@staix/agent-hub 0.29.0 → 0.31.0

package/src/rooms/service.ts

@@ -1,17 +1,18 @@
 /** Host integration for X4. Remote identities carry chat, never local control authority. */
-import type { Bus } from "../hub/bus.ts";
-import { USER, MAX_HOP, type Envelope, type PeerState } from "../hub/envelope.ts";
+import { ROOM_PROOF_UNAVAILABLE_REASON, type Bus } from "../hub/bus.ts";
+import { USER, MAX_HOP, isInvocationKind, type Envelope, type PeerState } from "../hub/envelope.ts";
 import type { RoomInvocationAuthorization } from "./boundary.ts";
 import { roomInvocationHash } from "../hub/room-invocations.ts";
 import { Limiter, PROJECT_LIMITS, type LimitsConfig } from "../hub/limits.ts";
 import type { PiiVerdict } from "../hub/inference.ts";
 import type { Routing } from "../hub/routing.ts";
-import { roomMembers } from "./wire.ts";
+import { RoomCryptoError } from "./crypto.ts";
+import { roomMembers, RoomWireError } from "./wire.ts";
 import { RoomStore, RoomStoreError, RoomApplicationLimitError, type RoomOutgoing } from "./store.ts";
 import { RoomPolicy } from "./policy.ts";
 import { RemotePeer } from "./remote-peer.ts";
 import { parseRemotePeerId, roomReceiptReasonText, type RoomMessage, type RoomReceiptReason, type RoomChatEnvelope } from "./application.ts";
-import { RoomApplicationDeferredError, type RoomLink, type RoomLinkApplication, type RoomLinkContext, type RoomLinkState, type RoomPresencePeer } from "./link.ts";
+import { RoomApplicationDeferredError, RoomNotSentError, type RoomLink, type RoomLinkApplication, type RoomLinkContext, type RoomLinkState, type RoomPresencePeer } from "./link.ts";
 
 export interface RoomInvocationIdentity { room: string; member: string; epoch: string; current: () => boolean }
 export interface RoomInvocationIngress {
@@ -48,6 +49,12 @@ function refusalReason(row: Pick<RoomOutgoing, "reason" | "lateReceipt">): RoomR
   const late = row.lateReceipt?.reason;
   return late && late !== "admitted" && late !== "inbox_admitted" ? late : undefined;
 }
+function permanentOutboundProofFailure(error: unknown): boolean {
+  if (error instanceof RoomStoreError) return ["invalid", "corrupt", "unsupported", "untrusted", "state_changed"].includes(error.code);
+  if (error instanceof RoomCryptoError) return error.code !== "unavailable";
+  if (error instanceof RoomWireError) return ["invalid_wire", "untrusted", "wrong_epoch", "authentication_failed", "state_changed"].includes(error.code);
+  return false;
+}
 
 export class RoomChat {
   private readonly policy: RoomPolicy;
@@ -60,6 +67,8 @@ export class RoomChat {
   private statusTargets = new Map<string, string[] | null>();
   private readonly remotes = new Map<string, RemotePeer>();
   private readonly outgoing = new Map<string, { binding: Binding; row: RoomOutgoing }>();
+  private readonly resuming = new Set<string>();
+  private readonly personHeldInvocations = new Map<string, Set<string>>();
   private evidenceCache?: Map<string, { peer: string; roomState: string; disposition?: string; lateReceipt?: string; refusalReason?: string }>;
   private timer?: ReturnType<typeof setTimeout>;
   private stopped = false;
@@ -75,19 +84,32 @@ export class RoomChat {
     this.application = {
       members: context => { if (context.current()) this.bind(context.store, context.name, context.link); },
       receive: (context, input) => this.receive(context, input),
-      online: async context => { if (context.current()) { this.bind(context.store, context.name, context.link); this.bindings.get(context.name)!.online = true; this.refreshTargets(); this.refreshOutgoing(this.bindings.get(context.name)!); this.queueChanged(); } },
+      online: async context => { if (context.current()) {
+        this.bind(context.store, context.name, context.link);
+        const binding = this.bindings.get(context.name)!; binding.online = true;
+        this.refreshTargets(); this.refreshOutgoing(binding); this.queueChanged();
+        this.wakeRemotes(binding);
+        this.reconcileSignedOutcomes(binding);
+        this.reconcileMissingStoreIntents(binding);
+        void this.resumeActive(binding);
+      } },
+      receiptTtlMs: context => { if (!context.current()) throw new Error("room: state_changed"); return this.policy.timing().ttlMs; },
       stored: (context, input) => {
         if (!context.current()) return;
         const row = context.store.markApplicationStored(context.name, input.digest, input.seq);
         if (row) this.outcome(this.bindings.get(context.name)!, row);
+        const binding = this.bindings.get(context.name); if (binding) this.wakeRemotes(binding);
       },
-      capacityChanged: context => { if (context.current()) this.capacityChanged(); },
+      capacityChanged: context => { if (context.current()) { const binding = this.bindings.get(context.name); if (binding) this.wakeRemotes(binding); this.capacityChanged(); } },
       gap: (context, input) => {
         if (context.current()) this.options.notice?.({ code: "sequence_gap", room: context.store.get(context.name)!.current.room, sender: input.sender, count: input.count });
       },
     };
   }
   private now(): number { return this.options.now?.() ?? Date.now(); }
+  private wakeRemotes(binding: Binding): void {
+    for (const [id, remote] of this.remotes) if (this.targets.get(id)?.binding === binding) remote.wake();
+  }
   metrics(name: string, room?: string): RoomMetrics | null {
     const binding = this.bindings.get(name);
     if (this.stopped || !binding || this.metricsSince === null || room !== undefined && binding.room !== room) return null;
@@ -107,6 +129,19 @@ export class RoomChat {
   private valid(binding: Binding): boolean {
     return !this.stopped && this.bindings.get(binding.name) === binding && binding.store.get(binding.name)?.left === false;
   }
+  private currentOutgoingRow(binding: Binding, expected: RoomOutgoing): () => boolean {
+    const digest = binding.digest, room = binding.room;
+    return () => {
+      try {
+        if (!this.valid(binding) || binding.store.get(binding.name)?.current.room !== room || binding.store.get(binding.name)?.current.digest !== digest) return false;
+        const row = binding.store.applicationOutbox(binding.name).find(item => item.deliveryId === expected.deliveryId);
+        return !!row && row.application === expected.application && row.remotePeer === expected.remotePeer
+          && row.recipient === expected.recipient && row.peer === expected.peer && row.state === expected.state
+          && row.disposition === expected.disposition && row.reason === expected.reason && row.expiresAt === expected.expiresAt
+          && JSON.stringify(row.lateReceipt) === JSON.stringify(expected.lateReceipt);
+      } catch { return false; }
+    };
+  }
   bind(store: RoomStore, name: string, link: RoomLink): void {
     if (this.stopped) return;
     const state = store.get(name), digest = state?.current.digest; if (!digest || !state) return;
@@ -116,7 +151,9 @@ export class RoomChat {
     const binding = saved?.store === store && saved.link === link && saved.room === room ? saved : { store, name, room, link, digest, online: false, states: new Map<string, PeerState>() };
     if (binding.digest !== digest) { binding.states.clear(); binding.online = false; binding.digest = digest; }
     this.bindings.set(name, binding);
-    this.refreshTargets(); this.refreshOutgoing(binding); this.queueChanged();
+    this.reconcileDispositions(binding);
+    this.refreshInvocationHolds(binding);
+    this.refreshOutgoing(binding); this.refreshTargets(); this.reconcileProofUnavailable(binding); this.queueChanged();
   }
   invocationIdentity(id: string, sender?: string): RoomInvocationIdentity | undefined {
     const target = this.targets.get(id), state = target?.binding.store.get(target.binding.name);
@@ -177,22 +214,43 @@ export class RoomChat {
             const binding = selected.binding;
             if (!current()) throw new Error("room: state_changed");
             const timing = this.policy.timing(), remaining = expiresAt - this.now();
-            if (remaining <= 0) throw new Error("room: expired");
+            const retained = binding.store.applicationOutbox(binding.name, true).find(row => row.deliveryId === deliveryId);
+            if (remaining <= 0) throw retained ? new Error("room: expired") : new RoomNotSentError();
             try {
               await binding.link.publishApplication({ v: 1, type: "chat", envelope: env }, target.member, {
                 deliveryId, application: env.id, remotePeer: id, recipient: target.member, peer: target.peer,
-                ackTimeoutMs: timing.ackTimeoutMs, ttlMs: Math.min(remaining, timing.ttlMs),
+                ackTimeoutMs: retained?.ackTimeoutMs ?? timing.ackTimeoutMs,
+                ttlMs: retained ? retained.expiresAt - retained.createdAt : Math.min(remaining, timing.ttlMs),
               }, current);
               this.count(binding, "outbound", withheld === true);
-            } catch (error) { binding.store.quarantineOutgoing(binding.name, deliveryId); throw error; }
+            }
             finally { this.refreshOutgoing(binding); this.queueChanged(); }
-          }, quarantine: deliveryId => {
+          }, ready: () => this.options.bus.remoteSendAllowed(remote!), waiting: () => this.queueChanged(),
+          notSent: deliveryId => this.options.bus.requeueRemoteNotSent(remote!, deliveryId),
+          queued: deliveryId => {
+            const selected = this.targets.get(id);
+            if (!selected || selected.member !== target.member || selected.peer !== target.peer || selected.binding.store.get(selected.binding.name)?.current.room !== room) return undefined;
+            try { return selected.binding.store.applicationOutbox(selected.binding.name).some(row => row.deliveryId === deliveryId); }
+            catch { return undefined; }
+          }, holdMissing: deliveryId => {
+            const selected = this.targets.get(id);
+            if (!selected || selected.member !== target.member || selected.peer !== target.peer || selected.binding.store.get(selected.binding.name)?.current.room !== room) return false;
+            const current = () => {
+              if (!this.valid(selected.binding) || this.targets.get(id)?.binding !== selected.binding
+                || this.targets.get(id)?.member !== target.member || this.targets.get(id)?.peer !== target.peer) return false;
+              try { return !selected.binding.store.applicationOutbox(selected.binding.name).some(row => row.deliveryId === deliveryId); }
+              catch { return false; }
+            };
+            const held = this.options.bus.holdRemoteMissingIntent(remote!, deliveryId, current, "known-not-sent");
+            if (held) remote!.settled(deliveryId);
+            return held;
+          }, quarantine: (deliveryId, reason) => {
             const selected = this.targets.get(id);
             const cached = [...this.outgoing.values()].filter(value => value.row.deliveryId === deliveryId && value.row.remotePeer === id && value.row.recipient === target.member).map(value => value.binding);
             const bindings = [...new Set([...(selected?.member === target.member && selected.peer === target.peer ? [selected.binding] : []), ...cached])];
             for (const binding of bindings) try {
               if (binding.store.get(binding.name)?.current.room !== room) continue;
-              const row = binding.store.quarantineOutgoing(binding.name, deliveryId);
+              const row = binding.store.quarantineOutgoingPermanent(binding.name, deliveryId, reason);
               if (row && row.remotePeer === id && row.recipient === target.member) { this.outcome(binding, row); return; }
             } catch { /* A retained old binding may already be closed after an explicit rejoin. */ }
           }, now: () => this.now(),
@@ -218,6 +276,20 @@ export class RoomChat {
       else { ids.push(id); shown++; }
     }
     this.statusTargets = statusTargets;
+    // Reserve restored Store intents before publishing a fresh idle presence can
+    // make the Bus drain a later queued envelope during asynchronous proof reads.
+    for (const [id, remote] of this.remotes) {
+      const target = this.targets.get(id);
+      if (!target) continue;
+      const queuedIds = new Set(this.options.bus.pendingEnvelopes(id).map(env => env.id));
+      for (const { binding, row } of this.outgoing.values()) {
+        if (binding === target.binding && row.remotePeer === id && row.recipient === target.member && row.peer === target.peer
+          && (row.state === "dispatching" || row.state === "accepted") && !row.disposition
+          && !this.personHeldInvocations.get(binding.name)?.has(row.deliveryId) && !queuedIds.has(row.application)) {
+          remote.retainPending(row.deliveryId);
+        }
+      }
+    }
     for (const [id, remote] of this.remotes) {
       const target = this.targets.get(id);
       remote.presence(target?.peer === USER ? "idle" : target?.binding.states.get(id) ?? "offline", target?.binding.online === true);
@@ -240,14 +312,19 @@ export class RoomChat {
     this.refreshTargets();
   }
   linkState(store: RoomStore, name: string, link: RoomLink, state: RoomLinkState): void {
+    // stop() fences callbacks as part of ordinary shutdown; it is not a room
+    // trust revocation and must leave durable outbound intents resumable.
+    if (this.stopped) return;
     const binding = this.bindings.get(name);
     if (!binding || binding.store !== store || binding.link !== link) return;
-    binding.online = state === "online";
+    // Application.online promotes readiness after membership and inbox recovery finish.
+    // A raw socket-online notification must not start the same recovery twice.
+    if (state !== "online") binding.online = false;
     // A transport blip does not revoke the last authenticated signed state.
     // A new roster digest still clears it in bind(), before target reconstruction.
     if (!this.valid(binding)) {
       try { for (const row of binding.store.applicationOutbox(name, true)) if (row.state === "dispatching" || row.state === "accepted") {
-        const unknown = binding.store.quarantineOutgoing(name, row.deliveryId); if (unknown) this.outcome(binding, unknown);
+        const unknown = binding.store.quarantineOutgoingPermanent(name, row.deliveryId, "boundary_refused"); if (unknown) this.outcome(binding, unknown);
       } } catch { for (const [key, row] of this.outgoing) if (row.binding === binding) this.outgoing.delete(key); }
     }
     this.refreshTargets();
@@ -263,10 +340,114 @@ export class RoomChat {
   }
   private outcome(binding: Binding, row: RoomOutgoing): void {
     const remote = this.remotes.get(row.remotePeer);
-    if (row.lateReceipt) this.options.bus.noteLateRemoteReceipt(row.remotePeer, row.deliveryId, row.lateReceipt.outcome);
+    if (row.state === "needs_review" && !row.disposition) {
+      const journalRow = this.options.bus.queueShow(row.deliveryId);
+      if (journalRow?.originals.some(isInvocationKind) && !this.options.bus.remoteDisposition(row.deliveryId)) {
+        const held = this.personHeldInvocations.get(binding.name) ?? new Set<string>();
+        held.add(row.deliveryId); this.personHeldInvocations.set(binding.name, held);
+      }
+    }
+    if ((row.state === "completed" || row.state === "failed_safe") && !row.disposition) this.settleStoredOutcome(binding, remote, row);
+    else if (row.state === "needs_review" && !row.disposition && remote) {
+      if (!this.holdStoreNeedsReview(binding, row, remote)) remote.receipt({ id: row.deliveryId, state: "needs_review", reason: "room acknowledgement expired or outcome uncertain" });
+    }
     else if (!row.disposition) remote?.receipt({ id: row.deliveryId, state: row.state === "dispatching" ? "needs_review" : row.state, reason: row.state === "completed" ? `room ${completedText(row.reason)}` : row.state === "failed_safe" ? roomReceiptReasonText(row.reason ?? "invalid_message") : row.state === "accepted" ? "room broker accepted ciphertext" : "room acknowledgement expired or outcome uncertain" });
     this.refreshOutgoing(binding); this.queueChanged(); this.options.changed?.();
   }
+  private settleStoredOutcome(binding: Binding, remote: RemotePeer | undefined, row: RoomOutgoing): boolean {
+    if ((row.state !== "completed" && row.state !== "failed_safe") || row.disposition) return false;
+    const outcome = row.lateReceipt?.outcome ?? row.state;
+    const reason = row.lateReceipt?.reason ?? row.reason ?? (outcome === "completed" ? "admitted" : "boundary_refused");
+    const journalRow = this.options.bus.queueShow(row.deliveryId);
+    if (journalRow?.state === "needs_review" && journalRow.originals.some(isInvocationKind)) {
+      if (!this.options.bus.remoteDisposition(row.deliveryId)) this.options.bus.noteLateRemoteReceipt(row.remotePeer, row.deliveryId, outcome);
+      return false;
+    }
+    const target = this.targets.get(row.remotePeer), state = binding.store.get(binding.name);
+    const targetCurrent = target?.binding === binding && target.member === row.recipient && target.peer === row.peer;
+    const proofCurrent = () => this.valid(binding) && binding.store.get(binding.name)?.current.room === binding.room
+      && binding.store.get(binding.name)?.current.digest === state?.current.digest
+      && binding.store.applicationOutbox(binding.name).some(saved => saved.deliveryId === row.deliveryId
+        && saved.remotePeer === row.remotePeer && saved.recipient === row.recipient && saved.peer === row.peer
+        && saved.state === row.state && !saved.disposition);
+    if (!targetCurrent || !remote) {
+      const invalidated = () => proofCurrent() && (() => {
+        const next = this.targets.get(row.remotePeer);
+        return !next || next.binding !== binding || next.member !== row.recipient || next.peer !== row.peer;
+      })();
+      return this.options.bus.holdInvalidatedRemoteOutcome(row.remotePeer, row.deliveryId, binding.room, row.recipient, invalidated);
+    }
+    const current = () => this.valid(binding) && target?.binding === binding && target.member === row.recipient
+      && target.peer === row.peer && state?.current.room === binding.room
+      && binding.store.get(binding.name)?.current.digest === state?.current.digest;
+    const settled = this.options.bus.settleRemoteReceipt(remote, row.deliveryId, outcome,
+      outcome === "completed" ? `room ${completedText(reason)}` : `room ${roomReceiptReasonText(reason)}`, current);
+    if (settled) remote.settled(row.deliveryId);
+    return settled;
+  }
+  /** Reconcile a signed store commit that may have preceded a process crash or Bus CAS. */
+  private reconcileSignedOutcomes(binding: Binding): void {
+    if (!binding.online || !this.valid(binding)) return;
+    try {
+      for (const row of binding.store.applicationOutbox(binding.name)) {
+        if ((row.state === "completed" || row.state === "failed_safe") && !row.disposition) {
+          const remote = this.remotes.get(row.remotePeer);
+          this.settleStoredOutcome(binding, remote, row);
+        }
+      }
+    } catch { /* The next authenticated online edge retries the signed outcome reconciliation. */ }
+  }
+  /** Hold restart-era Bus rows only after signed Store outcomes have had their reconciliation chance. */
+  private reconcileMissingStoreIntents(binding: Binding): void {
+    if (!binding.online || !this.valid(binding)) return;
+    let saved: RoomOutgoing[];
+    try { saved = binding.store.applicationOutbox(binding.name); }
+    catch { return; }
+    const known = new Set(saved.map(row => row.deliveryId));
+    for (const [id, target] of this.targets) {
+      if (target.binding !== binding) continue;
+      const remote = this.remotes.get(id);
+      if (!remote) continue;
+      const digest = binding.digest;
+      for (const row of this.options.bus.queueList(id, true).slice(0, 200)) {
+        if ((row.state !== "dispatching" && row.state !== "accepted") || known.has(row.id)) continue;
+        const current = () => this.valid(binding) && binding.store.get(binding.name)?.current.digest === digest
+          && this.targets.get(id)?.binding === binding && this.targets.get(id)?.member === target.member
+          && this.targets.get(id)?.peer === target.peer && binding.store.get(binding.name)?.current.room === binding.room
+          && !binding.store.applicationOutbox(binding.name).some(savedRow => savedRow.deliveryId === row.id);
+        this.options.bus.holdRemoteMissingIntent(remote, row.id, current);
+      }
+    }
+  }
+  private holdStoreNeedsReview(binding: Binding, row: RoomOutgoing, remote: RemotePeer): boolean {
+    const journal = this.options.bus.queueShow(row.deliveryId);
+    if (!journal || row.disposition || (journal.state !== "dispatching" && journal.state !== "accepted" && journal.state !== "needs_review")) return false;
+    const current = this.currentOutgoingRow(binding, row);
+    if (journal.originals.some(isInvocationKind)) return false;
+    const held = this.options.bus.holdRemoteMissingIntent(remote, row.deliveryId, current, "proof-unavailable");
+    if (held) remote.settled(row.deliveryId);
+    return held;
+  }
+  /** Reconcile Store TTL/permanent holds and Bus-first proof holds before any resume starts. */
+  private reconcileProofUnavailable(binding: Binding): void {
+    if (!this.valid(binding)) return;
+    let rows: RoomOutgoing[];
+    try { rows = binding.store.applicationOutbox(binding.name); } catch { return; }
+    for (const row of rows) {
+      if (row.disposition) continue;
+      const remote = this.remotes.get(row.remotePeer);
+      const journal = this.options.bus.queueShow(row.deliveryId);
+      if (!remote || !journal) continue;
+      const heldProof = journal.state === "needs_review" && journal.reason === `${ROOM_PROOF_UNAVAILABLE_REASON} ${row.deliveryId}`;
+      if (heldProof && (row.state === "dispatching" || row.state === "accepted")) {
+        const current = this.currentOutgoingRow(binding, row);
+        if (!this.options.bus.holdRemoteMissingIntent(remote, row.deliveryId, current, "proof-unavailable")) continue;
+        const quarantined = binding.store.quarantineOutgoingPermanent(binding.name, row.deliveryId, "boundary_refused", current);
+        if (quarantined) remote.settled(row.deliveryId);
+      } else if (row.state === "needs_review") this.holdStoreNeedsReview(binding, row, remote);
+    }
+    this.refreshOutgoing(binding);
+  }
   private rate(from: string, member: string, target: string, body: string): boolean {
     const config = this.options.limits?.() ?? PROJECT_LIMITS, key = JSON.stringify(config);
     if (key !== this.limitKey) { this.limitKey = key; this.peerLimiter = new Limiter(config, () => this.now()); }
@@ -284,6 +465,7 @@ export class RoomChat {
     if (!context.current() || this.stopped) throw new Error("room: state_changed");
     const binding = this.bindings.get(context.name);
     if (!binding || binding.store !== context.store || binding.link !== context.link) throw new Error("room: unavailable");
+    if (!this.reconcileDispositions(binding)) throw new RoomApplicationDeferredError("journal_unavailable");
     const saved = context.store.applicationReceipt(context.name, input.digest);
     if (saved) { await context.link.publishApplication(saved, input.sender, undefined, context.current); return; }
     if (input.message?.type === "receipt") {
@@ -363,16 +545,46 @@ export class RoomChat {
     if (receipt) await context.link.publishApplication(receipt, input.sender, undefined, context.current);
     this.options.changed?.();
   }
+  private refreshInvocationHolds(binding: Binding): void {
+    const room = binding.store.get(binding.name);
+    if (!room || !this.valid(binding)) return;
+    const held = new Set<string>();
+    try {
+      for (const member of roomMembers(room.current)) {
+        if (member.fingerprint === binding.store.identity.public.fingerprint) continue;
+        for (const peer of new Set([...member.exposedPeers, USER])) {
+          const id = `${peer}@${member.label}`;
+          for (const row of this.options.bus.queueList(id, true)) {
+            if (row.state === "needs_review" && row.originals.some(isInvocationKind) && !this.options.bus.remoteDisposition(row.id)) held.add(row.id);
+          }
+        }
+      }
+    } catch { /* Unknown Bus state never grants a proof resume by itself. */ }
+    this.personHeldInvocations.set(binding.name, held);
+  }
   queueChanged(): void {
     if (this.timer) clearTimeout(this.timer);
     this.timer = undefined; if (this.stopped || !this.bindings.size) return;
     let next = this.options.bus.nextRemoteExpiry();
-    for (const { row } of this.outgoing.values()) if ((row.state === "dispatching" || row.state === "accepted") && !row.disposition) {
-      const due = Math.min(row.expiresAt, row.ackDeadline ?? Infinity); next = next === undefined ? due : Math.min(next, due);
+    for (const { binding, row } of this.outgoing.values()) if ((row.state === "dispatching" || row.state === "accepted") && !row.disposition) {
+      const due = Math.min(row.expiresAt, binding.online ? row.ackDeadline ?? Infinity : Infinity); next = next === undefined ? due : Math.min(next, due);
     }
     if (next === undefined) return;
     this.timer = setTimeout(() => { this.timer = undefined; try { this.tick(); } catch { this.stop(); } }, Math.max(1, Math.min(2_147_483_647, next - this.now())));
     this.timer.unref?.();
+    this.resumeReadyIntents();
+  }
+  private resumeReadyIntents(): void {
+    if (this.stopped) return;
+    for (const binding of this.bindings.values()) {
+      if (!binding.online || !this.valid(binding)) continue;
+      try {
+        for (const row of binding.store.applicationOutbox(binding.name, true)) {
+          const remote = this.remotes.get(row.remotePeer);
+          if (remote?.readyToResume(row.deliveryId)) this.launchResume(binding, row);
+        }
+      } catch { /* An actual future queue, receipt or online event retries the scan. */ }
+    }
   }
   tick(): void {
     if (this.stopped) return;
@@ -380,12 +592,104 @@ export class RoomChat {
     for (const binding of this.bindings.values()) if (this.valid(binding)) {
       try {
         for (const row of binding.store.expireApplications(binding.name)) this.outcome(binding, row);
+        if (binding.online) {
+          const due = binding.store.dueApplicationRetries(binding.name);
+          this.refreshOutgoing(binding);
+          for (const row of due) this.launchResume(binding, row);
+        }
         this.reconcileDispositions(binding);
       }
       catch { binding.online = false; for (const [key, entry] of this.outgoing) if (entry.binding === binding) this.outgoing.delete(key); }
     }
     void this.retryPending(); this.queueChanged();
   }
+  private async resumeActive(binding: Binding): Promise<void> {
+    if (!binding.online || !this.valid(binding)) return;
+    try {
+      const active = binding.store.applicationOutbox(binding.name, true).filter(row => (row.state === "dispatching" || row.state === "accepted")
+        && !this.personHeldInvocations.get(binding.name)?.has(row.deliveryId));
+      for (const row of active) this.remotes.get(row.remotePeer)?.reservePending(row.deliveryId);
+      for (const row of active) this.launchResume(binding, row);
+    } catch { /* The next authenticated online edge will retry durable rows. */ }
+  }
+  private launchResume(binding: Binding, row: RoomOutgoing): void {
+    const key = `${binding.name}:${row.deliveryId}`;
+    if (this.resuming.has(key)) return;
+    const remote = this.remotes.get(row.remotePeer);
+    if (!remote) return;
+    this.resuming.add(key);
+    void this.resumeApplication(binding, row, remote).catch(() => { remote.deferResume(row.deliveryId); })
+      .finally(() => { this.resuming.delete(key); try { this.queueChanged(); } catch { /* a later real event or ACK deadline retries */ } });
+  }
+  private storeProofCurrent(binding: Binding, row: RoomOutgoing, remote: RemotePeer, target: Target | undefined, digest: string | undefined): boolean {
+    try {
+      if (!target || !digest || !this.valid(binding) || binding.store.get(binding.name)?.current.room !== binding.room
+        || binding.store.get(binding.name)?.current.digest !== digest || this.targets.get(row.remotePeer)?.binding !== binding
+        || this.targets.get(row.remotePeer)?.member !== row.recipient || this.targets.get(row.remotePeer)?.peer !== row.peer
+        || !remote.isPendingHead(row.deliveryId) || row.disposition || row.expiresAt <= this.now()) return false;
+      return binding.store.applicationOutbox(binding.name, true).some(saved => saved.deliveryId === row.deliveryId
+        && saved.application === row.application && saved.remotePeer === row.remotePeer && saved.recipient === row.recipient
+        && saved.peer === row.peer && (saved.state === "dispatching" || saved.state === "accepted") && !saved.disposition);
+    } catch { return false; }
+  }
+  private holdUnavailableProof(binding: Binding, row: RoomOutgoing, remote: RemotePeer, current: () => boolean): boolean {
+    const busRow = this.options.bus.queueShow(row.deliveryId);
+    if (busRow?.originals.some(isInvocationKind)) { remote.deferResume(row.deliveryId); return false; }
+    if (!this.options.bus.holdRemoteMissingIntent(remote, row.deliveryId, current, "proof-unavailable")) { remote.deferResume(row.deliveryId); return false; }
+    try { binding.store.quarantineOutgoingPermanent(binding.name, row.deliveryId, "boundary_refused", current); }
+    catch { /* Bus hold is durable; startup reconciliation can finish the Store side. */ }
+    remote.settled(row.deliveryId);
+    this.refreshOutgoing(binding); this.queueChanged(); this.options.changed?.();
+    return true;
+  }
+  private async resumeApplication(binding: Binding, row: RoomOutgoing, remote: RemotePeer): Promise<void> {
+    if (this.personHeldInvocations.get(binding.name)?.has(row.deliveryId)) return;
+    if (!remote || !remote.isPendingHead(row.deliveryId)) return;
+    const heldRow = this.options.bus.queueShow(row.deliveryId);
+    const original = this.options.bus.remoteDeliveryEnvelope(remote, row.deliveryId);
+    const proofHoldReason = `${ROOM_PROOF_UNAVAILABLE_REASON} ${row.deliveryId}`;
+    if (heldRow?.state === "needs_review" && heldRow.reason === proofHoldReason && original) {
+      if (!row.disposition && (row.state === "dispatching" || row.state === "accepted")) {
+        const digest = binding.store.get(binding.name)?.current.digest;
+        const target = this.targets.get(row.remotePeer);
+        const proofCurrent = () => this.storeProofCurrent(binding, row, remote, target, digest);
+        const quarantined = binding.store.quarantineOutgoingPermanent(binding.name, row.deliveryId, "boundary_refused", proofCurrent);
+        if (quarantined) { remote.settled(row.deliveryId); this.refreshOutgoing(binding); this.queueChanged(); }
+        else remote.deferResume(row.deliveryId);
+      }
+      return;
+    }
+    if (!original || !binding.online || !this.valid(binding) || row.disposition || row.expiresAt <= this.now()) { remote.deferResume(row.deliveryId); return; }
+    const target = this.targets.get(row.remotePeer), state = binding.store.get(binding.name);
+    const digest = state?.current.digest;
+    const proofCurrent = () => this.storeProofCurrent(binding, row, remote, target, digest);
+    if (!target || !state || target.binding !== binding || !proofCurrent()) { remote.deferResume(row.deliveryId); return; }
+    const ready = () => binding.online && this.options.bus.remoteSendAllowed(remote);
+    if (!ready()) { remote.waitForReady(row.deliveryId); return; }
+    let readinessLost = false;
+    const current = () => {
+      const allowed = ready();
+      if (!allowed) readinessLost = true;
+      return allowed && proofCurrent();
+    };
+    let saved: RoomMessage | undefined;
+    try { saved = await binding.store.outgoingMessage(binding.name, row.application, current); }
+    catch (error) {
+      if (!proofCurrent()) { remote.deferResume(row.deliveryId); return; }
+      if (readinessLost || !ready()) { remote.waitForReady(row.deliveryId); return; }
+      if (permanentOutboundProofFailure(error)) { this.holdUnavailableProof(binding, row, remote, proofCurrent); return; }
+      remote.deferResume(row.deliveryId); return;
+    }
+    if (!proofCurrent()) { remote.deferResume(row.deliveryId); return; }
+    if (!ready()) { remote.waitForReady(row.deliveryId); return; }
+    if (!saved || saved.type !== "chat" || saved.envelope.id !== row.application || saved.envelope.to !== row.peer) {
+      this.holdUnavailableProof(binding, row, remote, proofCurrent); return;
+    }
+    const resumeState = row.state === "accepted" ? "accepted" : "dispatching";
+    if (!this.options.bus.resumeRemotePending(remote, row.deliveryId, resumeState, current)) return;
+    await remote.resume(original, row.deliveryId, row.expiresAt, saved.envelope);
+    this.refreshOutgoing(binding); this.queueChanged();
+  }
   /** Global byte capacity can be freed by another room. This is event-coalesced, never polled. */
   private capacityChanged(): void {
     if (this.stopped || this.capacityRefreshPending) return;
@@ -407,19 +711,31 @@ export class RoomChat {
     } catch { /* A completed person disposition must not fail because another room is unavailable. */ }
     await Promise.allSettled(retries); this.capacityChanged();
   }
-  private reconcileDispositions(binding: Binding): void {
-    for (const row of binding.store.applicationOutbox(binding.name, true)) if (row.state === "needs_review" && !row.disposition) {
+  private reconcileDispositions(binding: Binding): boolean {
+    let complete = true;
+    for (const row of binding.store.applicationOutbox(binding.name)) if (!row.disposition) {
       const action = this.options.bus.remoteDisposition(row.deliveryId);
-      if (action) binding.store.disposeApplication(binding.name, row.deliveryId, action, () => !this.stopped);
+      if (action) try {
+        const disposed = binding.store.disposeApplication(binding.name, row.deliveryId, action, true, () => this.valid(binding)
+          && binding.store.get(binding.name)?.current.digest === binding.digest && this.options.bus.remoteDisposition(row.deliveryId) === action);
+        if (disposed?.disposition === action) this.remotes.get(row.remotePeer)?.settled(row.deliveryId);
+      }
+      catch { complete = false; }
     }
     this.refreshOutgoing(binding);
+    return complete;
   }
   disposition(peer: string, deliveryId: string, action: "completed" | "retry" | "discard"): void {
     if (this.options.bus.remoteDisposition(deliveryId) !== action) return;
     for (const binding of this.bindings.values()) {
-      const row = binding.store.applicationOutbox(binding.name, true).find(row => row.deliveryId === deliveryId && row.remotePeer === peer);
+      const row = binding.store.applicationOutbox(binding.name).find(row => row.deliveryId === deliveryId && row.remotePeer === peer);
       if (!row) continue;
-      binding.store.disposeApplication(binding.name, deliveryId, action, () => !this.stopped);
+      const room = binding.room, digest = binding.digest;
+      const disposed = binding.store.disposeApplication(binding.name, deliveryId, action, true, () => this.valid(binding)
+        && binding.store.get(binding.name)?.current.room === room && binding.store.get(binding.name)?.current.digest === digest
+        && this.options.bus.remoteDisposition(deliveryId) === action);
+      if (disposed?.disposition === action) this.remotes.get(peer)?.settled(deliveryId);
+      this.personHeldInvocations.get(binding.name)?.delete(deliveryId);
       this.refreshOutgoing(binding); break;
     }
     this.refreshTargets(); this.queueChanged(); void this.retryPending();