?");
+            cursorParams.push(selector.operationId);
+        }
+        else {
+            cursorScope.push("c.correlation_id = ?");
+            cursorParams.push(selector.correlationId);
+        }
+        if (callerInstance !== null) {
+            cursorScope.push("(c.source_instance = ? OR c.target_instance = ?)");
+            cursorParams.push(callerInstance, callerInstance);
+        }
+        where.push(`d.created_seq > (SELECT c.created_seq FROM deliveries c WHERE ${cursorScope.join(" AND ")} LIMIT 1)`);
+        params.push(...cursorParams);
+    }
+    const limit = selector.deliveryId ? 1 : Math.max(1, Math.min(100, selector.limit ?? 20));
+    const rows = db.prepare(`
+    SELECT d.delivery_id,d.operation_id,d.correlation_id,d.source_instance,d.target_instance,
+      d.kind,
+      CASE WHEN d.state='submission_started' AND d.reconciliation_pending=1
+        THEN 'reconciliation_pending' ELSE d.state END AS state,
+      d.attempt_no,d.created_at,d.updated_at,d.last_error
+    FROM deliveries d
+    WHERE ${where.join(" AND ")}
+    ORDER BY d.created_seq
+    LIMIT ?
+  `).all(...params, limit + 1);
+    const hasMore = rows.length > limit;
+    const visible = rows.slice(0, limit);
+    return {
+        items: visible.map(row => ({
+            delivery_id: row.delivery_id,
+            operation_id: row.operation_id,
+            correlation_id: row.correlation_id,
+            source_instance: row.source_instance,
+            target_instance: row.target_instance,
+            kind: row.kind,
+            state: row.state,
+            attempt_no: row.attempt_no,
+            created_at: row.created_at,
+            updated_at: row.updated_at,
+            status_summary: statusSummary(row.state),
+            error_summary: safeErrorSummary(row.last_error),
+            safe_to_retry: safeToRetry(row.state),
+        })),
+        next_cursor: hasMore ? visible.at(-1)?.delivery_id ?? null : null,
     };
 }
 /** Durable admission and fenced state transitions for the fleet delivery queue. */
@@ -63,6 +165,7 @@ export class DeliveryOutbox extends EventEmitter {
         created_seq INTEGER NOT NULL UNIQUE,
         manager_boot_id TEXT,
         response_delivered_at TEXT,
+        reconciliation_pending INTEGER NOT NULL DEFAULT 0,
         next_attempt_at TEXT,
         last_error TEXT,
         created_at TEXT NOT NULL,
@@ -77,6 +180,10 @@ export class DeliveryOutbox extends EventEmitter {
         ON deliveries(target_instance, state, created_seq);
       CREATE INDEX IF NOT EXISTS idx_delivery_operation_source
         ON deliveries(source_instance, operation_id);
+      CREATE INDEX IF NOT EXISTS idx_delivery_operation_seq
+        ON deliveries(operation_id, created_seq);
+      CREATE INDEX IF NOT EXISTS idx_delivery_correlation_seq
+        ON deliveries(correlation_id, created_seq);
 
       CREATE TABLE IF NOT EXISTS delivery_attempts (
         delivery_id TEXT NOT NULL REFERENCES deliveries(delivery_id),
@@ -87,6 +194,15 @@ export class DeliveryOutbox extends EventEmitter {
         abort_at TEXT,
         finished_at TEXT,
         evidence TEXT,
+        backend TEXT,
+        window_id TEXT,
+        transcript_path TEXT,
+        transcript_offset INTEGER,
+        transcript_session_id TEXT,
+        submission_mode TEXT,
+        backend_version TEXT,
+        queue_resume_policy TEXT,
+        enter_started_at TEXT,
         PRIMARY KEY (delivery_id, target_daemon_boot_id, attempt_no)
       );
 
@@ -104,8 +220,26 @@ export class DeliveryOutbox extends EventEmitter {
         notice_delivery_id TEXT NOT NULL UNIQUE,
         created_at TEXT NOT NULL
       );
-      PRAGMA user_version = 1;
     `);
+        // Additive migration: existing Phase 1 databases keep their row identities,
+        // foreign keys, and WAL while gaining reconciliation evidence columns.
+        this.ensureColumn("deliveries", "reconciliation_pending", "INTEGER NOT NULL DEFAULT 0");
+        this.ensureColumn("delivery_attempts", "backend", "TEXT");
+        this.ensureColumn("delivery_attempts", "window_id", "TEXT");
+        this.ensureColumn("delivery_attempts", "transcript_path", "TEXT");
+        this.ensureColumn("delivery_attempts", "transcript_offset", "INTEGER");
+        this.ensureColumn("delivery_attempts", "transcript_session_id", "TEXT");
+        this.ensureColumn("delivery_attempts", "submission_mode", "TEXT");
+        this.ensureColumn("delivery_attempts", "backend_version", "TEXT");
+        this.ensureColumn("delivery_attempts", "queue_resume_policy", "TEXT");
+        this.ensureColumn("delivery_attempts", "enter_started_at", "TEXT");
+        this.db.pragma("user_version = 3");
+    }
+    ensureColumn(table, column, definition) {
+        const columns = this.db.prepare(`PRAGMA table_info(${table})`).all();
+        if (columns.some(item => item.name === column))
+            return;
+        this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
     }
     /** Commit admission before returning success. Duplicate source keys return their original row. */
     admit(input) {
@@ -157,6 +291,26 @@ export class DeliveryOutbox extends EventEmitter {
     `).all(sourceInstance, operationId);
         return rows.map(mapRow);
     }
+    /**
+     * Query only rows owned by the authenticated instance as source or target.
+     * This method accepts caller identity separately from user arguments so a
+     * caller cannot widen its own visibility with a forged source name.
+     */
+    queryStatusForInstance(callerInstance, selector) {
+        return queryStatusPage(this.db, selector, callerInstance);
+    }
+    /** Open the existing outbox without migrations or writes for the operator CLI. */
+    static queryStatusReadOnly(dbPath, selector) {
+        const db = new Database(dbPath, { readonly: true, fileMustExist: true });
+        try {
+            db.pragma("busy_timeout = 1000");
+            db.pragma("query_only = ON");
+            return queryStatusPage(db, selector, null);
+        }
+        finally {
+            db.close();
+        }
+    }
     listPending() {
         const rows = this.db.prepare(`
       SELECT * FROM deliveries
@@ -182,6 +336,10 @@ export class DeliveryOutbox extends EventEmitter {
         // The oldest pending row owns its target lane even while it is in retry
         // backoff or the target is temporarily unavailable. Later rows must not
         // pass it merely because they happen to be eligible first.
+        const reconciliationTargets = new Set(this.db.prepare(`
+      SELECT DISTINCT target_instance FROM deliveries
+      WHERE state='submission_started' AND reconciliation_pending=1
+    `).all().map(item => item.target_instance));
         const visitedTargets = new Set();
         for (const row of rows) {
             if (visitedTargets.has(row.target_instance))
@@ -189,6 +347,10 @@ export class DeliveryOutbox extends EventEmitter {
             visitedTargets.add(row.target_instance);
             if (blockedTargets.has(row.target_instance))
                 continue;
+            // A recovered submission owns only its target lane while its evidence is
+            // classified; independent targets can keep dispatching.
+            if (reconciliationTargets.has(row.target_instance))
+                continue;
             if (row.state === "retry_wait" && row.next_attempt_at && row.next_attempt_at > now)
                 continue;
             const targetBootId = targetBootIdFor(row.target_instance);
@@ -210,7 +372,7 @@ export class DeliveryOutbox extends EventEmitter {
         return undefined;
     }
     /** Idempotent begin permit, committed immediately before the pane side effect. */
-    begin(deliveryId, targetBootId, attemptNo) {
+    begin(deliveryId, targetBootId, attemptNo, evidence) {
         const now = new Date().toISOString();
         const transaction = this.db.transaction(() => {
             const row = this.db.prepare("SELECT * FROM deliveries WHERE delivery_id=?").get(deliveryId);
@@ -239,9 +401,12 @@ export class DeliveryOutbox extends EventEmitter {
                 return { outcome: "stale", failed: true };
             }
             this.db.prepare(`
-        INSERT INTO delivery_attempts(delivery_id,target_daemon_boot_id,attempt_no,state,begin_ack_at)
-        VALUES (?,?,?,'begun',?)
-      `).run(deliveryId, targetBootId, attemptNo, now);
+        INSERT INTO delivery_attempts(
+          delivery_id,target_daemon_boot_id,attempt_no,state,begin_ack_at,
+          backend,window_id,transcript_path,transcript_offset,transcript_session_id,submission_mode,
+          backend_version,queue_resume_policy
+        ) VALUES (?,?,?,'begun',?,?,?,?,?,?,?,?,?)
+      `).run(deliveryId, targetBootId, attemptNo, now, evidence?.backend ?? null, evidence?.windowId ?? null, evidence?.transcriptPath ?? null, evidence?.transcriptOffset ?? null, evidence?.transcriptSessionId ?? null, evidence?.submissionMode ?? null, evidence?.backendVersion ?? null, evidence?.queueResumePolicy ?? null);
             this.db.prepare(`
         UPDATE deliveries SET state='submission_started', submitted_at=?, updated_at=?
         WHERE delivery_id=? AND state='delivering'
@@ -255,6 +420,19 @@ export class DeliveryOutbox extends EventEmitter {
             this.emit("state", { deliveryId, state: "failed" });
         return result.outcome;
     }
+    /** Write-ahead fence: commit before tmux is allowed to receive Enter. */
+    markEnterStarted(deliveryId, targetBootId, attemptNo) {
+        const now = new Date().toISOString();
+        const changed = this.db.prepare(`
+      UPDATE delivery_attempts SET enter_started_at=COALESCE(enter_started_at,?)
+      WHERE delivery_id=? AND target_daemon_boot_id=? AND attempt_no=? AND state='begun'
+        AND EXISTS (
+          SELECT 1 FROM deliveries WHERE delivery_id=? AND target_daemon_boot_id=?
+            AND attempt_no=? AND state='submission_started'
+        )
+    `).run(now, deliveryId, targetBootId, attemptNo, deliveryId, targetBootId, attemptNo).changes;
+        return changed === 1;
+    }
     /** Safe only when the caller can prove no pane write occurred for this attempt. */
     abort(deliveryId, targetBootId, attemptNo, reason) {
         const now = new Date().toISOString();
@@ -281,7 +459,7 @@ export class DeliveryOutbox extends EventEmitter {
             if (updateAttempt.changes !== 1)
                 return false;
             const updateDelivery = this.db.prepare(`
-        UPDATE deliveries SET state='retry_wait',updated_at=?,last_error=?,next_attempt_at=?
+        UPDATE deliveries SET state='retry_wait',reconciliation_pending=0,updated_at=?,last_error=?,next_attempt_at=?
         WHERE delivery_id=? AND state='submission_started' AND target_daemon_boot_id=? AND attempt_no=?
       `).run(now, reason.slice(0, 300), new Date(Date.now() + DURABLE_DELIVERY_ABORT_BACKOFF_MS).toISOString(), deliveryId, targetBootId, attemptNo);
             if (updateDelivery.changes !== 1)
@@ -298,7 +476,7 @@ export class DeliveryOutbox extends EventEmitter {
         const transaction = this.db.transaction(() => {
             const parent = this.db.prepare("SELECT * FROM deliveries WHERE delivery_id=?").get(deliveryId);
             const result = this.db.prepare(`
-        UPDATE deliveries SET state=?,updated_at=?,finished_at=?,last_error=?
+        UPDATE deliveries SET state=?,reconciliation_pending=0,updated_at=?,finished_at=?,last_error=?
         WHERE delivery_id=? AND target_daemon_boot_id=? AND attempt_no=? AND state='submission_started'
       `).run(outcome, now, now, outcome === "delivered" ? null : (evidence ?? outcome).slice(0, 300), deliveryId, targetBootId, attemptNo);
             if (result.changes !== 1) {
@@ -368,7 +546,7 @@ export class DeliveryOutbox extends EventEmitter {
             this.emit("state", { deliveryId, state: "failed" });
         return changed;
     }
-    /** Expire unavailable/pre-submit rows instead of leaving them queued forever. */
+    /** Bound both unavailable rows and unresolved reconciliation without stealing a live lease. */
     expireStale(nowMs = Date.now(), maxAgeMs = DURABLE_DELIVERY_MAX_AGE_MS) {
         const cutoff = new Date(nowMs - maxAgeMs).toISOString();
         const now = new Date(nowMs).toISOString();
@@ -383,23 +561,46 @@ export class DeliveryOutbox extends EventEmitter {
         WHERE delivery_id=? AND state IN ('queued','retry_wait')
       `);
             let changed = 0;
+            let uncertain = 0;
             for (const row of stale) {
                 if (update.run(now, now, row.delivery_id).changes !== 1)
                     continue;
                 this.insertFailureNotice(row, "failed", "delivery TTL expired before target became available", now);
                 changed++;
             }
-            return changed;
+            const unresolved = this.db.prepare(`
+        SELECT * FROM deliveries
+        WHERE state='submission_started' AND reconciliation_pending=1 AND created_at<=?
+        ORDER BY created_seq
+      `).all(cutoff);
+            const markUncertain = this.db.prepare(`
+        UPDATE deliveries SET state='uncertain',reconciliation_pending=0,updated_at=?,finished_at=?,
+          last_error='reconciliation TTL expired without sufficient evidence'
+        WHERE delivery_id=? AND state='submission_started' AND reconciliation_pending=1
+      `);
+            for (const row of unresolved) {
+                if (markUncertain.run(now, now, row.delivery_id).changes !== 1)
+                    continue;
+                this.db.prepare(`
+          UPDATE delivery_attempts SET state='uncertain',finished_at=?,evidence='reconciliation TTL expired without sufficient evidence'
+          WHERE delivery_id=? AND target_daemon_boot_id=? AND attempt_no=? AND state='begun'
+        `).run(now, row.delivery_id, row.target_daemon_boot_id, row.attempt_no);
+                this.insertFailureNotice(row, "uncertain", "reconciliation TTL expired without sufficient evidence", now);
+                changed++;
+                uncertain++;
+            }
+            return { changed, uncertain };
         });
-        const changed = transaction();
-        if (changed)
-            this.emit("expired", { count: changed });
-        return changed;
+        const result = transaction();
+        if (result.changed)
+            this.emit("expired", { count: result.changed, uncertain: result.uncertain });
+        return result.changed;
     }
     /** Next queued/retry expiry for bounded maintenance scheduling. */
     nextExpiryAt() {
         const row = this.db.prepare(`
-      SELECT MIN(created_at) AS created_at FROM deliveries WHERE state IN ('queued','retry_wait')
+      SELECT MIN(created_at) AS created_at FROM deliveries
+      WHERE state IN ('queued','retry_wait') OR (state='submission_started' AND reconciliation_pending=1)
     `).get();
         return row.created_at ? new Date(Date.parse(row.created_at) + DURABLE_DELIVERY_MAX_AGE_MS).toISOString() : null;
     }
@@ -414,23 +615,17 @@ export class DeliveryOutbox extends EventEmitter {
     recoverForBoot(managerBootId) {
         const now = new Date().toISOString();
         const transaction = this.db.transaction(() => {
-            const uncertainRows = this.db.prepare(`
-        SELECT * FROM deliveries WHERE manager_boot_id IS NOT NULL AND manager_boot_id<>? AND state='submission_started'
-      `).all(managerBootId);
             const queued = this.db.prepare(`
         UPDATE deliveries SET state='queued',manager_boot_id=NULL,target_daemon_boot_id=NULL,next_attempt_at=NULL,updated_at=?
         WHERE manager_boot_id IS NOT NULL AND manager_boot_id<>? AND state IN ('delivering','retry_wait')
       `).run(now, managerBootId).changes;
-            // Until transcript reconciliation is enabled, never blindly replay a row
-            // whose pane side effect may already have happened.
-            const uncertain = this.db.prepare(`
-        UPDATE deliveries SET state='uncertain',updated_at=?,finished_at=?,last_error='process restarted during submission; reconciliation required'
+            // Keep the submission fence and target lane while bounded pane/transcript
+            // evidence is captured. Never replay an in-flight row blindly.
+            const reconciliationPending = this.db.prepare(`
+        UPDATE deliveries SET reconciliation_pending=1,updated_at=?,last_error='process restarted during submission; reconciliation required'
         WHERE manager_boot_id IS NOT NULL AND manager_boot_id<>? AND state='submission_started'
-      `).run(now, now, managerBootId).changes;
-            for (const row of uncertainRows) {
-                this.insertFailureNotice(row, "uncertain", "process restarted during submission; reconciliation required", now);
-            }
-            return { queued, uncertain };
+      `).run(now, managerBootId).changes;
+            return { queued, reconciliationPending };
         });
         return transaction();
     }
@@ -491,34 +686,101 @@ export class DeliveryOutbox extends EventEmitter {
     recoverTargetGeneration(targetInstance, currentTargetBootId) {
         const now = new Date().toISOString();
         const transaction = this.db.transaction(() => {
-            const uncertainRows = this.db.prepare(`
-        SELECT * FROM deliveries WHERE target_instance=? AND target_daemon_boot_id IS NOT NULL
-          AND target_daemon_boot_id<>? AND state='submission_started'
-      `).all(targetInstance, currentTargetBootId);
             const queued = this.db.prepare(`
         UPDATE deliveries SET state='queued',manager_boot_id=NULL,target_daemon_boot_id=NULL,next_attempt_at=NULL,updated_at=?
         WHERE target_instance=? AND target_daemon_boot_id IS NOT NULL AND target_daemon_boot_id<>?
           AND state IN ('delivering','retry_wait')
       `).run(now, targetInstance, currentTargetBootId).changes;
-            const uncertain = this.db.prepare(`
-        UPDATE deliveries SET state='uncertain',updated_at=?,finished_at=?,last_error='target daemon generation changed during submission; reconciliation required'
+            const reconciliationPending = this.db.prepare(`
+        UPDATE deliveries SET reconciliation_pending=1,updated_at=?,last_error='target daemon generation changed during submission; reconciliation required'
         WHERE target_instance=? AND target_daemon_boot_id IS NOT NULL AND target_daemon_boot_id<>?
           AND state='submission_started'
-      `).run(now, now, targetInstance, currentTargetBootId).changes;
-            for (const row of uncertainRows) {
-                this.insertFailureNotice(row, "uncertain", "target daemon generation changed during submission; reconciliation required", now);
-            }
-            return { queued, uncertain };
+      `).run(now, targetInstance, currentTargetBootId).changes;
+            return { queued, reconciliationPending };
         });
         const result = transaction();
-        if (result.queued + result.uncertain > 0)
+        if (result.queued + result.reconciliationPending > 0)
             this.emit("generation_recovered", { targetInstance, ...result });
         return result;
     }
+    /** Fence in-flight writes before an in-process target stop begins. */
+    markTargetReconciliationPending(targetInstance, targetBootId) {
+        const now = new Date().toISOString();
+        return this.db.prepare(`
+      UPDATE deliveries SET reconciliation_pending=1,updated_at=?,last_error='target daemon stopping; reconciliation required'
+      WHERE target_instance=? AND target_daemon_boot_id=? AND state='submission_started'
+    `).run(now, targetInstance, targetBootId).changes;
+    }
+    getReconciliationCandidates(targetInstance) {
+        const rows = this.db.prepare(`
+      SELECT d.*, a.target_daemon_boot_id AS attempt_target_boot_id,
+        a.attempt_no AS attempt_attempt_no, a.backend AS attempt_backend,
+        a.window_id AS attempt_window_id, a.transcript_path AS attempt_transcript_path,
+        a.transcript_offset AS attempt_transcript_offset,
+        a.transcript_session_id AS attempt_transcript_session_id,
+        a.submission_mode AS attempt_submission_mode, a.backend_version AS attempt_backend_version,
+        a.queue_resume_policy AS attempt_queue_resume_policy,
+        a.enter_started_at AS attempt_enter_started_at
+      FROM deliveries d JOIN delivery_attempts a ON a.delivery_id=d.delivery_id
+        AND a.attempt_no=d.attempt_no AND a.target_daemon_boot_id=d.target_daemon_boot_id
+      WHERE d.target_instance=? AND d.state='submission_started' AND d.reconciliation_pending=1
+      ORDER BY d.created_seq
+    `).all(targetInstance);
+        return rows.map(row => ({
+            ...mapRow(row),
+            attempt: {
+                targetDaemonBootId: row.attempt_target_boot_id,
+                attemptNo: row.attempt_attempt_no,
+                backend: row.attempt_backend,
+                backendVersion: row.attempt_backend_version,
+                windowId: row.attempt_window_id,
+                transcriptPath: row.attempt_transcript_path,
+                transcriptOffset: row.attempt_transcript_offset,
+                transcriptSessionId: row.attempt_transcript_session_id,
+                submissionMode: row.attempt_submission_mode,
+                queueResumePolicy: row.attempt_queue_resume_policy,
+                enterStartedAt: row.attempt_enter_started_at,
+            },
+        }));
+    }
+    /** Atomically settle one old attempt using only its boot/attempt fence. */
+    reconcileAttempt(deliveryId, targetBootId, attemptNo, outcome, evidence) {
+        const now = new Date().toISOString();
+        const transaction = this.db.transaction(() => {
+            const parent = this.db.prepare("SELECT * FROM deliveries WHERE delivery_id=?").get(deliveryId);
+            if (!parent || parent.state !== "submission_started" || parent.target_daemon_boot_id !== targetBootId
+                || parent.attempt_no !== attemptNo || parent.reconciliation_pending !== 1)
+                return false;
+            const terminal = outcome !== "retry_wait";
+            const changed = this.db.prepare(`
+        UPDATE deliveries SET state=?,reconciliation_pending=0,manager_boot_id=?,
+          target_daemon_boot_id=?,updated_at=?,finished_at=?,last_error=?,next_attempt_at=?
+        WHERE delivery_id=? AND state='submission_started' AND reconciliation_pending=1
+          AND target_daemon_boot_id=? AND attempt_no=?
+      `).run(outcome, outcome === "retry_wait" ? null : parent.manager_boot_id, outcome === "retry_wait" ? null : targetBootId, now, terminal ? now : null, outcome === "delivered" ? null : evidence.slice(0, 300), outcome === "retry_wait" ? new Date(Date.now() + DURABLE_DELIVERY_ABORT_BACKOFF_MS).toISOString() : null, deliveryId, targetBootId, attemptNo).changes;
+            if (changed !== 1)
+                return false;
+            const attemptState = outcome === "retry_wait" ? "aborted" : outcome;
+            this.db.prepare(`
+        UPDATE delivery_attempts SET state=?,abort_at=?,finished_at=?,evidence=?
+        WHERE delivery_id=? AND target_daemon_boot_id=? AND attempt_no=? AND state='begun'
+      `).run(attemptState, outcome === "retry_wait" ? now : null, terminal ? now : null, evidence.slice(0, 300), deliveryId, targetBootId, attemptNo);
+            if (outcome === "uncertain")
+                this.insertFailureNotice(parent, "uncertain", evidence, now);
+            return true;
+        });
+        const changed = transaction();
+        if (changed)
+            this.emit("state", { deliveryId, state: outcome });
+        return changed;
+    }
     getUnansweredAccepted(sourceInstance, currentBootId) {
         const rows = this.db.prepare(`
       SELECT * FROM deliveries
       WHERE source_instance=? AND source_daemon_boot_id<>? AND response_delivered_at IS NULL
+        -- Scheduler admission has no waiting source-agent tool response; its
+        -- stable run key and durable row are the recovery/lookup contract.
+        AND kind NOT IN ('raw_paste')
       ORDER BY created_seq
     `).all(sourceInstance, currentBootId);
         return rows.map(mapRow);