@team-agent/installer 0.5.50 → 0.5.52

package/crates/team-agent/src/messaging/delivery.rs

@@ -45,20 +45,28 @@ pub fn deliver_stored_message(
 ) -> Result<DeliveryOutcome, MessagingError> {
     let _ = (wait_visible, timeout);
     let recipient = target.unwrap_or("leader");
-    let store = MessageStore::open(workspace)?;
-    let message_id = store.create_message(
+    let super::PersistResolution::Persisted(persisted) = super::persist::persist_internal_send(
+        workspace,
+        super::InternalSendKind::Delivery,
+        team.map(TeamKey::as_str),
         task_id.map(crate::model::ids::TaskId::as_str),
         sender,
         recipient,
         content,
         None,
         requires_ack,
-        team.map(TeamKey::as_str),
-    )?;
+        None,
+        super::InitialDisposition::Accepted,
+    )?
+    else {
+        unreachable!("internal delivery does not accept caller-supplied ids")
+    };
+    let message_status = persisted.row_status.as_str().to_string();
+    let message_id = persisted.message_id;
     Ok(DeliveryOutcome {
         ok: true,
         status: DeliveryStatus::Queued,
-        message_status: MessageStatusShadow("accepted".to_string()),
+        message_status: MessageStatusShadow(message_status),
         message_id: Some(message_id),
         verification: None,
         stage: None,
@@ -67,6 +75,17 @@ pub fn deliver_stored_message(
     })
 }
 
+pub fn deliver_persisted_message(
+    workspace: &Path,
+    transport: &dyn Transport,
+    message_id: &str,
+    event_log: &EventLog,
+    state: &serde_json::Value,
+) -> Result<DeliveryOutcome, MessagingError> {
+    let store = MessageStore::open(workspace)?;
+    deliver_pending_message(workspace, &store, transport, message_id, event_log, state)
+}
+
 // ===========================================================================
 // delivery.py — 单条 tmux 注入投递 + trust 有界重试 + turn-open arm (card §16)
 // ===========================================================================
@@ -200,6 +219,47 @@ pub fn deliver_pending_message(
         }
         _ => state,
     };
+    if message.recipient == "leader" && message.status == "submitted_pending_acceptance" {
+        return observe_pending_leader_acceptance(store, event_log, state, message_id);
+    }
+    if message.recipient == "leader" && message.status == "queued_until_leader_attach" {
+        let Some(receiver) = leader_receiver_value(state) else {
+            return Ok(leader_acceptance_pending_outcome(
+                message_id,
+                "queued_until_leader_attach",
+            ));
+        };
+        let channel_transport =
+            delivery_transport_for_recipient(workspace, transport, state, "leader");
+        let resolution = crate::messaging::resolve_live_leader_channel(
+            workspace,
+            receiver,
+            channel_transport.as_transport(),
+        );
+        let crate::messaging::LeaderChannelResolution::Live(channel) = resolution else {
+            return Ok(leader_acceptance_pending_outcome(
+                message_id,
+                "queued_until_leader_attach",
+            ));
+        };
+        let metadata_drift = match &channel {
+            crate::messaging::LiveLeaderChannel::DirectTmux(channel) => {
+                channel.metadata_drift.clone()
+            }
+            crate::messaging::LiveLeaderChannel::CodexAppServer(_) => Vec::new(),
+        };
+        store.mark(message_id, "accepted", None)?;
+        event_log.write(
+            "leader_receiver.mailbox_requeued",
+            serde_json::json!({
+                "message_id": message_id,
+                "channel_live": true,
+                "metadata_drift": metadata_drift,
+                "requeue_trigger": "delivery_revalidation",
+                "revalidated_at": chrono::Utc::now().to_rfc3339(),
+            }),
+        )?;
+    }
     let attempt = if store.claim_for_delivery(message_id)? {
         message.delivery_attempts.saturating_add(1)
     } else if message.status == "target_resolved" && message.error.is_some() {
@@ -217,88 +277,108 @@ pub fn deliver_pending_message(
         });
     };
     if message.recipient == "leader" {
-        if let Some(receiver) = leader_receiver_value(state) {
-            if let Some(outcome) = leader_receiver_transport_conflict_outcome(
+        let Some(receiver) = leader_receiver_value(state) else {
+            store.mark(message_id, "failed", Some("leader_not_attached"))?;
+            event_log.write(
+                "leader_receiver.delivery_blocked",
+                serde_json::json!({
+                    "message_id": message_id,
+                    "sender": message.sender,
+                    "reason": "leader_receiver_not_attached",
+                    "error": "leader_not_attached",
+                    "channel_reason": "receiver_missing",
+                    "channel": "rebind_required",
+                    "action": "run team-agent attach-leader or team-agent takeover",
+                    "status": "unbound",
+                }),
+            )?;
+            return Ok(DeliveryOutcome {
+                ok: false,
+                status: DeliveryStatus::Refused,
+                message_status: MessageStatusShadow("failed".to_string()),
+                message_id: Some(message_id.to_string()),
+                verification: Some(
+                    "run team-agent attach-leader or team-agent takeover".to_string(),
+                ),
+                stage: None,
+                reason: Some(DeliveryRefusal::LeaderNotAttached),
+                channel: Some("rebind_required".to_string()),
+            });
+        };
+        if let Some(outcome) = leader_receiver_transport_conflict_outcome(
+            store,
+            event_log,
+            message_id,
+            receiver,
+            &message.sender,
+        )? {
+            return Ok(outcome);
+        }
+        let channel_transport =
+            delivery_transport_for_recipient(workspace, transport, state, "leader");
+        match crate::messaging::resolve_live_leader_channel(
+            workspace,
+            receiver,
+            channel_transport.as_transport(),
+        ) {
+            crate::messaging::LeaderChannelResolution::Live(_) => {}
+            crate::messaging::LeaderChannelResolution::ProbeFailed(error) => {
+                store.mark(message_id, "target_resolved", Some(&error))?;
+                return Ok(DeliveryOutcome {
+                    ok: false,
+                    status: DeliveryStatus::Degraded,
+                    message_status: MessageStatusShadow("target_resolved".to_string()),
+                    message_id: Some(message_id.to_string()),
+                    verification: Some(error),
+                    stage: None,
+                    reason: None,
+                    channel: Some("rebind_required".to_string()),
+                });
+            }
+            crate::messaging::LeaderChannelResolution::Unbound(reason) => {
+                let receiver_status = receiver
+                    .get("status")
+                    .and_then(serde_json::Value::as_str)
+                    .unwrap_or("unbound");
+                store.mark(message_id, "failed", Some("leader_not_attached"))?;
+                event_log.write(
+                    "leader_receiver.delivery_blocked",
+                    serde_json::json!({
+                        "message_id": message_id,
+                        "sender": message.sender,
+                        "reason": "leader_receiver_not_attached",
+                        "error": "leader_not_attached",
+                        "channel_reason": format!("{reason:?}"),
+                        "channel": "rebind_required",
+                        "action": "run team-agent attach-leader or team-agent takeover",
+                        "status": receiver_status,
+                    }),
+                )?;
+                return Ok(DeliveryOutcome {
+                    ok: false,
+                    status: DeliveryStatus::Refused,
+                    message_status: MessageStatusShadow("failed".to_string()),
+                    message_id: Some(message_id.to_string()),
+                    verification: Some(
+                        "run team-agent attach-leader or team-agent takeover".to_string(),
+                    ),
+                    stage: None,
+                    reason: Some(DeliveryRefusal::LeaderNotAttached),
+                    channel: Some("rebind_required".to_string()),
+                });
+            }
+        }
+        if crate::codex_app_server::receiver_is_app_server(receiver) {
+            return deliver_leader_via_app_server(
                 store,
                 event_log,
+                state,
                 message_id,
-                receiver,
-                &message.sender,
-            )? {
-                return Ok(outcome);
-            }
-            // 0.5.4 gate054 cross-team leak fix: a `leader_receiver.status`
-            // other than `"attached"` (restart demotes killed-session receivers
-            // to `"rebind_required"` — lifecycle/restart/rebuild.rs:1311) MUST
-            // refuse delivery before any pane injection or cross-server pane-id
-            // probing. Without this gate, a stale receiver on team A's socket
-            // could otherwise fall back to the same pane id on the main tmux
-            // server (delivery.rs:1150-1201) and inject A's leader traffic into
-            // team B's leader pane. See .team/artifacts/0.5.4-gate-crossteam-notify-triage.md.
-            if let Some(status) = leader_receiver_status(state) {
-                if status != "attached" {
-                    store.mark(message_id, "failed", Some("leader_not_attached"))?;
-                    event_log.write(
-                        "leader_receiver.delivery_blocked",
-                        serde_json::json!({
-                            "message_id": message_id,
-                            "sender": message.sender,
-                            "reason": "leader_receiver_not_attached",
-                            "channel": "rebind_required",
-                            "action": "run team-agent attach-leader or team-agent takeover",
-                            "status": status,
-                        }),
-                    )?;
-                    return Ok(DeliveryOutcome {
-                        ok: false,
-                        status: DeliveryStatus::Refused,
-                        message_status: MessageStatusShadow("failed".to_string()),
-                        message_id: Some(message_id.to_string()),
-                        verification: Some(
-                            "run team-agent attach-leader or team-agent takeover".to_string(),
-                        ),
-                        stage: None,
-                        reason: Some(DeliveryRefusal::LeaderNotAttached),
-                        channel: Some("rebind_required".to_string()),
-                    });
-                }
-            }
-            if crate::codex_app_server::receiver_is_app_server(receiver) {
-                return deliver_leader_via_app_server(
-                    store,
-                    event_log,
-                    state,
-                    message_id,
-                    &message,
-                    canonical_owner_team_id.as_deref(),
-                );
-            }
+                &message,
+                canonical_owner_team_id.as_deref(),
+            );
         }
     }
-    if message.recipient == "leader" && leader_receiver_has_noncanonical_tmux_socket(state) {
-        store.mark(message_id, "failed", Some("leader_not_attached"))?;
-        event_log.write(
-            "leader_receiver.delivery_blocked",
-            serde_json::json!({
-                "message_id": message_id,
-                "sender": message.sender,
-                "reason": "leader_not_attached",
-                "channel": "rebind_required",
-                "action": "run team-agent claim-leader or team-agent takeover",
-                "error": "leader_receiver.tmux_socket is not a canonical full socket path",
-            }),
-        )?;
-        return Ok(DeliveryOutcome {
-            ok: false,
-            status: DeliveryStatus::Refused,
-            message_status: MessageStatusShadow("failed".to_string()),
-            message_id: Some(message_id.to_string()),
-            verification: Some("run team-agent claim-leader or team-agent takeover".to_string()),
-            stage: None,
-            reason: Some(DeliveryRefusal::LeaderNotAttached),
-            channel: Some("rebind_required".to_string()),
-        });
-    }
     let delivery_transport =
         delivery_transport_for_recipient(workspace, transport, state, &message.recipient);
     let transport = delivery_transport.as_transport();
@@ -334,32 +414,6 @@ pub fn deliver_pending_message(
             });
         }
     };
-    // Do not inject queued leader messages into a synthetic "leader" window.
-    if message.recipient == "leader"
-        && !leader_receiver_pane_is_usable(transport, state, &live_targets)
-    {
-        store.mark(message_id, "failed", Some("leader_not_attached"))?;
-        event_log.write(
-            "leader_receiver.delivery_blocked",
-            serde_json::json!({
-                "message_id": message_id,
-                "sender": message.sender,
-                "reason": "leader_not_attached",
-                "channel": "rebind_required",
-                "action": "run team-agent claim-leader or team-agent takeover",
-            }),
-        )?;
-        return Ok(DeliveryOutcome {
-            ok: false,
-            status: DeliveryStatus::Refused,
-            message_status: MessageStatusShadow("failed".to_string()),
-            message_id: Some(message_id.to_string()),
-            verification: Some("run team-agent claim-leader or team-agent takeover".to_string()),
-            stage: None,
-            reason: Some(DeliveryRefusal::LeaderNotAttached),
-            channel: Some("rebind_required".to_string()),
-        });
-    }
     let resolved = resolve_inject_target(state, &message.recipient, transport, &live_targets);
     if let Some(stale) = resolved.stale_binding.as_ref() {
         event_log.write(
@@ -524,14 +578,10 @@ pub fn deliver_pending_message(
     }
     let submit_verified = inject_submit_verified(&inject_report);
     let readback_verified = pane_readback_verified(&inject_report);
-    // Leader pane: inject success is delivery proof. Worker pane: post-submit
-    // evidence is the delivery proof; stale Phase-1 readback must not veto it
-    // and cannot independently prove the current Enter submitted.
-    let verified = if is_leader_recipient {
-        true
-    } else {
-        submit_verified
-    };
+    // A successful tmux command is never provider-acceptance proof. Leader and
+    // worker delivery both require post-submit evidence; leader additionally
+    // waits for its authoritative provider transcript below.
+    let verified = submit_verified;
     if !verified {
         let reason = if !readback_verified {
             "pane_readback_unverified:capture_missing_token".to_string()
@@ -658,7 +708,26 @@ pub fn deliver_pending_message(
             });
         }
     }
-    store.mark(message_id, "delivered", None)?;
+    if is_leader_recipient {
+        store.record_delivery_submission(message_id, readback_verified)?;
+        if !leader_transcript_has_token(state, message_id) {
+            store.mark(message_id, "submitted_pending_acceptance", None)?;
+            event_log.write(
+                "leader_receiver.acceptance_pending",
+                serde_json::json!({
+                    "message_id": message_id,
+                    "reason": "provider_receipt_not_observed",
+                }),
+            )?;
+            return Ok(leader_acceptance_pending_outcome(
+                message_id,
+                "submitted_pending_acceptance",
+            ));
+        }
+        store.mark_delivered_with_receipt(message_id)?;
+    } else {
+        store.mark(message_id, "delivered", None)?;
+    }
     let mut delivered_event = serde_json::json!({"message_id": message_id});
     if let Some(metadata) = resolved.metadata.as_ref() {
         append_target_metadata(&mut delivered_event, metadata);
@@ -908,7 +977,8 @@ fn deliver_leader_via_app_server(
     );
     match crate::codex_app_server::submit_to_bound_thread(&binding, message_id, &rendered) {
         Ok(submit) => {
-            store.mark(message_id, "delivered", None)?;
+            store.record_delivery_submission(message_id, true)?;
+            store.mark_delivered_with_receipt(message_id)?;
             event_log.write(
                 "message.delivered",
                 serde_json::json!({"message_id": message_id}),
@@ -1482,32 +1552,6 @@ fn leader_receiver_pane_binding(state: &serde_json::Value) -> Option<PaneSocketB
         .or_else(|| only_team_entry(state).and_then(leader_receiver_pane_binding_in_state))
 }
 
-/// `state` is "usable" for leader delivery when the bound `leader_receiver.pane_id`
-/// is present and alive (in `live_targets` or `liveness` probe returns not-Dead).
-///
-/// **0.3.24 excision (U1-A real-machine RED v2)**: the wave-2 session+window drift
-/// fallback was removed. Drift now fails loudly as `leader_not_attached` —
-/// see resolve_inject_target and `.team/artifacts/u1-a-realmachine-v2-fix-or-excise.md`.
-fn leader_receiver_pane_is_usable(
-    transport: &dyn Transport,
-    state: &serde_json::Value,
-    live_targets: &[PaneInfo],
-) -> bool {
-    let Some(pane_id) = leader_receiver_pane_id(state) else {
-        return false;
-    };
-    if live_targets
-        .iter()
-        .any(|target| target.pane_id.as_str() == pane_id)
-    {
-        return true;
-    }
-    !matches!(
-        transport.liveness(&PaneId::new(pane_id)),
-        Ok(PaneLiveness::Dead)
-    )
-}
-
 /// 0.5.x Phase 1d Batch 4: the `Owned` variant now carries a boxed
 /// `Transport` trait object rather than a concrete `TmuxBackend`. All
 /// existing leader-fallback sites still supply a `TmuxBackend` here
@@ -1580,7 +1624,7 @@ fn delivery_transport_for_recipient<'a>(
         // switching transports on a match can cross the team/tmux boundary and
         // inject A's leader traffic into team B's leader pane. If the pane is
         // absent on the recorded endpoint, let the downstream
-        // `leader_receiver_pane_is_usable` guard produce `rebind_required`
+        // the shared leader-channel resolver produce `rebind_required`
         // instead of falling back to another server.
         let endpoint_backend = crate::transport_factory::tmux_endpoint_transport(socket);
         DeliveryTransport::Owned(Box::new(endpoint_backend))
@@ -1622,20 +1666,6 @@ fn leader_receiver_tmux_socket(state: &serde_json::Value) -> Option<&str> {
     leader_receiver_field(state, "tmux_socket")
 }
 
-/// 0.5.4 gate054 cross-team leak fix: read the bound `leader_receiver.status`
-/// through the same team-scope resolution as [`leader_receiver_tmux_socket`].
-/// Restart marks demoted receivers as `"rebind_required"`
-/// (lifecycle/restart/rebuild.rs:1311); delivery must refuse before injecting
-/// or cross-server pane-id probing (delivery.rs:1150-1201).
-fn leader_receiver_status(state: &serde_json::Value) -> Option<&str> {
-    leader_receiver_field(state, "status")
-}
-
-fn leader_receiver_has_noncanonical_tmux_socket(state: &serde_json::Value) -> bool {
-    leader_receiver_tmux_socket(state)
-        .is_some_and(|socket| socket != "default" && !std::path::Path::new(socket).is_absolute())
-}
-
 fn leader_receiver_field<'a>(state: &'a serde_json::Value, field: &str) -> Option<&'a str> {
     leader_receiver_field_in_state(state, field)
         .or_else(|| {
@@ -1800,10 +1830,16 @@ pub fn deliver_pending_messages(
         let conn = crate::db::schema::open_db(store.db_path())?;
         let mut stmt = conn.prepare(
             "select message_id from messages
-             where status in ('pending', 'accepted', 'target_resolved')
+             where status in (
+                 'pending', 'accepted', 'target_resolved',
+                 'submitted_pending_acceptance', 'queued_until_leader_attach', ?1
+             )
              order by created_at, message_id",
         )?;
-        let rows = stmt.query_map([], |row| row.get::<_, String>(0))?;
+        let rows = stmt.query_map(
+            [crate::message_store::MessageRowStatus::QueuedCoordinatorUnavailable.as_str()],
+            |row| row.get::<_, String>(0),
+        )?;
         rows.collect::<Result<Vec<_>, _>>()?
     };
     let mut delivered = Vec::new();
@@ -1874,7 +1910,7 @@ pub fn deliver_pending_messages(
                 continue;
             }
         };
-        if outcome.ok {
+        if matches!(outcome.status, DeliveryStatus::Delivered) {
             delivered.push(message_id);
         }
     }
@@ -2017,6 +2053,73 @@ fn recipient_is_busy(state: &serde_json::Value, recipient: &str) -> bool {
         == Some("busy")
 }
 
+fn leader_rollout_path(state: &serde_json::Value) -> Option<std::path::PathBuf> {
+    state
+        .get("leader")
+        .and_then(|leader| leader.get("rollout_path"))
+        .and_then(serde_json::Value::as_str)
+        .or_else(|| {
+            leader_receiver_value(state)
+                .and_then(|receiver| receiver.get("rollout_path"))
+                .and_then(serde_json::Value::as_str)
+        })
+        .filter(|path| !path.is_empty())
+        .map(std::path::PathBuf::from)
+}
+
+pub(crate) fn leader_transcript_has_token(state: &serde_json::Value, message_id: &str) -> bool {
+    let Some(path) = leader_rollout_path(state) else {
+        return false;
+    };
+    rollout_tail_contains(
+        &path,
+        &format!("[team-agent-token:{message_id}]"),
+        64 * 1024,
+    )
+}
+
+fn leader_acceptance_pending_outcome(message_id: &str, status: &str) -> DeliveryOutcome {
+    DeliveryOutcome {
+        ok: true,
+        status: DeliveryStatus::RetryScheduled,
+        message_status: MessageStatusShadow(status.to_string()),
+        message_id: Some(message_id.to_string()),
+        verification: Some("provider_receipt_not_observed".to_string()),
+        stage: Some(DeliveryStage::Submit),
+        reason: None,
+        channel: Some("leader_acceptance_pending".to_string()),
+    }
+}
+
+fn observe_pending_leader_acceptance(
+    store: &MessageStore,
+    event_log: &EventLog,
+    state: &serde_json::Value,
+    message_id: &str,
+) -> Result<DeliveryOutcome, MessagingError> {
+    if !leader_transcript_has_token(state, message_id) {
+        return Ok(leader_acceptance_pending_outcome(
+            message_id,
+            "submitted_pending_acceptance",
+        ));
+    }
+    store.mark_delivered_with_receipt(message_id)?;
+    event_log.write(
+        "message.delivered",
+        serde_json::json!({"message_id": message_id}),
+    )?;
+    Ok(DeliveryOutcome {
+        ok: true,
+        status: DeliveryStatus::Delivered,
+        message_status: MessageStatusShadow("delivered".to_string()),
+        message_id: Some(message_id.to_string()),
+        verification: Some("provider_transcript_receipt".to_string()),
+        stage: None,
+        reason: None,
+        channel: Some("leader_receiver".to_string()),
+    })
+}
+
 /// `_handle_trust_retry_needed` (`delivery.py:221`):trust 应答失败时调度有界退避重试
 /// (`attempt < MAX` → schedule;`>= MAX` → 终态 mark failed + `trust_auto_answer_exhausted`)。
 pub fn handle_trust_retry_needed(
@@ -2341,8 +2444,10 @@ fn save_scoped_state(
     state: &serde_json::Value,
     owner_team_id: Option<&str>,
 ) -> Result<(), MessagingError> {
-    if owner_team_id.filter(|team| !team.is_empty()).is_some() {
-        if state
+    let scoped_owner_team_id = owner_team_id
+        .filter(|team| !team.is_empty())
+        .filter(|_| {
+            state
             .get("teams")
             .and_then(serde_json::Value::as_object)
             .is_some_and(|teams| {
@@ -2354,14 +2459,13 @@ fn save_scoped_state(
                     })
                     .is_some_and(|team| teams.contains_key(&team))
             })
-        {
-            crate::state::projection::save_team_scoped_state(workspace, state)?;
-        } else {
-            crate::state::persist::save_runtime_state(workspace, state)?;
-        }
-    } else {
-        crate::state::persist::save_runtime_state(workspace, state)?;
-    }
+        });
+    crate::state::repository::StateRepository::new(workspace).save(
+        crate::state::repository::StateWriteIntent::MessagingDeliveryState {
+            owner_team_id: scoped_owner_team_id,
+        },
+        state,
+    )?;
     Ok(())
 }
 
@@ -2374,8 +2478,10 @@ fn save_scoped_state_reapplying_after_conflict<F>(
 where
     F: FnOnce(&mut serde_json::Value),
 {
-    if owner_team_id.filter(|team| !team.is_empty()).is_some()
-        && state
+    let scoped_owner_team_id = owner_team_id
+        .filter(|team| !team.is_empty())
+        .filter(|_| {
+            state
             .get("teams")
             .and_then(serde_json::Value::as_object)
             .is_some_and(|teams| {
@@ -2387,15 +2493,14 @@ where
                     })
                     .is_some_and(|team| teams.contains_key(&team))
             })
-    {
-        crate::state::projection::save_team_scoped_state_reapplying_after_conflict(
-            workspace, state, reapply,
-        )?;
-    } else {
-        crate::state::persist::save_runtime_state_reapplying_after_conflict(
-            workspace, state, reapply,
-        )?;
-    }
+        });
+    crate::state::repository::StateRepository::new(workspace).save_reapplying(
+        crate::state::repository::StateWriteIntent::MessagingDeliveryState {
+            owner_team_id: scoped_owner_team_id,
+        },
+        state,
+        reapply,
+    )?;
     Ok(())
 }
 

package/crates/team-agent/src/messaging/helpers.rs

@@ -274,21 +274,25 @@ pub fn fail_leader_delivery(
     error: Option<&str>,
 ) -> Result<DeliveryOutcome, MessagingError> {
     let store = MessageStore::open(workspace)?;
-    let sender = payload
-        .get("sender")
-        .and_then(serde_json::Value::as_str)
-        .unwrap_or("system");
-    let content = payload
-        .get("content")
-        .and_then(serde_json::Value::as_str)
-        .unwrap_or("");
-    let task_id = payload.get("task_id").and_then(serde_json::Value::as_str);
-    let message_id = match payload
+    let Some(message_id) = payload
         .get("message_id")
         .and_then(serde_json::Value::as_str)
-    {
-        Some(existing) => existing.to_string(),
-        None => store.create_message(task_id, sender, "leader", content, None, false, None)?,
+        .map(ToOwned::to_owned)
+    else {
+        crate::event_log::EventLog::new(workspace).write(
+            "leader_receiver.delivery_failed_without_message",
+            serde_json::json!({"reason": serde_json::to_value(reason).ok(), "error": error}),
+        )?;
+        return Ok(DeliveryOutcome {
+            ok: false,
+            status: DeliveryStatus::FallbackLog,
+            message_status: MessageStatusShadow("failed".to_string()),
+            message_id: None,
+            verification: None,
+            stage: None,
+            reason: Some(reason),
+            channel: Some("fallback_log".to_string()),
+        });
     };
     store.mark(&message_id, "failed", error)?;
     crate::event_log::EventLog::new(workspace).write(