@songsid/agend 2.2.0-alpha.9 → 2.2.0-beta.10

package/dist/delivery-outbox.js

@@ -5,9 +5,23 @@ import { EventEmitter } from "node:events";
 import { chmodSync, mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { t } from "./locale.js";
+import { initializeHumanReceipts, createHumanReceipt, getHumanReceipt, bindHumanReceipt, settleHumanReceipt, queryHumanReceipt } from "./human-delivery-receipts.js";
 export const DURABLE_DELIVERY_MAX_ATTEMPTS = 8;
 export const DURABLE_DELIVERY_MAX_AGE_MS = 24 * 60 * 60_000;
 export const DURABLE_DELIVERY_ABORT_BACKOFF_MS = 5_000;
+export const DEFAULT_REPLY_OBLIGATION_TTL_MS = 24 * 60 * 60_000;
+const RESTART_REPLY_DISPLAY_LIMIT = 10;
+/** Keep each preview on one physical line and bound even an arbitrary correlation ID. */
+function replyPreview(value) {
+    const escaped = value.replace(/[\u0000-\u001f\u007f]/g, c => JSON.stringify(c).slice(1, -1));
+    const bytes = Buffer.from(escaped);
+    if (bytes.length <= 256)
+        return escaped;
+    let end = 253;
+    while ((bytes[end] & 0xc0) === 0x80)
+        end--;
+    return bytes.subarray(0, end).toString("utf8") + "…";
+}
 /** The one mapping from validated tool/CLI arguments to a selector. */
 export function deliveryStatusSelector(args) {
     const page = { ...(args.limit !== undefined ? { limit: args.limit } : {}), ...(args.cursor ? { cursor: args.cursor } : {}) };
@@ -54,12 +68,21 @@ function payloadMessageId(payload) {
     const id = meta && typeof meta === "object" ? meta.message_id : undefined;
     return typeof id === "string" && id.length > 0 ? id : null;
 }
-/** The exact statement `needsAttention` runs; exported so the plan test checks this text and no copy of it. */
+/**
+ * The exact statement `needsAttention` runs; exported so the plan test checks this text and no copy of it. A silent
+ * schedule's raw paste is never an item (#1647): nobody can act on it, the next run goes ahead anyway, and the fleet's
+ * notice to the leader (with the cause) is its whole report. Every human-originated row stays.
+ */
 export const NEEDS_ATTENTION_SQL = `
   SELECT delivery_id, state, source_instance, target_instance, kind, finished_at, last_error
   FROM deliveries INDEXED BY idx_delivery_attention
   WHERE state IN ('uncertain','failed') AND acknowledged_at IS NULL AND finished_at >= ?
+    AND NOT (kind = 'raw_paste' AND source_key LIKE 'schedule:%')
   ORDER BY finished_at DESC LIMIT ?`;
+/** A silent schedule's raw paste (fleet-manager admits it as `raw_paste` under a `schedule:` source key). */
+export function isSilentScheduleDelivery(row) {
+    return row.kind === "raw_paste" && (row.sourceKey ?? "").startsWith("schedule:");
+}
 function mapRow(row) {
     return {
         deliveryId: row.delivery_id,
@@ -94,7 +117,9 @@ function safeErrorSummary(error, state) {
         return t("delivery.error_expired");
     if (normalized.includes("attempt limit"))
         return t("delivery.error_attempts");
-    if (normalized.includes("reconcil") || normalized.includes("uncertain") || normalized.includes("restart") || normalized.includes("unverified") || normalized.includes("unverifiable")) {
+    // `<phase>-proof:<proof>` is what a pane or transcript submission proof could not establish (#1647).
+    if (normalized.includes("reconcil") || normalized.includes("uncertain") || normalized.includes("restart") || normalized.includes("unverified") || normalized.includes("unverifiable")
+        || /-proof:/.test(normalized)) {
         // Retry guidance comes from the recorded outcome, not a historical diagnostic.
         if (state && safeToRetry(state))
             return t("delivery.error_recorded");
@@ -115,8 +140,9 @@ function hasTable(db, table) {
 function obligationFor(db, correlationId, requester, owner) {
     if (!correlationId || !hasTable(db, "reply_obligations"))
         return null;
+    const expiredAt = hasColumn(db, "reply_obligations", "expired_at") ? "expired_at" : "NULL AS expired_at";
     const row = db.prepare(`
-    SELECT state, opened_at, last_asked_at, nudged_at, overdue_notified_at, answered_at FROM reply_obligations
+    SELECT state, opened_at, last_asked_at, nudged_at, overdue_notified_at, answered_at, ${expiredAt} FROM reply_obligations
     WHERE correlation_id=? AND requester_instance=? AND owner_instance=?
   `).get(correlationId, requester, owner);
     return row ?? null;
@@ -124,6 +150,25 @@ function obligationFor(db, correlationId, requester, owner) {
 function hasColumn(db, table, column) {
     return db.prepare(`PRAGMA table_info(${table})`).all().some(c => c.name === column);
 }
+/** The same row ACL protects results, cursor anchors and forward admission. */
+function deliveryVisibility(db, alias, caller) {
+    const grants = hasTable(db, "delivery_forward_edges");
+    return {
+        sql: `(${alias}.source_instance=? OR ${alias}.target_instance=?${grants
+            ? ` OR EXISTS (SELECT 1 FROM delivery_forward_edges g WHERE g.reference_kind='delivery' AND g.reference_id=${alias}.delivery_id AND g.receiver_instance=?)`
+            : ""})`,
+        params: grants ? [caller, caller, caller] : [caller, caller],
+    };
+}
+function forwardingEvidence(db, kind, id, caller) {
+    if (!hasTable(db, "delivery_forward_edges"))
+        return undefined;
+    const rows = db.prepare(`SELECT sender_instance AS source_instance, forwarding_message_id AS message_id,
+    created_at AS forwarded_at FROM delivery_forward_edges
+    WHERE reference_kind=? AND reference_id=? AND receiver_instance=? ORDER BY created_at DESC,forwarding_delivery_id DESC LIMIT 1`)
+        .all(kind, id, caller);
+    return rows.length ? rows : undefined;
+}
 /** Derived from the stored payload, so it is the same for pre-#856 rows. */
 function rowContentEvidence(payloadJson, withContent) {
     let payload = null;
@@ -139,6 +184,9 @@ function rowContentEvidence(payloadJson, withContent) {
     };
 }
 function queryStatusPage(db, selector, callerInstance) {
+    const human = queryHumanReceipt(db, callerInstance, selector);
+    if (human)
+        return human;
     const where = [];
     const params = [];
     // An operator may read a database written before the column existed.
@@ -161,8 +209,9 @@ function queryStatusPage(db, selector, callerInstance) {
         params.push(selector.correlationId);
     }
     if (callerInstance !== null) {
-        where.push("(d.source_instance = ? OR d.target_instance = ?)");
-        params.push(callerInstance, callerInstance);
+        const acl = deliveryVisibility(db, "d", callerInstance);
+        where.push(acl.sql);
+        params.push(...acl.params);
     }
     if (selector.cursor) {
         const cursorScope = ["c.delivery_id = ?"];
@@ -180,8 +229,9 @@ function queryStatusPage(db, selector, callerInstance) {
             cursorParams.push(selector.correlationId);
         }
         if (callerInstance !== null) {
-            cursorScope.push("(c.source_instance = ? OR c.target_instance = ?)");
-            cursorParams.push(callerInstance, callerInstance);
+            const acl = deliveryVisibility(db, "c", callerInstance);
+            cursorScope.push(acl.sql);
+            cursorParams.push(...acl.params);
         }
         where.push(`d.created_seq > (SELECT c.created_seq FROM deliveries c WHERE ${cursorScope.join(" AND ")} LIMIT 1)`);
         params.push(...cursorParams);
@@ -199,7 +249,8 @@ function queryStatusPage(db, selector, callerInstance) {
       CASE WHEN d.state='submission_started' AND d.reconciliation_pending=1
         THEN 'reconciliation_pending' ELSE d.state END AS state,
       d.attempt_no,d.created_at,d.updated_at,d.last_error,d.payload_json,
-      ${consumedColumns}, ${submissionMode} AS submission_mode
+      ${consumedColumns}, ${submissionMode} AS submission_mode,
+      ${hasColumn(db, "deliveries", "finished_at") ? "d.finished_at" : "NULL"} AS delivered_at
     FROM deliveries d
     WHERE ${where.join(" AND ")}
     ORDER BY d.created_seq
@@ -224,11 +275,14 @@ function queryStatusPage(db, selector, callerInstance) {
             safe_to_retry: safeToRetry(row.state),
             delivery_mode: row.kind === "steer" ? "steer" : "idle_queue",
             submission_mode: row.submission_mode ?? null,
+            delivered_at: row.state === "delivered" ? row.delivered_at : null,
             consumed_at: row.consumed_at ?? null,
             consumed_via: row.consumed_via ?? null,
             // Text only for the explicit verification query (#856), and only to the
             // row's own source/target; every other query keeps #982's redaction.
             ...rowContentEvidence(row.payload_json, callerInstance !== null && !!selector.messageId),
+            ...(callerInstance !== null && selector.messageId
+                ? { forwarded_by: forwardingEvidence(db, "delivery", row.delivery_id, callerInstance) } : {}),
             reply_obligation: obligationFor(db, row.correlation_id, row.source_instance, row.target_instance),
         })),
         next_cursor: hasMore ? visible.at(-1)?.delivery_id ?? null : null,
@@ -240,6 +294,7 @@ function mapObligation(row) {
         requestDeliveryId: row.request_delivery_id, openedAt: row.opened_at, lastAskedAt: row.last_asked_at, state: row.state,
         nudgedAt: row.nudged_at, overdueNotifiedAt: row.overdue_notified_at, answeredAt: row.answered_at,
         answeredDeliveryId: row.answered_delivery_id,
+        expiredAt: row.expired_at,
     };
 }
 /** Durable admission and fenced state transitions for the fleet delivery queue. */
@@ -346,20 +401,55 @@ export class DeliveryOutbox extends EventEmitter {
         request_delivery_id TEXT NOT NULL,
         opened_at TEXT NOT NULL,
         last_asked_at TEXT NOT NULL,
-        state TEXT NOT NULL CHECK (state IN ('open','answered')),
+        state TEXT NOT NULL CHECK (state IN ('open','answered','expired')),
         nudged_at TEXT,
         overdue_notified_at TEXT,
         answered_at TEXT,
         answered_delivery_id TEXT,
+        expired_at TEXT,
         PRIMARY KEY (correlation_id, requester_instance, owner_instance)
       );
       CREATE INDEX IF NOT EXISTS idx_reply_obligation_owner_state ON reply_obligations(owner_instance, state);
+      -- A notice can be pruned while its boot is still alive. Keep the claim
+      -- independently: no notice FK/cascade and no request or message content.
+      CREATE TABLE IF NOT EXISTS reply_restart_markers (
+        owner_instance TEXT NOT NULL,
+        restart_id TEXT NOT NULL,
+        reminded_at TEXT NOT NULL,
+        PRIMARY KEY (owner_instance, restart_id)
+      );
       CREATE TABLE IF NOT EXISTS failure_notices (
         parent_delivery_id TEXT PRIMARY KEY,
         notice_delivery_id TEXT NOT NULL UNIQUE,
         created_at TEXT NOT NULL
       );
+      -- Retain a grant while its reference exists, even if its forwarding
+      -- notification is pruned. No message body or inferred authority here.
+      CREATE TABLE IF NOT EXISTS delivery_forward_edges (
+        reference_kind TEXT NOT NULL CHECK (reference_kind IN ('delivery','human')),
+        reference_id TEXT NOT NULL,
+        sender_instance TEXT NOT NULL,
+        receiver_instance TEXT NOT NULL,
+        forwarding_delivery_id TEXT NOT NULL,
+        forwarding_message_id TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        PRIMARY KEY (reference_kind,reference_id,receiver_instance,forwarding_delivery_id)
+      );
+      -- Independent of recipient/session/effective mode and notification retention.
+      -- A pruned admitted row cannot authorize a retry to create new grants.
+      CREATE TABLE IF NOT EXISTS delivery_forward_proposals (
+        source_instance TEXT NOT NULL,
+        operation_id TEXT NOT NULL,
+        proposal_sha256 TEXT NOT NULL,
+        delivery_id TEXT NOT NULL,
+        PRIMARY KEY (source_instance,operation_id)
+      );
+      CREATE INDEX IF NOT EXISTS idx_delivery_forward_admission ON delivery_forward_edges(forwarding_delivery_id);
+      CREATE INDEX IF NOT EXISTS idx_delivery_forward_latest ON delivery_forward_edges
+        (reference_kind,reference_id,receiver_instance,created_at DESC,forwarding_delivery_id DESC);
     `);
+        this.migrateReplyObligationExpiry();
+        initializeHumanReceipts(this.db);
         // Additive migration: existing Phase 1 databases keep their row identities,
         // foreign keys, and WAL while gaining reconciliation evidence columns.
         this.ensureColumn("deliveries", "reconciliation_pending", "INTEGER NOT NULL DEFAULT 0");
@@ -411,6 +501,30 @@ export class DeliveryOutbox extends EventEmitter {
       WHERE state IN ('uncertain','failed') AND acknowledged_at IS NULL`);
         this.db.pragma("user_version = 5");
     }
+    /** SQLite cannot widen a CHECK with ADD COLUMN; preserve all old rows in one transaction. */
+    migrateReplyObligationExpiry() {
+        const schema = this.db.prepare("SELECT sql FROM sqlite_master WHERE type='table' AND name='reply_obligations'")
+            .get();
+        if (!schema.sql.includes("'expired'")) {
+            this.db.transaction(() => {
+                this.db.exec(`CREATE TABLE reply_obligations_v1694 (
+          correlation_id TEXT NOT NULL, requester_instance TEXT NOT NULL, owner_instance TEXT NOT NULL,
+          request_delivery_id TEXT NOT NULL, opened_at TEXT NOT NULL, last_asked_at TEXT NOT NULL,
+          state TEXT NOT NULL CHECK (state IN ('open','answered','expired')),
+          nudged_at TEXT, overdue_notified_at TEXT, answered_at TEXT, answered_delivery_id TEXT, expired_at TEXT,
+          PRIMARY KEY (correlation_id, requester_instance, owner_instance)
+        );
+        INSERT INTO reply_obligations_v1694 SELECT correlation_id,requester_instance,owner_instance,
+          request_delivery_id,opened_at,last_asked_at,state,nudged_at,overdue_notified_at,
+          answered_at,answered_delivery_id,NULL FROM reply_obligations;`);
+                this.db.exec("DROP TABLE reply_obligations");
+                this.db.exec("ALTER TABLE reply_obligations_v1694 RENAME TO reply_obligations");
+                this.db.exec("CREATE INDEX idx_reply_obligation_owner_state ON reply_obligations(owner_instance,state)");
+            })();
+        }
+        this.ensureColumn("reply_obligations", "expired_at", "TEXT");
+        this.db.exec("CREATE INDEX IF NOT EXISTS idx_reply_obligation_state_asked ON reply_obligations(state,last_asked_at)");
+    }
     /**
      * #926: a delivered `requires_reply` request opens (or, asked again,
      * re-opens) the owner's obligation. Runs inside the delivered transition.
@@ -442,7 +556,7 @@ export class DeliveryOutbox extends EventEmitter {
       ON CONFLICT(correlation_id, requester_instance, owner_instance) DO UPDATE SET
         request_delivery_id=excluded.request_delivery_id, last_asked_at=excluded.last_asked_at,
         state=excluded.state, nudged_at=NULL, overdue_notified_at=NULL,
-        answered_at=excluded.answered_at, answered_delivery_id=excluded.answered_delivery_id
+        answered_at=excluded.answered_at, answered_delivery_id=excluded.answered_delivery_id, expired_at=NULL
     `).run({
             cid: request.correlation_id, requester: request.source_instance, owner: request.target_instance,
             request: request.delivery_id, now,
@@ -462,8 +576,8 @@ export class DeliveryOutbox extends EventEmitter {
     /**
      * #926 safety net 1: remind an owner that has not answered. `turn-ended`
      * reminds once per ask, after the grace (a reply seconds after the ask is
-     * normal); `restart` reminds once per restart, because the interrupted turn
-     * does not resume on its own. Marked in the same transaction as the notice.
+     * normal); `restart` batches once per daemon boot, because the interrupted
+     * turn does not resume on its own. Marked in the same transaction as the notice.
      */
     remindReplyObligations(ownerInstance, opts) {
         const now = opts.now ?? new Date();
@@ -471,15 +585,42 @@ export class DeliveryOutbox extends EventEmitter {
         const graceCutoff = new Date(now.getTime() - opts.graceMs).toISOString();
         const sinceIso = (opts.since ?? now).toISOString();
         const inserted = this.db.transaction(() => {
-            const due = this.db.prepare(opts.reason === "turn-ended"
-                ? "SELECT * FROM reply_obligations WHERE owner_instance=? AND state='open' AND nudged_at IS NULL AND last_asked_at <= ?"
-                : "SELECT * FROM reply_obligations WHERE owner_instance=? AND state='open' AND (nudged_at IS NULL OR nudged_at < ?)").all(ownerInstance, opts.reason === "turn-ended" ? graceCutoff : sinceIso);
+            if (opts.reason === "restart") {
+                const restartId = opts.restartId ?? sinceIso;
+                const key = `reply-pending:restart:${JSON.stringify([ownerInstance, restartId])}`;
+                if (this.db.prepare("SELECT 1 FROM reply_restart_markers WHERE owner_instance=? AND restart_id=?")
+                    .get(ownerInstance, restartId))
+                    return 0;
+                // Adopt an existing notice from the earlier implementation/rollback
+                // without stamping a new ask or producing another notice.
+                const prior = this.db.prepare("SELECT created_at FROM deliveries WHERE source_key=?").get(key);
+                if (prior) {
+                    this.recordReplyRestart(ownerInstance, restartId, prior.created_at);
+                    return 0;
+                }
+                const total = this.db.prepare("SELECT count(*) n FROM reply_obligations WHERE owner_instance=? AND state='open'")
+                    .get(ownerInstance).n;
+                if (!total)
+                    return 0;
+                const preview = this.db.prepare(`SELECT requester_instance,correlation_id,last_asked_at FROM reply_obligations
+          WHERE owner_instance=? AND state='open' ORDER BY last_asked_at,correlation_id,requester_instance LIMIT ?`)
+                    .all(ownerInstance, RESTART_REPLY_DISPLAY_LIMIT);
+                const lines = preview.map(row => `${replyPreview(row.requester_instance)}; correlation_id=${replyPreview(row.correlation_id)}; asked=${replyPreview(row.last_asked_at)}`);
+                if (total > preview.length)
+                    lines.push(t("delivery.reply_restart_more", total - preview.length));
+                const content = t("delivery.reply_restart") + "\n" + lines.join("\n");
+                if (!this.insertReplyObligationNotice(ownerInstance, null, key, content, nowIso))
+                    return 0;
+                this.recordReplyRestart(ownerInstance, restartId, nowIso);
+                this.db.prepare("UPDATE reply_obligations SET nudged_at=? WHERE owner_instance=? AND state='open'").run(nowIso, ownerInstance);
+                return 1;
+            }
+            const due = this.db.prepare("SELECT * FROM reply_obligations WHERE owner_instance=? AND state='open' AND nudged_at IS NULL AND last_asked_at <= ?")
+                .all(ownerInstance, graceCutoff);
             let count = 0;
             for (const row of due) {
-                const content = opts.reason === "turn-ended"
-                    ? t("delivery.reply_turn_ended", row.requester_instance, row.correlation_id, row.last_asked_at)
-                    : t("delivery.reply_restart", row.requester_instance, row.correlation_id, row.last_asked_at);
-                const key = `reply-pending:${opts.reason}:${row.correlation_id}:${row.requester_instance}:${row.owner_instance}:${opts.reason === "turn-ended" ? row.last_asked_at : sinceIso}`;
+                const content = t("delivery.reply_turn_ended", row.requester_instance, row.correlation_id, row.last_asked_at);
+                const key = `reply-pending:turn-ended:${row.correlation_id}:${row.requester_instance}:${row.owner_instance}:${row.last_asked_at}`;
                 if (this.insertReplyObligationNotice(row.owner_instance, row.correlation_id, key, content, nowIso))
                     count++;
                 this.db.prepare(`
@@ -492,6 +633,37 @@ export class DeliveryOutbox extends EventEmitter {
             this.emit("admitted");
         return inserted;
     }
+    recordReplyRestart(owner, restartId, now) {
+        this.db.prepare("INSERT INTO reply_restart_markers(owner_instance,restart_id,reminded_at) VALUES (?,?,?)")
+            .run(owner, restartId, now);
+    }
+    /** Expiry is terminal for this ask; a later delivered re-ask can reopen the same tuple. */
+    expireReplyObligations(opts = {}) {
+        const now = opts.now ?? new Date();
+        const ttl = opts.ttlMs !== undefined && Number.isFinite(opts.ttlMs) && opts.ttlMs > 0 ? opts.ttlMs : DEFAULT_REPLY_OBLIGATION_TTL_MS;
+        const cutoff = new Date(Math.max(-8.64e15, now.getTime() - ttl)).toISOString();
+        const nowIso = now.toISOString();
+        const expired = this.db.transaction(() => {
+            const due = this.db.prepare("SELECT * FROM reply_obligations WHERE state='open' AND last_asked_at<=? ORDER BY last_asked_at")
+                .all(cutoff);
+            for (const row of due) {
+                if (!row.overdue_notified_at) {
+                    const key = `reply-overdue:${row.correlation_id}:${row.requester_instance}:${row.owner_instance}:${row.last_asked_at}`;
+                    this.insertReplyObligationNotice(row.requester_instance, row.correlation_id, key, t("delivery.reply_expired", row.owner_instance, row.correlation_id, row.last_asked_at), nowIso);
+                }
+                this.db.prepare(`UPDATE reply_obligations SET state='expired',expired_at=?,overdue_notified_at=COALESCE(overdue_notified_at,?)
+          WHERE correlation_id=? AND requester_instance=? AND owner_instance=? AND state='open'`)
+                    .run(nowIso, nowIso, row.correlation_id, row.requester_instance, row.owner_instance);
+                row.state = "expired";
+                row.expired_at = nowIso;
+                row.overdue_notified_at ??= nowIso;
+            }
+            return due.map(mapObligation);
+        })();
+        if (expired.length)
+            this.emit("admitted");
+        return expired;
+    }
     /**
      * #926 safety net 2 (poll-on-timeout, in code): tell the requester once when
      * the owner is not working and nothing has come back for `overdueMs` since
@@ -633,6 +805,74 @@ export class DeliveryOutbox extends EventEmitter {
     `);
         const select = this.db.prepare("SELECT * FROM deliveries WHERE source_key = ?");
         const transaction = this.db.transaction(() => {
+            const previous = select.get(input.sourceKey);
+            const forwards = input.forwards ?? [];
+            if (forwards.length > 16 || new Set(forwards).size !== forwards.length
+                || forwards.some(id => typeof id !== "string" || id.length === 0 || id.length > 256 || /[\s\u0000-\u001f\u007f]/.test(id))) {
+                throw new Error("Forwarded message verification is unavailable");
+            }
+            const pinned = this.db.prepare("SELECT proposal_sha256,delivery_id FROM delivery_forward_proposals WHERE source_instance=? AND operation_id=?")
+                .get(input.sourceInstance, input.operationId);
+            const meta = input.payload.meta;
+            const proposalHash = deliveryContentDigest(JSON.stringify({
+                target: input.targetInstance, session: input.targetSession ?? null,
+                requestedKind: input.requestedKind ?? input.kind, content: payloadContent(input.payload), forwards: [...forwards].sort(),
+                // Volatile envelope IDs/timestamps and generated correlations are not proposal input.
+                requestKind: meta?.request_kind ?? null, requiresReply: meta?.requires_reply ?? null,
+                taskSummary: meta?.task_summary ?? null, workingDirectory: meta?.working_directory ?? null, branch: meta?.branch ?? null,
+            }));
+            if (pinned) {
+                if (pinned.proposal_sha256 !== proposalHash)
+                    throw new Error("Duplicate operation cannot change its forwarded request");
+                const admitted = this.db.prepare("SELECT * FROM deliveries WHERE delivery_id=?").get(pinned.delivery_id);
+                if (!admitted)
+                    throw new Error("Previously admitted forwarded operation is unavailable");
+                return { delivery: mapRow(admitted), inserted: false }; // Reuse the original effective mode, never recompute it.
+            }
+            if (forwards.length && this.db.prepare("SELECT 1 FROM deliveries WHERE source_instance=? AND operation_id=? LIMIT 1")
+                .get(input.sourceInstance, input.operationId)) {
+                throw new Error("Duplicate operation cannot change its forwarded request");
+            }
+            if (previous) {
+                const previousPayload = JSON.parse(previous.payload_json);
+                const oldForwards = (typeof previousPayload.meta?.forwards === "string"
+                    ? JSON.parse(previousPayload.meta.forwards) : []).sort();
+                if ((forwards.length || oldForwards.length)
+                    && (JSON.stringify([...forwards].sort()) !== JSON.stringify(oldForwards)
+                        || previous.source_instance !== input.sourceInstance || previous.target_instance !== input.targetInstance
+                        || previous.target_session !== (input.targetSession ?? null) || previous.kind !== input.kind
+                        || payloadContent(previousPayload) !== payloadContent(input.payload))) {
+                    throw new Error("Duplicate operation cannot change its forwarded request");
+                }
+                return { delivery: mapRow(previous), inserted: false };
+            }
+            // Validate all references before inserting any delivery or edge. The
+            // authenticated sender can explicitly disclose a grant it already owns.
+            const acl = deliveryVisibility(this.db, "d", input.sourceInstance);
+            const references = forwards.map(messageId => {
+                if (messageId.startsWith("hmsg-")) {
+                    const page = queryHumanReceipt(this.db, input.sourceInstance, { messageId });
+                    if (!page || page.items.length !== 1 || page.items[0].state !== "delivered") {
+                        throw new Error("Forwarded message verification is unavailable");
+                    }
+                    return { kind: "human", id: page.items[0].delivery_id, messageId };
+                }
+                const rows = this.db.prepare(`SELECT d.delivery_id,d.state FROM deliveries d
+          WHERE d.message_id=? AND ${acl.sql} LIMIT 2`).all(messageId, ...acl.params);
+                if (rows.length !== 1 || rows[0].state !== "delivered")
+                    throw new Error("Forwarded message verification is unavailable");
+                return { kind: "delivery", id: rows[0].delivery_id, messageId };
+            });
+            // The typed admission list is authoritative; callers need not mirror it
+            // in display metadata, and retries recover its canonical stored set.
+            const payload = { ...input.payload };
+            if (forwards.length || (payload.meta && typeof payload.meta === "object" && Object.hasOwn(payload.meta, "forwards"))) {
+                const meta = { ...(payload.meta ?? {}) };
+                delete meta.forwards;
+                if (forwards.length)
+                    meta.forwards = JSON.stringify(forwards);
+                payload.meta = meta;
+            }
             const result = insert.run({
                 delivery_id: deliveryId,
                 operation_id: input.operationId,
@@ -643,7 +883,7 @@ export class DeliveryOutbox extends EventEmitter {
                 target_session: input.targetSession ?? null,
                 kind: input.kind,
                 correlation_id: input.correlationId ?? null,
-                payload_json: JSON.stringify(input.payload),
+                payload_json: JSON.stringify(payload),
                 message_id: payloadMessageId(input.payload),
                 content_sha256: (content => content === null ? null : deliveryContentDigest(content))(payloadContent(input.payload)),
                 created_at: now,
@@ -653,6 +893,18 @@ export class DeliveryOutbox extends EventEmitter {
             const row = select.get(input.sourceKey);
             if (!row)
                 throw new Error("outbox admission committed without a readable row");
+            const forwardingMessageId = row.message_id;
+            if (references.length && !forwardingMessageId)
+                throw new Error("Forwarded message verification is unavailable");
+            const edge = this.db.prepare(`INSERT INTO delivery_forward_edges
+        (reference_kind,reference_id,sender_instance,receiver_instance,forwarding_delivery_id,forwarding_message_id,created_at)
+        VALUES (?,?,?,?,?,?,?)`);
+            for (const reference of references)
+                edge.run(reference.kind, reference.id, input.sourceInstance, input.targetInstance, row.delivery_id, forwardingMessageId, now);
+            if (references.length)
+                this.db.prepare(`INSERT INTO delivery_forward_proposals
+        (source_instance,operation_id,proposal_sha256,delivery_id) VALUES (?,?,?,?)`)
+                    .run(input.sourceInstance, input.operationId, proposalHash, row.delivery_id);
             if (result.changes === 1)
                 this.answerReplyObligation(row, now);
             return { delivery: mapRow(row), inserted: result.changes === 1 };
@@ -663,6 +915,20 @@ export class DeliveryOutbox extends EventEmitter {
         const row = this.db.prepare("SELECT * FROM deliveries WHERE delivery_id = ?").get(deliveryId);
         return row ? mapRow(row) : undefined;
     }
+    createHumanReceipt(input) {
+        return createHumanReceipt(this.db, input);
+    }
+    markHumanReceiptUncertain(id, target) {
+        this.db.prepare("UPDATE human_delivery_receipts SET state='uncertain',updated_at=? WHERE receipt_id=? AND target_instance=? AND state='queued'")
+            .run(new Date().toISOString(), id, target);
+    }
+    getHumanReceipt(id) { return getHumanReceipt(this.db, id); }
+    bindHumanReceipt(id, target, ownerKey, wire, managerBootId) {
+        return bindHumanReceipt(this.db, id, target, ownerKey, wire, managerBootId);
+    }
+    settleHumanReceipt(id, target, ownerKey, proof, currentOwnerKey) {
+        return settleHumanReceipt(this.db, id, target, ownerKey, proof, currentOwnerKey);
+    }
     getByOperation(sourceInstance, operationId) {
         const rows = this.db.prepare(`
       SELECT * FROM deliveries WHERE source_instance = ? AND operation_id = ? ORDER BY created_seq
@@ -1121,6 +1387,8 @@ export class DeliveryOutbox extends EventEmitter {
     recoverForBoot(managerBootId) {
         const now = new Date().toISOString();
         const transaction = this.db.transaction(() => {
+            this.db.prepare("UPDATE human_delivery_receipts SET state='uncertain',updated_at=? WHERE state='queued' AND manager_boot_id<>?")
+                .run(now, managerBootId);
             const queued = this.db.prepare(`
         UPDATE deliveries SET state='queued',manager_boot_id=NULL,target_daemon_boot_id=NULL,next_attempt_at=NULL,updated_at=?
         WHERE manager_boot_id IS NOT NULL AND manager_boot_id<>? AND state IN ('delivering','retry_wait')
@@ -1351,15 +1619,16 @@ export class DeliveryOutbox extends EventEmitter {
                     insertPruned.run(row.delivery_id, row.source_instance, row.target_instance, now);
                 // Delete child rows first.
                 this.db.prepare(`DELETE FROM delivery_attempts WHERE delivery_id IN (${placeholders})`).run(...ids);
-                // Only closed reply_obligations (answered): open ones were excluded above.
+                // Only closed reply_obligations (answered/expired): open ones were excluded above.
                 if (hasTable(this.db, "reply_obligations")) {
                     this.db.prepare(`
             DELETE FROM reply_obligations
-            WHERE request_delivery_id IN (${placeholders}) AND state = 'answered'
+            WHERE request_delivery_id IN (${placeholders}) AND state IN ('answered','expired')
           `).run(...ids);
                 }
                 this.db.prepare(`DELETE FROM outcome_notices WHERE notice_delivery_id IN (${placeholders})`).run(...ids);
                 this.db.prepare(`DELETE FROM failure_notices WHERE parent_delivery_id IN (${placeholders}) OR notice_delivery_id IN (${placeholders})`).run(...ids, ...ids);
+                this.db.prepare(`DELETE FROM delivery_forward_edges WHERE reference_kind='delivery' AND reference_id IN (${placeholders})`).run(...ids);
                 this.db.prepare(`DELETE FROM deliveries WHERE delivery_id IN (${placeholders})`).run(...ids);
             })();
             total += rows.length;
@@ -1368,6 +1637,24 @@ export class DeliveryOutbox extends EventEmitter {
             // Yield between chunks so the event loop can turn.
             await new Promise(resolve => setImmediate(resolve));
         }
+        // Human rows are evidence only: retention never schedules or retries them.
+        for (;;) {
+            if (!this.db.open)
+                break;
+            const rows = this.db.prepare("SELECT receipt_id FROM human_delivery_receipts WHERE updated_at<? LIMIT 500").all(cutoff);
+            if (!rows.length)
+                break;
+            this.db.transaction(() => {
+                for (const row of rows) {
+                    this.db.prepare("DELETE FROM delivery_forward_edges WHERE reference_kind='human' AND reference_id=?").run(row.receipt_id);
+                    this.db.prepare("DELETE FROM human_delivery_receipts WHERE receipt_id=?").run(row.receipt_id);
+                }
+            })();
+            total += rows.length;
+            if (rows.length < CHUNK)
+                break;
+            await new Promise(resolve => setImmediate(resolve));
+        }
         // Self-prune pruned_ids after 2× the retention window — chunked (Fix 4).
         if (this.db.open) {
             const oldCutoff = new Date(Date.now() - 2 * days * 24 * 60 * 60_000).toISOString();