@volter/supercode-teams 0.3.150 → 0.3.152

package/mail/send.mjs

@@ -3,13 +3,12 @@
 // came through another machine's link to this machine's mail door. It resolves the receiver on the live-session map,
 // routes to another machine through Teams or to the receiver's door here, guards against loops and repeats, and words
 // the outcome for the sending agent, as crates/harness/src/mail_send.rs and mail_route.rs `deliver` did (their texts
-// kept word for word: an agent reads them). The mail it files is mailbox.rs's, through the store (store.mjs).
-import { appendFileSync, chmodSync, closeSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync, writeSync } from 'node:fs';
-import { join } from 'node:path';
+// kept word for word: an agent reads them). Mail is filed through the daemon's SQLite store.
 import { blake3Hex, render, shortId } from './envelope.mjs';
 import { AGENT_HARNESS, RESUME_WAIT_MS } from './agents.mjs';
 import { MAX_RELAYED_BYTES, RELAY_NAME_PREFIX } from './relay.mjs';
 import { FULL_ID_LEN, cameThroughLink, envelope as makeEnvelope, makeAddress, messageIdFor, newMessageId, normalMachineName, parseAddress, senderIdentity, subjectLine, threadOf } from './compose.mjs';
+import { nativeMailContinuation } from './continuation.mjs';
 
 export const EXIT_REFUSED = 2;
 export const EXIT_UNKNOWN = 3;
@@ -43,7 +42,6 @@ const outcome = (code, text, receipt = null) => ({ code, text, receipt });
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /** The daemon pane a live session runs in, or null (mail_route.rs `daemon_pane`). */
 const paneOf = (session) => { const pane = typeof session.pane === 'string' ? session.pane.split(':')[0] : null; return pane && /^p_[A-Za-z0-9_-]+$/.test(pane) ? pane : null; };
-const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
 
 /** A delivery a door refused before anything was sent. */
 class Refused extends Error { constructor(kind, bytes = 0) { super(kind); this.kind = kind; this.bytes = bytes; } }
@@ -56,10 +54,20 @@ export class MailSend {
    * question's answer through its app-server; `typeTurn(pane, harness, text, ids)` a user's own turn typed into a daemon
    * pane's empty composer (machine.mjs `#paneTurn`: `{ delivered }`, `{ queued }`, or neither when it waits).
    */
-  constructor({ machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, log = () => {} }) {
-    Object.assign(this, { machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, log });
+  constructor({ machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, claudeProjects = () => [], log = () => {} }) {
+    Object.assign(this, { machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, claudeProjects, log });
     this.handing = new Set(); // `<address>\n<id>` of each hand-over running here (handOver)
     this.relaying = new Set(); // `<address>\n<id>` of each relay send running here (route): its wake waits for it
+    for (const name of ['askMachine', 'deliverRuntime', 'codexAnswer', 'typeTurn']) {
+      const operation = this[name];
+      this[name] = (...args) => { this.#active(); return operation(...args); };
+    }
+  }
+
+  stop() { this.stopped = true; }
+
+  #active() {
+    if (this.stopped || this.store.database?.closed) throw Object.assign(new Error('the daemon is stopping; no mail delivery was submitted'), { code: 503, notAsked: true });
   }
 
   // ---- one send ----------------------------------------------------------------------------------------------------
@@ -70,6 +78,18 @@ export class MailSend {
    * came through (`{ principal, name }`), or null for this machine's own callers. Answers `{ code, text, receipt }`.
    */
   async send(caller, to, body, options = {}, context = {}) {
+    this.#active();
+    if (context.link && this.#remoteMachine(to)) return outcome(EXIT_UNKNOWN, `${to} is not on this machine; a send through its mail door is for its own sessions.`);
+    // Every stream earns its current route's grants before it can join the existing same-ID send in flight.
+    let receiver = null;
+    if (!this.#remoteMachine(to)) {
+      receiver = await this.#receiver(to, this.live.sessions());
+      if (receiver.outcome && !this.live.codexKnown) { await this.#codexKnown(); receiver = await this.#receiver(to, this.live.sessions()); }
+      if (receiver.outcome) return receiver.outcome;
+      const refused = await this.#authorizeReceiver(context, receiver.continuation?.chain ?? [receiver.address]);
+      if (refused) return refused;
+    }
+    this.#active();
     // A send under an --id is held while it runs: the sent marker is written only once it is done, so a second send
     // under the same key meanwhile waits for the first and takes its outcome (sent once), never delivering it again; one
     // after a first that was not sent sends.
@@ -78,17 +98,25 @@ export class MailSend {
       const running = (this.inFlight ??= new Map()).get(key);
       if (running) {
         const first = await running.catch(() => null);
-        if (first?.code === 0) return outcome(0, `Already sent with --id ${options.id}: ${first.text} Nothing was sent again.`, first.receipt ?? null);
+        if (first?.code === 0) {
+          const addresses = [...(first.continuation?.chain ?? []), ...(first.receipt?.recipients ?? []), first.receipt?.recipient].filter(Boolean);
+          if (addresses.length) {
+            const refused = await this.#authorizeReceiver(context, addresses);
+            if (refused) return refused;
+          } else if (context.authorizeRecipients) return outcome(EXIT_REFUSED, 'Not sent: the earlier send has no recipient receipt to authorize on this stream. Nothing was sent again.');
+          return { ...outcome(0, `Already sent with --id ${options.id}: ${first.text} Nothing was sent again.`, first.receipt ?? null), ...(first.continuation ? { continuation: first.continuation } : {}) };
+        }
         return this.send(caller, to, body, options, context);
       }
     }
-    const sending = this.#send(caller, to, body, options, context);
+    const sending = this.#send(caller, to, body, options, context, receiver);
     if (!key) return sending;
     this.inFlight.set(key, sending);
     try { return await sending; } finally { if (this.inFlight.get(key) === sending) this.inFlight.delete(key); }
   }
 
-  async #send(caller, to, body, { subject = null, in_reply_to = null, notify_when_idle = false, queue = false, id = null, notice = false, thread = null, message_id = null } = {}, { link = null } = {}) {
+  async #send(caller, to, body, { subject = null, in_reply_to = null, notify_when_idle = false, queue = false, id = null, notice = false, thread = null, message_id = null } = {}, context = {}, receiver = null) {
+    const { link = null } = context;
     // an id its client chose (so a lost answer can name it), never an idempotency key: it marks nothing sent
     const chosen = typeof message_id === 'string' && /^m-[0-9a-f]{24}$/.test(message_id) ? message_id : null;
     const machine = this.#remoteMachine(to);
@@ -103,10 +131,26 @@ export class MailSend {
       const request = { op: 'send', from: caller.address, from_name: caller.name, to, body, subject, in_reply_to: answered.id, thread: carried, notify_when_idle, queue, id: messageId, notice };
       const sent = await this.#remoteSend(machine, request);
       // unanswered, it may have been delivered: kept in the send log, so a later reply to it resolves here
-      if (sent.code === 0 || sent.code === EXIT_STORED || sent.receipt?.unanswered === true) this.#recordSend(caller.address, to, messageId, carried ?? answered.id ?? messageId);
+      if (sent.code === 0 || sent.code === EXIT_STORED || sent.receipt?.unanswered === true) this.#recordSend(caller.address, to, messageId, carried ?? answered.id ?? messageId, sent.continuation);
       return sent;
     }
-    return this.#deliver(caller, to, body, { subject, in_reply_to, notify_when_idle, queue, id, notice, thread, chosen }, link);
+    const answer = await this.#deliver(caller, receiver, body, { subject, in_reply_to, notify_when_idle, queue, id, notice, thread, chosen }, link, context);
+    return this.#annotateReceiver(answer, receiver);
+  }
+
+  #annotateReceiver(answer, receiver) {
+    const continuation = receiver.continuation;
+    const alias = continuation && !answer.text.includes(receiver.alias) ? receiver.alias : '';
+    return { ...answer, text: answer.text + alias, ...(continuation ? { continuation } : {}),
+      receipt: answer.receipt ? { ...answer.receipt, recipient: receiver.address,
+        recipients: answer.receipt.recipients ?? [receiver.address], ...(continuation ? { continuation } : {}) } : null };
+  }
+
+  async #authorizeReceiver(context, addresses) {
+    if (!context.authorizeRecipients) return null;
+    const reason = await context.authorizeRecipients(addresses);
+    this.#active();
+    return reason ? outcome(EXIT_REFUSED, `Not sent: ${reason}. Nothing was filed or delivered by this request.`) : null;
   }
 
   /** The machine `to` names when it is not this one, in its normal form. */
@@ -123,7 +167,7 @@ export class MailSend {
       const answer = await this.askMachine(machine, request);
       const code = Number.isInteger(answer?.code) ? answer.code : EXIT_FAILED;
       const text = typeof answer?.text === 'string' ? answer.text : typeof answer?.detail === 'string' ? answer.detail : 'the other machine answered nothing readable';
-      return outcome(code, text, answer?.receipt ?? null);
+      return { ...outcome(code, text, answer?.receipt ?? null), ...(answer?.continuation ? { continuation: answer.continuation } : {}) };
     } catch (error) {
       const detail = String(error?.message ?? error);
       // the door took it and its answer was lost: unanswered, never refused or failed (what it did there is unknown)
@@ -140,14 +184,14 @@ export class MailSend {
   #answeredId(callerAddress, answered) {
     if (typeof answered !== 'string' || answered.length >= FULL_ID_LEN) return { id: answered ?? null };
     const found = this.store.findPrefixIn(callerAddress, answered).map((item) => item.envelope.id);
-    for (const id of this.#sentIds(callerAddress)) if (id.startsWith(answered) && !found.includes(id)) found.push(id);
+    for (const id of this.store.sentIds(callerAddress, answered)) if (!found.includes(id)) found.push(id);
     if (found.length === 1) return { id: found[0] };
     if (!found.length) return { refused: outcome(EXIT_REFUSED, `Not sent: no message you received or sent has an id starting ${answered}. Name the message you answer as its envelope or your send showed it.`) };
     return { refused: outcome(EXIT_REFUSED, `Not sent: ${answered} names ${found.length} messages you received or sent (${found.join(', ')}). Give more of its id.`) };
   }
 
   /** The receiver `to` names here: `{ address, name, session (its live row, when it runs) }`, or an outcome. */
-  #receiver(to, sessions) {
+  async #receiver(to, sessions) {
     const operator = String(to).startsWith('operator:') ? makeAddress(this.machine, 'operator', String(to).slice('operator:'.length)) : null;
     const parsed = parseAddress(operator ?? to);
     // an operator (a board, a script) is not a listed session: its address is taken as given
@@ -158,7 +202,9 @@ export class MailSend {
       return { address: parsed.address, name: `agent ${parsed.session}@${parsed.machine}` };
     }
     if (parsed) {
-      const session = sessions.find((row) => row.address === parsed.address);
+      const resolved = await this.#nativeReceiver(parsed.address, sessions);
+      if (resolved) return resolved;
+      const session = this.live.sessions().find((row) => row.address === parsed.address);
       if (!session) return { outcome: outcome(EXIT_UNKNOWN, this.#notYetKnown(to) ?? `${to} is no longer running. Nothing was sent. Run supercode message list for the live sessions.`) };
       return { address: session.address, name: session.name, session };
     }
@@ -172,7 +218,9 @@ export class MailSend {
     if (!matching.length) {
       const remembered = this.#rememberedAddress(wanted);
       if (remembered) {
-        const session = sessions.find((row) => row.address === remembered);
+        const resolved = await this.#nativeReceiver(remembered, sessions);
+        if (resolved) return resolved;
+        const session = this.live.sessions().find((row) => row.address === remembered);
         if (!session) return { outcome: outcome(EXIT_UNKNOWN, `${wanted} was ${remembered}, which is not running. Nothing was sent. Run supercode message list for the live sessions.`) };
         return { address: session.address, name: session.name, session, alias: ` "${wanted}" is a name it ran under before; it runs as ${session.name} now.` };
       }
@@ -190,6 +238,18 @@ export class MailSend {
     return { outcome: outcome(EXIT_UNKNOWN, this.#notYetKnown(wanted) ?? `No session named "${wanted}" is reachable.${hint} Run supercode message list. Nothing was sent.`) };
   }
 
+  async #nativeReceiver(address, sessions) {
+    const live = sessions.find((row) => row.address === address);
+    if (live) return { address: live.address, name: live.name, session: live };
+    const continued = await nativeMailContinuation(address, { machine: this.machine, claudeProjects: this.claudeProjects, sessions: () => this.live.sessions() });
+    if (continued?.error) return { outcome: outcome(EXIT_UNKNOWN, `Not sent: ${address}'s continuation is unresolved: ${continued.error}. Nothing was sent.`) };
+    if (!continued) return null;
+    const { session, addressed, chain } = continued;
+    return { address: session.address, name: session.name, session,
+      continuation: { addressed, recipient: session.address, chain },
+      alias: ` Addressed to ${address}; its native continued-in record routes it to ${session.address}.` };
+  }
+
   /** In a daemon's first moments the Codex sessions are not known yet (its session index and their activity still being
    *  read): a send waits for them, at most CODEX_KNOWN_WAIT_MS. */
   async #codexKnown() { if (!this.live.codexKnown) await this.live.whenCodexKnown?.(CODEX_KNOWN_WAIT_MS); }
@@ -219,19 +279,14 @@ export class MailSend {
   }
 
   /** Deliver from `caller` to `to` on this machine (mail_send.rs `deliver`). */
-  async #deliver(caller, to, body, { subject, in_reply_to, notify_when_idle, queue, id, notice, thread: carried, chosen }, link) {
-    let sessions = this.live.sessions();
-    let receiver = this.#receiver(to, sessions);
-    // only a receiver not found waits for the Codex sessions to be known (one the map holds is reached at once)
-    if (receiver.outcome && !this.live.codexKnown) { await this.#codexKnown(); sessions = this.live.sessions(); receiver = this.#receiver(to, sessions); }
-    if (receiver.outcome) return receiver.outcome;
+  async #deliver(caller, receiver, body, { subject, in_reply_to, notify_when_idle, queue, id, notice, thread: carried, chosen }, link, context) {
+    const sessions = this.live.sessions();
     const { address, name } = receiver;
     if (address === caller.address) return outcome(EXIT_REFUSED, 'Not sent: that address is your own session.');
     const door = parseAddress(address).harness === AGENT_HARNESS ? null : this.#door(address, sessions);
     const messageId = id == null && chosen ? chosen : messageIdFor(caller.address, id);
-    const marker = this.#sentMarker(caller.address, messageId);
     const terminal = door?.kind === 'hook' && door.pane != null;
-    let previous = null; try { previous = readFileSync(marker, 'utf8'); } catch { /* not sent before */ }
+    const previous = this.store.sentMarker(caller.address, messageId);
     if (previous !== null) {
       if (terminal && !queue) this.store.requestWake(address, messageId);
       return outcome(0, `Already sent with --id ${id ?? ''}: ${previous} Nothing was sent again.`, this.#deliveryReceipt(address, messageId, terminal));
@@ -250,7 +305,14 @@ export class MailSend {
     });
     const plan = await this.#plan(sent, address, {});
     if (plan.outcome) return plan.outcome;
-    if (plan.plan) return this.#deliverPlanned(caller, sent, plan.plan, { queue, notify_when_idle });
+    const recipients = plan.plan ? [...new Set([address, ...(plan.plan.agent ? [plan.plan.agent] : []),
+      ...plan.plan.recipients.filter(item => item.address !== caller.address).map(item => item.address)])] : [address];
+    const refused = await this.#authorizeReceiver(context, [...(receiver.continuation?.chain ?? []), ...recipients]);
+    if (refused) return refused;
+    if (plan.plan) {
+      const answer = await this.#deliverPlanned(caller, sent, plan.plan, { queue, notify_when_idle, continuation: receiver.continuation });
+      return { ...answer, receipt: answer.receipt ? { ...answer.receipt, recipients } : null };
+    }
     // the thread this message is in, kept in the send log: a later reply to it continues that thread
     const sentIn = threadOf(sent);
     if (!door || door.kind === 'other_machine') return outcome(EXIT_UNKNOWN, this.#notYetKnown(name) ?? `${name} is no longer running. Nothing was sent. Run supercode message list for the live sessions.`);
@@ -263,7 +325,7 @@ export class MailSend {
       if (error instanceof Refused && error.kind === 'queue') return outcome(EXIT_REFUSED, `Not sent: ${name} is idle, and a Claude session always starts a turn when a message arrives, so --queue cannot hold it. Send without --queue to wake it.`);
       if (error instanceof Refused) return outcome(EXIT_REFUSED, `Not sent: the message is ${error.bytes} bytes; the limit is ${MAX_RELAYED_BYTES}. Write it to a file and send its path instead.`);
       // may have arrived: kept filed, and said unanswered with its id (sent again with the same id, nothing is sent twice)
-      if (error.unanswered) { this.#recordSend(caller.address, address, messageId, sentIn); return outcome(EXIT_UNANSWERED, unansweredText(`${name}'s Claude relay`, error.message, messageId)); }
+      if (error.unanswered) { this.#recordSend(caller.address, address, messageId, sentIn, receiver.continuation); return outcome(EXIT_UNANSWERED, unansweredText(`${name}'s Claude relay`, error.message, messageId)); }
       return outcome(EXIT_FAILED, `Not sent to ${name}: ${error.message}`);
     }
     const [code, what] = {
@@ -281,12 +343,12 @@ export class MailSend {
       pane_waits: [EXIT_STORED, 'Stored (not failed): its pane\'s composer was not empty, so the message waits in its mailbox; it sees it with supercode message inbox. Don\'t resend'],
       stored: [EXIT_STORED, `Stored (not failed): it has no delivery door, so it sees this only if it runs supercode message inbox${parseAddress(address).harness === 'codex' ? ' (a Codex session gets one with: supercode message setup codex)' : ''}. Don't resend, and don't wait for a reply`],
     }[delivered];
-    this.#recordSend(caller.address, address, messageId, sentIn);
+    this.#recordSend(caller.address, address, messageId, sentIn, receiver.continuation);
     const harness = parseAddress(address).harness;
     const text = code === 0
       ? `sent to ${name} (${harness}, ${door.kind}): ${what}. Message id ${shortId(messageId)}.${receiver.alias ?? ''}${idleNote} Don't poll; carry on.`
       : `${name} (${harness}): ${what}. Message id ${shortId(messageId)}.${idleNote}`;
-    if (code === 0 && id != null) { try { mkdirSync(join(marker, '..'), { recursive: true }); writeFileSync(marker, text); } catch { /* the marker is best kept */ } }
+    if (code === 0 && id != null) { try { this.store.setSentMarker(caller.address, messageId, text); } catch { /* the marker is best kept */ } }
     return outcome(code, text, code === 0 ? this.#deliveryReceipt(address, messageId, terminal) : null);
   }
 
@@ -305,6 +367,7 @@ export class MailSend {
    * refused before anything was sent, and an Error with what failed.
    */
   async route(sent, to, door, wake, notifyWhenIdle) {
+    this.#active();
     this.store.open(to);
     let finalReply = false;
     let delivered;
@@ -368,7 +431,7 @@ export class MailSend {
         if (filedHere && wake) { try { this.store.requestWake(to, handed.id); } catch { /* the wake filed above stands */ } }
         throw Object.assign(new Error(relayed.detail), { unanswered: true });
       }
-      if (!relayed.delivered && !received) { if (filedHere) { try { unlinkSync(filed); } catch { /* gone */ } } throw new Error(relayed.detail); }
+      if (!relayed.delivered && !received) { if (filedHere) { try { this.store.remove(to, filed); } catch { /* gone */ } } throw new Error(relayed.detail); }
       // relayed: a copy filed unread before this delivery (an earlier unanswered or queued one, held for the receiver's
       // own read) is moved to cur/, so that read never hands it over a second time
       if (relayed.delivered && !received) {
@@ -408,7 +471,7 @@ export class MailSend {
    */
   async deliverPlanned(caller, sent, plan, { queue = false, notify_when_idle = false } = {}) { return this.#deliverPlanned(caller, sent, plan, { queue, notify_when_idle }); }
 
-  async #deliverPlanned(caller, sent, plan, { queue, notify_when_idle }) {
+  async #deliverPlanned(caller, sent, plan, { queue, notify_when_idle, continuation = null }) {
     const reached = [], copied = [], failed = [];
     let recorded = false;
     const held = []; // recipients whose own copy is held unread with its wake (an unanswered relay)
@@ -428,7 +491,7 @@ export class MailSend {
     const sessions = this.live.sessions();
     for (const recipient of plan.recipients.filter((item) => item.address !== caller.address)) {
       const label = this.#label(sessions, recipient.address);
-      this.#recordSend(caller.address, recipient.address, sent.id, threadOf(sent));
+      this.#recordSend(caller.address, recipient.address, sent.id, threadOf(sent), continuation);
       if (!recipient.wake) {
         try { this.#fileUnread(recipient.address, sent); copied.push(label); } catch (error) { failed.push(`${label} (${error.message})`); }
         continue;
@@ -512,6 +575,7 @@ export class MailSend {
       try { await this.agents.resume(to); } catch (error) { throw new Error(`not resumed: ${error.message}`); }
       const started = Date.now();
       for (;;) {
+        this.#active();
         door = this.#door(to, this.live.sessions());
         if (door) break;
         if (Date.now() - started > RESUME_WAIT_MS) return { how: 'not_running', text: 'resumed; the message waits in its mailbox' };
@@ -597,7 +661,7 @@ export class MailSend {
       if (typeof key !== 'string' || !key || Buffer.byteLength(key) > 256) return refused('invalid_key', 'idempotency_key needs 1–256 bytes');
       id = `m-${blake3Hex(JSON.stringify([sender, receiver, key]))}`.slice(0, 26);
       const previous = this.store.findIn(receiver, id);
-      const saved = previous ? readJson(previous.path) : null;
+      const saved = previous ? this.store.body(previous) : null;
       if (saved && (saved.body !== text || (saved.subject ?? null) !== subject || saved.kind !== (params.channel ? 'channel' : 'peer') || saved.from_name !== (params.sender_name ?? `${fromName}@${this.machine}`) || (saved.in_reply_to ?? null) !== (params.in_reply_to ?? null) || (saved.voice_for ?? null) !== (params.voice_for ?? null))) {
         return refused('idempotency_conflict', 'this key already names different mail');
       }
@@ -732,9 +796,11 @@ export class MailSend {
    * (mail_route.rs `type_user_turns`).
    */
   async typeUserTurns(address, pane) {
+    this.#active();
     const typed = [];
     const harness = parseAddress(address).harness;
     for (const waiting of this.store.userTurns(address)) {
+      this.#active();
       const claimed = this.store.claimUserTurn(address, waiting);
       if (!claimed) break;
       let result;
@@ -764,9 +830,10 @@ export class MailSend {
    * `{ outcome: 'delivered' | 'filed' | 'later', detail }`.
    */
   async handOver(address, id, { wake = false } = {}) {
+    this.#active();
     const found = this.store.findIn(address, id);
     if (!found) return { outcome: 'filed', detail: 'not in its mailbox' };
-    const sent = readJson(found.path);
+    const sent = this.store.body(found);
     if (!sent) return { outcome: 'later', detail: 'its envelope could not be read' };
     if (found.state !== 'unread') return { outcome: 'filed', detail: 'already read' };
     // one already handed to its receiver's door (that delivery's claim, the door's or the carrier's: a daemon that ended
@@ -815,8 +882,10 @@ export class MailSend {
       return error instanceof Refused ? { outcome: 'filed', detail: error.kind } : { outcome: 'later', detail: error.message };
     } finally {
       this.handing.delete(key);
-      const after = this.store.wakeState(address, id);
-      this.store.setWakeState(address, id, { ...after, handover_at_ms: null });
+      if (!this.stopped) {
+        const after = this.store.wakeState(address, id);
+        this.store.setWakeState(address, id, { ...after, handover_at_ms: null });
+      }
     }
   }
 
@@ -824,13 +893,13 @@ export class MailSend {
 
   /** Answer the native question `id` asked in `to` (mail_question.rs `reply`): only its recorded creator answers, once. */
   async #questionReply(caller, to, id, body, link) {
-    const dir = join(this.mailRoot, 'native-questions');
-    const path = (suffix) => join(dir, `${id}.${suffix}`);
-    const question = readJson(path('json'));
+    const key = (suffix) => `${id}.${suffix}`;
+    const question = this.store.record('native_questions', key('json'));
     if (!question) return outcome(EXIT_FAILED, `Not answered: question ${id} could not be read.`);
     if (question.binding?.session !== to || question.binding?.creator !== caller.address) return outcome(EXIT_REFUSED, 'Not answered: this question belongs to a different session or recipient.');
+    if (this.store.record('native_questions', key('claim'))) return outcome(EXIT_REFUSED, 'An answer is already recorded for this question. Nothing was submitted again; inspect its thread for delivery.');
     if (parseAddress(to).harness === 'claude-code') {
-      const waiting = readJson(path('waiting'));
+      const waiting = this.store.record('native_questions', key('waiting'));
       if (!waiting) return outcome(EXIT_REFUSED, 'Not answered: the native question hook is no longer waiting.');
       let alive = false; try { process.kill(waiting.pid, 0); alive = true; } catch (error) { alive = error.code === 'EPERM'; }
       if (!Number.isInteger(waiting.pid) || !alive) return outcome(EXIT_REFUSED, 'Not answered: the native question hook has ended.');
@@ -841,24 +910,25 @@ export class MailSend {
       envelope: makeEnvelope({ id: `u-${blake3Hex(`${id}\n${caller.address}`).slice(0, 24)}`, from: caller.address, from_name: caller.name, sender_identity: senderIdentity(caller.address, link, this.machine), kind: 'user', reply_via: { mode: 'none' }, in_reply_to: id, thread: id, body }),
       answers,
     };
-    try { createPrivate(dir, path('claim'), reply); }
-    catch (error) {
-      if (error.code === 'EEXIST') return outcome(EXIT_REFUSED, 'An answer is already recorded for this question. Nothing was submitted again; inspect its thread for delivery.');
-      throw error;
-    }
-    this.store.deliver(to, reply.envelope);
-    // published to the hook only once the whole reply is in mail
-    linkSync(path('claim'), path('reply'));
+    const claimed = this.store.transaction(() => {
+      if (!this.store.putRecord('native_questions', key('claim'), reply, { create: true })) return false;
+      this.store.deliver(to, reply.envelope);
+      this.store.putRecord('native_questions', key('reply'), reply, { create: true });
+      return true;
+    });
+    if (!claimed) return outcome(EXIT_REFUSED, 'An answer is already recorded for this question. Nothing was submitted again; inspect its thread for delivery.');
     if (parseAddress(to).harness === 'claude-code') return outcome(0, `Answer ${shortId(reply.envelope.id)} recorded in reply to ${id}; awaiting confirmation from the native question hook. It is not composer input.`);
-    const binding = readJson(join(dir, `binding-${blake3Hex(to)}.json`));
+    const binding = this.store.record('native_questions', `binding-${blake3Hex(to)}.json`);
     if (!binding?.socket_path) return outcome(EXIT_STORED, 'Answer recorded but NOT delivered: this launch has no native question endpoint. Nothing was typed.');
     let result;
     try { result = await this.codexAnswer({ socketPath: binding.socket_path, threadId: parseAddress(to).session, answer: { question: question.native, answers: reply.answers } }); }
     catch (error) { result = { delivered: false, reason: error.code ?? 'native-question-error' }; }
     if (result?.delivered === true) {
-      const filed = this.store.findIn(to, reply.envelope.id);
-      if (filed?.state === 'unread') this.store.markRead(to, filed.path);
-      try { createPrivate(dir, path('delivered'), Date.now()); } catch (error) { if (error.code !== 'EEXIST') throw error; }
+      this.store.transaction(() => {
+        const filed = this.store.findIn(to, reply.envelope.id);
+        if (filed?.state === 'unread') this.store.markRead(to, filed.path);
+        this.store.putRecord('native_questions', key('delivered'), Date.now(), { create: true });
+      });
       return outcome(0, `Answer ${shortId(reply.envelope.id)} delivered to native question ${id}.`);
     }
     return outcome(EXIT_STORED, `Answer recorded but NOT confirmed by the native question: ${JSON.stringify(result?.reason ?? null)}. It will not be typed or automatically resent.`);
@@ -866,29 +936,10 @@ export class MailSend {
 
   // ---- the send log and its guards ---------------------------------------------------------------------------------
 
-  #sentDir(sender) { return join(this.mailRoot, 'sent', blake3Hex(sender).slice(0, 24)); }
-  #sentMarker(sender, id) { return join(this.#sentDir(sender), id); }
-
-  #logOf(sender) {
-    let text = '';
-    try { text = readFileSync(join(this.#sentDir(sender), 'log.jsonl'), 'utf8'); } catch { return []; }
-    return text.split('\n').map((line) => { try { return JSON.parse(line); } catch { return null; } }).filter(Boolean);
-  }
-
-  #sentIds(sender) { return this.#logOf(sender).map((entry) => entry.id).filter((id) => typeof id === 'string'); }
-  #sentThread(sender, id) { return this.#logOf(sender).find((entry) => entry.id === id && typeof entry.thread === 'string')?.thread ?? null; }
+  #sentThread(sender, id) { return this.store.sentThread(sender, id); }
 
   /** The thread any author on this machine sent `id` in, as its send log keeps it. */
-  #sentThreadHere(id) {
-    let names = [];
-    try { names = readdirSync(join(this.mailRoot, 'sent')); } catch { return null; }
-    for (const name of names) {
-      let text = '';
-      try { text = readFileSync(join(this.mailRoot, 'sent', name, 'log.jsonl'), 'utf8'); } catch { continue; }
-      for (const line of text.split('\n')) { let entry = null; try { entry = JSON.parse(line); } catch { continue; } if (entry?.id === id && typeof entry.thread === 'string') return entry.thread; }
-    }
-    return null;
-  }
+  #sentThreadHere(id) { return this.store.sentThreadHere(id); }
 
   /** The thread `parent` is filed in on this machine (mailbox.rs `filed_thread`). */
   #filedThread(parent) {
@@ -906,19 +957,19 @@ export class MailSend {
     return parent;
   }
 
-  /** How deep the reply chain ending at `answered` runs between `a` and `b`, read from both mailboxes' folders. */
+  /** The bounded reply chain between `a` and `b`, from exact message keys. */
   #replyChainDepth(a, b, answered) {
-    const links = new Map([...this.store.links(a), ...this.store.links(b)]);
     let depth = 0, current = answered;
-    while (current != null && depth <= REPLY_CHAIN_LIMIT && links.has(current)) { depth += 1; current = links.get(current); }
+    while (current != null && depth <= REPLY_CHAIN_LIMIT) {
+      const parent = this.store.replyParent(a, b, current);
+      if (parent === undefined) break;
+      depth += 1; current = parent;
+    }
     return depth;
   }
 
-  #recordSend(sender, to, id, thread) {
-    try {
-      mkdirSync(this.#sentDir(sender), { recursive: true });
-      appendFileSync(join(this.#sentDir(sender), 'log.jsonl'), `${JSON.stringify({ to, at_ms: Date.now(), id, thread })}\n`);
-    } catch { /* the log is best kept */ }
+  #recordSend(sender, to, id, thread, continuation = null) {
+    try { this.store.recordSend(sender, to, id, thread, continuation); } catch { /* the log is best kept */ }
   }
 
   /** A terminal's acknowledgement from the native watch's retained receipts, never from a filing (mail_send.rs
@@ -927,11 +978,8 @@ export class MailSend {
     if (!terminal) return { delivered: true, message_ids: [id], receipt: 'native-mail' };
     const parsed = parseAddress(address);
     const recipient = `${parsed.harness}:${parsed.session}`;
-    let names = [];
-    try { names = readdirSync(join(this.mailRoot, 'terminal-delivery')); } catch { /* none yet */ }
-    for (const name of names) {
-      const state = readJson(join(this.mailRoot, 'terminal-delivery', name, 'queue.json'));
-      if (state?.recipient !== recipient) continue;
+    const state = this.store.terminalState(recipient);
+    if (state) {
       const receipt = (Array.isArray(state.receipts) ? state.receipts : []).find((item) => Array.isArray(item?.message_ids) && item.message_ids.includes(id));
       if (receipt) return receipt;
       return { delivered: false, queued: true, message_ids: [id], reason: state.active?.error ?? null };
@@ -950,7 +998,7 @@ export class MailSend {
 
   /** rememberedName for each of `addresses`, the ledger read once. */
   rememberedNames(addresses) {
-    const names = readJson(join(this.mailRoot, 'names.json'));
+    const names = Object.fromEntries(this.store.records('names').map(({ key, value }) => [key, value]));
     const wanted = new Set(addresses), best = new Map();
     if (names && typeof names === 'object') {
       for (const [name, record] of Object.entries(names)) {
@@ -963,7 +1011,7 @@ export class MailSend {
   }
 
   #rememberedAddress(name) {
-    const record = readJson(join(this.mailRoot, 'names.json'))?.[name];
+    const record = this.store.record('names', name);
     if (!record || Date.now() - Math.max(record.seen_ms ?? 0, record.since_ms ?? 0) > NAME_KEPT_MS) return null;
     return parseAddress(record.address)?.address ?? null;
   }
@@ -971,10 +1019,7 @@ export class MailSend {
   /** Each running session's name recorded (mail_route.rs `remember_names`): a name two sessions carry is left as it was;
    *  written only when a name is new, names another session, or its last listing is an hour old. */
   rememberNames(sessions) {
-    const path = join(this.mailRoot, 'names.json');
-    let names;
-    try { names = JSON.parse(readFileSync(path, 'utf8')); } catch (error) { if (error.code !== 'ENOENT') return; names = {}; }
-    if (!names || typeof names !== 'object') return;
+    const names = Object.fromEntries(this.store.records('names').map(({ key, value }) => [key, value]));
     const carried = new Map();
     for (const row of sessions) {
       const name = row.name.split('@')[0];
@@ -982,7 +1027,7 @@ export class MailSend {
     }
     const now = Date.now();
     const latest = (address) => Object.entries(names).filter(([, record]) => record.address === address).sort((x, y) => y[1].since_ms - x[1].since_ms)[0]?.[0] ?? null;
-    let changed = false;
+    const changed = [];
     for (const [name, addresses] of carried) {
       if (addresses.length !== 1) continue;
       const [address] = addresses;
@@ -991,11 +1036,11 @@ export class MailSend {
       if (current && latest(address) === name) continue;
       const renewed = record?.address === address && latest(address) === name;
       names[name] = { address, since_ms: renewed ? record.since_ms : now, seen_ms: now };
-      changed = true;
+      changed.push(name);
     }
-    if (!changed) return;
-    const staged = `${path}.${process.pid}.tmp`;
-    try { writeFileSync(staged, JSON.stringify(names)); renameSync(staged, path); } catch { /* kept for the next listing */ }
+    if (!changed.length) return;
+    try { this.store.transaction(() => { for (const name of changed) this.store.putRecord('names', name, names[name]); }); }
+    catch { /* kept for the next listing */ }
   }
 }
 
@@ -1017,11 +1062,3 @@ function questionAnswers(question, body) {
   if (!values || typeof values !== 'object' || Object.keys(values).length !== Object.keys(out).length) throw new Error('answer only the question ids shown');
   return out;
 }
-
-/** A file made once, owner-only, written whole and synced (mail_question.rs `create`). */
-function createPrivate(dir, path, value) {
-  mkdirSync(dir, { recursive: true });
-  try { chmodSync(dir, 0o700); } catch { /* not ours to set */ }
-  const fd = openSync(path, 'wx', 0o600);
-  try { writeSync(fd, JSON.stringify(value)); fsyncSync(fd); } finally { closeSync(fd); }
-}