@vellumai/assistant 0.11.8 → 0.11.9-staging.2

package/src/persistence/conversation-queries.ts

@@ -25,6 +25,8 @@ import { ensureDisplayOrderMigration } from "./conversation-display-order-migrat
 import { ensureGroupMigration } from "./conversation-group-migration.js";
 import { searchMessageIdsLexical } from "./conversation-search-lexical.js";
 import {
+  ASSISTANT_INITIATED_GROUP_ID,
+  ASSISTANT_INITIATED_SOURCE,
   type ConversationType,
   NATIVE_ORIGIN_CHANNEL,
   PINNED_GROUP_ID,
@@ -213,6 +215,58 @@ function notBackgroundVisibilitySql(alias = "conversations"): string {
   );
 }
 
+/**
+ * Raw SQL predicate for "a thread the assistant started on its own": the rows
+ * stamped {@link ASSISTANT_INITIATED_SOURCE} at creation by a producer that
+ * opted the thread into the section.
+ *
+ * Membership rides `source` rather than `group_id` because those rows are
+ * filed nowhere — see {@link ASSISTANT_INITIATED_GROUP_ID} for why the section
+ * is still named as a group id. It is a dedicated source rather than the
+ * notification pipeline's `'notification'`, whose rows are the transactional
+ * request trails (guardian approvals, confirmation / access / question /
+ * tool-grant requests, channel deliveries) that belong to the bell and to
+ * Chats - see {@link ASSISTANT_INITIATED_SOURCE} for the full rationale.
+ */
+function assistantInitiatedSql(alias = "conversations"): string {
+  return `(${alias}.source = '${ASSISTANT_INITIATED_SOURCE}' AND ${ungroupedSql(alias)})`;
+}
+
+/**
+ * The complement of {@link assistantInitiatedSql}, spelled out rather than
+ * wrapped in `NOT`.
+ *
+ * `source` is nullable and the overwhelming majority of rows carry NULL, so
+ * `NOT (source = '...')` evaluates to NULL for them under SQL's three-valued
+ * logic and the WHERE clause drops them. Negating the column naively would
+ * therefore not withhold one section from Chats - it would empty Chats.
+ */
+function notAssistantInitiatedSql(alias = "conversations"): string {
+  return `(${alias}.source IS NULL OR ${alias}.source != '${ASSISTANT_INITIATED_SOURCE}' OR NOT ${ungroupedSql(alias)})`;
+}
+
+/**
+ * Raw SQL predicate for {@link UNGROUPED_GROUP_ID}: every row the sidebar's
+ * flat list shows — not pinned and not filed in a custom group.
+ *
+ * It deliberately admits the system buckets, because a surfaced background or
+ * scheduled conversation keeps its `system:background` / `system:scheduled`
+ * group id (surfacing writes only `surfaced_at`) while the standard listing
+ * renders it in Recents. Whether such a row is actually visible stays with
+ * {@link conversationTypeClause}, which admits the surfaced ones and excludes
+ * the rest; matching on group id alone here would drop them.
+ *
+ * Named because two sections are carved out of this same set — Chats and the
+ * assistant-initiated threads — and they have to agree on what it contains or
+ * a row lands in both or neither.
+ */
+function ungroupedSql(alias = "conversations"): string {
+  return (
+    `(${alias}.group_id IS NULL` +
+    ` OR (${alias}.group_id LIKE 'system:%' AND ${alias}.group_id != '${PINNED_GROUP_ID}'))`
+  );
+}
+
 /**
  * SQL predicate selecting which bucket {@link listConversations} and
  * {@link countConversations} return, keyed by the canonical
@@ -293,6 +347,21 @@ export interface ConversationListFilter {
    * row instead of paging past runs it would skip.
    */
   foregroundOnly?: true;
+  /**
+   * Withhold the threads the assistant started on its own
+   * ({@link assistantInitiatedSql}) from the result.
+   *
+   * The exact complement of `groupId: ASSISTANT_INITIATED_GROUP_ID`, and the
+   * other half of splitting that section out of Chats: without it those rows
+   * would be counted and listed twice, once in their own section and once in
+   * the leftover bucket that never excluded them. Being the exact complement
+   * matters as much as the exclusion — a thread the user pinned or filed into
+   * a custom group is not in the assistant section, so this must not withhold
+   * it from the section that does hold it. Only `true` narrows; omit to keep
+   * every row, which is what every caller does while the
+   * `assistant-initiated-threads` flag is off.
+   */
+  excludeAssistantInitiated?: true;
 }
 
 export interface ConversationListQuery extends ConversationListFilter {
@@ -313,16 +382,15 @@ export interface ConversationListQuery extends ConversationListFilter {
  * declared in `schema/conversations.ts`.
  */
 function groupIdClause(groupId: string) {
+  if (groupId === ASSISTANT_INITIATED_GROUP_ID) {
+    // Not a `group_id` match: `source` decides membership. See
+    // ASSISTANT_INITIATED_GROUP_ID. Still narrowed to the ungrouped set,
+    // because filing one of these threads into a custom group — or pinning it
+    // — must move it there rather than leave it in two sections at once.
+    return sql.raw(assistantInitiatedSql());
+  }
   if (groupId === UNGROUPED_GROUP_ID) {
-    // "Ungrouped" means every row the sidebar's flat list shows: not pinned
-    // and not filed in a custom group. It deliberately admits the system
-    // buckets, because a surfaced background or scheduled conversation keeps
-    // its `system:background` / `system:scheduled` group id (surfacing writes
-    // only `surfaced_at`) while the standard listing renders it in Recents.
-    // Whether such a row is actually visible stays with
-    // `conversationTypeClause`, which admits the surfaced ones and excludes
-    // the rest; matching on group id alone here would drop them.
-    return sql`(group_id IS NULL OR (group_id LIKE 'system:%' AND group_id != ${PINNED_GROUP_ID}))`;
+    return sql.raw(ungroupedSql());
   }
   // `group_id` is single-valued and authoritative, so a row belongs to
   // exactly one section by construction. `is_pinned` is a derived duplicate
@@ -376,6 +444,7 @@ function conversationListWhere(filter: ConversationListFilter) {
     groupId,
     needsAttention,
     foregroundOnly,
+    excludeAssistantInitiated,
   } = filter;
   return and(
     conversationTypeClause(conversationType),
@@ -384,6 +453,7 @@ function conversationListWhere(filter: ConversationListFilter) {
     groupId ? groupIdClause(groupId) : undefined,
     ...(needsAttention ? unseenAttentionStateConditions() : []),
     foregroundOnly ? sql.raw(notBackgroundVisibilitySql()) : undefined,
+    excludeAssistantInitiated ? sql.raw(notAssistantInitiatedSql()) : undefined,
   );
 }
 
@@ -699,11 +769,34 @@ export interface ConversationSectionCount {
 export interface ConversationSectionCounts {
   groups: Array<{ groupId: string } & ConversationSectionCount>;
   channels: Array<{ channel: string } & ConversationSectionCount>;
+  /**
+   * The assistant-initiated section, present only when the caller asked for
+   * the split ({@link CountConversationSectionsOptions.splitAssistantInitiated}).
+   * Absent — not zero — when it did not, so a caller that never asked cannot
+   * mistake "not split out" for "split out and empty".
+   *
+   * When present, these rows are withheld from `channels`, keeping the two
+   * axes disjoint the way `groups` and `channels` already are.
+   */
+  assistantInitiated?: ConversationSectionCount;
+}
+
+export interface CountConversationSectionsOptions {
+  /**
+   * Count the threads the assistant started on its own as their own section
+   * and withhold them from the channel buckets. Off by default: the caller
+   * that knows about the `assistant-initiated-threads` flag turns it on, and
+   * every other caller keeps today's shape.
+   */
+  splitAssistantInitiated?: boolean;
 }
 
-export function countConversationSections(): ConversationSectionCounts {
+export function countConversationSections(
+  options: CountConversationSectionsOptions = {},
+): ConversationSectionCounts {
   ensureGroupMigration();
   const db = getDb();
+  const { splitAssistantInitiated = false } = options;
 
   /* `countUnreadConversations` gets the same effect with an INNER JOIN and
      the unseen conditions in its WHERE; here every row must be counted and
@@ -747,12 +840,48 @@ export function countConversationSections(): ConversationSectionCounts {
         conversationTypeClause("standard"),
         isNull(conversations.archivedAt),
         groupIdClause(UNGROUPED_GROUP_ID),
+        /* The split's other half. These rows are ungrouped and natively
+           attributed, so without this they stay in the Chats bucket and get
+           counted in both sections at once. */
+        splitAssistantInitiated
+          ? sql.raw(notAssistantInitiatedSql())
+          : undefined,
       ),
     )
     .groupBy(effectiveChannel)
     .all();
 
-  return { groups, channels };
+  if (!splitAssistantInitiated) {
+    return { groups, channels };
+  }
+
+  /* Composed from the same predicates as the buckets above rather than
+     restated, so this section's badge cannot drift from theirs: same standard
+     listing visibility, same active-rows-only rule, same unread CASE. */
+  const [assistantInitiated] = db
+    .select({ total: count(), unread })
+    .from(conversations)
+    .leftJoin(conversationAssistantAttentionState, attentionJoin)
+    .where(
+      and(
+        conversationTypeClause("standard"),
+        isNull(conversations.archivedAt),
+        groupIdClause(ASSISTANT_INITIATED_GROUP_ID),
+      ),
+    )
+    .all();
+
+  return {
+    groups,
+    channels,
+    /* The aggregate is over no GROUP BY, so it always yields one row — but it
+       yields `unread: null` rather than 0 when no row matched, because SUM
+       over an empty set is NULL. */
+    assistantInitiated: {
+      total: assistantInitiated?.total ?? 0,
+      unread: assistantInitiated?.unread ?? 0,
+    },
+  };
 }
 
 /**
@@ -1250,10 +1379,6 @@ function wrapRecallEvidenceExcerpt(
     : wrapUntrustedContent(excerpt, { source });
 }
 
-function escapeRegExp(value: string): string {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
 /**
  * Earliest case-insensitive match of the query in `text`: the contiguous
  * query when present, otherwise the earliest of its lexical tokens (same
@@ -1275,7 +1400,7 @@ function findEarliestMatch(
     ).exec(text);
   };
 
-  const whole = execAnchored(escapeRegExp(query));
+  const whole = execAnchored(RegExp.escape(query));
   if (whole) {
     return { index: whole.index, length: whole[0].length };
   }
@@ -1285,7 +1410,9 @@ function findEarliestMatch(
   if (tokens.length === 0) {
     return null;
   }
-  const match = execAnchored(tokens.map(escapeRegExp).join("|"));
+  const match = execAnchored(
+    tokens.map((token) => RegExp.escape(token)).join("|"),
+  );
   return match ? { index: match.index, length: match[0].length } : null;
 }
 

package/src/persistence/conversation-types.ts

@@ -82,10 +82,7 @@ export function isBackgroundConversationType(
  * columns into one label.
  */
 export type ConversationKind =
-  | "user"
-  | "background"
-  | "background_memory_consolidation"
-  | "scheduled";
+  "user" | "background" | "background_memory_consolidation" | "scheduled";
 
 /**
  * Single classifier shared by the LLM-context routes and the notification
@@ -363,7 +360,9 @@ export function isDesktopOriginatedUserMessage(
     return false;
   }
   const clientOs = parseClientOs((client as Record<string, unknown>).os);
-  return clientOs === "macos" || clientOs === "windows";
+  return (
+    clientOs === "macos" || clientOs === "windows" || clientOs === "linux"
+  );
 }
 
 /**
@@ -449,6 +448,41 @@ export function isReplyPushIneligibleUserMessage(
 export const UNGROUPED_GROUP_ID = "system:all";
 export const PINNED_GROUP_ID = "system:pinned";
 
+/**
+ * The `conversations.source` that makes a thread a member of the
+ * assistant-initiated section ({@link ASSISTANT_INITIATED_GROUP_ID}).
+ *
+ * Opt-in and stamped at creation, by a producer declaring "this is a thread
+ * I started because it is worth the user's time" - a heartbeat realization,
+ * an observation the user did not ask for. Deliberately NOT the notification
+ * pipeline's `'notification'`: the conversations that stamp carries are the
+ * transactional flows (guardian call approvals, confirmation / access /
+ * question / tool-grant requests, channel delivery trails - the
+ * `requiresConversation` producers), which belong to the bell and to Chats,
+ * and matching on it would also sweep every historical row into the section
+ * the day the flag turns on. A dedicated source makes membership all-new by
+ * construction: nothing stamps it until a producer passes it through
+ * `conversationMetadata.source` on its notification signal (see
+ * `notifications/conversation-pairing.ts`), so the section holds exactly the
+ * threads written for it and nothing retroactively.
+ */
+// FROZEN: persisted `conversations.source` value. Never rename it.
+export const ASSISTANT_INITIATED_SOURCE = "assistant_initiated";
+
+/**
+ * The section holding the conversations the assistant started on its own:
+ * the threads stamped {@link ASSISTANT_INITIATED_SOURCE} at creation.
+ *
+ * A pseudo-group in the same sense as {@link UNGROUPED_GROUP_ID}: no row
+ * carries it in `group_id`. Those conversations are filed nowhere (NULL
+ * `group_id`), so without the split they land in Chats; membership is
+ * decided by `source`, not by the column this id names. It is spelled as a
+ * group id anyway so a client selects the section through the `groupId`
+ * parameter every other section already uses, rather than through a filter
+ * only this one section knows about.
+ */
+export const ASSISTANT_INITIATED_GROUP_ID = "system:assistant";
+
 /**
  * The `origin_channel` value for a conversation started in Vellum itself
  * rather than arriving from an external channel.

package/src/persistence/delivery-crud.ts

@@ -5,10 +5,21 @@
  * finding messages by source identifiers, and managing raw payload storage.
  */
 
-import { and, desc, eq, isNotNull, like, ne, or, sql } from "drizzle-orm";
+import {
+  and,
+  desc,
+  eq,
+  isNotNull,
+  like,
+  ne,
+  notExists,
+  or,
+  sql,
+} from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
 import type { ChannelId } from "../channels/types.js";
+import type { ProviderMessageMetadata } from "../messaging/provider-message-metadata.js";
 import { readProviderMetadata } from "../messaging/read-provider-metadata.js";
 import type { SlackInboundMessageMetadata } from "../runtime/http-types.js";
 import { parseJsonSafe } from "../util/json.js";
@@ -23,6 +34,7 @@ import type { NonScheduledConversationType } from "./conversation-types.js";
 import { getDb } from "./db-connection.js";
 import {
   channelInboundEvents,
+  channelOutboundPosts,
   conversationKeys,
   conversations,
   messages,
@@ -55,8 +67,26 @@ const SLACK_LEGACY_THREAD_EVIDENCE_MAX_SCAN = 500;
  * Bounded on purpose: the scan runs on the inbound path while the gateway
  * waits for its ack, and reactions land on recent messages, so a cap costs
  * almost no recall and keeps the cost flat as the database grows.
+ *
+ * The candidate set is provenance-bearing rows with no inbound-event link
+ * (the NOT EXISTS in the query): inbound user rows carry `providerMeta` too,
+ * but the inbound-event index already resolves them, so admitting them here
+ * would only shrink the window of assistant posts the cap can reach.
+ */
+const OUTBOUND_MESSAGE_ID_MAX_SCAN = 800;
+const PROVIDER_MESSAGE_ID_SCAN_BATCH_SIZE = 200;
+const UNRECONCILED_OUTBOUND_ROW_SCAN = 25;
+
+/**
+ * Widened `maxScan` for the deletion path's TRANSITIONAL fallback. Posts
+ * delivered since `channel_outbound_posts` exists resolve through that
+ * index exactly, at any age; this bound serves only rows reconciled before
+ * the table. A delete can target an arbitrarily old such post, so recency
+ * is not a completeness contract, but deletes are rare and run off the
+ * gateway-ack hot path, so a deep batched scan is affordable. Delete this
+ * (and the fallback scan) once pre-table rows stop mattering.
  */
-const OUTBOUND_MESSAGE_ID_MAX_SCAN = 400;
+export const DELETE_PROVIDER_MESSAGE_ID_MAX_SCAN = 20_000;
 
 /**
  * Channels where an inbound thread id scopes the conversation: a Slack thread
@@ -295,33 +325,173 @@ export function findInboundEvent(
 }
 
 /**
- * The conversation holding the message with this provider id, found by
- * reading the metadata the assistant's own posts carry, on any channel.
+ * The message row carrying this provider id in its stored envelope, on any
+ * channel. Returns the same shape as {@link findMessageBySourceId} so the
+ * two resolution legs compose: that one covers every message that arrived
+ * as an inbound event, and this one covers what the assistant posted, which
+ * opens no inbound event and is only identifiable by the id its row carries.
  *
  * Reads through `readProviderMetadata`, so it matches any channel that
  * describes its rows in the neutral shape as well as Slack's own envelope.
  *
- * `findMessageBySourceId` covers every message that arrived as an inbound
- * event. It cannot see what the assistant posted, because an outbound reply
- * opens no inbound event, so a reaction on the assistant's own message needs
- * this. The search is confined to conversations already bound to the same
- * channel address and to the most recent
- * {@link OUTBOUND_MESSAGE_ID_MAX_SCAN} rows among them; beyond that it gives
- * up and the caller drops the annotation, which is the same outcome as never
- * finding it at all.
+ * The search is confined to conversations already bound to the same
+ * channel address and, by default, to the most recent
+ * {@link OUTBOUND_MESSAGE_ID_MAX_SCAN} rows among them: reactions land on
+ * recent messages and the reaction path runs while the gateway waits for
+ * its ack. A caller resolving an event that can target arbitrarily old
+ * posts off the hot path (a deletion) widens the window via `maxScan`;
+ * beyond whichever bound applies the lookup gives up and the caller drops
+ * the annotation, which is the same outcome as never finding it at all.
  */
-export function findConversationByProviderMessageId(
+export function findMessageByProviderMessageId(
   sourceChannel: string,
   externalChatId: string,
   providerMessageId: string,
-): string | null {
+  opts?: { maxScan?: number },
+): { messageId: string; conversationId: string } | null {
   const db = getDb();
-  const keyPrefix = `${CONVERSATION_KEY_SCOPE}:${sourceChannel}:${externalChatId}`;
-  const rows = db
+
+  // The `channel_outbound_posts` index is the resolution contract: exact,
+  // unbounded by recency, one indexed read. It covers every post delivered
+  // since the table exists; the batched envelope scan below survives only
+  // as the transitional fallback for rows reconciled before it.
+  const indexed = db
     .select({
-      conversationId: messages.conversationId,
-      metadata: messages.metadata,
+      messageId: channelOutboundPosts.messageId,
+      conversationId: channelOutboundPosts.conversationId,
     })
+    .from(channelOutboundPosts)
+    .where(
+      and(
+        eq(channelOutboundPosts.sourceChannel, sourceChannel),
+        eq(channelOutboundPosts.externalChatId, externalChatId),
+        eq(channelOutboundPosts.providerMessageId, providerMessageId),
+      ),
+    )
+    .get();
+  if (indexed) {
+    return indexed;
+  }
+
+  const keyPrefix = `${CONVERSATION_KEY_SCOPE}:${sourceChannel}:${externalChatId}`;
+  const maxScan = opts?.maxScan ?? OUTBOUND_MESSAGE_ID_MAX_SCAN;
+
+  let offset = 0;
+  while (offset < maxScan) {
+    const batchLimit = Math.min(
+      PROVIDER_MESSAGE_ID_SCAN_BATCH_SIZE,
+      maxScan - offset,
+    );
+    const rows = db
+      .select({
+        id: messages.id,
+        conversationId: messages.conversationId,
+        metadata: messages.metadata,
+      })
+      .from(messages)
+      .innerJoin(
+        conversationKeys,
+        eq(conversationKeys.conversationId, messages.conversationId),
+      )
+      .where(
+        and(
+          or(
+            eq(conversationKeys.conversationKey, keyPrefix),
+            like(conversationKeys.conversationKey, `${keyPrefix}:thread:%`),
+          ),
+          or(
+            like(messages.metadata, '%"providerMeta"%'),
+            like(messages.metadata, '%"slackMeta"%'),
+          ),
+          // Rows the inbound-event index resolves are not candidates: this
+          // fallback exists for messages `findMessageBySourceId` cannot
+          // answer (the assistant's pre-table posts, a crash-window inbound
+          // row whose link never landed, and legacy linked rows whose event
+          // carries no source_message_id), and admitting resolvable rows
+          // would burn the scan budget on messages the primary path already
+          // answers.
+          notExists(
+            db
+              .select({ id: channelInboundEvents.id })
+              .from(channelInboundEvents)
+              .where(
+                and(
+                  eq(channelInboundEvents.messageId, messages.id),
+                  isNotNull(channelInboundEvents.sourceMessageId),
+                ),
+              ),
+          ),
+        ),
+      )
+      .orderBy(desc(messages.createdAt))
+      .limit(batchLimit)
+      .offset(offset)
+      .all();
+
+    for (const row of rows) {
+      const meta = readProviderMetadata(row.metadata, {
+        allowFlatLegacy: true,
+      });
+      if (
+        meta?.conversationExternalId === externalChatId &&
+        (meta.messageId === providerMessageId ||
+          meta.additionalMessageIds?.includes(providerMessageId))
+      ) {
+        return { messageId: row.id, conversationId: row.conversationId };
+      }
+    }
+    if (rows.length < batchLimit) {
+      return null;
+    }
+    offset += rows.length;
+  }
+  return null;
+}
+
+/**
+ * Record one provider post the assistant's delivery produced, into the
+ * `channel_outbound_posts` index. Idempotent: a redelivered id upserts onto
+ * the same triple and changes nothing. Written by the post-send
+ * reconciliation alongside the row's `providerMeta` envelope; the envelope
+ * stays the row's self-description, this table is the resolution index.
+ */
+export function recordOutboundPost(post: {
+  sourceChannel: string;
+  externalChatId: string;
+  providerMessageId: string;
+  messageId: string;
+  conversationId: string;
+}): void {
+  const db = getDb();
+  db.insert(channelOutboundPosts)
+    .values({
+      sourceChannel: post.sourceChannel,
+      externalChatId: post.externalChatId,
+      providerMessageId: post.providerMessageId,
+      messageId: post.messageId,
+      conversationId: post.conversationId,
+      createdAt: Date.now(),
+    })
+    .onConflictDoNothing()
+    .run();
+}
+
+/**
+ * Whether the chat has a recent outbound row still awaiting its post-send id
+ * reconciliation (a neutral envelope naming no `messageId`). The deletion
+ * path's evidence that "unresolvable" may mean "not reconciled yet" rather
+ * than "never stored": with no such row, a miss is final and the delete
+ * returns without paying a retry window. Bounded to the newest handful of
+ * rows: the race it detects is one delivery round-trip wide.
+ */
+export function hasUnreconciledOutboundRow(
+  sourceChannel: string,
+  externalChatId: string,
+): boolean {
+  const db = getDb();
+  const keyPrefix = `${CONVERSATION_KEY_SCOPE}:${sourceChannel}:${externalChatId}`;
+  const rows = db
+    .select({ metadata: messages.metadata })
     .from(messages)
     .innerJoin(
       conversationKeys,
@@ -333,27 +503,38 @@ export function findConversationByProviderMessageId(
           eq(conversationKeys.conversationKey, keyPrefix),
           like(conversationKeys.conversationKey, `${keyPrefix}:thread:%`),
         ),
-        or(
-          like(messages.metadata, '%"providerMeta"%'),
-          like(messages.metadata, '%"slackMeta"%'),
+        like(messages.metadata, '%"providerMeta"%'),
+        // Inbound rows carry `providerMeta` too, and a busy chat's newest
+        // rows are mostly inbound; excluding rows the inbound-event index
+        // resolves keeps this probe's small window counting only rows that
+        // could actually be an unreconciled outbound post.
+        notExists(
+          db
+            .select({ id: channelInboundEvents.id })
+            .from(channelInboundEvents)
+            .where(
+              and(
+                eq(channelInboundEvents.messageId, messages.id),
+                isNotNull(channelInboundEvents.sourceMessageId),
+              ),
+            ),
         ),
       ),
     )
     .orderBy(desc(messages.createdAt))
-    .limit(OUTBOUND_MESSAGE_ID_MAX_SCAN)
+    .limit(UNRECONCILED_OUTBOUND_ROW_SCAN)
     .all();
-
   for (const row of rows) {
-    const meta = readProviderMetadata(row.metadata, { allowFlatLegacy: true });
+    const meta = readProviderMetadata(row.metadata);
     if (
       meta?.conversationExternalId === externalChatId &&
-      (meta.messageId === providerMessageId ||
-        meta.additionalMessageIds?.includes(providerMessageId))
+      meta.eventKind === "message" &&
+      meta.messageId === undefined
     ) {
-      return row.conversationId;
+      return true;
     }
   }
-  return null;
+  return false;
 }
 
 export function recordInbound(
@@ -653,6 +834,21 @@ export function storeInboundSlackMetadata(
   mergeRawPayload(eventId, { slackInbound });
 }
 
+/**
+ * Persist the neutral channel inbound envelope captured at ingress onto the
+ * stored payload, the non-Slack counterpart of
+ * {@link storeInboundSlackMetadata}: the retry sweep replays the turn with
+ * the SAME `channelInbound` the live path used, so the replayed row carries
+ * an identical `providerMeta` envelope. No-ops when the payload was cleared
+ * (e.g. a secret-bearing ingress), so cleared secrets are never resurrected.
+ */
+export function storeInboundChannelMetadata(
+  eventId: string,
+  channelInbound: ProviderMessageMetadata,
+): void {
+  mergeRawPayload(eventId, { channelInbound });
+}
+
 /**
  * Return the `slackStreamMessageTs` durably recorded by any sibling inbound
  * event linked to the given user message (excluding `excludeEventId`).

package/src/persistence/delivery-status.ts

@@ -14,8 +14,27 @@ import {
   RETRY_MAX_ATTEMPTS,
   retryDelayForAttempt,
 } from "./job-utils.js";
+import type { ChannelDeliveryStatus } from "./schema.js";
 import { channelInboundEvents } from "./schema.js";
 
+/**
+ * Whether a delivery status means the row owes no further delivery.
+ *
+ * A total map over the union rather than a `!== "pending"` comparison: adding
+ * a status is then a compile error until its terminality is decided, and that
+ * decision is load-bearing. `isDeduplicatedDeliveryOwnedBySibling` reads it to
+ * decide whether a sibling event already owns this turn's reply, and the
+ * stranded-delivery recovery step treats a non-terminal row as a reply still
+ * owed. A new status silently defaulting to one side or the other either
+ * double-posts a reply or drops one.
+ */
+const DELIVERY_STATUS_IS_TERMINAL: Record<ChannelDeliveryStatus, boolean> = {
+  pending: false,
+  delivered: true,
+  failed: true,
+  dead_letter: true,
+};
+
 /**
  * How long {@link deferRetryUntilIdle} pushes `retryAfter` forward. Shorter than
  * the retry sweep's own interval so a busy-deferred event is re-evaluated on the
@@ -327,7 +346,7 @@ export function getRetryableDeliveryEvents(limit = 20): Array<{
 export function getSiblingEventDeliveryStatuses(
   messageId: string,
   excludeEventId: string,
-): string[] {
+): ChannelDeliveryStatus[] {
   const db = getDb();
   return db
     .select({ deliveryStatus: channelInboundEvents.deliveryStatus })
@@ -355,7 +374,7 @@ export function isDeduplicatedDeliveryOwnedBySibling(
   excludeEventId: string,
 ): boolean {
   return getSiblingEventDeliveryStatuses(messageId, excludeEventId).some(
-    (status) => status !== "pending",
+    (status) => DELIVERY_STATUS_IS_TERMINAL[status],
   );
 }