@songsid/agend 2.1.7-beta.5 → 2.1.7-beta.6

package/dist/delivery-outbox.d.ts

@@ -47,21 +47,50 @@ export type DeliveryStatusSelector = {
     deliveryId: string;
     operationId?: never;
     correlationId?: never;
+    messageId?: never;
     limit?: never;
     cursor?: never;
 } | {
     operationId: string;
     deliveryId?: never;
     correlationId?: never;
+    messageId?: never;
     limit?: number;
     cursor?: string;
 } | {
     correlationId: string;
     deliveryId?: never;
     operationId?: never;
+    messageId?: never;
+    limit?: number;
+    cursor?: string;
+}
+/**
+ * #856: the `message_id` a receiver sees in the envelope header. Lets an
+ * agent check that a peer message it is about to act on was really
+ * delivered by the fleet — a model can "see" one nobody sent.
+ */
+ | {
+    messageId: string;
+    deliveryId?: never;
+    operationId?: never;
+    correlationId?: never;
     limit?: number;
     cursor?: string;
 };
+/** The one mapping from validated tool/CLI arguments to a selector. */
+export declare function deliveryStatusSelector(args: {
+    delivery_id?: string;
+    operation_id?: string;
+    correlation_id?: string;
+    message_id?: string;
+    limit?: number;
+    cursor?: string;
+}): DeliveryStatusSelector;
+/** sha256 of a delivered text, as hex. The same function hashes admission and paste. */
+export declare function deliveryContentDigest(text: string): string;
+/** #926 reminders and overdue notices; never themselves the subject of a failure notice. */
+export declare const REPLY_OBLIGATION_NOTICE_KIND = "reply_obligation_notice";
 export interface DeliveryStatusItem {
     delivery_id: string;
     operation_id: string;
@@ -76,6 +105,44 @@ export interface DeliveryStatusItem {
     status_summary: string;
     error_summary: string | null;
     safe_to_retry: boolean;
+    /** Fleet message ID of the delivered envelope, when it had one. */
+    message_id: string | null;
+    /** sha256 of the delivered text as admitted (#856). */
+    content_sha256: string | null;
+    /**
+     * The text as admitted — only on a `message_id` query by the row's own
+     * source or target: the caller already sent or received it, and verifying
+     * a value (a SHA, a PR number) needs the text, not just its digest. Every
+     * other query, and operator reads, stay redacted as before (#982).
+     */
+    content?: string | null;
+    /** #926: the reply this request is owed, when it asked for one. */
+    reply_obligation?: {
+        state: "open" | "answered";
+        opened_at: string;
+        last_asked_at: string;
+        nudged_at: string | null;
+        overdue_notified_at: string | null;
+        answered_at: string | null;
+    } | null;
+}
+/**
+ * #926: a peer asked with `requires_reply` and the owner has not answered it
+ * through the fleet yet. Terminal text is not an answer: only a message the
+ * owner sends back to the requester with the same correlation_id closes it.
+ */
+export interface ReplyObligation {
+    correlationId: string;
+    requesterInstance: string;
+    ownerInstance: string;
+    requestDeliveryId: string;
+    openedAt: string;
+    lastAskedAt: string;
+    state: "open" | "answered";
+    nudgedAt: string | null;
+    overdueNotifiedAt: string | null;
+    answeredAt: string | null;
+    answeredDeliveryId: string | null;
 }
 export interface DeliveryStatusPage {
     items: DeliveryStatusItem[];
@@ -92,6 +159,10 @@ export interface DeliveryAttemptEvidence {
     transcriptSessionId: string | null;
     submissionMode: DurableSubmissionMode;
     queueResumePolicy?: QueueResumePolicy;
+    /** sha256 of the text the target daemon received, before formatting (#856). */
+    pastedContentSha256?: string | null;
+    /** sha256 of the exact string handed to the pane write (#856). */
+    pastedBytesSha256?: string | null;
 }
 export interface DeliveryReconciliationCandidate extends OutboxDelivery {
     attempt: {
@@ -116,6 +187,44 @@ export declare class DeliveryOutbox extends EventEmitter {
     private readonly db;
     readonly managerBootId: string;
     constructor(dbPath: string, managerBootId?: string);
+    /**
+     * #926: a delivered `requires_reply` request opens (or, asked again,
+     * re-opens) the owner's obligation. Runs inside the delivered transition.
+     * An answer admitted before the request finished its submission proof —
+     * an owner can reply while the daemon is still confirming — counts.
+     */
+    private openReplyObligation;
+    /** The owner's message back to the requester on the same correlation_id answers it — at admission. */
+    private answerReplyObligation;
+    /**
+     * #926 safety net 1: remind an owner that has not answered. `turn-ended`
+     * reminds once per ask, after the grace (a reply seconds after the ask is
+     * normal); `restart` reminds once per restart, because the interrupted turn
+     * does not resume on its own. Marked in the same transaction as the notice.
+     */
+    remindReplyObligations(ownerInstance: string, opts: {
+        now?: Date;
+        graceMs: number;
+        reason: "turn-ended" | "restart";
+        since?: Date;
+    }): number;
+    /**
+     * #926 safety net 2 (poll-on-timeout, in code): tell the requester once when
+     * the owner is not working and nothing has come back for `overdueMs` since
+     * the last ask or reminder. A still-working owner is never reported.
+     */
+    notifyOverdueReplyObligations(opts: {
+        now?: Date;
+        overdueMs: number;
+        ownerIdle: (owner: string) => boolean;
+    }): number;
+    /** A system notice as a durable row, like #929's outcome notices; the key makes it idempotent. */
+    private insertReplyObligationNotice;
+    /** The owner's open obligations, oldest first (#926). */
+    openReplyObligations(ownerInstance: string): ReplyObligation[];
+    getReplyObligation(correlationId: string, requesterInstance: string, ownerInstance: string): ReplyObligation | undefined;
+    /** Rows admitted before #856 get the same message_id / digest a new row would. */
+    private backfillMessageEvidence;
     private ensureColumn;
     /** Commit admission before returning success. Duplicate source keys return their original row. */
     admit(input: NewOutboxDelivery): {

package/dist/delivery-outbox.js

@@ -1,11 +1,44 @@
 import Database from "better-sqlite3";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { chmodSync, mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 export const DURABLE_DELIVERY_MAX_ATTEMPTS = 8;
 export const DURABLE_DELIVERY_MAX_AGE_MS = 24 * 60 * 60_000;
 export const DURABLE_DELIVERY_ABORT_BACKOFF_MS = 5_000;
+/** The one mapping from validated tool/CLI arguments to a selector. */
+export function deliveryStatusSelector(args) {
+    const page = { ...(args.limit !== undefined ? { limit: args.limit } : {}), ...(args.cursor ? { cursor: args.cursor } : {}) };
+    if (args.delivery_id)
+        return { deliveryId: args.delivery_id };
+    if (args.operation_id)
+        return { operationId: args.operation_id, ...page };
+    if (args.message_id)
+        return { messageId: args.message_id, ...page };
+    return { correlationId: args.correlation_id, ...page };
+}
+/** sha256 of a delivered text, as hex. The same function hashes admission and paste. */
+export function deliveryContentDigest(text) {
+    return createHash("sha256").update(text, "utf8").digest("hex");
+}
+/** The text a durable row delivers, for kinds whose payload carries one. */
+function payloadContent(payload) {
+    const content = payload && typeof payload === "object" ? payload.content : undefined;
+    return typeof content === "string" ? content : null;
+}
+/** #926 reminders and overdue notices; never themselves the subject of a failure notice. */
+export const REPLY_OBLIGATION_NOTICE_KIND = "reply_obligation_notice";
+/** Kinds that carry a peer request or its answer. Broadcasts are one-to-many and deferred (#926 §6). */
+const REPLY_OBLIGATION_KINDS = ["fleet_inbound", "steer"];
+function payloadRequiresReply(payload) {
+    const meta = payload && typeof payload === "object" ? payload.meta : undefined;
+    return !!meta && typeof meta === "object" && meta.requires_reply === "true";
+}
+function payloadMessageId(payload) {
+    const meta = payload && typeof payload === "object" ? payload.meta : undefined;
+    const id = meta && typeof meta === "object" ? meta.message_id : undefined;
+    return typeof id === "string" && id.length > 0 ? id : null;
+}
 function mapRow(row) {
     return {
         deliveryId: row.delivery_id,
@@ -60,9 +93,42 @@ function statusSummary(state) {
 function safeToRetry(state) {
     return state === "queued" || state === "delivering" || state === "retry_wait" || state === "failed";
 }
+function hasTable(db, table) {
+    return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=?").get(table);
+}
+/** The obligation a request row opened, if any; absent on databases from before #926. */
+function obligationFor(db, correlationId, requester, owner) {
+    if (!correlationId || !hasTable(db, "reply_obligations"))
+        return null;
+    const row = db.prepare(`
+    SELECT state, opened_at, last_asked_at, nudged_at, overdue_notified_at, answered_at FROM reply_obligations
+    WHERE correlation_id=? AND requester_instance=? AND owner_instance=?
+  `).get(correlationId, requester, owner);
+    return row ?? null;
+}
+function hasColumn(db, table, column) {
+    return db.prepare(`PRAGMA table_info(${table})`).all().some(c => c.name === column);
+}
+/** Derived from the stored payload, so it is the same for pre-#856 rows. */
+function rowContentEvidence(payloadJson, withContent) {
+    let payload = null;
+    try {
+        payload = JSON.parse(payloadJson);
+    }
+    catch { /* corrupt row: report no evidence */ }
+    const content = payloadContent(payload);
+    return {
+        message_id: payloadMessageId(payload),
+        content_sha256: content === null ? null : deliveryContentDigest(content),
+        ...(withContent ? { content } : {}),
+    };
+}
 function queryStatusPage(db, selector, callerInstance) {
     const where = [];
     const params = [];
+    // An operator may read a database written before the column existed.
+    const messageIdColumn = hasColumn(db, "deliveries", "message_id")
+        ? "d.message_id" : "json_extract(d.payload_json,'$.meta.message_id')";
     if (selector.deliveryId) {
         where.push("d.delivery_id = ?");
         params.push(selector.deliveryId);
@@ -71,6 +137,10 @@ function queryStatusPage(db, selector, callerInstance) {
         where.push("d.operation_id = ?");
         params.push(selector.operationId);
     }
+    else if (selector.messageId) {
+        where.push(`${messageIdColumn} = ?`);
+        params.push(selector.messageId);
+    }
     else {
         where.push("d.correlation_id = ?");
         params.push(selector.correlationId);
@@ -86,6 +156,10 @@ function queryStatusPage(db, selector, callerInstance) {
             cursorScope.push("c.operation_id = ?");
             cursorParams.push(selector.operationId);
         }
+        else if (selector.messageId) {
+            cursorScope.push(`${messageIdColumn.replace(/\bd\./g, "c.")} = ?`);
+            cursorParams.push(selector.messageId);
+        }
         else {
             cursorScope.push("c.correlation_id = ?");
             cursorParams.push(selector.correlationId);
@@ -103,7 +177,7 @@ function queryStatusPage(db, selector, callerInstance) {
       d.kind,
       CASE WHEN d.state='submission_started' AND d.reconciliation_pending=1
         THEN 'reconciliation_pending' ELSE d.state END AS state,
-      d.attempt_no,d.created_at,d.updated_at,d.last_error
+      d.attempt_no,d.created_at,d.updated_at,d.last_error,d.payload_json
     FROM deliveries d
     WHERE ${where.join(" AND ")}
     ORDER BY d.created_seq
@@ -126,10 +200,22 @@ function queryStatusPage(db, selector, callerInstance) {
             status_summary: statusSummary(row.state),
             error_summary: safeErrorSummary(row.last_error),
             safe_to_retry: safeToRetry(row.state),
+            // Text only for the explicit verification query (#856), and only to the
+            // row's own source/target; every other query keeps #982's redaction.
+            ...rowContentEvidence(row.payload_json, callerInstance !== null && !!selector.messageId),
+            reply_obligation: obligationFor(db, row.correlation_id, row.source_instance, row.target_instance),
         })),
         next_cursor: hasMore ? visible.at(-1)?.delivery_id ?? null : null,
     };
 }
+function mapObligation(row) {
+    return {
+        correlationId: row.correlation_id, requesterInstance: row.requester_instance, ownerInstance: row.owner_instance,
+        requestDeliveryId: row.request_delivery_id, openedAt: row.opened_at, lastAskedAt: row.last_asked_at, state: row.state,
+        nudgedAt: row.nudged_at, overdueNotifiedAt: row.overdue_notified_at, answeredAt: row.answered_at,
+        answeredDeliveryId: row.answered_delivery_id,
+    };
+}
 /** Durable admission and fenced state transitions for the fleet delivery queue. */
 export class DeliveryOutbox extends EventEmitter {
     db;
@@ -215,6 +301,21 @@ export class DeliveryOutbox extends EventEmitter {
         created_at TEXT NOT NULL,
         PRIMARY KEY (source_instance, source_daemon_boot_id, operation_id, target_instance)
       );
+      CREATE TABLE IF NOT EXISTS reply_obligations (
+        correlation_id TEXT NOT NULL,
+        requester_instance TEXT NOT NULL,
+        owner_instance TEXT NOT NULL,
+        request_delivery_id TEXT NOT NULL,
+        opened_at TEXT NOT NULL,
+        last_asked_at TEXT NOT NULL,
+        state TEXT NOT NULL CHECK (state IN ('open','answered')),
+        nudged_at TEXT,
+        overdue_notified_at TEXT,
+        answered_at TEXT,
+        answered_delivery_id TEXT,
+        PRIMARY KEY (correlation_id, requester_instance, owner_instance)
+      );
+      CREATE INDEX IF NOT EXISTS idx_reply_obligation_owner_state ON reply_obligations(owner_instance, state);
       CREATE TABLE IF NOT EXISTS failure_notices (
         parent_delivery_id TEXT PRIMARY KEY,
         notice_delivery_id TEXT NOT NULL UNIQUE,
@@ -233,7 +334,186 @@ export class DeliveryOutbox extends EventEmitter {
         this.ensureColumn("delivery_attempts", "backend_version", "TEXT");
         this.ensureColumn("delivery_attempts", "queue_resume_policy", "TEXT");
         this.ensureColumn("delivery_attempts", "enter_started_at", "TEXT");
-        this.db.pragma("user_version = 3");
+        // #856: a receiver can look a message up by the ID in its envelope, and
+        // admission vs pane-write digests tell transport rewrites apart from a
+        // receiver acting on a message nobody sent.
+        this.ensureColumn("deliveries", "message_id", "TEXT");
+        this.ensureColumn("deliveries", "content_sha256", "TEXT");
+        this.ensureColumn("delivery_attempts", "pasted_content_sha256", "TEXT");
+        this.ensureColumn("delivery_attempts", "pasted_bytes_sha256", "TEXT");
+        this.ensureColumn("delivery_attempts", "content_digest_mismatch", "INTEGER NOT NULL DEFAULT 0");
+        this.db.exec("CREATE INDEX IF NOT EXISTS idx_delivery_message_id ON deliveries(message_id)");
+        this.backfillMessageEvidence();
+        this.db.pragma("user_version = 4");
+    }
+    /**
+     * #926: a delivered `requires_reply` request opens (or, asked again,
+     * re-opens) the owner's obligation. Runs inside the delivered transition.
+     * An answer admitted before the request finished its submission proof —
+     * an owner can reply while the daemon is still confirming — counts.
+     */
+    openReplyObligation(request, now) {
+        if (!REPLY_OBLIGATION_KINDS.includes(request.kind) || !request.correlation_id)
+            return;
+        let payload = null;
+        try {
+            payload = JSON.parse(request.payload_json);
+        }
+        catch {
+            return;
+        }
+        if (!payloadRequiresReply(payload))
+            return;
+        const earlyAnswer = this.db.prepare(`
+      SELECT delivery_id FROM deliveries
+      WHERE correlation_id=? AND source_instance=? AND target_instance=? AND created_seq > ?
+        AND kind IN (${REPLY_OBLIGATION_KINDS.map(() => "?").join(",")})
+      ORDER BY created_seq LIMIT 1
+    `).get(request.correlation_id, request.target_instance, request.source_instance, request.created_seq, ...REPLY_OBLIGATION_KINDS);
+        this.db.prepare(`
+      INSERT INTO reply_obligations(correlation_id, requester_instance, owner_instance, request_delivery_id,
+        opened_at, last_asked_at, state, answered_at, answered_delivery_id)
+      VALUES (@cid, @requester, @owner, @request, @now, @now, @state, @answeredAt, @answeredId)
+      ON CONFLICT(correlation_id, requester_instance, owner_instance) DO UPDATE SET
+        request_delivery_id=excluded.request_delivery_id, last_asked_at=excluded.last_asked_at,
+        state=excluded.state, nudged_at=NULL, overdue_notified_at=NULL,
+        answered_at=excluded.answered_at, answered_delivery_id=excluded.answered_delivery_id
+    `).run({
+            cid: request.correlation_id, requester: request.source_instance, owner: request.target_instance,
+            request: request.delivery_id, now,
+            state: earlyAnswer ? "answered" : "open",
+            answeredAt: earlyAnswer ? now : null, answeredId: earlyAnswer?.delivery_id ?? null,
+        });
+    }
+    /** The owner's message back to the requester on the same correlation_id answers it — at admission. */
+    answerReplyObligation(answer, now) {
+        if (!REPLY_OBLIGATION_KINDS.includes(answer.kind) || !answer.correlation_id)
+            return;
+        this.db.prepare(`
+      UPDATE reply_obligations SET state='answered', answered_at=?, answered_delivery_id=?
+      WHERE correlation_id=? AND owner_instance=? AND requester_instance=? AND state='open'
+    `).run(now, answer.delivery_id, answer.correlation_id, answer.source_instance, answer.target_instance);
+    }
+    /**
+     * #926 safety net 1: remind an owner that has not answered. `turn-ended`
+     * reminds once per ask, after the grace (a reply seconds after the ask is
+     * normal); `restart` reminds once per restart, because the interrupted turn
+     * does not resume on its own. Marked in the same transaction as the notice.
+     */
+    remindReplyObligations(ownerInstance, opts) {
+        const now = opts.now ?? new Date();
+        const nowIso = now.toISOString();
+        const graceCutoff = new Date(now.getTime() - opts.graceMs).toISOString();
+        const sinceIso = (opts.since ?? now).toISOString();
+        const inserted = this.db.transaction(() => {
+            const due = this.db.prepare(opts.reason === "turn-ended"
+                ? "SELECT * FROM reply_obligations WHERE owner_instance=? AND state='open' AND nudged_at IS NULL AND last_asked_at <= ?"
+                : "SELECT * FROM reply_obligations WHERE owner_instance=? AND state='open' AND (nudged_at IS NULL OR nudged_at < ?)").all(ownerInstance, opts.reason === "turn-ended" ? graceCutoff : sinceIso);
+            let count = 0;
+            for (const row of due) {
+                const content = opts.reason === "turn-ended"
+                    ? `[system:reply-pending] Your turn ended without answering ${row.requester_instance} (correlation_id ${row.correlation_id}, asked ${row.last_asked_at}). Send your conclusion with report_result (correlation_id ${row.correlation_id}) now — text you write in the terminal does not reach them.`
+                    : `[system:reply-pending] A restart interrupted your work on correlation_id ${row.correlation_id} from ${row.requester_instance} (asked ${row.last_asked_at}). Resume it and answer with report_result (correlation_id ${row.correlation_id}); terminal text does not reach them.`;
+                const key = `reply-pending:${opts.reason}:${row.correlation_id}:${row.requester_instance}:${row.owner_instance}:${opts.reason === "turn-ended" ? row.last_asked_at : sinceIso}`;
+                if (this.insertReplyObligationNotice(row.owner_instance, row.correlation_id, key, content, nowIso))
+                    count++;
+                this.db.prepare(`
+          UPDATE reply_obligations SET nudged_at=? WHERE correlation_id=? AND requester_instance=? AND owner_instance=? AND state='open'
+        `).run(nowIso, row.correlation_id, row.requester_instance, row.owner_instance);
+            }
+            return count;
+        })();
+        if (inserted > 0)
+            this.emit("admitted");
+        return inserted;
+    }
+    /**
+     * #926 safety net 2 (poll-on-timeout, in code): tell the requester once when
+     * the owner is not working and nothing has come back for `overdueMs` since
+     * the last ask or reminder. A still-working owner is never reported.
+     */
+    notifyOverdueReplyObligations(opts) {
+        if (!(opts.overdueMs > 0))
+            return 0;
+        const now = opts.now ?? new Date();
+        const nowIso = now.toISOString();
+        const inserted = this.db.transaction(() => {
+            const open = this.db.prepare(`
+        SELECT * FROM reply_obligations WHERE state='open' AND overdue_notified_at IS NULL ORDER BY opened_at
+      `).all();
+            let count = 0;
+            for (const row of open) {
+                const quietSince = Math.max(Date.parse(row.last_asked_at), row.nudged_at ? Date.parse(row.nudged_at) : 0);
+                if (now.getTime() - quietSince < opts.overdueMs || !opts.ownerIdle(row.owner_instance))
+                    continue;
+                const content = `[system:reply-overdue] ${row.owner_instance} has not answered correlation_id ${row.correlation_id} (asked ${row.last_asked_at}${row.nudged_at ? `, reminded ${row.nudged_at}` : ""}) and is not working on anything now. Check with describe_instance or delivery_status (correlation_id ${row.correlation_id}), or ask again.`;
+                const key = `reply-overdue:${row.correlation_id}:${row.requester_instance}:${row.owner_instance}:${row.last_asked_at}`;
+                if (this.insertReplyObligationNotice(row.requester_instance, row.correlation_id, key, content, nowIso))
+                    count++;
+                this.db.prepare(`
+          UPDATE reply_obligations SET overdue_notified_at=? WHERE correlation_id=? AND requester_instance=? AND owner_instance=? AND state='open'
+        `).run(nowIso, row.correlation_id, row.requester_instance, row.owner_instance);
+            }
+            return count;
+        })();
+        if (inserted > 0)
+            this.emit("admitted");
+        return inserted;
+    }
+    /** A system notice as a durable row, like #929's outcome notices; the key makes it idempotent. */
+    insertReplyObligationNotice(target, correlationId, sourceKey, content, now) {
+        const noticeId = randomUUID();
+        const payload = {
+            type: "fleet_inbound",
+            content,
+            meta: {
+                user: "AgEnD delivery outbox", user_id: "agend-system", message_id: `reply-obligation-${noticeId}`,
+                chat_id: "", thread_id: "", source: "delivery-outbox",
+            },
+        };
+        return this.db.prepare(`
+      INSERT OR IGNORE INTO deliveries (
+        delivery_id,operation_id,source_key,source_instance,source_daemon_boot_id,
+        target_instance,target_session,target_daemon_boot_id,kind,correlation_id,payload_json,message_id,content_sha256,state,
+        attempt_no,created_seq,manager_boot_id,created_at,updated_at,accepted_at
+      ) VALUES (?,?,?,'agend-system',?,?,NULL,NULL,?,?,?,?,?,'queued',0,
+        (SELECT COALESCE(MAX(created_seq),0)+1 FROM deliveries),NULL,?,?,?)
+    `).run(noticeId, `notice:${sourceKey}`, sourceKey, this.managerBootId, target, REPLY_OBLIGATION_NOTICE_KIND, correlationId, JSON.stringify(payload), payload.meta.message_id, deliveryContentDigest(content), now, now, now).changes === 1;
+    }
+    /** The owner's open obligations, oldest first (#926). */
+    openReplyObligations(ownerInstance) {
+        const rows = this.db.prepare(`
+      SELECT * FROM reply_obligations WHERE owner_instance=? AND state='open' ORDER BY opened_at, correlation_id
+    `).all(ownerInstance);
+        return rows.map(mapObligation);
+    }
+    getReplyObligation(correlationId, requesterInstance, ownerInstance) {
+        const row = this.db.prepare(`
+      SELECT * FROM reply_obligations WHERE correlation_id=? AND requester_instance=? AND owner_instance=?
+    `).get(correlationId, requesterInstance, ownerInstance);
+        return row ? mapObligation(row) : undefined;
+    }
+    /** Rows admitted before #856 get the same message_id / digest a new row would. */
+    backfillMessageEvidence() {
+        const rows = this.db.prepare(`
+      SELECT delivery_id, payload_json FROM deliveries WHERE message_id IS NULL AND content_sha256 IS NULL
+    `).all();
+        if (rows.length === 0)
+            return;
+        const update = this.db.prepare("UPDATE deliveries SET message_id=?, content_sha256=? WHERE delivery_id=?");
+        this.db.transaction(() => {
+            for (const row of rows) {
+                let payload = null;
+                try {
+                    payload = JSON.parse(row.payload_json);
+                }
+                catch {
+                    continue;
+                }
+                const content = payloadContent(payload);
+                update.run(payloadMessageId(payload), content === null ? null : deliveryContentDigest(content), row.delivery_id);
+            }
+        })();
     }
     ensureColumn(table, column, definition) {
         const columns = this.db.prepare(`PRAGMA table_info(${table})`).all();
@@ -248,11 +528,11 @@ export class DeliveryOutbox extends EventEmitter {
         const insert = this.db.prepare(`
       INSERT OR IGNORE INTO deliveries (
         delivery_id, operation_id, source_key, source_instance, source_daemon_boot_id,
-        target_instance, target_session, kind, correlation_id, payload_json, state,
+        target_instance, target_session, kind, correlation_id, payload_json, message_id, content_sha256, state,
         attempt_no, created_seq, manager_boot_id, created_at, updated_at, accepted_at
       ) VALUES (
         @delivery_id, @operation_id, @source_key, @source_instance, @source_daemon_boot_id,
-        @target_instance, @target_session, @kind, @correlation_id, @payload_json, 'queued',
+        @target_instance, @target_session, @kind, @correlation_id, @payload_json, @message_id, @content_sha256, 'queued',
         0, (SELECT COALESCE(MAX(created_seq), 0) + 1 FROM deliveries), NULL,
         @created_at, @updated_at, @accepted_at
       )
@@ -270,6 +550,8 @@ export class DeliveryOutbox extends EventEmitter {
                 kind: input.kind,
                 correlation_id: input.correlationId ?? null,
                 payload_json: JSON.stringify(input.payload),
+                message_id: payloadMessageId(input.payload),
+                content_sha256: (content => content === null ? null : deliveryContentDigest(content))(payloadContent(input.payload)),
                 created_at: now,
                 updated_at: now,
                 accepted_at: now,
@@ -277,6 +559,8 @@ export class DeliveryOutbox extends EventEmitter {
             const row = select.get(input.sourceKey);
             if (!row)
                 throw new Error("outbox admission committed without a readable row");
+            if (result.changes === 1)
+                this.answerReplyObligation(row, now);
             return { delivery: mapRow(row), inserted: result.changes === 1 };
         });
         return transaction();
@@ -390,6 +674,10 @@ export class DeliveryOutbox extends EventEmitter {
             const started = this.db.prepare(`
         SELECT COUNT(*) AS count FROM delivery_attempts WHERE delivery_id=?
       `).get(deliveryId);
+            // Only a digest on BOTH sides can disagree: a pre-#856 row or a caller
+            // that could not hash is "unknown", never a mismatch.
+            const mismatch = !!row.content_sha256 && !!evidence?.pastedContentSha256
+                && row.content_sha256 !== evidence.pastedContentSha256;
             if (started.count >= DURABLE_DELIVERY_MAX_ATTEMPTS) {
                 const update = this.db.prepare(`
           UPDATE deliveries SET state='failed',updated_at=?,finished_at=?,last_error='delivery submission attempt limit reached'
@@ -404,16 +692,19 @@ export class DeliveryOutbox extends EventEmitter {
         INSERT INTO delivery_attempts(
           delivery_id,target_daemon_boot_id,attempt_no,state,begin_ack_at,
           backend,window_id,transcript_path,transcript_offset,transcript_session_id,submission_mode,
-          backend_version,queue_resume_policy
-        ) VALUES (?,?,?,'begun',?,?,?,?,?,?,?,?,?)
-      `).run(deliveryId, targetBootId, attemptNo, now, evidence?.backend ?? null, evidence?.windowId ?? null, evidence?.transcriptPath ?? null, evidence?.transcriptOffset ?? null, evidence?.transcriptSessionId ?? null, evidence?.submissionMode ?? null, evidence?.backendVersion ?? null, evidence?.queueResumePolicy ?? null);
+          backend_version,queue_resume_policy,pasted_content_sha256,pasted_bytes_sha256,content_digest_mismatch
+        ) VALUES (?,?,?,'begun',?,?,?,?,?,?,?,?,?,?,?,?)
+      `).run(deliveryId, targetBootId, attemptNo, now, evidence?.backend ?? null, evidence?.windowId ?? null, evidence?.transcriptPath ?? null, evidence?.transcriptOffset ?? null, evidence?.transcriptSessionId ?? null, evidence?.submissionMode ?? null, evidence?.backendVersion ?? null, evidence?.queueResumePolicy ?? null, evidence?.pastedContentSha256 ?? null, evidence?.pastedBytesSha256 ?? null, mismatch ? 1 : 0);
             this.db.prepare(`
         UPDATE deliveries SET state='submission_started', submitted_at=?, updated_at=?
         WHERE delivery_id=? AND state='delivering'
       `).run(now, now, deliveryId);
-            return { outcome: "begun", failed: false };
+            return { outcome: "begun", failed: false, mismatch };
         });
         const result = transaction();
+        if (result.mismatch) {
+            this.emit("content_digest_mismatch", { deliveryId, targetBootId, attemptNo, targetInstance: this.get(deliveryId)?.targetInstance });
+        }
         if (result.outcome === "begun")
             this.emit("state", { deliveryId, state: "submission_started" });
         else if (result.failed)
@@ -490,6 +781,8 @@ export class DeliveryOutbox extends EventEmitter {
             if (parent && (outcome === "failed" || outcome === "uncertain")) {
                 this.insertFailureNotice(parent, outcome, evidence ?? outcome, now);
             }
+            if (parent && outcome === "delivered")
+                this.openReplyObligation(parent, now);
             return { changed: true, accepted: true };
         });
         const result = transaction();
@@ -767,6 +1060,8 @@ export class DeliveryOutbox extends EventEmitter {
       `).run(attemptState, outcome === "retry_wait" ? now : null, terminal ? now : null, evidence.slice(0, 300), deliveryId, targetBootId, attemptNo);
             if (outcome === "uncertain")
                 this.insertFailureNotice(parent, "uncertain", evidence, now);
+            if (outcome === "delivered")
+                this.openReplyObligation(parent, now);
             return true;
         });
         const changed = transaction();
@@ -790,7 +1085,8 @@ export class DeliveryOutbox extends EventEmitter {
     }
     /** Must be called inside the same SQLite transaction as the terminal transition. */
     insertFailureNotice(parent, outcome, reason, now) {
-        if (parent.kind === "delivery_outcome_notice" || parent.kind === "post_restart_outcome_notice")
+        if (parent.kind === "delivery_outcome_notice" || parent.kind === "post_restart_outcome_notice"
+            || parent.kind === REPLY_OBLIGATION_NOTICE_KIND)
             return;
         const noticeId = randomUUID();
         const operationId = `notice:${parent.operation_id}:${parent.delivery_id}`;