@spine-event-engine/server 2.0.0-snapshot.25 → 2.0.0-snapshot.28

package/dist/repository/repository.js

@@ -12,7 +12,7 @@
  * the License.
  */
 import { clone, create, equals, ScalarType, toBinary, } from "@bufbuild/protobuf";
-import { AnySchema, Int32ValueSchema, Int64ValueSchema, StringValueSchema, } from "@bufbuild/protobuf/wkt";
+import { AnySchema, Int32ValueSchema, Int64ValueSchema, StringValueSchema, TimestampSchema, } from "@bufbuild/protobuf/wkt";
 import { ValidationException, RejectionThrowable, Validate, TypeUrls, AnyPacker, Identifiers, StringifierRegistry, Time, } from "@spine-event-engine/core";
 import { CommandContextSchema, ActorContextSchema, CommandIdSchema, CommandSchema, EventContextSchema, EventIdSchema, EventSchema, MessageIdSchema, TenantIdSchema, RejectionEventContextSchema, VersionSchema, EntityOption_Kind, } from "@spine-event-engine/proto";
 import * as EntityLog from "@spine-event-engine/proto/generated/spine/system/server/entity_log_events_pb.js";
@@ -22,7 +22,7 @@ import { EventStore, StorageQueryPolicy, } from "@spine-event-engine/storage";
 import { TenantBoundary, eventStoreAccess, StoragePreparations, } from "@spine-event-engine/storage/provider";
 import { EntityCommitStorageFactories } from "@spine-event-engine/storage/provider";
 import { AgentHistoryStorageFactories, } from "@spine-event-engine/storage/provider";
-import { AgentHistoryEntrySchema, AgentInvocationTerminatedSchema, AgentModelSelectionChangedSchema as SelectionChangedSchema, AiModelKind, ModelRefSchema, ModelPreferenceSchema, ConversationIdSchema, } from "@spine-event-engine/proto/agent";
+import { AgentHistoryEntrySchema, AgentInvocationTerminatedSchema, AgentModelSelectionChangedSchema as SelectionChangedSchema, AiModelKind, ModelRefSchema, ModelPreferenceSchema, ConversationRecordSchema, ConversationIdSchema, AgentHistoryCursorSchema, } from "@spine-event-engine/proto/agent";
 import { registryOptions } from "@spine-event-engine/ai/spi/runtime";
 import { CommandValidationError } from "../bus/command-errors.js";
 import { SignalPublisher } from "../runtime/signal-publisher.js";
@@ -32,10 +32,12 @@ import { CommandRoutingInternals, } from "./command-routing.js";
 import { EventRoutingInternals } from "./event-routing.js";
 import { StateUpdateRoutingInternals, } from "./state-update-routing.js";
 import { RoutingDeclarations } from "./routing-declarations.js";
+import { snapshotTrustedReader, } from "@spine-event-engine/core/spi/trusted-reader";
+import { Code, ConnectError } from "@connectrpc/connect";
 import { EventDispatcherOriginSchemas } from "../bus/event-dispatcher-origin-schemas.js";
 import { receptionObservation } from "../delivery/reception-observation.js";
-import { commitFenced, withDeliveryCommitFence } from "./commit-fence.js";
-import { AgentHistoryReads } from "../agent/agent-history.js";
+import { commitFenced, withDeliveryCommitFence, withoutDeliveryCommitFence, } from "./commit-fence.js";
+import { AgentHistoryReads, } from "../agent/agent-history.js";
 import { AgentLiveAiRuntime } from "../agent/agent-live-ai-runtime.js";
 import { AgentLiveAudit } from "../agent/agent-live-audit.js";
 import { AgentLiveBudget } from "../agent/agent-live-budget.js";
@@ -258,7 +260,14 @@ const RepositoryAgentReads = {
             : validated;
         const tenant = scope.tenantId === undefined ? undefined : RepositoryTenants.require(scope.tenantId);
         const context = RepositoryTenants.storageContextForTenant(runtime.context, tenant);
-        return { runtime, context, id: copiedId };
+        const readSide = {
+            ...(scope.actorContext === undefined
+                ? {}
+                : { actorContext: clone(ActorContextSchema, scope.actorContext) }),
+            ...(scope.reader === undefined ? {} : snapshotTrustedReader(scope.reader)),
+            ...(scope.signal === undefined ? {} : { signal: scope.signal }),
+        };
+        return { runtime, context, id: copiedId, readSide };
     },
     /**
      * Returns a detached public history request before provider access.
@@ -269,7 +278,9 @@ const RepositoryAgentReads = {
     request(request) {
         return {
             pageSize: request.pageSize,
-            ...(request.cursor === undefined ? {} : { cursor: request.cursor }),
+            ...(request.cursor === undefined
+                ? {}
+                : { cursor: clone(AgentHistoryCursorSchema, request.cursor) }),
         };
     },
     /**
@@ -313,22 +324,95 @@ const RepositoryAgentReads = {
      * @returns Detached history entries and opaque continuation.
      */
     async historyPage(repository, captured, view, request) {
+        this.checkCanceled(captured.readSide.signal);
         if (repositoryRuntimes.get(repository) !== captured.runtime)
             throw new Error("Agent read requires an active repository.");
         await captured.runtime.onAdmit(captured.context.tenantId);
-        return RepositoryStorage.track(repository, async () => {
-            const input = RepositoryStorage.entityStorageInput(repository, captured.context);
-            const history = RepositoryStorage.openRepositoryAgentHistory(repository, captured.runtime.storageFactory, input);
-            const page = await AgentHistoryReads.readBound({
-                storage: history,
-                entityId: captured.id,
-                scope: repositoryAccess.agentHistoryScope(captured.context, input, captured.id),
-            }, view, request);
-            return {
-                items: page.items,
-                ...(page.nextCursor === undefined ? {} : { nextCursor: page.nextCursor }),
-            };
-        });
+        this.checkCanceled(captured.readSide.signal);
+        const page = await RepositoryStorage.track(repository, () => this.loadHistoryPage(repository, captured, view, request));
+        this.checkCanceled(captured.readSide.signal);
+        return page;
+    },
+    /**
+     * Rejects canceled public history reads even when no policy callback runs.
+     * @param signal Current caller cancellation, if supplied.
+     */
+    checkCanceled(signal) {
+        if (signal?.aborted)
+            throw new ConnectError("Read canceled.", Code.Canceled);
+    },
+    /**
+     * Reads a retained Agent page and transforms only its outward domain values.
+     *
+     * @param repository Registered Agent repository.
+     * @param captured Stable Entity, tenant, and reader facts.
+     * @param view Indexed history category.
+     * @param request Detached page request.
+     * @returns Visible entries and original continuation.
+     */
+    async loadHistoryPage(repository, captured, view, request) {
+        const input = RepositoryStorage.entityStorageInput(repository, captured.context);
+        const history = RepositoryStorage.openRepositoryAgentHistory(repository, captured.runtime.storageFactory, input);
+        const page = await AgentHistoryReads.readBound({
+            storage: history,
+            entityId: captured.id,
+            scope: repositoryAccess.agentHistoryScope(captured.context, input, captured.id),
+        }, view, request);
+        return this.visibleHistory(captured.runtime.stand, page, captured.id, view, request, captured.context.tenantId, captured.readSide);
+    },
+    /**
+     * Transforms returned Agent domain roots while retaining the original page cursor.
+     *
+     * @param stand Producing context's read policy.
+     * @param page Captured history page before outward transformation.
+     * @param entityId Agent identifier used for this call.
+     * @param view Requested history category.
+     * @param request Original page request.
+     * @param tenantId Effective tenant of this Agent.
+     * @param readSide Trusted in-process caller facts captured with the reader.
+     * @returns Visible entries with the provider's original continuation.
+     */
+    async visibleHistory(stand, page, entityId, view, request, tenantId, readSide = {}) {
+        const facts = {
+            operation: { kind: "history", history: { source: "agent", entityId, view, request } },
+            ...(tenantId === undefined ? {} : { effectiveTenant: tenantId }),
+            ...readSide,
+        };
+        const items = [];
+        for (const entry of page.items) {
+            const visible = await this.visibleEntry(stand, entry, facts);
+            if (visible !== undefined)
+                items.push(visible);
+        }
+        return { items, ...(page.nextCursor === undefined ? {} : { nextCursor: page.nextCursor }) };
+    },
+    /**
+     * Transforms one retained Agent entry without changing its wrapper or cursor.
+     *
+     * @param stand Producing context's outward read policy.
+     * @param entry Captured indexed history entry.
+     * @param facts Actual read operation and trusted invocation facts.
+     * @returns Visible entry, or undefined when policy removed its root.
+     */
+    async visibleEntry(stand, entry, facts) {
+        const item = entry.item;
+        let visible;
+        if (item.case === "conversationRecord") {
+            const value = await standAccess.filterState(stand, ConversationRecordSchema, item.value, facts);
+            if (value !== null)
+                visible = { case: "conversationRecord", value };
+        }
+        else if (item.case === "systemEvent" || item.case === "domainEvent") {
+            const value = await standAccess.filterEvent(stand, item.value, facts);
+            if (value !== null)
+                visible =
+                    item.case === "systemEvent"
+                        ? { case: "systemEvent", value }
+                        : { case: "domainEvent", value };
+        }
+        return visible === undefined
+            ? undefined
+            : create(AgentHistoryEntrySchema, { ...entry, item: visible });
     },
     /**
      * Returns one typed category from the full Proto history oneof.
@@ -483,6 +567,9 @@ export const repositoryAccess = Object.freeze({
         }
         return schemas;
     },
+    /**
+     * Returns the AI registry configured for this repository, if present.
+     */
     agentConfiguration(repository) {
         const ai = repositoryAiConfigurations.get(repository);
         return ai === undefined ? {} : { ai };
@@ -512,6 +599,9 @@ export const repositoryAccess = Object.freeze({
             ...read,
         }));
     },
+    /**
+     * Reads one tenant-admitted Agent history page through retained history storage.
+     */
     async agentHistoryPage(repository, entityId, request, tenantId) {
         if (repository.entityFamily !== "agent")
             throw new TypeError("Agent history requires an Agent repository.");
@@ -531,7 +621,7 @@ export const repositoryAccess = Object.freeze({
         });
     },
     /**
-     * Computes the opaque cursor scope for a registered Agent history read.
+     * Returns the opaque cursor scope for a registered Agent history read.
      */
     agentHistoryScope(context, input, entityId) {
         return {
@@ -600,19 +690,19 @@ export const repositoryAccess = Object.freeze({
         });
     },
     /**
-     * Looks up the Aggregate or Process Manager inbox replay target.
+     * Looks up the Aggregate or Process Manager Inbox delivery target.
      *
      * @param repository Repository to inspect.
-     * @returns Its replay target, when registered.
+     * @returns Its delivery target, when registered.
      */
     entityInboxTarget(repository) {
         return repositoryEntityInboxTargets.get(repository);
     },
     /**
-     * Looks up the Projection inbox replay target.
+     * Looks up the Projection Inbox delivery target.
      *
      * @param repository Repository to inspect.
-     * @returns Its replay target, when registered.
+     * @returns Its delivery target, when registered.
      */
     projectionInboxTarget(repository) {
         return repositoryProjectionInboxTargets.get(repository);
@@ -977,7 +1067,8 @@ class AggregateExecutionSupport {
         return Object.freeze([produced]);
     }
     /**
-     * Stores Aggregate state and diagnostic and delivery Events in one atomic commit.
+     * Writes Aggregate state, diagnostic history, and produced Events through the configured
+     * commit storage. Atomicity depends on that storage implementation.
      *
      * @param loaded Aggregate and commit storage to update.
      * @param entityId Aggregate identifier.
@@ -1051,7 +1142,7 @@ class AggregateExecutionSupport {
         await loaded.events.append(clone(EventSchema, event));
     }
     /**
-     * Completes persistence before scheduling best-effort stored-Event dispatch.
+     * Completes persistence and one handoff attempt for each produced Event.
      *
      * @param loaded Aggregate and commit storage to update.
      * @param entityId Aggregate identifier.
@@ -1059,14 +1150,14 @@ class AggregateExecutionSupport {
      * @param dispatch Publishes one committed Event.
      * @param onPersisted Runs after durable persistence.
      * @param diagnostics Events to retain in diagnostic history with this commit.
-     * @returns A deferred follow-up that dispatches the Events.
+     * @returns Completion after the Event handoff attempts settle.
      */
     async persistAggregateAndDispatch(loaded, entityId, events, dispatch, onPersisted, diagnostics = events) {
         const committed = await this.persistAggregateUpdate(loaded, entityId, events, diagnostics);
         if (!committed)
-            return () => Promise.resolve();
+            return;
         await onPersisted();
-        return async () => {
+        await withoutDeliveryCommitFence(async () => {
             await Promise.all(events.map(async (event) => {
                 try {
                     await dispatch(event);
@@ -1075,7 +1166,7 @@ class AggregateExecutionSupport {
                     this.#runtime.publisher.reportFailure("event", event, error);
                 }
             }));
-        };
+        });
     }
     /**
      * Restores an Aggregate or creates one with initial state and version zero.
@@ -1135,27 +1226,27 @@ class AggregateCommandExecution {
     /**
      * Validates the Command and executes its assignee when registered.
      *
-     * @param replayedRoute Accepted route from durable inbox replay, when present.
-     * @returns A deferred dispatch follow-up, or `undefined` without an assignee.
+     * @param deliveredRoute Accepted route from durable inbox delivery, when present.
+     * @returns Completion after processing and outgoing handoff attempts.
      */
-    async run(replayedRoute) {
+    async run(deliveredRoute) {
         void RepositorySignals.requireCommandId(this.#command);
-        const intake = await this.#readIntake(replayedRoute);
+        const intake = await this.#readIntake(deliveredRoute);
         if (intake === undefined)
             return undefined;
-        return this.#runAssignee(intake);
+        await this.#runAssignee(intake);
     }
     /**
      * Decodes the Command and selects its registered assignee.
      *
-     * @param replayedRoute Accepted inbox route, when present.
+     * @param deliveredRoute Accepted inbox route, when present.
      * @returns Decoded message and route with an assignee, or `undefined`.
      */
-    async #readIntake(replayedRoute) {
+    async #readIntake(deliveredRoute) {
         const commandMessage = EntityInvocation.requireSignalMessage(this.#command.message, "command");
         const commandSchema = RepositoryRoutes.schemaForTypeUrl(this.#routing.commandSchemas, commandMessage.typeUrl, "command");
         const message = EntityInvocation.unpackRequired(commandMessage, commandSchema, "command");
-        const route = replayedRoute ?? (await this.#repository.routeCommand(this.#command));
+        const route = deliveredRoute ?? (await this.#repository.routeCommand(this.#command));
         const assignee = this.#routing.commandReadiness?.findCommandAssignee(route.messageFullTypeName);
         return assignee === undefined ? undefined : Object.freeze({ message, route, assignee });
     }
@@ -1163,33 +1254,34 @@ class AggregateCommandExecution {
      * Invokes the assignee, persists its Events, or publishes a declared rejection.
      *
      * @param intake Decoded Command, target route, and assignee.
-     * @returns A deferred Event follow-up or a rejection follow-up.
+     * @returns Completion after processing and outgoing handoff attempts.
      */
     async #runAssignee(intake) {
         const loaded = await this.#support.loadAggregate(intake.route.entityId);
         this.#publishCommandDispatch(intake.route.entityId);
         let produced;
         try {
-            produced = await this.#invokeAssignee(loaded.entity, intake.assignee.handler, intake.message, EntityInvocation.commandHandlerContext(this.#command));
+            produced = await this.#invokeAssignee(loaded.entity, intake.assignee.handler, intake.message, EntityInvocation.commandHandlerContext(this.#command), this.#command.context?.actorContext);
         }
         catch (error) {
-            return this.#postAssigneeRejection(intake, error);
+            await this.#postAssigneeRejection(intake, error);
+            return undefined;
         }
         const events = this.#bindProducedEvents(this.#support.normalizeProducedSignals(produced), intake.route.entityId, RepositoryEntities.priorVersion(loaded.current));
-        return this.#persistAssigneeResult(loaded, intake.route.entityId, events);
+        await this.#persistAssigneeResult(loaded, intake.route.entityId, events);
     }
     /**
      * Publishes a declared rejection from the invoked Aggregate assignee.
      *
      * @param intake Assignee and target route for the rejected Command.
      * @param error Handler failure to classify and publish.
-     * @returns A rejection follow-up when one is created.
+     * @returns Completion after the rejection Event handoff attempt.
      */
-    #postAssigneeRejection(intake, error) {
+    async #postAssigneeRejection(intake, error) {
         if (!RejectionThrowable.is(error))
             throw error;
         RepositorySignals.requireDeclaredRejection(intake.assignee.handler, error);
-        return RepositorySignals.postRejectionEvent(this.#runtime, this.#repository, this.#command, intake.route.entityId, error);
+        await RepositorySignals.postRejectionEvent(this.#runtime, this.#repository, this.#command, intake.route.entityId, error);
     }
     /**
      * Publishes a best-effort Command dispatch diagnostic.
@@ -1205,11 +1297,11 @@ class AggregateCommandExecution {
      * @param loaded Aggregate and commit storage.
      * @param entityId Target Aggregate identifier.
      * @param events Bound Events from the assignee.
-     * @returns A deferred committed-Event dispatch follow-up.
+     * @returns Completion after committed Event handoff attempts.
      */
-    #persistAssigneeResult(loaded, entityId, events) {
+    async #persistAssigneeResult(loaded, entityId, events) {
         const committedVersion = loaded.version + 1n;
-        return this.#support.persistAggregateAndDispatch(loaded, entityId, events, (event) => this.#runtime.publisher.publishCommittedEvent(event), () => {
+        await this.#support.persistAggregateAndDispatch(loaded, entityId, events, (event) => this.#runtime.publisher.publishCommittedEvent(event), () => {
             if (!RepositoryEntities.repositoryChanged(loaded.entity))
                 return;
             EntityStateChangePublisher.command(this.#runtime, this.#repository, this.#command, entityId, loaded.oldState, loaded.current === undefined
@@ -1227,26 +1319,45 @@ class AggregateCommandExecution {
      * @param handler Assignee declaration to invoke.
      * @param message Decoded Command message.
      * @param context Copied Command context for the handler.
+     * @param actorContext Actor metadata of the Command signal.
      * @returns The handler's raw result after a successful commit.
      */
-    async #invokeAssignee(entity, handler, message, context) {
-        transactionalEntityAccess.start(entity);
+    async #invokeAssignee(entity, handler, message, context, actorContext) {
+        const releaseActor = entityHistoryAccess.bindActor(entity, actorContext);
+        let started = false;
         try {
-            const produced = await EntityInvocation.invokeEntityMethod(entity, handler.methodName, message, handler.parameterCount, context);
-            const signals = this.#support.normalizeProducedSignals(produced);
-            if (signals.length === 0)
-                throw receptionObservation.recordPostHandlerFailure(new Error("Repository aggregate command handlers must return at least one event."));
-            RepositoryHandlers.requireDeclaredOutputs(handler, signals);
-            const commit = await commitFenced(entity, (current) => transactionalEntityAccess.commit(current, true));
-            if (commit.status === "rejected") {
-                throw EntityInvocation.rejectedTransition(commit.validation.error);
-            }
-            return produced;
+            transactionalEntityAccess.start(entity);
+            started = true;
+            return await this.#invokeAndCommitAssignee(entity, handler, message, context);
         }
         catch (error) {
-            transactionalEntityAccess.rollback(entity);
+            if (started)
+                transactionalEntityAccess.rollback(entity);
             throw error;
         }
+        finally {
+            releaseActor();
+        }
+    }
+    /**
+     * Checks a declared Aggregate result and commits its accepted transition.
+     *
+     * @param entity Current Aggregate draft.
+     * @param handler Declared Command handler.
+     * @param message Decoded domain Command.
+     * @param context Detached signal context supplied to the handler.
+     * @returns Raw handler result after commit.
+     */
+    async #invokeAndCommitAssignee(entity, handler, message, context) {
+        const produced = await EntityInvocation.invokeEntityMethod(entity, handler.methodName, message, handler.parameterCount, context);
+        const signals = this.#support.normalizeProducedSignals(produced);
+        if (signals.length === 0)
+            throw receptionObservation.recordPostHandlerFailure(new Error("Repository aggregate command handlers must return at least one event."));
+        RepositoryHandlers.requireDeclaredOutputs(handler, signals);
+        const commit = await commitFenced(entity, (current) => transactionalEntityAccess.commit(current, true));
+        if (commit.status === "rejected")
+            throw EntityInvocation.rejectedTransition(commit.validation.error);
+        return produced;
     }
     /**
      * Binds each produced result to the target and pre-dispatch version.
@@ -1380,10 +1491,9 @@ class AggregateEventExecution {
             await this.#support.appendDiagnosticEvent(loaded, entityId, source);
             return;
         }
-        const dispatch = await this.#support.persistAggregateAndDispatch(loaded, entityId, produced, (event) => this.#runtime.publisher.publishReactorEvent(event), () => {
+        await this.#support.persistAggregateAndDispatch(loaded, entityId, produced, (event) => this.#runtime.publisher.publishReactorEvent(event), () => {
             this.#publishStateChange(loaded, entityId);
         }, [source, ...produced]);
-        void dispatch();
     }
     /**
      * Publishes an Entity state-change System Event when the Aggregate changed.
@@ -1421,16 +1531,23 @@ class AggregateEventExecution {
     async #invokeHandlers(entityId, loaded, intake) {
         const eventContext = EntityInvocation.eventHandlerContext(this.#event);
         const events = [];
-        transactionalEntityAccess.start(loaded.entity);
+        const releaseActor = entityHistoryAccess.bindActor(loaded.entity, this.#runtime.signalMetadata.originFromEvent(this.#event).actorContext);
+        let started = false;
         try {
+            transactionalEntityAccess.start(loaded.entity);
+            started = true;
             await this.#invokeReactors(entityId, loaded, intake, eventContext, events);
             await this.#commitEntity(loaded.entity, events.length > 0);
             return Object.freeze(events);
         }
         catch (error) {
-            transactionalEntityAccess.rollback(loaded.entity);
+            if (started)
+                transactionalEntityAccess.rollback(loaded.entity);
             throw error;
         }
+        finally {
+            releaseActor();
+        }
     }
     /**
      * Invokes each reactor, checks its declared output, and collects bound Events.
@@ -1559,7 +1676,7 @@ class ProjectionEventExecution {
      * Delivers an accepted Event for one Projection target.
      *
      * @param entityId Target Projection identifier.
-     * @param acceptedRoute Route accepted before replay.
+     * @param acceptedRoute Route accepted before deliver.
      * @returns Completion after target delivery.
      */
     async runTarget(entityId, acceptedRoute) {
@@ -1734,20 +1851,26 @@ class ProjectionEventExecution {
      * @returns Completion after the subscriber transaction commits.
      */
     async #invokeSubscribers(entity, subscribers, packedMessage) {
-        transactionalEntityAccess.start(entity);
+        const releaseActor = entityHistoryAccess.bindActor(entity, this.#runtime.signalMetadata.originFromEvent(this.#event).actorContext);
+        let started = false;
         try {
+            transactionalEntityAccess.start(entity);
+            started = true;
             for (const subscriber of subscribers) {
                 await this.#invokeSubscriber(entity, subscriber, packedMessage);
             }
             const commit = await commitFenced(entity, (current) => transactionalEntityAccess.commit(current));
-            if (commit.status === "rejected") {
+            if (commit.status === "rejected")
                 throw EntityInvocation.rejectedTransition(commit.validation.error);
-            }
         }
         catch (error) {
-            transactionalEntityAccess.rollback(entity);
+            if (started)
+                transactionalEntityAccess.rollback(entity);
             throw error;
         }
+        finally {
+            releaseActor();
+        }
     }
     /**
      * Invokes one Event subscriber and checks its raw return value.
@@ -1773,22 +1896,40 @@ class ProjectionEventExecution {
      * @returns Completion after the subscriber transaction commits.
      */
     async #invokeStateSubscribers(entity, subscribers, state) {
-        transactionalEntityAccess.start(entity);
+        const releaseActor = entityHistoryAccess.bindActor(entity, this.#runtime.signalMetadata.originFromEvent(this.#event).actorContext);
+        let started = false;
         try {
-            for (const subscriber of subscribers) {
-                const context = EntityInvocation.eventHandlerContext(this.#event);
-                const result = await EntityInvocation.invokeEntityMethod(entity, subscriber.handler.methodName, state, subscriber.handler.parameterCount, context);
-                if (result !== undefined)
-                    throw receptionObservation.recordPostHandlerFailure(new Error(`Projection subscriber "${subscriber.handler.methodName}" must not return signals.`));
-            }
+            transactionalEntityAccess.start(entity);
+            started = true;
+            await this.#runStateSubscribers(entity, subscribers, state);
             const commit = await commitFenced(entity, (current) => transactionalEntityAccess.commit(current));
             if (commit.status === "rejected")
                 throw EntityInvocation.rejectedTransition(commit.validation.error);
         }
         catch (error) {
-            transactionalEntityAccess.rollback(entity);
+            if (started)
+                transactionalEntityAccess.rollback(entity);
             throw error;
         }
+        finally {
+            releaseActor();
+        }
+    }
+    /**
+     * Delivers one state update to each declared Projection subscriber.
+     *
+     * @param entity Projection currently in its transaction.
+     * @param subscribers Subscribers selected for the source state.
+     * @param state Decoded source Entity state.
+     * @returns Completion after all subscribers accept the state.
+     */
+    async #runStateSubscribers(entity, subscribers, state) {
+        for (const subscriber of subscribers) {
+            const context = EntityInvocation.eventHandlerContext(this.#event);
+            const result = await EntityInvocation.invokeEntityMethod(entity, subscriber.handler.methodName, state, subscriber.handler.parameterCount, context);
+            if (result !== undefined)
+                throw receptionObservation.recordPostHandlerFailure(new Error(`Projection subscriber "${subscriber.handler.methodName}" must not return signals.`));
+        }
     }
     /**
      * Restores or creates a Projection and binds its storage history.
@@ -1867,7 +2008,11 @@ const ProcessManagerQueries = Object.freeze({
      * @returns Detached Projection state snapshots.
      */
     async load(stand, registeredSchema, plan, destination, query, schema) {
-        const results = await QueryReader.read(stand, registeredSchema, plan, destination, 10_000, query);
+        const results = await QueryReader.read(stand, registeredSchema, plan, destination, 10_000, query, {
+            operation: { kind: "query", query },
+            ...(query.context === undefined ? {} : { actorContext: query.context }),
+            ...(destination === undefined ? {} : { effectiveTenant: destination }),
+        });
         return Object.freeze(results.map((result) => clone(schema, result.state)));
     },
 });
@@ -2503,7 +2648,7 @@ class AgentLiveRunner {
      * @returns The handler bound to current protected history and AI capabilities.
      */
     bind(entity, facade, reads, actor) {
-        const history = AgentHistoryReads.withReadInterceptor(entity, (scope, request, live, maxBytes) => reads.history(scope, request, live, maxBytes));
+        const history = AgentHistoryReads.withReadInterceptor(entity, (scope, request, live, maxBytes, present) => reads.history(scope, request, live, maxBytes, present));
         let query;
         try {
             query = ProcessManagerQueries.bind(entity, this.runtime, actor, this.tenantId, (schema, request, live) => reads.query(schema, request, live));
@@ -2767,27 +2912,29 @@ class ProcessManagerCommandExecution {
     /**
      * Invokes the registered Command handler and commits its results.
      *
-     * @param replayedRoute Accepted route from durable inbox replay, when present.
-     * @returns A deferred Command follow-up, rejection follow-up, or `undefined`.
+     * @param deliveredRoute Accepted route from durable inbox delivery, when present.
+     * @returns Completion after processing and outgoing handoff attempts.
      */
-    async run(replayedRoute) {
+    async run(deliveredRoute) {
         RepositorySignals.requireCommandId(this.#command);
-        const intake = await this.#readIntake(replayedRoute);
+        const intake = await this.#readIntake(deliveredRoute);
         if (intake === undefined)
             return undefined;
         const tenantOptions = RepositoryTenants.commandStandOptions(this.#runtime.context, this.#command);
         const loaded = await this.#support.load(intake.route.entityId, tenantOptions);
         await this.#publishDispatch(loaded, intake.route.entityId);
+        let produced;
         try {
-            const produced = await this.#invoke(loaded.entity, intake.assignee, intake.message, tenantOptions.tenantId);
-            return await this.#commitAndPublish(loaded, tenantOptions, intake, produced);
+            produced = await this.#invoke(loaded.entity, intake.assignee, intake.message, tenantOptions.tenantId);
         }
         catch (error) {
             if (!RejectionThrowable.is(error))
                 throw error;
             RepositorySignals.requireDeclaredRejection(intake.assignee.handler, error);
-            return RepositorySignals.postRejectionEvent(this.#runtime, this.#repository, this.#command, intake.route.entityId, error);
+            await RepositorySignals.postRejectionEvent(this.#runtime, this.#repository, this.#command, intake.route.entityId, error);
+            return undefined;
         }
+        await this.#commitAndPublish(loaded, tenantOptions, intake, produced);
     }
     /**
      * Persists required Agent dispatch history before the handler runs.
@@ -2817,14 +2964,14 @@ class ProcessManagerCommandExecution {
     /**
      * Decodes a registered Command and finds its assignee.
      *
-     * @param replayedRoute Accepted inbox route, when present.
+     * @param deliveredRoute Accepted inbox route, when present.
      * @returns Decoded Command, route, and assignee, or `undefined`.
      */
-    async #readIntake(replayedRoute) {
+    async #readIntake(deliveredRoute) {
         const commandMessage = EntityInvocation.requireSignalMessage(this.#command.message, "command");
         const commandSchema = RepositoryRoutes.schemaForTypeUrl(this.#routing.commandSchemas, commandMessage.typeUrl, "command");
         const message = EntityInvocation.unpackRequired(commandMessage, commandSchema, "command");
-        const route = replayedRoute ?? (await this.#repository.routeCommand(this.#command));
+        const route = deliveredRoute ?? (await this.#repository.routeCommand(this.#command));
         const assignee = this.#routing.commandReadiness?.findCommandAssignee(route.messageFullTypeName);
         return assignee === undefined ? undefined : Object.freeze({ assignee, message, route });
     }
@@ -2835,7 +2982,7 @@ class ProcessManagerCommandExecution {
      * @param tenantOptions Stand tenant selection.
      * @param intake Assignee and target route.
      * @param producedSignals Validated handler results.
-     * @returns Deferred Command publication when Commands were produced.
+     * @returns Completion after produced-signal handoff attempts.
      */
     async #commitAndPublish(loaded, tenantOptions, intake, producedSignals) {
         const commands = this.#commandOutputs(intake.assignee, producedSignals);
@@ -2844,12 +2991,10 @@ class ProcessManagerCommandExecution {
         if (!committed)
             return undefined;
         this.#publishChangedState(loaded, intake.route.entityId);
-        this.#postEvents(events);
-        return commands.length === 0
-            ? undefined
-            : async () => {
-                await this.#postCommands(commands, this.#command);
-            };
+        await withoutDeliveryCommitFence(async () => {
+            await this.#postEvents(events);
+            await this.#postCommands(commands, this.#command);
+        });
     }
     /**
      * Binds substitution results as Commands and requires nonempty output.
@@ -3012,15 +3157,15 @@ class ProcessManagerCommandExecution {
         }
     }
     /**
-     * Schedules publication of produced Events.
+     * Publishes the Process Manager Command's produced Events after its commit.
      *
      * @param events Bound Events to publish.
+     * @returns Completion after each Event handoff attempt.
      */
-    #postEvents(events) {
-        for (const event of events) {
-            // spine-log-boundary: server.repository_event_follow_up
-            void this.#runtime.publisher.publishReactorEvent(event);
-        }
+    async #postEvents(events) {
+        await Promise.all(events.map((event) => {
+            return this.#runtime.publisher.publishReactorEvent(event);
+        }));
     }
 }
 /**
@@ -3060,16 +3205,16 @@ class ProcessManagerEventExecution {
         }
         this.#validateSourceEventIdForFollowUps(intake);
         if (intake.route.entityIds.length === 1) {
-            await InboxHandoff.handoffPmEvent(this.#repository, this.#runtime, this.#event, intake.route.entityIds[0]);
+            await InboxHandoff.handoffEntityEvent(this.#repository, this.#runtime, this.#event, intake.route.entityIds[0]);
             return;
         }
-        await InboxHandoff.handoffPmEvents(this.#repository, this.#runtime, this.#event, intake.route.entityIds);
+        await InboxHandoff.handoffEntityEvents(this.#repository, this.#runtime, this.#event, intake.route.entityIds);
     }
     /**
      * Delivers a routed Event for one target under the duplicate-dispatch guard.
      *
      * @param entityId Target Entity identifier.
-     * @param acceptedRoute Route accepted before replay.
+     * @param acceptedRoute Route accepted before deliver.
      * @returns Completion after guarded target execution.
      */
     async runTarget(entityId, acceptedRoute) {
@@ -3123,8 +3268,10 @@ class ProcessManagerEventExecution {
         if (!committed)
             return;
         this.#publishChangedState(loaded, entityId);
-        this.#postEvents(events);
-        this.#postCommands(commands);
+        await withoutDeliveryCommitFence(async () => {
+            await this.#postEvents(events);
+            await this.#postCommands(commands);
+        });
     }
     /**
      * Publishes a state-change System Event when the Entity changed.
@@ -3170,17 +3317,18 @@ class ProcessManagerEventExecution {
         const commands = [];
         const events = [];
         const releaseQuery = ProcessManagerQueries.bind(entity, this.#runtime, this.#runtime.signalMetadata.originFromEvent(this.#event).actorContext, tenantId);
-        transactionalEntityAccess.start(entity);
+        let started = false;
         try {
+            transactionalEntityAccess.start(entity);
+            started = true;
             await this.#invokeEventHandlers(entityId, entity, intake, eventContext, events, commands);
             await this.#commitEntity(entity, events.length > 0);
-            return Object.freeze({
-                commands: Object.freeze(commands),
-                events: Object.freeze(events),
-            });
+            const emitted = { commands: Object.freeze(commands), events: Object.freeze(events) };
+            return Object.freeze(emitted);
         }
         catch (error) {
-            transactionalEntityAccess.rollback(entity);
+            if (started)
+                transactionalEntityAccess.rollback(entity);
             throw error;
         }
         finally {
@@ -3301,23 +3449,24 @@ class ProcessManagerEventExecution {
      * Publishes each produced Command in handler order.
      *
      * @param commands Bound Commands to publish.
+     * @returns Completion after each Command handoff attempt.
      */
-    #postCommands(commands) {
+    async #postCommands(commands) {
         for (const command of commands) {
             // spine-log-boundary: server.process_manager_command_follow_up
-            void this.#runtime.publisher.publishCommand(command);
+            await this.#runtime.publisher.publishCommand(command);
         }
     }
     /**
-     * Schedules publication of produced Events.
+     * Publishes the Process Manager Event's produced Events after its commit.
      *
      * @param events Bound Events to publish.
+     * @returns Completion after each Event handoff attempt.
      */
-    #postEvents(events) {
-        for (const event of events) {
-            // spine-log-boundary: server.process_manager_event_follow_up
-            void this.#runtime.publisher.publishReactorEvent(event);
-        }
+    async #postEvents(events) {
+        await Promise.all(events.map((event) => {
+            return this.#runtime.publisher.publishReactorEvent(event);
+        }));
     }
 }
 /**
@@ -3758,22 +3907,50 @@ const RepositoryEntities = {
             throw new Error("Agent history storage is required.");
         const lifetime = RepositoryStorage.lifetime(repository);
         const runtime = repositoryRuntimes.get(repository);
-        AgentHistoryReads.bind(entity, {
+        if (runtime === undefined)
+            throw new Error("Agent history requires its active runtime.");
+        AgentHistoryReads.bind(entity, this.agentHistoryBinding(repository, entity, entityId, input, history, runtime, lifetime));
+    },
+    /**
+     * Captures retained Agent history admission and outward filtering in one binding.
+     *
+     * @param repository Repository tracking the active runtime.
+     * @param entity Restored Agent instance.
+     * @param entityId Typed Agent identifier.
+     * @param input Retained storage scope.
+     * @param history Indexed Agent history handle.
+     * @param runtime Current context services.
+     * @param lifetime Repository storage lifetime.
+     * @returns History binding with an invocation-time actor snapshot.
+     */
+    agentHistoryBinding(repository, entity, entityId, input, history, runtime, lifetime) {
+        return {
             storage: history,
             entityId,
             onAdmit: async (onRead) => {
-                if (runtime === undefined || repositoryRuntimes.get(repository) !== runtime)
+                if (repositoryRuntimes.get(repository) !== runtime)
                     throw new Error("Agent history requires its active runtime.");
                 await runtime.onAdmit(input.context.tenantId);
                 return RepositoryStorage.track(repository, onRead, lifetime);
             },
-            scope: {
-                context: input.context.name,
-                tenant: JSON.stringify(input.context.tenantId ?? null),
-                repository: input.sourceType.typeName,
-                entity: input.id.key(entityId),
-            },
-        });
+            captureActor: () => entityHistoryAccess.currentActor(entity),
+            filterPage: (page, view, request, actorContext) => RepositoryAgentReads.visibleHistory(runtime.stand, page, entityId, view, request, input.context.tenantId, actorContext === undefined ? {} : { actorContext }),
+            scope: this.agentHistoryScope(input, entityId),
+        };
+    },
+    /**
+     * Returns the exact retained Agent repository and typed ID for cursor validation.
+     * @param input Captured Agent storage scope.
+     * @param entityId Typed Agent identifier.
+     * @returns Stable scope encoded in history cursors.
+     */
+    agentHistoryScope(input, entityId) {
+        return {
+            context: input.context.name,
+            tenant: JSON.stringify(input.context.tenantId ?? null),
+            repository: input.sourceType.typeName,
+            entity: input.id.key(entityId),
+        };
     },
     /**
      * Restores an Entity from Stand or creates a fresh instance at Version zero.
@@ -3959,18 +4136,18 @@ const RepositorySignals = {
         });
     },
     /**
-     * Builds a rejection Event and returns a best-effort publication follow-up.
+     * Builds a rejection Event and awaits one publication attempt.
      *
      * @param runtime Context signal and publication services.
      * @param repository Repository of the rejected Command.
      * @param command Command rejected by its handler.
      * @param entityId Target Entity identifier.
      * @param rejection Declared handler rejection.
-     * @returns Deferred rejection Event publication.
+     * @returns Completion after the rejection handoff attempt settles.
      */
-    postRejectionEvent(runtime, repository, command, entityId, rejection) {
+    async postRejectionEvent(runtime, repository, command, entityId, rejection) {
         const event = this.rejectionEvent(runtime, repository, command, entityId, rejection);
-        return async () => {
+        await withoutDeliveryCommitFence(async () => {
             try {
                 // spine-log-boundary: server.repository_rejection_follow_up
                 await runtime.publisher.publishRejectionEvent(event);
@@ -3978,7 +4155,7 @@ const RepositorySignals = {
             catch (error) {
                 runtime.publisher.reportFailure("event", event, error);
             }
-        };
+        });
     },
     /**
      * Creates the original declared rejection envelope without publishing it.
@@ -4565,13 +4742,13 @@ const RepositoryTenants = {
         return RepositoryTenants.require(tenantId);
     },
     /**
-     * Validates an Event tenant before Process Manager inbox handoff.
+     * Validates an Event tenant before Entity Inbox handoff.
      *
      * @param context Bounded context storage mode.
-     * @param event Event entering Process Manager delivery.
+     * @param event Event entering Entity Inbox delivery.
      * @returns Validated tenant, or `undefined` for single-tenant contexts.
      */
-    requirePmEventTenant(context, event) {
+    requireEntityEventTenant(context, event) {
         if (!context.multitenant) {
             return undefined;
         }
@@ -6310,7 +6487,7 @@ const RepositoryStorage = {
 };
 Object.freeze(RepositoryStorage);
 /**
- * Internal repository history internals operations.
+ * Provides internal repository history operations.
  */
 const RepositoryHistoryInternals = {
     /**
@@ -6326,30 +6503,89 @@ const RepositoryHistoryInternals = {
     bindEntityHistory(repository, entity, storage, entityId, schema, tenantId) {
         const lifetime = RepositoryStorage.lifetime(repository);
         const runtime = repositoryRuntimes.get(repository);
-        const onAdmit = async () => {
-            if (runtime === undefined || repositoryRuntimes.get(repository) !== runtime)
-                throw new Error("Repository history requires its active runtime.");
-            await runtime.onAdmit(tenantId);
-        };
+        if (runtime === undefined)
+            throw new Error("Repository history requires its active runtime.");
+        const onAdmit = () => this.admitHistory(repository, runtime, tenantId);
         const { stateCache, eventCache } = this.boundHistoryCaches(storage, entityId, schema);
         entityStateHistoryCaches.set(entity, stateCache);
         entityHistoryAccess.bind(entity, {
-            stateAt: async (time) => {
-                await onAdmit();
-                return this.readBoundStateAt(repository, lifetime, storage, entityId, time);
-            },
-            states: async (depth) => {
-                await onAdmit();
-                return this.readBoundStates(repository, lifetime, schema, stateCache, depth);
-            },
-            events: async (depth) => {
-                await onAdmit();
-                return this.readBoundEvents(repository, lifetime, eventCache, depth);
-            },
+            ...this.historyReaders({
+                repository,
+                lifetime,
+                stand: runtime.stand,
+                storage,
+                schema,
+                entityId,
+                tenantId,
+                entity,
+                onAdmit,
+                stateCache,
+                eventCache,
+            }),
             stateMaintenance: this.boundStateMaintenance(repository, lifetime, storage.states, onAdmit),
             eventMaintenance: this.boundEventMaintenance(repository, lifetime, storage.events, onAdmit),
         });
     },
+    /**
+     * Admits retained history provider work only while repository membership remains current.
+     *
+     * @param repository Repository whose runtime must remain current.
+     * @param runtime Captured context runtime.
+     * @param tenantId Bound tenant when multitenant.
+     * @returns Completion after membership admission.
+     */
+    async admitHistory(repository, runtime, tenantId) {
+        if (repositoryRuntimes.get(repository) !== runtime)
+            throw new Error("Repository history requires its active runtime.");
+        await runtime.onAdmit(tenantId);
+    },
+    /**
+     * Captures each protected history call's actor and request before admission awaits.
+     *
+     * @param scope Bound repository, caches, and admission work.
+     * @returns State and Event read callbacks for the Entity.
+     */
+    historyReaders(scope) {
+        return {
+            stateAt: (time) => this.historyStateAt(scope, time),
+            states: (depth) => this.historyStates(scope, depth),
+            events: (depth) => this.historyEvents(scope, depth),
+        };
+    },
+    /**
+     * Captures an Entity's state-at request and actor before membership awaits.
+     * @param scope Bound history resources.
+     * @param time Caller-selected historical time.
+     * @returns Historical state, if retained and visible.
+     */
+    async historyStateAt(scope, time) {
+        const actor = entityHistoryAccess.currentActor(scope.entity);
+        const captured = clone(TimestampSchema, time);
+        await scope.onAdmit();
+        return this.readBoundStateAt(scope.repository, scope.lifetime, scope.stand, scope.storage, scope.schema, scope.entityId, captured, scope.tenantId, actor);
+    },
+    /**
+     * Captures an Entity state-history depth and actor before membership awaits.
+     * @param scope Bound history resources.
+     * @param depth Number of prior states requested.
+     * @returns Visible historical states in retained order.
+     */
+    async historyStates(scope, depth) {
+        const actor = entityHistoryAccess.currentActor(scope.entity);
+        await scope.onAdmit();
+        return this.readBoundStates(scope.repository, scope.lifetime, scope.stand, scope.schema, scope.stateCache, scope.entityId, depth, scope.tenantId, actor);
+    },
+    /**
+     * Captures an Entity Event-history depth and actor before membership awaits.
+     * @param scope Bound history resources.
+     * @param depth Number of prior Events requested.
+     * @returns Visible retained Event envelopes.
+     */
+    async historyEvents(scope, depth) {
+        const actor = entityHistoryAccess.currentActor(scope.entity);
+        await scope.onAdmit();
+        return this.readBoundEvents(scope.repository, scope.lifetime, scope.stand, scope.eventCache, scope.entityId, depth, scope.tenantId, actor);
+    },
     /**
      * Creates state and Event caches over retained history ports.
      *
@@ -6406,38 +6642,86 @@ const RepositoryHistoryInternals = {
      *
      * @param repository Registered repository.
      * @param lifetime Captured repository storage lifetime.
+     * @param stand Producing context's outward read policy.
      * @param storage Retained Entity read port.
+     * @param schema Historical state schema.
      * @param entityId Captured Entity identifier.
      * @param time Historical instant.
+     * @param tenantId Effective tenant of the bound Entity.
+     * @param actorContext Actor metadata of an active handler, when present.
      * @returns Historical state, if present.
      */
-    readBoundStateAt(repository, lifetime, storage, entityId, time) {
-        return RepositoryStorage.track(repository, async () => this.cloneHistoryState(await storage.states.stateAt(entityId, time)), lifetime);
+    readBoundStateAt(repository, lifetime, stand, storage, schema, entityId, time, tenantId, actorContext) {
+        return RepositoryStorage.track(repository, async () => {
+            const state = this.cloneHistoryState(await storage.states.stateAt(entityId, time));
+            if (state === undefined)
+                return undefined;
+            const visible = await standAccess.filterState(stand, schema, state, {
+                operation: { kind: "history", history: { source: "entity-state-at", entityId, time } },
+                ...(tenantId === undefined ? {} : { effectiveTenant: tenantId }),
+                ...(actorContext === undefined ? {} : { actorContext }),
+            });
+            return visible ?? undefined;
+        }, lifetime);
     },
     /**
      * Reads a complete bound state-history page within repository admission.
      *
      * @param repository Registered repository.
      * @param lifetime Captured repository storage lifetime.
+     * @param stand Producing context's outward read policy.
      * @param schema State schema used to unpack rows.
      * @param cache Bound state-history cache.
+     * @param entityId Captured Entity identifier.
      * @param depth Requested history depth.
+     * @param tenantId Effective tenant of the bound Entity.
+     * @param actorContext Actor metadata of an active handler, when present.
      * @returns Frozen historical states.
      */
-    readBoundStates(repository, lifetime, schema, cache, depth) {
-        return RepositoryStorage.track(repository, async () => this.freezeHistoryStates((await cache.read(depth)).map((record) => EntityRecords.unpack(schema, record).state)), lifetime);
+    readBoundStates(repository, lifetime, stand, schema, cache, entityId, depth, tenantId, actorContext) {
+        return RepositoryStorage.track(repository, async () => {
+            const states = this.freezeHistoryStates((await cache.read(depth)).map((record) => EntityRecords.unpack(schema, record).state));
+            const visible = [];
+            for (const state of states) {
+                const next = await standAccess.filterState(stand, schema, state, {
+                    operation: { kind: "history", history: { source: "entity-states", entityId, depth } },
+                    ...(tenantId === undefined ? {} : { effectiveTenant: tenantId }),
+                    ...(actorContext === undefined ? {} : { actorContext }),
+                });
+                if (next !== null)
+                    visible.push(Object.freeze(next));
+            }
+            return Object.freeze(visible);
+        }, lifetime);
     },
     /**
      * Reads a complete bound Event-history page within repository admission.
      *
      * @param repository Registered repository.
      * @param lifetime Captured repository storage lifetime.
+     * @param stand Producing context's outward read policy.
      * @param cache Bound Event-history cache.
+     * @param entityId Captured Entity identifier.
      * @param depth Requested history depth.
+     * @param tenantId Effective tenant of the bound Entity.
+     * @param actorContext Actor metadata of an active handler, when present.
      * @returns Frozen historical Events.
      */
-    readBoundEvents(repository, lifetime, cache, depth) {
-        return RepositoryStorage.track(repository, async () => this.freezeHistoryEvents(await cache.read(depth)), lifetime);
+    readBoundEvents(repository, lifetime, stand, cache, entityId, depth, tenantId, actorContext) {
+        return RepositoryStorage.track(repository, async () => {
+            const events = this.freezeHistoryEvents(await cache.read(depth));
+            const visible = [];
+            for (const event of events) {
+                const next = await standAccess.filterEvent(stand, event, {
+                    operation: { kind: "history", history: { source: "entity-events", entityId, depth } },
+                    ...(tenantId === undefined ? {} : { effectiveTenant: tenantId }),
+                    ...(actorContext === undefined ? {} : { actorContext }),
+                });
+                if (next !== null)
+                    visible.push(Object.freeze(next));
+            }
+            return Object.freeze(visible);
+        }, lifetime);
     },
     /**
      * Creates a history cache that serializes reads and extends prior results.
@@ -6974,7 +7258,7 @@ const InboxMessages = {
             }
         }
         if (entityId === undefined) {
-            throw new Error("Entity Inbox replay stored target ID is incompatible with the repository.");
+            throw new Error("Entity Inbox delivery stored target ID is incompatible with the repository.");
         }
         return RepositoryRoutes.readRouteId(entityId, idField, "command");
     },
@@ -6986,7 +7270,7 @@ const InboxMessages = {
      */
     readInboxCommand(message) {
         if (message.label !== "HANDLE_COMMAND") {
-            throw new Error(`Entity Inbox replay does not handle "${message.label}" messages.`);
+            throw new Error(`Entity Inbox delivery does not handle "${message.label}" messages.`);
         }
         const command = message.signal === undefined ? undefined : AnyPacker.tryUnpack(message.signal, CommandSchema);
         if (command === undefined) {
@@ -6995,13 +7279,13 @@ const InboxMessages = {
         return command;
     },
     /**
-     * Reads an Event labeled for a Process Manager reaction.
+     * Reads an Event labeled for an Entity reaction.
      *
      * @param message Stored Inbox message to validate and unpack.
      * @returns The stored Event envelope.
      */
-    readPmInboxEvent(message) {
-        return InboxMessages.readStoredEvent(message, "REACT_UPON_EVENT", "Entity Inbox replay", "Entity Inbox replay requires a readable stored event.");
+    readEntityInboxEvent(message) {
+        return InboxMessages.readStoredEvent(message, "REACT_UPON_EVENT", "Entity Inbox delivery", "Entity Inbox delivery requires a readable stored event.");
     },
     /**
      * Reads an Event labeled for a Projection update.
@@ -7010,20 +7294,20 @@ const InboxMessages = {
      * @returns The stored Event envelope.
      */
     readProjectionInboxEvent(message) {
-        return InboxMessages.readStoredEvent(message, "UPDATE_SUBSCRIBER", "Projection inbox replay", "Projection inbox replay requires a readable stored event.");
+        return InboxMessages.readStoredEvent(message, "UPDATE_SUBSCRIBER", "Projection inbox delivery", "Projection inbox delivery requires a readable stored event.");
     },
     /**
      * Validates an Inbox operation label and decodes its stored Event bytes.
      *
      * @param message Stored Inbox message to inspect.
      * @param expectedLabel Operation label required by the caller.
-     * @param replayName Human-readable operation name used in label errors.
+     * @param deliverName Human-readable operation name used in label errors.
      * @param unreadableMessage Error text used when Event decoding fails.
      * @returns The stored Event envelope.
      */
-    readStoredEvent(message, expectedLabel, replayName, unreadableMessage) {
+    readStoredEvent(message, expectedLabel, deliverName, unreadableMessage) {
         if (message.label !== expectedLabel) {
-            throw new Error(`${replayName} does not handle "${message.label}" messages.`);
+            throw new Error(`${deliverName} does not handle "${message.label}" messages.`);
         }
         const signal = message.signal === undefined
             ? undefined
@@ -7042,7 +7326,7 @@ Object.freeze(InboxMessages);
 /**
  * Validates and dispatches stored Inbox signals to their recorded Entity targets.
  */
-const InboxReplay = {
+const InboxDelivery = {
     /**
      * Dispatches a stored Aggregate Command after checking its tenant and payload.
      *
@@ -7050,44 +7334,66 @@ const InboxReplay = {
      * @param routing Registered handlers and message schemas.
      * @param message Stored Inbox message with the recorded target.
      * @param deliveryTenantId Tenant selected by delivery in a multitenant context.
-     * @returns Any follow-up work that must wait for Inbox completion.
+     * @returns Completion after processing and outgoing handoff attempts.
      */
-    async replayAggregateCommand(repository, routing, message, deliveryTenantId) {
+    async deliverAggregateCommand(repository, routing, message, deliveryTenantId) {
         const runtime = repositoryRuntimes.get(repository);
         if (runtime === undefined) {
-            throw new Error("Aggregate inbox replay requires a bound repository runtime.");
+            throw new Error("Aggregate inbox delivery requires a bound repository runtime.");
         }
         if (message.label !== "HANDLE_COMMAND") {
-            throw new Error(`Aggregate inbox replay does not handle "${message.label}" messages.`);
+            throw new Error(`Aggregate inbox delivery does not handle "${message.label}" messages.`);
         }
         const command = InboxMessages.readInboxCommand(message);
-        InboxReplay.validateReplayTenant(runtime.context, deliveryTenantId, command);
-        InboxReplay.validateReplayedCommandPayload(routing, command);
-        const route = InboxReplay.replayCommandRoute(repository, routing, message, command);
-        return await new AggregateCommandExecution(repository, routing, runtime, command).run(route);
+        InboxDelivery.validateDeliveryTenant(runtime.context, deliveryTenantId, command);
+        InboxDelivery.validateDeliveredCommandPayload(routing, command);
+        const route = InboxDelivery.deliverCommandRoute(repository, routing, message, command);
+        await new AggregateCommandExecution(repository, routing, runtime, command).run(route);
     },
     /**
-     * Routes Process Manager Command or Event replay by its stored operation label.
+     * Delivers a stored Event to the recorded Aggregate target.
+     *
+     * @param repository Aggregate repository receiving the Event.
+     * @param routing Registered Event handlers and message schemas.
+     * @param message Stored Inbox row with the recorded target.
+     * @param deliveryTenantId Tenant selected by delivery in a multitenant context.
+     * @returns Completion after the guarded reactor and outgoing handoff attempts.
+     */
+    async deliverAggregateEvent(repository, routing, message, deliveryTenantId) {
+        const runtime = repositoryRuntimes.get(repository);
+        if (runtime === undefined) {
+            throw new Error("Aggregate inbox delivery requires a bound repository runtime.");
+        }
+        const event = InboxMessages.readEntityInboxEvent(message);
+        InboxDelivery.validateEventTenant(runtime.context, deliveryTenantId, event);
+        InboxDelivery.validateDeliveredEventPayload(routing, event, "Aggregate inbox delivery requires a readable event payload.");
+        const route = InboxDelivery.deliverEventRoute(repository, routing, message, event, "Aggregate inbox delivery");
+        const [entityId] = route.entityIds;
+        await DispatchGuards.guardedEntityEventDispatch(repository, runtime, event, entityId, () => new AggregateEventExecution(repository, routing, runtime, event).runTarget(entityId, route));
+    },
+    /**
+     * Routes Process Manager Command or Event deliver by its stored operation label.
      *
      * @param repository Process Manager repository receiving the signal.
      * @param routing Registered handlers and message schemas.
      * @param message Stored Inbox message with the recorded target.
      * @param deliveryTenantId Tenant selected by delivery in a multitenant context.
-     * @returns Any Command follow-up work that must wait for Inbox completion.
+     * @returns Completion after processing and outgoing handoff attempts.
      */
-    async replayPmInbox(repository, routing, message, deliveryTenantId) {
+    async deliverPmInbox(repository, routing, message, deliveryTenantId) {
         if (repository.entityFamily === "agent") {
-            await InboxReplay.replayAgentInbox(repository, routing, message, deliveryTenantId);
+            await InboxDelivery.deliverAgentInbox(repository, routing, message, deliveryTenantId);
             return undefined;
         }
         if (message.label === "HANDLE_COMMAND") {
-            return await InboxReplay.replayProcessManagerCommand(repository, routing, message, deliveryTenantId);
+            await InboxDelivery.deliverProcessManagerCommand(repository, routing, message, deliveryTenantId);
+            return;
         }
         if (message.label === "REACT_UPON_EVENT") {
-            await InboxReplay.replayProcessManagerEvent(repository, routing, message, deliveryTenantId);
+            await InboxDelivery.deliverProcessManagerEvent(repository, routing, message, deliveryTenantId);
             return undefined;
         }
-        throw new Error(`Entity Inbox replay does not handle "${message.label}" messages.`);
+        throw new Error(`Entity Inbox delivery does not handle "${message.label}" messages.`);
     },
     /**
      * Persists selected Agent work before the normal Inbox acknowledges delivery.
@@ -7098,17 +7404,17 @@ const InboxReplay = {
      * @param deliveryTenantId Tenant selected by delivery.
      * @returns When the fenced repository operation completes.
      */
-    async replayAgentInbox(repository, routing, message, deliveryTenantId) {
+    async deliverAgentInbox(repository, routing, message, deliveryTenantId) {
         const runtime = repositoryRuntimes.get(repository);
         if (runtime === undefined)
-            throw new Error("Agent Inbox replay requires a bound runtime.");
+            throw new Error("Agent Inbox delivery requires a bound runtime.");
         if (message.label === "HANDLE_COMMAND") {
-            await InboxReplay.replayAgentCommand(repository, routing, runtime, message, deliveryTenantId);
+            await InboxDelivery.deliverAgentCommand(repository, routing, runtime, message, deliveryTenantId);
             return;
         }
         if (message.label !== "REACT_UPON_EVENT")
-            throw new Error(`Agent Inbox replay does not handle "${message.label}" messages.`);
-        await InboxReplay.replayAgentEvent(repository, routing, runtime, message, deliveryTenantId);
+            throw new Error(`Agent Inbox delivery does not handle "${message.label}" messages.`);
+        await InboxDelivery.deliverAgentEvent(repository, routing, runtime, message, deliveryTenantId);
     },
     /**
      * Admits a Command using its stored target and registered assignee.
@@ -7120,15 +7426,15 @@ const InboxReplay = {
      * @param tenantId Delivery tenant.
      * @returns When the fenced repository operation completes.
      */
-    async replayAgentCommand(repository, routing, runtime, message, tenantId) {
+    async deliverAgentCommand(repository, routing, runtime, message, tenantId) {
         const command = InboxMessages.readInboxCommand(message);
-        InboxReplay.validateReplayTenant(runtime.context, tenantId, command);
-        InboxReplay.validateReplayedCommandPayload(routing, command);
-        const route = InboxReplay.replayCommandRoute(repository, routing, message, command);
+        InboxDelivery.validateDeliveryTenant(runtime.context, tenantId, command);
+        InboxDelivery.validateDeliveredCommandPayload(routing, command);
+        const route = InboxDelivery.deliverCommandRoute(repository, routing, message, command);
         const assignee = routing.commandReadiness?.findCommandAssignee(route.messageFullTypeName);
         if (assignee === undefined)
             throw new Error("Agent Command has no selected assignee.");
-        await InboxReplay.admitAgent(repository, runtime, message, tenantId, route.entityId, { case: "command", value: command }, [assignee.registeredHandler]);
+        await InboxDelivery.admitAgent(repository, runtime, message, tenantId, route.entityId, { case: "command", value: command }, [assignee.registeredHandler]);
     },
     /**
      * Admits matching Event handlers from the stored target without rerouting.
@@ -7140,15 +7446,15 @@ const InboxReplay = {
      * @param tenantId Delivery tenant.
      * @returns When the fenced repository operation completes.
      */
-    async replayAgentEvent(repository, routing, runtime, message, tenantId) {
-        const event = InboxMessages.readPmInboxEvent(message);
-        InboxReplay.validatePmReplayTenant(runtime.context, tenantId, event);
-        InboxReplay.validateReplayedEventPayload(routing, event, "Agent Inbox replay requires an Event payload.");
-        const route = InboxReplay.replayEventRoute(repository, routing, message, event, "Agent Inbox replay");
-        const handlers = InboxReplay.agentEventHandlers(routing, route.messageFullTypeName, event);
+    async deliverAgentEvent(repository, routing, runtime, message, tenantId) {
+        const event = InboxMessages.readEntityInboxEvent(message);
+        InboxDelivery.validateEventTenant(runtime.context, tenantId, event);
+        InboxDelivery.validateDeliveredEventPayload(routing, event, "Agent Inbox delivery requires an Event payload.");
+        const route = InboxDelivery.deliverEventRoute(repository, routing, message, event, "Agent Inbox delivery");
+        const handlers = InboxDelivery.agentEventHandlers(routing, route.messageFullTypeName, event);
         if (handlers.length === 0)
             return;
-        await InboxReplay.admitAgent(repository, runtime, message, tenantId, route.entityIds[0], { case: "event", value: event }, handlers);
+        await InboxDelivery.admitAgent(repository, runtime, message, tenantId, route.entityIds[0], { case: "event", value: event }, handlers);
     },
     /**
      * Restores selected Event and Command reactions from the original payload.
@@ -7187,14 +7493,14 @@ const InboxReplay = {
         if (deliverySignal === undefined)
             throw new Error("Agent admission requires delivery scope.");
         const cancellation = AbortSignal.any([deliverySignal, runtime.agentSignal]);
-        const key = InboxReplay.capacityKeyFor(repository, input.context, input.id.key(entityId));
+        const key = InboxDelivery.capacityKeyFor(repository, input.context, input.id.key(entityId));
         const reservation = runtime.reserveAgent(key, cancellation);
         if (reservation === undefined) {
             runtime.deferAgent(message, tenantId);
             AgentDeliveryScope.record({ kind: "deferred" });
             return;
         }
-        await InboxReplay.admitReservedAgent({
+        await InboxDelivery.admitReservedAgent({
             repository,
             runtime,
             context: input.context,
@@ -7236,13 +7542,13 @@ const InboxReplay = {
     async admitReservedAgent(input) {
         const { repository, runtime, context, message, signal, reservation } = input;
         try {
-            const accepted = await InboxReplay.acceptAgentReceipt(runtime, context, repository, message, signal);
+            const accepted = await InboxDelivery.acceptAgentReceipt(runtime, context, repository, message, signal);
             if (!accepted) {
                 reservation.release();
                 AgentDeliveryScope.record({ kind: "duplicate" });
                 return;
             }
-            InboxReplay.recordAcceptedAgent(input);
+            InboxDelivery.recordAcceptedAgent(input);
         }
         catch (error) {
             reservation.release();
@@ -7267,7 +7573,7 @@ const InboxReplay = {
             },
             run: (fence, checkSession) => {
                 const cancellation = AbortSignal.any([fence, runtime.agentSignal]);
-                const checkAgentSession = InboxReplay.agentSessionGuard(cancellation, checkSession);
+                const checkAgentSession = InboxDelivery.agentSessionGuard(cancellation, checkSession);
                 return reservation.run(() => withDeliveryCommitFence(checkAgentSession, () => new AgentLiveRunner(repository, runtime, tenantId, entityId, invocation, handlers, cancellation, checkAgentSession).run()));
             },
         });
@@ -7296,8 +7602,8 @@ const InboxReplay = {
      */
     acceptAgentReceipt(runtime, context, repository, message, signal) {
         const source = signal.case === "command"
-            ? { kind: "command", id: InboxReplay.requireAgentCommandId(signal.value) }
-            : { kind: "event", id: InboxReplay.requireAgentEventId(signal.value) };
+            ? { kind: "command", id: InboxDelivery.requireAgentCommandId(signal.value) }
+            : { kind: "event", id: InboxDelivery.requireAgentEventId(signal.value) };
         return runtime.agentReceipts.accept(context, {
             stateType: repository.stateSchema.typeName,
             recipientId: message.inboxId.targetId,
@@ -7332,18 +7638,18 @@ const InboxReplay = {
      * @param routing Registered handlers and message schemas.
      * @param message Stored Inbox message with the recorded target.
      * @param deliveryTenantId Tenant selected by delivery in a multitenant context.
-     * @returns Any follow-up work that must wait for Inbox completion.
+     * @returns Completion after processing and outgoing handoff attempts.
      */
-    async replayProcessManagerCommand(repository, routing, message, deliveryTenantId) {
+    async deliverProcessManagerCommand(repository, routing, message, deliveryTenantId) {
         const runtime = repositoryRuntimes.get(repository);
         if (runtime === undefined) {
-            throw new Error("Entity Inbox replay requires a bound repository runtime.");
+            throw new Error("Entity Inbox delivery requires a bound repository runtime.");
         }
         const command = InboxMessages.readInboxCommand(message);
-        InboxReplay.validateReplayTenant(runtime.context, deliveryTenantId, command);
-        InboxReplay.validateReplayedCommandPayload(routing, command);
-        const route = InboxReplay.replayCommandRoute(repository, routing, message, command);
-        return await new ProcessManagerCommandExecution(repository, routing, runtime, command).run(route);
+        InboxDelivery.validateDeliveryTenant(runtime.context, deliveryTenantId, command);
+        InboxDelivery.validateDeliveredCommandPayload(routing, command);
+        const route = InboxDelivery.deliverCommandRoute(repository, routing, message, command);
+        await new ProcessManagerCommandExecution(repository, routing, runtime, command).run(route);
     },
     /**
      * Dispatches a validated Event to the Process Manager target recorded in its Inbox.
@@ -7354,15 +7660,15 @@ const InboxReplay = {
      * @param deliveryTenantId Tenant selected by delivery in a multitenant context.
      * @returns Completion of dispatch to the recorded target.
      */
-    async replayProcessManagerEvent(repository, routing, message, deliveryTenantId) {
+    async deliverProcessManagerEvent(repository, routing, message, deliveryTenantId) {
         const runtime = repositoryRuntimes.get(repository);
         if (runtime === undefined) {
-            throw new Error("Entity Inbox replay requires a bound repository runtime.");
+            throw new Error("Entity Inbox delivery requires a bound repository runtime.");
         }
-        const event = InboxMessages.readPmInboxEvent(message);
-        InboxReplay.validatePmReplayTenant(runtime.context, deliveryTenantId, event);
-        InboxReplay.validateReplayedEventPayload(routing, event, "Entity Inbox replay requires a readable event payload.");
-        const route = InboxReplay.replayEventRoute(repository, routing, message, event, "Entity Inbox replay");
+        const event = InboxMessages.readEntityInboxEvent(message);
+        InboxDelivery.validateEventTenant(runtime.context, deliveryTenantId, event);
+        InboxDelivery.validateDeliveredEventPayload(routing, event, "Entity Inbox delivery requires a readable event payload.");
+        const route = InboxDelivery.deliverEventRoute(repository, routing, message, event, "Entity Inbox delivery");
         const [entityId] = route.entityIds;
         await new ProcessManagerEventExecution(repository, routing, runtime, event).runTarget(entityId, route);
     },
@@ -7375,34 +7681,34 @@ const InboxReplay = {
      * @param deliveryTenantId Tenant selected by delivery in a multitenant context.
      * @returns Completion of dispatch to the recorded target.
      */
-    async replayProjectionEvent(repository, routing, message, deliveryTenantId) {
+    async deliverProjectionEvent(repository, routing, message, deliveryTenantId) {
         const runtime = repositoryRuntimes.get(repository);
         if (runtime === undefined) {
-            throw new Error("Projection inbox replay requires a bound repository runtime.");
+            throw new Error("Projection inbox delivery requires a bound repository runtime.");
         }
         const event = InboxMessages.readProjectionInboxEvent(message);
-        InboxReplay.validateProjectionReplayTenant(runtime.context, deliveryTenantId, event);
-        InboxReplay.validateReplayedEventPayload(routing, event);
-        const route = InboxReplay.replayEventRoute(repository, routing, message, event, "Projection inbox replay");
+        InboxDelivery.validateProjectionDeliveryTenant(runtime.context, deliveryTenantId, event);
+        InboxDelivery.validateDeliveredEventPayload(routing, event);
+        const route = InboxDelivery.deliverEventRoute(repository, routing, message, event, "Projection inbox delivery");
         const [entityId] = route.entityIds;
         await new ProjectionEventExecution(repository, routing, runtime, event).runTarget(entityId, route);
     },
     /**
-     * Routes a Projection Inbox message to domain Event or Entity-state update replay.
+     * Routes a Projection Inbox message to domain Event or Entity-state update deliver.
      *
      * @param repository Projection repository receiving the update.
      * @param routing Registered subscribers and message schemas.
      * @param message Stored Projection Inbox message.
      * @param deliveryTenantId Tenant selected by delivery in a multitenant context.
-     * @returns Completion of the selected replay operation.
+     * @returns Completion of the selected deliver operation.
      */
-    async replayProjectionMessage(repository, routing, message, deliveryTenantId) {
+    async deliverProjectionMessage(repository, routing, message, deliveryTenantId) {
         const event = InboxMessages.readProjectionInboxEvent(message);
         if (event.message?.typeUrl === TypeUrls.derive(EntityLog.EntityStateChangedSchema)) {
-            await InboxReplay.replayProjectionStateUpdate(repository, routing, message, event, deliveryTenantId);
+            await InboxDelivery.deliverProjectionStateUpdate(repository, routing, message, event, deliveryTenantId);
             return;
         }
-        await InboxReplay.replayProjectionEvent(repository, routing, message, deliveryTenantId);
+        await InboxDelivery.deliverProjectionEvent(repository, routing, message, deliveryTenantId);
     },
     /**
      * Dispatches an Entity-state update to the Projection target recorded in its Inbox.
@@ -7414,12 +7720,12 @@ const InboxReplay = {
      * @param deliveryTenantId Tenant selected by delivery in a multitenant context.
      * @returns Completion of state-subscriber dispatch to the recorded target.
      */
-    async replayProjectionStateUpdate(repository, routing, message, event, deliveryTenantId) {
+    async deliverProjectionStateUpdate(repository, routing, message, event, deliveryTenantId) {
         const runtime = repositoryRuntimes.get(repository);
         if (runtime === undefined)
-            throw new Error("Projection inbox replay requires a bound repository runtime.");
-        InboxReplay.validateProjectionReplayTenant(runtime.context, deliveryTenantId, event);
-        const route = InboxReplay.replayStateUpdateRoute(repository, routing, message, event);
+            throw new Error("Projection inbox delivery requires a bound repository runtime.");
+        InboxDelivery.validateProjectionDeliveryTenant(runtime.context, deliveryTenantId, event);
+        const route = InboxDelivery.deliverStateUpdateRoute(repository, routing, message, event);
         const [entityId] = route.entityIds;
         const subscribers = route.subscribers;
         await ProjectionEventExecution.runStateTarget(repository, routing, runtime, event, entityId, route, subscribers);
@@ -7428,9 +7734,9 @@ const InboxReplay = {
      * Validates a stored Command against its schema and implicit identifier requirements.
      *
      * @param routing Registered Command schemas.
-     * @param command Envelope whose payload must remain valid on replay.
+     * @param command Envelope whose payload must remain valid on deliver.
      */
-    validateReplayedCommandPayload(routing, command) {
+    validateDeliveredCommandPayload(routing, command) {
         const commandMessage = EntityInvocation.requireSignalMessage(command.message, "command");
         const commandSchema = RepositoryRoutes.schemaForTypeUrl(routing.commandSchemas, commandMessage.typeUrl, "command");
         const payload = AnyPacker.tryUnpack(commandMessage, commandSchema);
@@ -7455,10 +7761,10 @@ const InboxReplay = {
      * Unpacks and validates a stored Event against its registered schema.
      *
      * @param routing Registered Event schemas.
-     * @param event Envelope whose payload must remain valid on replay.
+     * @param event Envelope whose payload must remain valid on deliver.
      * @param invalidPayloadMessage Error text used when the payload cannot be unpacked.
      */
-    validateReplayedEventPayload(routing, event, invalidPayloadMessage = "Projection inbox replay requires a readable event payload.") {
+    validateDeliveredEventPayload(routing, event, invalidPayloadMessage = "Projection inbox delivery requires a readable event payload.") {
         const eventMessage = EntityInvocation.requireSignalMessage(event.message, "event");
         const eventSchema = RepositoryRoutes.schemaForTypeUrl(routing.eventSchemas, eventMessage.typeUrl, "event");
         const payload = AnyPacker.tryUnpack(eventMessage, eventSchema);
@@ -7468,69 +7774,69 @@ const InboxReplay = {
         Validate.check(eventSchema, payload);
     },
     /**
-     * Checks that a replayed Command's tenant matches its delivery tenant.
+     * Checks that a delivered Command's tenant matches its delivery tenant.
      *
      * @param context Context name and tenant mode; single-tenant contexts need no check.
      * @param deliveryTenantId Tenant selected by Inbox delivery.
      * @param command Stored Command containing the original actor context.
      */
-    validateReplayTenant(context, deliveryTenantId, command) {
+    validateDeliveryTenant(context, deliveryTenantId, command) {
         if (!context.multitenant) {
             return;
         }
         if (deliveryTenantId === undefined) {
-            throw new Error(`Multitenant Entity Inbox replay for "${context.name}" requires tenantId.`);
+            throw new Error(`Multitenant Entity Inbox delivery for "${context.name}" requires tenantId.`);
         }
         const envelopeTenantId = RepositoryTenants.readCommandTenant(command);
         if (envelopeTenantId === undefined) {
-            throw new Error("Entity Inbox replay requires stored command tenant metadata.");
+            throw new Error("Entity Inbox delivery requires stored command tenant metadata.");
         }
         if (!RepositoryTenants.equal(envelopeTenantId, deliveryTenantId)) {
-            throw new Error("Entity Inbox replay stored command tenant does not match.");
+            throw new Error("Entity Inbox delivery stored command tenant does not match.");
         }
     },
     /**
-     * Checks that a replayed Projection Event's tenant matches its delivery tenant.
+     * Checks that a delivered Projection Event's tenant matches its delivery tenant.
      *
      * @param context Context name and tenant mode; single-tenant contexts need no check.
      * @param deliveryTenantId Tenant selected by Inbox delivery.
      * @param event Stored Event containing the original tenant metadata.
      */
-    validateProjectionReplayTenant(context, deliveryTenantId, event) {
+    validateProjectionDeliveryTenant(context, deliveryTenantId, event) {
         if (!context.multitenant) {
             return;
         }
         if (deliveryTenantId === undefined) {
-            throw new Error(`Multitenant projection inbox replay for "${context.name}" requires tenantId.`);
+            throw new Error(`Multitenant projection inbox delivery for "${context.name}" requires tenantId.`);
         }
         const envelopeTenantId = RepositoryTenants.readEventTenant(event);
         if (envelopeTenantId === undefined) {
-            throw new Error("Projection inbox replay requires stored event tenant metadata.");
+            throw new Error("Projection inbox delivery requires stored event tenant metadata.");
         }
         if (!RepositoryTenants.equal(envelopeTenantId, deliveryTenantId)) {
-            throw new Error("Projection inbox replay stored event tenant does not match.");
+            throw new Error("Projection inbox delivery stored event tenant does not match.");
         }
     },
     /**
-     * Checks that a replayed Process Manager Event's tenant matches its delivery tenant.
+     * Checks that a delivered Entity Event's tenant matches its delivery tenant.
      *
      * @param context Context name and tenant mode; single-tenant contexts need no check.
      * @param deliveryTenantId Tenant selected by Inbox delivery.
      * @param event Stored Event containing the original tenant metadata.
      */
-    validatePmReplayTenant(context, deliveryTenantId, event) {
+    validateEventTenant(context, deliveryTenantId, event) {
         if (!context.multitenant) {
             return;
         }
         if (deliveryTenantId === undefined) {
-            throw new Error(`Multitenant Entity Inbox replay for "${context.name}" requires tenantId.`);
+            throw new Error(`Multitenant Entity Inbox delivery for "${context.name}" requires tenantId.`);
         }
         const envelopeTenantId = RepositoryTenants.readEventTenant(event);
         if (envelopeTenantId === undefined) {
-            throw new Error("Entity Inbox replay requires stored event tenant metadata.");
+            throw new Error("Entity Inbox delivery requires stored event tenant metadata.");
         }
         if (!RepositoryTenants.equal(envelopeTenantId, deliveryTenantId)) {
-            throw new Error("Entity Inbox replay stored event tenant does not match.");
+            throw new Error("Entity Inbox delivery stored event tenant does not match.");
         }
     },
     /**
@@ -7542,10 +7848,10 @@ const InboxReplay = {
      * @param command Stored Command used to identify the registered handler schema.
      * @returns A deferred route to the recorded Entity identifier.
      */
-    replayCommandRoute(repository, routing, message, command) {
+    deliverCommandRoute(repository, routing, message, command) {
         const expectedTargetTypeUrl = TypeUrls.derive(repository.stateSchema);
         if (message.inboxId.targetTypeUrl !== expectedTargetTypeUrl) {
-            throw new Error("Entity Inbox replay stored target type does not match the routed repository.");
+            throw new Error("Entity Inbox delivery stored target type does not match the routed repository.");
         }
         const commandMessage = EntityInvocation.requireSignalMessage(command.message, "command");
         const schema = RepositoryRoutes.schemaForTypeUrl(routing.commandSchemas, commandMessage.typeUrl, "command");
@@ -7562,13 +7868,13 @@ const InboxReplay = {
      * @param routing Registered Event schemas.
      * @param message Inbox message recording the target type and identifier.
      * @param event Stored Event used to identify the registered handler schema.
-     * @param replayName Operation name used when reporting a target-type mismatch.
+     * @param deliverName Operation name used when reporting a target-type mismatch.
      * @returns A deferred route containing exactly the recorded target identifier.
      */
-    replayEventRoute(repository, routing, message, event, replayName) {
+    deliverEventRoute(repository, routing, message, event, deliverName) {
         const expectedTargetTypeUrl = TypeUrls.derive(repository.stateSchema);
         if (message.inboxId.targetTypeUrl !== expectedTargetTypeUrl) {
-            throw new Error(`${replayName} stored target type does not match the routed repository.`);
+            throw new Error(`${deliverName} stored target type does not match the routed repository.`);
         }
         const eventMessage = EntityInvocation.requireSignalMessage(event.message, "event");
         const schema = RepositoryRoutes.schemaForTypeUrl(routing.eventSchemas, eventMessage.typeUrl, "event");
@@ -7589,15 +7895,15 @@ const InboxReplay = {
      * @param event Stored Entity-state update envelope.
      * @returns A deferred route with the unpacked state and matching subscribers.
      */
-    replayStateUpdateRoute(repository, routing, message, event) {
+    deliverStateUpdateRoute(repository, routing, message, event) {
         const expectedTargetTypeUrl = TypeUrls.derive(repository.stateSchema);
         if (message.inboxId.targetTypeUrl !== expectedTargetTypeUrl) {
-            throw new Error("Projection inbox replay stored target type does not match the routed repository.");
+            throw new Error("Projection inbox delivery stored target type does not match the routed repository.");
         }
-        const update = RepositoryRoutes.decodeStateUpdate(event, routing.stateSchemas, "Projection inbox replay");
+        const update = RepositoryRoutes.decodeStateUpdate(event, routing.stateSchemas, "Projection inbox delivery");
         if (update === undefined ||
             (routing.stateSubscriptions.get(update.schema.typeName)?.length ?? 0) === 0) {
-            throw new Error("Projection inbox replay requires a readable stored Entity state update.");
+            throw new Error("Projection inbox delivery requires a readable stored Entity state update.");
         }
         const { schema, state } = update;
         const entityId = InboxMessages.targetEntityId(message.inboxId.targetId, repository.idField);
@@ -7606,7 +7912,7 @@ const InboxReplay = {
             entityIds,
             messageFullTypeName: schema.typeName,
             state,
-            subscribers: InboxReplay.stateSubscribers(routing, schema, event),
+            subscribers: InboxDelivery.stateSubscribers(routing, schema, event),
             invocation: "deferred",
         });
     },
@@ -7623,7 +7929,7 @@ const InboxReplay = {
         return Object.freeze(candidates.filter((subscriber) => (subscriber.handler.origin === "external") === (event.context?.external === true)));
     },
 };
-Object.freeze(InboxReplay);
+Object.freeze(InboxDelivery);
 /**
  * Records routed signals in the appropriate Entity or Projection Inbox.
  */
@@ -7634,7 +7940,7 @@ const InboxHandoff = {
      * @param repository Repository supplying the Command route and Entity type.
      * @param runtime Inbox, storage, tenant mode, and delivery strategy.
      * @param command Command envelope to retain and deliver.
-     * @returns Completion of Inbox receipt and its selected delivery operation.
+     * @returns Completion after Inbox receipt and eligible delivery scheduling.
      * @param acceptedRoute Recipient route saved when the signal was accepted.
      */
     async handoffEntityCommand(repository, runtime, command, acceptedRoute) {
@@ -7662,7 +7968,7 @@ const InboxHandoff = {
      * @param runtime Projection Inbox, storage, and tenant mode.
      * @param event Event envelope to retain and deliver.
      * @param entityId Routed Projection identifier.
-     * @returns Completion of Inbox receipt and delivery.
+     * @returns Completion after Inbox receipt and eligible delivery scheduling.
      */
     async handoffProjectionEvent(repository, runtime, event, entityId) {
         const eventId = RepositorySignals.requireEventId(event);
@@ -7683,53 +7989,53 @@ const InboxHandoff = {
         }, deliveryTenantId);
     },
     /**
-     * Delivers an Event to one Process Manager target using its Entity Inbox.
+     * Delivers an Event to one Entity target using its Inbox.
      *
-     * @param repository Repository supplying the Process Manager type and ID descriptor.
+     * @param repository Repository supplying the Entity type and ID descriptor.
      * @param runtime Entity Inbox, storage, tenant mode, and delivery strategy.
      * @param event Event envelope to retain and deliver.
-     * @param entityId Routed Process Manager identifier.
-     * @returns Completion of Inbox receipt and its selected delivery operation.
+     * @param entityId Routed Entity identifier.
+     * @returns Completion after Inbox receipt and eligible delivery scheduling.
      */
-    async handoffPmEvent(repository, runtime, event, entityId) {
+    async handoffEntityEvent(repository, runtime, event, entityId) {
         const eventId = RepositorySignals.requireEventId(event);
         const keepUntil = new Date(Time.currentTimeMillis() + inboxDedupMs);
-        const deliveryTenantId = RepositoryTenants.requirePmEventTenant(runtime.context, event);
+        const deliveryTenantId = RepositoryTenants.requireEntityEventTenant(runtime.context, event);
         const delivery = serverEnvironmentAccess.coreDelivery(ServerEnvironment.instance());
-        await runtime.entityInbox.receive(delivery, InboxHandoff.pmEventInboxInput(repository, eventId.value, event, entityId, keepUntil), deliveryTenantId);
+        await runtime.entityInbox.receive(delivery, InboxHandoff.entityEventInboxInput(repository, eventId.value, event, entityId, keepUntil), deliveryTenantId);
     },
     /**
-     * Delivers an Event to all routed Process Manager targets through batch receipt.
+     * Delivers an Event to all routed Entity targets through batch receipt.
      *
-     * @param repository Repository supplying the Process Manager type and ID descriptor.
+     * @param repository Repository supplying the Entity type and ID descriptor.
      * @param runtime Entity Inbox, storage, tenant mode, and delivery strategy.
      * @param event Event envelope shared by the target deliveries.
-     * @param entityIds Routed Process Manager identifiers.
-     * @returns Completion of batch receipt and its selected delivery operation.
+     * @param entityIds Routed Entity identifiers.
+     * @returns Completion after batch Inbox receipts and eligible delivery scheduling.
      */
-    async handoffPmEvents(repository, runtime, event, entityIds) {
+    async handoffEntityEvents(repository, runtime, event, entityIds) {
         const eventId = RepositorySignals.requireEventId(event);
         const keepUntil = new Date(Time.currentTimeMillis() + inboxDedupMs);
-        const deliveryTenantId = RepositoryTenants.requirePmEventTenant(runtime.context, event);
+        const deliveryTenantId = RepositoryTenants.requireEntityEventTenant(runtime.context, event);
         const delivery = serverEnvironmentAccess.coreDelivery(ServerEnvironment.instance());
         for (let start = 0; start < entityIds.length; start += 1_000) {
             const inputs = entityIds
                 .slice(start, start + 1_000)
-                .map((entityId) => InboxHandoff.pmEventInboxInput(repository, eventId.value, event, entityId, keepUntil));
+                .map((entityId) => InboxHandoff.entityEventInboxInput(repository, eventId.value, event, entityId, keepUntil));
             await runtime.entityInbox.receiveAll(delivery, inputs, deliveryTenantId);
         }
     },
     /**
-     * Builds a pending Process Manager Event delivery for a single target.
+     * Builds a pending Entity Event delivery for a single target.
      *
      * @param repository Repository supplying the target type and ID descriptor.
      * @param signalId Identifier of the original Event.
      * @param event Event envelope to pack without repeating validation.
-     * @param entityId Routed Process Manager identifier.
+     * @param entityId Routed Entity identifier.
      * @param keepUntil Duplicate-retention deadline for this receipt.
      * @returns Input for Entity Inbox receipt.
      */
-    pmEventInboxInput(repository, signalId, event, entityId, keepUntil) {
+    entityEventInboxInput(repository, signalId, event, entityId, keepUntil) {
         return {
             inboxId: {
                 targetId: InboxMessages.inboxTargetId(entityId, repository.idField),
@@ -7745,7 +8051,7 @@ const InboxHandoff = {
 };
 Object.freeze(InboxHandoff);
 /**
- * Connects bus dispatchers and Inbox replay to repository execution.
+ * Connects bus dispatchers and Inbox delivery to repository execution.
  */
 const RepositoryDispatch = {
     /**
@@ -7846,7 +8152,7 @@ const RepositoryDispatch = {
             : RepositoryDispatch.dispatchRepositoryStateUpdate(repository, routing, event, route);
     },
     /**
-     * Creates replay access for an Aggregate or Process Manager with signal handlers.
+     * Creates deliver access for an Aggregate or Process Manager with signal handlers.
      *
      * @param repository Repository providing signal routes and Entity identity.
      * @param routing Registered handlers and message schemas.
@@ -7863,19 +8169,17 @@ const RepositoryDispatch = {
             targetTypeUrl: TypeUrls.derive(repository.stateSchema),
             labels: Object.freeze([
                 ...(routing.commandSchemas.length === 0 ? [] : ["HANDLE_COMMAND"]),
-                ...((repository.entityFamily === "process-manager" ||
-                    repository.entityFamily === "agent") &&
-                    routing.eventSchemas.length > 0
-                    ? ["REACT_UPON_EVENT"]
-                    : []),
+                ...(routing.eventSchemas.length > 0 ? ["REACT_UPON_EVENT"] : []),
             ]),
-            replay: (message, deliveryTenantId) => repository.entityFamily === "aggregate"
-                ? InboxReplay.replayAggregateCommand(repository, routing, message, deliveryTenantId)
-                : InboxReplay.replayPmInbox(repository, routing, message, deliveryTenantId),
+            deliver: (message, deliveryTenantId) => repository.entityFamily === "aggregate"
+                ? message.label === "REACT_UPON_EVENT"
+                    ? InboxDelivery.deliverAggregateEvent(repository, routing, message, deliveryTenantId)
+                    : InboxDelivery.deliverAggregateCommand(repository, routing, message, deliveryTenantId)
+                : InboxDelivery.deliverPmInbox(repository, routing, message, deliveryTenantId),
         });
     },
     /**
-     * Creates replay access for a Projection with Event or state subscribers.
+     * Creates deliver access for a Projection with Event or state subscribers.
      *
      * @param repository Repository providing Projection identity and Event routes.
      * @param routing Registered Event and state subscribers.
@@ -7888,7 +8192,7 @@ const RepositoryDispatch = {
         }
         return Object.freeze({
             targetTypeUrl: TypeUrls.derive(repository.stateSchema),
-            replay: (message, deliveryTenantId) => InboxReplay.replayProjectionMessage(repository, routing, message, deliveryTenantId),
+            deliver: (message, deliveryTenantId) => InboxDelivery.deliverProjectionMessage(repository, routing, message, deliveryTenantId),
         });
     },
     /**
@@ -7926,7 +8230,7 @@ const RepositoryDispatch = {
         const route = acceptedRoute ?? (await repository.routeEvent(event));
         switch (repository.entityFamily) {
             case "aggregate":
-                await RepositoryDispatch.dispatchAggregateEvent(repository, routing, runtime, event, route);
+                await RepositoryDispatch.dispatchAggregateEvent(repository, runtime, event, route);
                 return;
             case "process-manager":
             case "agent":
@@ -7941,17 +8245,19 @@ const RepositoryDispatch = {
      * Dispatches an Event to each routed Aggregate with its configured duplicate guard.
      *
      * @param repository Aggregate repository receiving the Event.
-     * @param routing Registered Aggregate Event handlers and schemas.
      * @param runtime Bound storage, publisher, and tenant context.
      * @param event Event envelope to dispatch.
      * @param route Accepted route listing target Aggregate identifiers.
      * @returns Completion of all target dispatches in route order.
      */
-    async dispatchAggregateEvent(repository, routing, runtime, event, route) {
-        const execution = new AggregateEventExecution(repository, routing, runtime, event);
-        for (const entityId of route.entityIds) {
-            await DispatchGuards.guardedEntityEventDispatch(repository, runtime, event, entityId, () => execution.runTarget(entityId, route));
+    async dispatchAggregateEvent(repository, runtime, event, route) {
+        if (route.entityIds.length === 0)
+            return;
+        if (route.entityIds.length === 1) {
+            await InboxHandoff.handoffEntityEvent(repository, runtime, event, route.entityIds[0]);
+            return;
         }
+        await InboxHandoff.handoffEntityEvents(repository, runtime, event, route.entityIds);
     },
     /**
      * Delivers a routed Entity-state update to each target Projection Inbox.