@volter/supercode-teams 0.3.150 → 0.3.152

package/mail/continuation.mjs

@@ -0,0 +1,101 @@
+// Native continuation is a mail route, never a caller identity or an authority alias. Only Claude's own terminal
+// continued-in row links two UUIDs. Read the requested filenames and their tails, not every transcript in a home.
+import { open, opendir, realpath, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { makeAddress, parseAddress } from './compose.mjs';
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const TAIL_BYTES = 64 * 1024;
+const MAX_PROJECTS = 4096;
+const MAX_HOPS = 16;
+const LOOKUP_MS = 750;
+const unchanged = (a, b) => a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs && a.ino === b.ino && a.dev === b.dev;
+const problem = (reason) => Object.assign(new Error(reason), { continuation: true });
+
+/** All followed homes must agree on the named transcript: a UUID copied to another project/home is ambiguous. */
+async function namedTranscript(id, roots, budget) {
+  const found = new Set();
+  for (const root of new Set(roots)) {
+    budget.check();
+    let directory;
+    try { directory = await opendir(root); }
+    catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+    for await (const project of directory) {
+      budget.check();
+      if (++budget.projects > MAX_PROJECTS) throw problem('the named transcript lookup exceeded its project bound');
+      if (!project.isDirectory() && !project.isSymbolicLink()) continue;
+      const path = join(root, project.name, `${id}.jsonl`);
+      try {
+        if ((await stat(path)).isFile()) found.add(await realpath(path));
+      } catch (error) { if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') throw error; }
+      if (found.size > 1) throw problem('more than one native transcript has that session id');
+    }
+  }
+  budget.check();
+  return [...found][0] ?? null;
+}
+
+/** A complete, unchanged final JSONL row. A partial write, large final row or changed file cannot establish a route. */
+async function terminalContinuation(path, id, budget) {
+  budget.check();
+  const file = await open(path, 'r');
+  try {
+    const before = await file.stat({ bigint: true });
+    const size = Number(before.size);
+    if (!Number.isSafeInteger(size)) throw problem('the native transcript size is not readable');
+    if (!size) return null;
+    const start = Math.max(0, size - TAIL_BYTES);
+    const bytes = Buffer.alloc(size - start);
+    const { bytesRead } = await file.read(bytes, 0, bytes.length, start);
+    const after = await file.stat({ bigint: true });
+    budget.check();
+    if (bytesRead !== bytes.length || !unchanged(before, after)) throw problem('the native transcript changed during its continuation read');
+    let end = bytes.length;
+    if (bytes[end - 1] !== 10) throw problem('the native transcript has an incomplete final row');
+    while (end && (bytes[end - 1] === 10 || bytes[end - 1] === 13)) end--;
+    const boundary = bytes.lastIndexOf(10, end - 1);
+    if (start && boundary < 0) throw problem('the native transcript final row exceeds the continuation read bound');
+    let row;
+    try { row = JSON.parse(bytes.subarray(boundary + 1, end).toString('utf8')); }
+    catch { throw problem('the native transcript final row is unreadable'); }
+    if (row?.type !== 'continued-in') return null;
+    if (row.sessionId !== id || typeof row.continuedInSessionId !== 'string' || !UUID.test(row.continuedInSessionId) || row.continuedInSessionId === id || row.isSidechain === true) {
+      throw problem('the native continuation row does not identify a distinct continuation of that session');
+    }
+    return row.continuedInSessionId;
+  } finally { await file.close(); }
+}
+
+/** Resolve an exact old native address to a currently live receiver. No route is cached, guessed or persisted.
+ * The shared budget bounds project entries, hops and elapsed lookup work, and each file read is at most 64 KiB.
+ * Filesystem calls are asynchronous; the elapsed bound is checked after each await, not an OS I/O cancellation.
+ */
+export async function nativeMailContinuation(address, { machine, claudeProjects, sessions }) {
+  const parsed = parseAddress(address);
+  if (parsed?.machine !== machine || parsed.harness !== 'claude-code' || !UUID.test(parsed.session)) return null;
+  const budget = { projects: 0, until: performance.now() + LOOKUP_MS, check() {
+    if (performance.now() > this.until) throw problem('the named transcript continuation lookup exceeded its time bound');
+  } };
+  const chain = [address];
+  try {
+    for (let hop = 0; hop <= MAX_HOPS; hop++) {
+      // The exact address may resume while its old transcript is being read. A currently live exact receiver wins.
+      if (sessions().some((row) => row.address === address)) return null;
+      const current = chain.at(-1);
+      const session = sessions().find((row) => row.address === current);
+      if (session) return chain.length > 1 ? { session, addressed: address, chain } : null;
+      if (hop === MAX_HOPS) throw problem('the native continuation chain exceeded its hop bound');
+      const id = parseAddress(current).session;
+      const path = await namedTranscript(id, claudeProjects(), budget);
+      const next = path ? await terminalContinuation(path, id, budget) : null;
+      if (!next) {
+        if (chain.length > 1) throw problem(`the recorded continuation ${current} is not running and records no further continuation`);
+        return null;
+      }
+      const target = makeAddress(machine, 'claude-code', next);
+      if (chain.includes(target)) throw problem('the native continuation chain contains a cycle');
+      chain.push(target);
+    }
+  } catch (error) { return { error: error.continuation ? error.message : `the native continuation could not be read (${error.code ?? 'filesystem error'})` }; }
+  return null;
+}

package/mail/envelope.mjs

@@ -2,8 +2,6 @@
 // reads of it (`render`). Ported line for line: what a session reads does not depend on which process read it out.
 import { blake3 } from '@noble/hashes/blake3.js';
 import { bytesToHex } from '@noble/hashes/utils.js';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
 
 /** Command an agent runs to send or reply. */
 export const SEND_COMMAND = 'supercode message send';
@@ -101,13 +99,13 @@ export const threadId = (envelope) => envelope.thread ?? envelope.id;
  * When a native question's reply reached its session (mail_question.rs `delivered_at`): only for a reply to a `q-`
  * question whose recorded reply is this envelope.
  */
-export function questionDeliveredAt(envelope, mailRoot) {
+export function questionDeliveredAt(envelope, store) {
   const id = envelope.in_reply_to;
   if (typeof id !== 'string' || !id.startsWith('q-')) return null;
   try {
-    const reply = JSON.parse(readFileSync(join(mailRoot, 'native-questions', `${id}.reply`), 'utf8'));
+    const reply = store.record('native_questions', `${id}.reply`);
     if (reply?.envelope?.id !== envelope.id) return null;
-    const delivered = JSON.parse(readFileSync(join(mailRoot, 'native-questions', `${id}.delivered`), 'utf8'));
+    const delivered = store.record('native_questions', `${id}.delivered`);
     return Number.isFinite(delivered) ? delivered : null;
   } catch { return null; }
 }
@@ -128,9 +126,9 @@ export function describe(delivery) {
 const printable = (name) => [...String(name)].filter((character) => /^[A-Za-z0-9\-_.@ ]$/.test(character)).slice(0, 80).join('');
 
 /** A message as an inbox lists it (message.rs `listed`). */
-export function listed(envelope, deliveries, mailRoot) {
+export function listed(envelope, deliveries, store) {
   const sent = rfc3339(envelope.created_at_ms);
-  const native = questionDeliveredAt(envelope, mailRoot);
+  const native = questionDeliveredAt(envelope, store);
   const delivered = describe(native !== null ? { state: 'delivered', at_ms: native } : deliveries.get(envelope.id) ?? null);
   if (envelope.kind === 'answer') return `${render(envelope)}\n(sent ${sent})`;
   if (envelope.kind !== 'user') return `${render(envelope)}\n(sent ${sent}; delivered to the model: ${delivered})`;
@@ -143,13 +141,13 @@ export function listed(envelope, deliveries, mailRoot) {
 }
 
 /** A message as `show` and `inbox --json` give it (message.rs `message_row`). */
-export function messageRow(address, stored, deliveries, mailRoot) {
-  const native = questionDeliveredAt(stored.envelope, mailRoot);
+export function messageRow(address, stored, deliveries, store) {
+  const native = questionDeliveredAt(stored.envelope, store);
   return {
     session: address,
     state: stored.state,
     delivery: native !== null ? { state: 'delivered', at_ms: native } : deliveries.get(stored.envelope.id) ?? null,
     envelope: stored.envelope,
-    rendered: listed(stored.envelope, deliveries, mailRoot),
+    rendered: listed(stored.envelope, deliveries, store),
   };
 }

package/mail/hooks.mjs

@@ -7,8 +7,8 @@
 //   that send went, `relay-inbound` files mail a relay's Claude was handed in the mailbox of the session it speaks for.
 // - `message native-question-hook` (mail_question.rs `hook`): a native session's creator recorded at its start, and its
 //   AskUserQuestion asked as mail and answered by the reply.
-import { existsSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { join, resolve, sep } from 'node:path';
+import { readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
 import { envelope as makeEnvelope, makeAddress, newMessageId, parseAddress } from './compose.mjs';
 import { blake3Hex } from './envelope.mjs';
 import { typedLineId } from './transcript.mjs';
@@ -34,13 +34,14 @@ export class MailHooks {
   /** `handOver(address, id)` a filed message to its session's door; `threadOf(id)` the thread a reply to `id` joins. */
   constructor({ machine, mailRoot, store, live, handOver, threadOf, stateDir = null, log = () => {} }) {
     Object.assign(this, { machine, mailRoot, store, live, handOver, threadOf, log });
+    this.stopped = false;
+    this.waiting = new Set();
     // Windows: each Codex session's last hook (the process it ran under, the rollout it named, when), which serve's
     // Codex listing reads through this daemon (codex_peer.rs `hook_recorded_rollouts`); kept beside this daemon's state,
     // never in the mail folder (mail step 1c)
     this.codexHooksFile = stateDir ? join(stateDir, 'codex-hooks.json') : null;
     this.codexHooks = new Map(Object.entries((this.codexHooksFile && readJson(this.codexHooksFile)) || {}));
-    this.relaysRoot = resolve(mailRoot, 'relays');
-    this.questions = join(mailRoot, 'native-questions');
+    this.relaysRoots = [resolve(mailRoot, 'relays'), resolve(dirname(mailRoot), 'relays')];
   }
 
   // ---- `message hook <harness>` -------------------------------------------------------------------------------------
@@ -50,7 +51,7 @@ export class MailHooks {
     const session = typeof input?.session_id === 'string' ? input.session_id : null;
     const address = session ? makeAddress(this.machine, harness, session) : null;
     if (!address) return null;
-    const box = this.store.open(address);
+    this.store.open(address);
     // Windows: where the listing cannot see a Codex's open rollout, the session's own hook says it runs (the process
     // that ran it, and the rollout it names), until the live map knows Codex there (step 1c)
     if (process.platform === 'win32' && harness === 'codex' && Number.isInteger(claim?.ppid)) {
@@ -64,9 +65,8 @@ export class MailHooks {
       return null;
     }
     if (event !== 'PostToolUse' && !(event === 'Stop' && input.stop_hook_active !== true)) return null;
-    let pending = [];
-    try { pending = readdirSync(join(box.dir, 'wake')); } catch { /* none */ }
-    const unread = this.store.inventory(address).stored.filter((item) => item.state === 'unread' && !pending.includes(item.envelope.id));
+    const pending = new Set(this.store.wakes(address));
+    const unread = this.store.unreadMessages(address).filter((item) => !pending.has(item.envelope.id));
     if (!unread.length) return null;
     const pointer = this.#pointer(unread);
     return event === 'PostToolUse'
@@ -112,42 +112,45 @@ export class MailHooks {
 
   // ---- a relay's hooks ----------------------------------------------------------------------------------------------
 
-  /** A relay's own folder, only one under this machine's relays: nothing outside it is read or written for a hook. */
+  /** A relay's runtime directory identifies its row. Older hooks can keep their
+   * Maildir-era identifier; neither spelling opens that directory for mail. */
   #relay(directory) {
     const dir = resolve(String(directory ?? ''));
-    if (!dir.startsWith(this.relaysRoot + sep) || dir.slice(this.relaysRoot.length + 1).includes(sep)) throw Object.assign(new Error(`${dir} is not a relay's folder`), { code: 400 });
-    return { dir, queue: join(dir, 'queue.json'), receipt: join(dir, 'receipt.json'), turn: join(dir, 'turn.txt'), sent: join(dir, 'sent.json') };
+    const root = this.relaysRoots.find((root) => dir.startsWith(root + sep) && !dir.slice(root.length + 1).includes(sep));
+    if (!root) throw Object.assign(new Error(`${dir} is not a relay's folder`), { code: 400 });
+    const key = dir.slice(root.length + 1);
+    return { dir, queue: `${key}/queue.json`, receipt: `${key}/receipt.json`, turn: `${key}/turn.txt`, sent: `${key}/sent.json` };
   }
 
   /** `message gate`: only a SendMessage equal to the queued one passes (ListAgents always); anything else is denied, and a
    *  queued send refused still answers its sender (claude_relay.rs `gate_decision`). */
   gate(directory, input) {
     const paths = this.#relay(directory);
-    const queued = readJson(paths.queue);
+    const queued = this.store.record('relays', paths.queue);
     const reason = gateDecision(input ?? {}, queued);
     if (reason == null) return null;
-    if (queued && !existsSync(paths.receipt)) { try { writeFileSync(paths.receipt, JSON.stringify({ denied: reason })); } catch { /* best kept */ } }
+    if (queued) { try { this.store.putRecord('relays', paths.receipt, { denied: reason }, { create: true }); } catch { /* best kept */ } }
     return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } };
   }
 
   /** `message relay-receipt`: Claude's own answer to the queued send, its error, or that the turn ended without one. */
   receipt(directory, input) {
     const paths = this.#relay(directory);
-    if (!existsSync(paths.queue) || existsSync(paths.receipt)) return null;
+    if (!this.store.record('relays', paths.queue) || this.store.record('relays', paths.receipt)) return null;
     const event = input?.hook_event_name;
     let receipt;
     if (event === 'PostToolUse') receipt = { tool_response: input.tool_response ?? null };
     else if (event === 'PostToolUseFailure') receipt = { send_failed: typeof input.error === 'string' ? input.error : input.error == null ? '' : JSON.stringify(input.error) };
     else if (event === 'Stop' || event === 'StopFailure') {
       // a turn that began before this send was queued (the last send's, still ending) is not its answer
-      const queued = readJson(paths.queue);
-      let prompt = null; try { prompt = readFileSync(paths.turn, 'utf8'); } catch { /* none recorded */ }
+      const queued = this.store.record('relays', paths.queue);
+      const prompt = this.store.record('relays', paths.turn);
       if (queued && prompt != null && !prompt.includes(sendTurn(queued))) return null;
       const text = (key) => (typeof input[key] === 'string' ? input[key] : null);
       const said = event === 'StopFailure' ? `${text('error_details') ?? text('last_assistant_message') ?? ''} (${text('error') ?? 'error'})` : text('last_assistant_message');
       receipt = { turn_ended: true, said: said == null ? null : Array.from(said).slice(0, 300).join('') };
     } else return null;
-    writeFileSync(paths.receipt, JSON.stringify(receipt));
+    this.store.putRecord('relays', paths.receipt, receipt, { create: true });
     return null;
   }
 
@@ -158,7 +161,7 @@ export class MailHooks {
     const prompt = typeof input?.prompt === 'string' ? input.prompt : '';
     const trimmed = prompt.trimStart();
     if (!(trimmed.startsWith(NATIVE_PEER_OPENING) || trimmed.startsWith(NATIVE_IDLE_NOTICE) || trimmed.startsWith(NATIVE_DELIVERY_NOTICE))) {
-      try { writeFileSync(paths.turn, prompt); } catch { /* best kept */ }
+      try { this.store.putRecord('relays', paths.turn, prompt); } catch { /* best kept */ }
       return null;
     }
     if (!parseAddress(represented)) throw Object.assign(new Error(`not an address: ${represented}`), { code: 400 });
@@ -169,7 +172,7 @@ export class MailHooks {
       // the replying Claude session runs beside the relay, on this machine
       const sender = this.live.sessions().find((row) => row.door === 'native' && row.socket && row.socket === event.from.replace(/^uds:/, ''));
       const sessionId = sender ? sender.address.split(':').slice(3).join(':') : null;
-      const lastSent = readJson(paths.sent) ?? {};
+      const lastSent = this.store.record('relays', paths.sent) ?? {};
       const inReplyTo = sessionId ? lastSent[sessionId] ?? null : null;
       this.#fileHome(represented, makeEnvelope({ id, from: makeAddress(this.machine, 'claude-code', sessionId ?? 'unknown'),
         from_name: sender ? sender.name : event.fromName ?? 'an unknown Claude session', kind: 'peer', reply_via: { mode: 'command' },
@@ -225,14 +228,15 @@ export class MailHooks {
     const seedFile = resolve(String(seedPath ?? ''));
     const launches = resolve(this.mailRoot, 'native-launches');
     if (!seedFile.startsWith(launches + sep)) throw Object.assign(new Error(`${seedFile} is not a native launch's binding`), { code: 400 });
-    const seed = readJson(seedFile);
+    const seedKey = seedFile.slice(launches.length + 1);
+    const seed = this.store.record('native_launches', seedKey);
     if (!seed || (seed.kind !== 'codex' && seed.kind !== 'claude-code')) throw new Error('unsupported native question harness');
     const binding = questions.bind(seed, { session_id: input?.session_id, transcript_path: typeof input?.transcript_path === 'string' ? input.transcript_path : null }, seed.kind);
     if (input?.hook_event_name === 'SessionStart' && binding.transcript_path) {
       // this launch's baseline precedes its native initial prompt, including on resume
-      const receipt = `${seedFile.replace(/\.json$/, '')}.session.json`;
+      const receipt = `${seedKey.replace(/\.json$/, '')}.session.json`;
       let offset = 0; try { offset = statSync(binding.transcript_path).size; } catch { /* not there yet */ }
-      try { questions.create(receipt, { path: binding.transcript_path, offset }); } catch (error) { if (error.code !== 'EEXIST') throw error; }
+      this.store.putRecord('native_launches', receipt, { path: binding.transcript_path, offset }, { create: true });
     }
     if (input?.tool_name !== 'AskUserQuestion') return {};
     const tool = input.tool_input ?? {};
@@ -242,23 +246,35 @@ export class MailHooks {
     const id = questions.idOf(binding.session, native);
     const answersOf = (reply) => Object.fromEntries(Object.entries(reply?.answers ?? {}).map(([key, value]) => [key, value?.answers?.[0] ?? null]));
     if (input.hook_event_name === 'PostToolUse') {
-      const reply = readJson(join(this.questions, `${id}.reply`));
+      const reply = this.store.record('native_questions', `${id}.reply`);
       if (reply && JSON.stringify(input.tool_response?.answers ?? null) === JSON.stringify(answersOf(reply))) questions.confirm(id, reply);
       return {};
     }
     if (input.hook_event_name !== 'PreToolUse') return {};
+    if (this.store.record('native_questions', `${id}.reply`)?.body_expired_at_ms != null) {
+      return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny',
+        permissionDecisionReason: 'This native question was already answered; its answer text expired under mail retention. Start a new question instead of reusing its tool id.' } };
+    }
     // one hook owns this wait, marked by its process: a hook its harness killed ends the wait, and never answers
-    const waiting = join(this.questions, `${id}.waiting`);
-    questions.create(waiting, { pid: claim?.pid ?? null });
+    const waiting = `${id}.waiting`;
+    if (!this.store.putRecord('native_questions', waiting, { pid: claim?.pid ?? null }, { create: true })) throw Object.assign(new Error(`native question already has a waiting hook: ${id}`), { code: 'EEXIST' });
+    this.waiting.add(waiting);
     try {
       questions.file(binding, native);
       for (;;) {
-        const reply = readJson(join(this.questions, `${id}.reply`));
+        if (this.stopped) throw Object.assign(new Error('the daemon stopped while waiting for a native question reply'), { code: 503 });
+        const reply = this.store.record('native_questions', `${id}.reply`);
         if (reply) return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', updatedInput: { ...tool, answers: answersOf(reply) } } };
         if (claim?.pid && !alive(Number(claim.pid))) return {};
         await new Promise((done) => setTimeout(done, 250));
       }
-    } finally { rmSync(waiting, { force: true }); }
+    } finally { if (!this.stopped) this.store.removeRecord('native_questions', waiting); this.waiting.delete(waiting); }
+  }
+
+  stop() {
+    this.stopped = true;
+    for (const key of this.waiting) this.store.removeRecord('native_questions', key);
+    this.waiting.clear();
   }
 }
 

package/mail/idle.mjs

@@ -28,6 +28,7 @@ export class IdleNotices {
    */
   constructor({ machine, store, live, serveRequest, locatorOf, log = () => {} }) {
     Object.assign(this, { machine, store, live, serveRequest, locatorOf, log });
+    this.stopped = false;
     this.targets = new Set(); // addresses here with a subscription on them
     this.activity = new Map(); // address → { turn, presence } as serve last reported it
     this.subscription = null; this.followed = '';
@@ -36,14 +37,15 @@ export class IdleNotices {
   }
 
   start() {
-    this.store.on('subscriptions', (address) => this.#track(address));
-    for (const address of this.store.addresses()) this.#track(address);
+    this.onSubscriptions = (address) => this.#track(address);
+    this.store.on('subscriptions', this.onSubscriptions);
+    for (const address of this.store.subscribed()) this.#track(address);
     this.sweeper = setInterval(() => { for (const address of this.targets) void this.#settle(address); }, SWEEP_MS);
     this.sweeper.unref?.();
     return this;
   }
 
-  stop() { clearInterval(this.sweeper); clearInterval(this.runtimeTimer); this.#unfollow(); }
+  stop() { this.stopped = true; this.store.off('subscriptions', this.onSubscriptions); clearInterval(this.sweeper); clearInterval(this.runtimeTimer); this.#unfollow(); }
 
   /** Serve's activity notification for this subscription: each changed session settled. */
   notified(params) {
@@ -56,6 +58,7 @@ export class IdleNotices {
   serveExited() { this.subscription = null; this.followed = ''; this.#follow(); }
 
   #track(address) {
+    if (this.stopped) return;
     const parsed = parseAddress(address);
     if (!parsed || parsed.machine !== this.machine) return;
     const has = this.store.subscriptions(address).length > 0;
@@ -66,6 +69,7 @@ export class IdleNotices {
   }
 
   #seen(activity) {
+    if (this.stopped) return;
     const address = `sc:${this.machine}:${activity.harness}:${activity.session_id}`;
     if (!this.targets.has(address)) return;
     this.activity.set(address, { turn: activity.turn, presence: activity.presence });
@@ -76,6 +80,7 @@ export class IdleNotices {
 
   /** The subscribed sessions' activity followed (one subscription for all of them, made again when the set changes). */
   async #follow() {
+    if (this.stopped) return;
     const locators = [];
     for (const address of this.targets) {
       if (this.#runtime(address)) continue; // a hosted runtime is asked itself
@@ -90,7 +95,7 @@ export class IdleNotices {
     if (locators.length) {
       try {
         const answer = await this.serveRequest('harness.v1.sessions.activity.subscribe', { locators: locators.slice(0, MAX_FOLLOWED) }, 30_000);
-        if (this.followed !== fingerprint) { if (answer?.subscription) void this.serveRequest('harness.v1.sessions.activity.unsubscribe', { subscription: answer.subscription }, 30_000).catch(() => {}); return; }
+        if (this.stopped || this.followed !== fingerprint) { if (answer?.subscription) void this.serveRequest('harness.v1.sessions.activity.unsubscribe', { subscription: answer.subscription }, 30_000).catch(() => {}); return; }
         this.subscription = answer?.subscription ?? null;
         if (locators.length > MAX_FOLLOWED) this.log(`idle notices: ${locators.length - MAX_FOLLOWED} subscribed sessions are not followed (at most ${MAX_FOLLOWED}); they settle on expiry`);
         for (const activity of answer?.initial ?? []) this.#seen(activity);
@@ -110,6 +115,7 @@ export class IdleNotices {
 
   /** The hosted runtimes with a final reply waiting, asked for their turn every RUNTIME_POLL_MS while one waits. */
   #pollRuntimes() {
+    if (this.stopped) return;
     const waiting = [...this.targets].filter((address) => this.#runtime(address) && this.store.subscriptions(address).some((item) => item.final_reply));
     this.polling = new Set(waiting);
     if (!waiting.length) { clearInterval(this.runtimeTimer); this.runtimeTimer = null; return; }
@@ -130,7 +136,7 @@ export class IdleNotices {
 
   /** One pass over one receiver's subscriptions (mail_watch.rs `tick`, for one mailbox). */
   async #settle(address) {
-    if (this.settling.has(address)) return;
+    if (this.stopped || this.settling.has(address)) return;
     this.settling.add(address);
     try {
       const subscriptions = this.store.subscriptions(address);
@@ -151,6 +157,7 @@ export class IdleNotices {
         const seen = this.activity.get(address);
         if (seen) { working = seen.turn === 'working'; idle = seen.turn === 'idle'; ended = seen.presence === 'persisted'; }
       }
+      if (this.stopped) return;
       // one turn settles every message a sender subscribed with; the sender hears it once, about its latest message,
       // and its earlier subscriptions settle with it silently
       subscriptions.sort((a, b) => (b.created_at_ms ?? 0) - (a.created_at_ms ?? 0));
@@ -162,6 +169,7 @@ export class IdleNotices {
         // however fast the turn was
         if (subscription.final_reply && !ended && !expired) {
           const answer = receipt && idle ? await this.#answerTo(address, receipt, subscription.message_id) : null;
+          if (this.stopped) return;
           if (answer && this.store.removeSubscription(address, subscription.message_id)) {
             this.#reply(address, subscription, answer);
             if (subscription.notice !== false) this.#notice(address, subscription, 'idle');
@@ -237,6 +245,7 @@ export class IdleNotices {
 
   /** Filed in the subscriber's mailbox with a wake: the carrier delivers it here, or carries it to its machine. */
   #file(subscriber, envelope) {
+    if (this.stopped) return;
     try { this.store.deliver(subscriber, envelope); this.store.requestWake(subscriber, envelope.id); }
     catch (error) { this.log(`idle notices: ${envelope.id} for ${subscriber} was not filed: ${error.message}`); }
   }