@wowyuarm/dsh-agent-team 0.1.10 → 0.1.11

package/packages/agent-team/lib/ledger.js

@@ -16,9 +16,12 @@ export function agentTeamHumanActor() {
 }
 function emptyProjection() {
     return { byRequest: new Map(), byOperation: new Map(), ordered: [], channels: new Map(), members: new Map(), memberships: new Map(),
-        claims: new Map(), messages: [], tasks: new Map(), threads: new Map(), attention: new Map(), directMarkers: new Map(), activityMarkers: new Map(),
+        claims: new Map(), tasks: new Map(), threads: new Map(), attention: new Map(), directMarkers: new Map(), activityMarkers: new Map(),
         orderedFacts: [], factsByThread: new Map(), channelRefByThread: new Map(), mentionsByMessage: new Map(), messageCountByThread: new Map(),
-        attentionByThread: new Map(), previousSessions: new Map(), rolloverSeeds: new Map() };
+        messagesByRef: new Map(),
+        attentionByThread: new Map(), previousSessions: new Map(), rolloverSeeds: new Map(),
+        anchorByThread: new Map(), taskNumberByTask: new Map(), taskCountByChannel: new Map(), attentionThreadsByMember: new Map(),
+        directMarkersByMember: new Map(), activityMarkersByMember: new Map(), observationsByThread: new Map() };
 }
 const EMPTY_PROGRESS_NUDGE_TARGETS = Object.freeze({
     progress: Object.freeze([]),
@@ -28,6 +31,40 @@ const EMPTY_PROGRESS_NUDGE_TARGETS = Object.freeze({
 function assertUnhandledKind(operation) {
     throw new Error(`agent-team ledger does not handle operation kind '${operation.kind}'`);
 }
+/**
+ * Opening-line preview for a direct-only Human Inbox row: the Thread anchor's
+ * first line, trimmed, then capped at 120 characters with an explicit mark —
+ * the same bound the Thread page applies to its Task title, so the row and
+ * the page it opens never disagree about what a Thread is about.
+ */
+function boundedInboxPreview(body) {
+    const firstLine = body.split('\n', 1)[0]?.trim() ?? '';
+    return firstLine.length > 120 ? `${firstLine.slice(0, 119)}…` : firstLine;
+}
+/**
+ * Whether one operation's Inbox delta would change nothing. A read that finds
+ * no unread fact for its reader and no marker to consume produces exactly this
+ * delta, which is why such a read is a no-op rather than a durable operation.
+ */
+function isEmptyInboxDelta(delta) {
+    return delta.attention.set.length === 0 && delta.attention.removed.length === 0
+        && delta.directMarkers.added.length === 0 && delta.directMarkers.removed.length === 0
+        && delta.activityMarkers.added.length === 0 && delta.activityMarkers.removed.length === 0;
+}
+/**
+ * Which of the two durable Thread-read forms one record holds. Both schemas are
+ * strict and structurally disjoint — only the pre-receipt snapshot carries the
+ * Thread picture — so `thread` decides it for every stored record.
+ */
+export function isThreadReadSnapshot(data) {
+    return 'thread' in data;
+}
+/** The Thread and optional Task one read targeted, whichever form the record holds. */
+export function threadReadTargetOf(data) {
+    return isThreadReadSnapshot(data)
+        ? { threadRef: data.thread.threadRef, ...(data.task === undefined ? {} : { taskRef: data.task.taskRef }) }
+        : { threadRef: data.threadRef, ...(data.taskRef === undefined ? {} : { taskRef: data.taskRef }) };
+}
 /** Deep-freeze a Member capability overlay; absent stays absent. */
 function freezeCapabilities(capabilities) {
     if (capabilities === undefined)
@@ -50,12 +87,35 @@ export class AgentTeamLedger {
     createOccurredAt;
     createRef;
     operationTail = Promise.resolve();
+    /**
+     * Head of the durable records the constructor's record-level replay
+     * validated, adoptable once by the invariant mount. See `validateAtMount`.
+     */
+    bootValidation;
+    /**
+     * Sequence of the newest committed record that invalidated the shared
+     * projection — the durable position the Client's change cursors compare
+     * against, rebuilt by replay like every other index.
+     *
+     * Records whose commit is private read progress or audit-only
+     * (`changeScopesOf` derives no scope for them) never move it, so one
+     * Member's Thread read cannot make a parked Client believe that something it
+     * watches changed. Being a ledger position rather than a process counter, it
+     * also stays monotone across a restart.
+     */
+    projectionVersion = 0;
     constructor(table, options = {}) {
         this.table = table;
         this.createOperationId = options.operationId ?? (() => `operation:${randomUUID()}`);
         this.createOccurredAt = options.occurredAt ?? (() => new Date().toISOString());
         this.createRef = options.ref ?? (kind => `${kind}:${randomUUID()}`);
         this.replay();
+        const head = this.state.ordered.at(-1);
+        this.bootValidation = Object.freeze({
+            records: this.state.ordered.length,
+            lastSequence: head?.sequence ?? 0,
+            lastOperationId: head?.operationId ?? null,
+        });
     }
     initialize(request = {
         requestId: AGENT_TEAM_INITIALIZE_REQUEST_ID,
@@ -1025,8 +1085,19 @@ export class AgentTeamLedger {
         const limit = request.limit ?? 50;
         if (!Number.isInteger(limit) || limit < 1 || limit > 100)
             throw new Error('inbox limit must be an integer between 1 and 100');
+        // The Human direct-only slice serves the Client's mention queue: rows show
+        // only Threads with an unread mention, `totalUnreadCount` collapses to the
+        // direct total so a badge on this call cannot bypass follow unread, and
+        // each row carries its Channel display name plus the Thread's opening line
+        // so the Client renders without a Channel view per row. The ordinary
+        // (agent-facing) projection stays body-free.
+        const directOnly = request.directOnly === true;
+        const taskNumbers = directOnly ? this.taskNumbers(request.workspaceId) : undefined;
         const items = [];
-        for (const thread of this.state.threads.values()) {
+        for (const threadRef of this.inboxCandidateThreads(authorized.memberId, directOnly)) {
+            const thread = this.state.threads.get(threadRef);
+            if (thread === undefined)
+                continue;
             const channelRef = this.channelRefForThread(thread.threadRef);
             if (channelRef === undefined)
                 continue;
@@ -1039,20 +1110,47 @@ export class AgentTeamLedger {
                 continue;
             const task = thread.taskRef === undefined ? undefined : this.state.tasks.get(thread.taskRef);
             const directCount = unread.filter(item => item.direct).length;
+            if (directOnly && directCount === 0)
+                continue;
             const attention = this.attentionFor(authorized.memberId, thread.threadRef);
             // Same snapshot, same source as newestSequence: the instant hangs off
             // the newest unread fact itself, never a second lookup that could
             // observe a different commit between the two reads.
             const newest = unread.at(-1).fact;
-            items.push(Object.freeze({ channelRef, ...(task === undefined ? {} : { task }), thread, unreadCount: unread.length, directCount,
+            const taskNumber = directOnly && task !== undefined ? taskNumbers?.get(task.taskRef) : undefined;
+            items.push(Object.freeze({ channelRef,
+                ...(directOnly ? { channelName: this.state.channels.get(channelRef)?.name ?? '' } : {}),
+                ...(task === undefined ? {} : { task }), ...(taskNumber === undefined ? {} : { taskNumber }), thread,
+                unreadCount: unread.length, directCount,
+                ...(directOnly ? { previewText: boundedInboxPreview(this.threadAnchor(thread.threadRef).body) } : {}),
                 newestSequence: newest.sequence, newestOccurredAt: newest.occurredAt, ...(attention === undefined ? {} : { attention }) }));
         }
         items.sort((left, right) => right.directCount - left.directCount || right.newestSequence - left.newestSequence || left.thread.threadRef.localeCompare(right.thread.threadRef));
         const selected = items.slice(0, limit);
         return Object.freeze({ items: Object.freeze(selected),
-            totalUnreadCount: items.reduce((sum, item) => sum + item.unreadCount, 0),
+            totalUnreadCount: directOnly
+                ? items.reduce((sum, item) => sum + item.directCount, 0)
+                : items.reduce((sum, item) => sum + item.unreadCount, 0),
             totalDirectCount: items.reduce((sum, item) => sum + item.directCount, 0) });
     }
+    /**
+     * Threads that can hold unread facts for one reader, from the per-reader
+     * derived indexes: Attention follows plus direct and activity markers.
+     * Every unread source is covered — ordinary unread requires Attention, and
+     * marker unread requires a marker — so no full Thread scan is needed. The
+     * direct-only slice needs only the direct-marker threads, since a row
+     * requires at least one direct unread.
+     */
+    inboxCandidateThreads(memberId, directOnly) {
+        if (directOnly)
+            return this.state.directMarkersByMember.get(memberId)?.keys() ?? [];
+        const refs = new Set();
+        for (const source of [this.state.attentionThreadsByMember.get(memberId), this.state.directMarkersByMember.get(memberId), this.state.activityMarkersByMember.get(memberId)]) {
+            for (const threadRef of source?.keys() ?? [])
+                refs.add(threadRef);
+        }
+        return refs;
+    }
     /** Model-visible notification material derived from the recipient's current durable unread state. */
     notificationFacts(memberId, request) {
         const member = this.requireMember(memberId);
@@ -1067,22 +1165,31 @@ export class AgentTeamLedger {
             const existing = this.state.byRequest.get(request.requestId);
             if (existing !== undefined) {
                 this.assertSameThreadRead(existing, request);
-                return this.resolved(this.threadReadResult(existing));
+                // A retry reports the original receipt with the picture the current
+                // projection derives, and never advances a watermark a second time.
+                const current = this.prepareRead(existing.data.memberId, existing.data.workspaceId, request);
+                return Object.freeze({ value: Object.freeze({ receipt: this.receipt(existing), ...this.readPicture(current) }), committed: false });
             }
             const actor = this.assertActorForWorkspace(request.actor, request.workspaceId);
             const prepared = this.prepareRead(actor.memberId, request.workspaceId, request);
+            // A read whose Inbox delta is empty writes nothing: the watermark does
+            // not advance and no marker is consumed. It answers with the same picture
+            // and no receipt, so the caller learns "no operation" from the result's
+            // committed flag, never from a sequence this read did not write.
+            if (isEmptyInboxDelta(prepared.inbox))
+                return Object.freeze({ value: this.readPicture(prepared), committed: false });
+            // The record carries progress, not the picture: the Thread, its facts,
+            // the anchor and the reader's Attention are projection state every replay
+            // already holds.
+            const data = Object.freeze({ workspaceId: request.workspaceId, memberId: actor.memberId,
+                threadRef: prepared.thread.threadRef, ...(prepared.task === undefined ? {} : { taskRef: prepared.task.taskRef }),
+                readThroughSequence: prepared.readThroughSequence, inbox: prepared.inbox });
             const operation = Object.freeze({
-                ...this.operationBase(request, this.nextSequence()), kind: 'team/thread-read',
-                data: Object.freeze({ workspaceId: request.workspaceId, memberId: actor.memberId,
-                    ...(prepared.task === undefined ? {} : { task: prepared.task }),
-                    thread: prepared.thread, claims: prepared.claims, anchor: prepared.anchor, anchorMentions: prepared.anchorMentions,
-                    facts: prepared.facts,
-                    readThroughSequence: prepared.readThroughSequence, remainingUnreadCount: prepared.remainingUnreadCount,
-                    ...(prepared.attention === undefined ? {} : { attention: prepared.attention }), inbox: prepared.inbox }),
+                ...this.operationBase(request, this.nextSequence()), kind: 'team/thread-read', data,
             });
             await this.table.put(operation.operationId, operation);
             this.apply(operation);
-            return this.committed(this.threadReadResult(operation));
+            return Object.freeze({ value: Object.freeze({ receipt: this.receipt(operation), ...this.readPicture(prepared) }), committed: true });
         });
     }
     threadObservations(actor, request) {
@@ -1092,33 +1199,13 @@ export class AgentTeamLedger {
         if (!Number.isInteger(limit) || limit < 1 || limit > 100)
             throw new Error('observation limit must be an integer between 1 and 100');
         const threadRef = thread.threadRef;
-        const current = new Map();
-        const observations = [];
-        for (const operation of this.state.ordered) {
-            const delta = this.attentionDelta(operation);
-            if (delta === undefined)
-                continue;
-            for (const removed of delta.attention.removed) {
-                if (removed.threadRef !== threadRef)
-                    continue;
-                if (!current.delete(removed.memberId))
-                    continue;
-                observations.push(Object.freeze({ sequence: operation.sequence, threadRef, ...(task === undefined ? {} : { taskRef: task.taskRef }),
-                    memberId: removed.memberId, action: 'unfollow' }));
-            }
-            for (const next of delta.attention.set) {
-                if (next.threadRef !== threadRef)
-                    continue;
-                const prior = current.get(next.memberId);
-                current.set(next.memberId, next);
-                // Task creation establishes initial Attention; reads only advance its watermark.
-                if (operation.kind === 'team/message-sent' || (prior !== undefined && prior.startSequence === next.startSequence))
-                    continue;
-                observations.push(Object.freeze({ sequence: operation.sequence, threadRef, ...(task === undefined ? {} : { taskRef: task.taskRef }),
-                    memberId: next.memberId, action: 'follow' }));
-            }
-        }
-        return Object.freeze({ items: Object.freeze(observations.slice(-limit)), followers: Object.freeze([...current.keys()]) });
+        // Both slices are replay-derived: the observation log is appended by
+        // committed Inbox deltas in ledger order, and the live follower set is
+        // the same Attention index the follow history converges to.
+        const observations = (this.state.observationsByThread.get(threadRef) ?? []).slice(-limit)
+            .map(event => Object.freeze({ sequence: event.sequence, threadRef, ...(task === undefined ? {} : { taskRef: task.taskRef }),
+            memberId: event.memberId, action: event.action }));
+        return Object.freeze({ items: Object.freeze(observations), followers: Object.freeze([...this.state.attentionByThread.get(threadRef) ?? []]) });
     }
     /** Every operation carrying an inbox delta drives the Inbox projection; the payload shape decides, not a per-kind list. */
     attentionDelta(operation) {
@@ -1216,7 +1303,8 @@ export class AgentTeamLedger {
             && channel.state !== 'archived'
             && (memberId === undefined || this.isChannelMember(channel.channelRef, memberId)));
         const channelRefs = new Set(channels.map(channel => channel.channelRef));
-        const allFacts = this.state.orderedFacts.filter(fact => {
+        const before = request.cursor ?? this.state.ordered.length + 1;
+        const matches = (fact) => {
             const threadRef = fact.kind === 'message' ? fact.message.threadRef : fact.activity.threadRef;
             const channelRef = this.channelRefForThread(threadRef);
             if (channelRef === undefined || !channelRefs.has(channelRef))
@@ -1229,9 +1317,40 @@ export class AgentTeamLedger {
                 return false;
             if (request.includeActivities === false && fact.kind === 'activity')
                 return false;
-            return direction === 'before' ? fact.sequence < (request.cursor ?? this.state.ordered.length + 1) : fact.sequence > cursor;
-        });
-        const selected = direction === 'before' ? allFacts.slice(-limit) : allFacts.slice(0, limit);
+            return direction === 'before' ? fact.sequence < before : fact.sequence > cursor;
+        };
+        // Walk from the end the direction starts at and stop once `limit` matches
+        // are collected plus one more proves `hasMore` — `limit` bounds only the
+        // returned items, never the scan below a single extra match. A sidebar
+        // asking for one item no longer sweeps the whole fact ledger.
+        const selected = [];
+        let hasMore = false;
+        if (direction === 'before') {
+            for (let index = this.state.orderedFacts.length - 1; index >= 0; index -= 1) {
+                const fact = this.state.orderedFacts[index];
+                if (!matches(fact))
+                    continue;
+                if (selected.length < limit)
+                    selected.push(fact);
+                else {
+                    hasMore = true;
+                    break;
+                }
+            }
+            selected.reverse();
+        }
+        else {
+            for (const fact of this.state.orderedFacts) {
+                if (!matches(fact))
+                    continue;
+                if (selected.length < limit)
+                    selected.push(fact);
+                else {
+                    hasMore = true;
+                    break;
+                }
+            }
+        }
         const visibleTasks = [...this.state.tasks.values()].filter(task => channelRefs.has(task.channelRef)
             && (request.channelRef === undefined || task.channelRef === request.channelRef)
             && (request.threadRef === undefined || task.threadRef === request.threadRef));
@@ -1266,7 +1385,7 @@ export class AgentTeamLedger {
             claims: this.claimsForVisibleTasks(visibleTasks),
             activities: Object.freeze(selected.filter((fact) => fact.kind === 'activity').map(fact => fact.activity)),
             cursor: nextCursor,
-            hasMore: allFacts.length > selected.length,
+            hasMore,
         });
     }
     status() {
@@ -1277,6 +1396,31 @@ export class AgentTeamLedger {
     validate() {
         this.validateRecords(this.sortedRecords());
     }
+    /**
+     * Validate the durable ledger for the invariant's mount check, reusing the
+     * constructor's record-level replay once instead of paying a second identical
+     * one at startup.
+     *
+     * The adoption is gated on the operations table's single-writer identity —
+     * this ledger's commit path is the only caller of `table.put` — so an
+     * unchanged record count, head sequence and head operation id mean a
+     * mount-time replay would re-derive precisely the records the constructor
+     * already re-derived against its own scratch projection. Any commit between
+     * construction and mount, and every later call, falls back to the full
+     * replay. The check is never narrowed: the reused conclusion is still that
+     * same independent replay of every durable record.
+     */
+    validateAtMount() {
+        const boot = this.bootValidation;
+        this.bootValidation = undefined;
+        const head = this.state.ordered.at(-1);
+        if (boot !== undefined
+            && boot.records === this.state.ordered.length
+            && boot.lastSequence === (head?.sequence ?? 0)
+            && boot.lastOperationId === (head?.operationId ?? null))
+            return;
+        this.validate();
+    }
     hasCommitted(requestId) {
         return this.state.byRequest.has(requestId);
     }
@@ -1284,6 +1428,33 @@ export class AgentTeamLedger {
     getOperation(operationId) {
         return this.state.byOperation.get(operationId);
     }
+    /**
+     * Claim releases are thread-visible facts: an open Channel page and every
+     * affected Thread page must refetch alongside the workspace-wide change. Each
+     * released activity contributes its own Thread scope plus the Channel that
+     * owns its Task, deduplicated against the caller's initial scopes — which is
+     * why the caller passes them in rather than the helper inventing them.
+     */
+    withReleasedActivityScopes(scopes, tasks, activities) {
+        const channelByTask = new Map(tasks.map(task => [task.taskRef, task.channelRef]));
+        for (const activity of activities) {
+            scopes.push({ kind: 'thread', threadRef: activity.threadRef });
+            const channelRef = channelByTask.get(activity.taskRef);
+            if (channelRef !== undefined && !scopes.some(scope => scope.kind === 'channel' && scope.channelRef === channelRef)) {
+                scopes.push({ kind: 'channel', channelRef });
+            }
+        }
+        return scopes;
+    }
+    /**
+     * Durable position of the newest shared-projection commit: the version every
+     * change waiter outside the presence scope observes. It only moves when a
+     * commit has scopes somebody could refetch (`changeScopesOf`), never for
+     * private read progress or an audit-only record.
+     */
+    projectionSequence() {
+        return this.projectionVersion;
+    }
     /** Scopes whose projections one committed operation invalidates; undefined wakes every waiter. */
     changeScopesOf(operation) {
         switch (operation.kind) {
@@ -1304,37 +1475,15 @@ export class AgentTeamLedger {
             case 'team/member-updated':
             case 'team/member-removed':
                 return [{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }];
-            case 'team/member-archived': {
-                // Claim releases are thread-visible facts: open Channel and Thread
-                // pages refetch alongside the workspace-wide roster change.
-                const channelByTask = new Map(operation.data.tasks.map(task => [task.taskRef, task.channelRef]));
-                const scopes = [{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }];
-                for (const activity of operation.data.activities) {
-                    scopes.push({ kind: 'thread', threadRef: activity.threadRef });
-                    const channelRef = channelByTask.get(activity.taskRef);
-                    if (channelRef !== undefined && !scopes.some(scope => scope.kind === 'channel' && scope.channelRef === channelRef)) {
-                        scopes.push({ kind: 'channel', channelRef });
-                    }
-                }
-                return scopes;
-            }
+            case 'team/member-archived':
+                return this.withReleasedActivityScopes([{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }], operation.data.tasks, operation.data.activities);
             case 'team/channel-member-added':
                 return [{ kind: 'workspace', workspaceId: operation.data.workspaceId }, { kind: 'channel', channelRef: operation.data.channelRef }];
-            case 'team/channel-member-removed': {
-                const channelByTask = new Map(operation.data.tasks.map(task => [task.taskRef, task.channelRef]));
-                const scopes = [
+            case 'team/channel-member-removed':
+                return this.withReleasedActivityScopes([
                     { kind: 'workspace', workspaceId: operation.data.workspaceId },
                     { kind: 'channel', channelRef: operation.data.channelRef },
-                ];
-                for (const activity of operation.data.activities) {
-                    scopes.push({ kind: 'thread', threadRef: activity.threadRef });
-                    const channelRef = channelByTask.get(activity.taskRef);
-                    if (channelRef !== undefined && !scopes.some(scope => scope.kind === 'channel' && scope.channelRef === channelRef)) {
-                        scopes.push({ kind: 'channel', channelRef });
-                    }
-                }
-                return scopes;
-            }
+                ], operation.data.tasks, operation.data.activities);
             case 'team/channel-archived': {
                 const scopes = [
                     { kind: 'workspace', workspaceId: operation.data.workspaceId },
@@ -1632,7 +1781,7 @@ export class AgentTeamLedger {
                 || operation.data.channel.createdAtSequence !== prior.createdAtSequence)
                 throw new Error('invalid Channel archival');
             const threadRefs = new Set([...projection.threads.keys()].filter(threadRef => this.channelRefForThreadFrom(projection, threadRef) === prior.channelRef));
-            this.validateChannelArchivalCleanup(operation.data, projection, threadRefs, operation.sequence, refs);
+            this.validateReleaseCleanup(operation.data, projection, undefined, threadRefs, operation.sequence, refs);
             return;
         }
         if (operation.kind === 'team/member-removed') {
@@ -1683,20 +1832,38 @@ export class AgentTeamLedger {
                 assertMember();
             else
                 assertHuman();
-            if (operation.data.memberId !== operation.actor.memberId)
+            const data = operation.data;
+            if (data.memberId !== operation.actor.memberId)
                 throw new Error('Thread read has wrong actor');
-            const expected = this.prepareReadFrom(projection, operation.data.memberId, operation.data.workspaceId, {
-                threadRef: operation.data.thread.threadRef,
-                ...(operation.data.task === undefined ? {} : { taskRef: operation.data.task.taskRef }),
-            });
-            const expectedData = Object.freeze({ workspaceId: operation.data.workspaceId, memberId: operation.data.memberId,
-                ...(expected.task === undefined ? {} : { task: expected.task }), thread: expected.thread, claims: expected.claims, anchor: expected.anchor,
-                anchorMentions: expected.anchorMentions, facts: expected.facts,
-                readThroughSequence: expected.readThroughSequence, remainingUnreadCount: expected.remainingUnreadCount,
-                ...(expected.attention === undefined ? {} : { attention: expected.attention }), inbox: expected.inbox });
-            if (!isDeepStrictEqual(operation.data, expectedData))
-                throw new Error('invalid Thread read projection');
-            this.validateInboxDelta(operation.data.inbox, projection, refs);
+            const target = threadReadTargetOf(data);
+            if (isThreadReadSnapshot(data)) {
+                // The pre-receipt form froze the whole picture, so its expected value
+                // is re-derived the same way it was written: from this record's prior
+                // projection only, never from the live one.
+                const expected = this.prepareReadFrom(projection, data.memberId, data.workspaceId, target);
+                const expectedData = Object.freeze({ workspaceId: data.workspaceId, memberId: data.memberId,
+                    ...(expected.task === undefined ? {} : { task: expected.task }), thread: expected.thread, claims: expected.claims, anchor: expected.anchor,
+                    anchorMentions: expected.anchorMentions, facts: expected.facts,
+                    readThroughSequence: expected.readThroughSequence, remainingUnreadCount: expected.remainingUnreadCount,
+                    ...(expected.attention === undefined ? {} : { attention: expected.attention }), inbox: expected.inbox });
+                if (!isDeepStrictEqual(data, expectedData))
+                    throw new Error('invalid Thread read projection');
+            }
+            else {
+                // A receipt claims progress and its Inbox delta, nothing else, so the
+                // independent derivation stops there too: the picture and the unread
+                // count left behind are projection state a replay re-derives for the
+                // surfaces that need them, not content of this record. The Task ref is
+                // derived rather than copied back, so a Task Thread read cannot drop
+                // the Task it belongs to and shrink its own claim unchecked.
+                const expected = this.prepareReadReceiptFrom(projection, data.memberId, data.workspaceId, target);
+                const expectedData = Object.freeze({ workspaceId: data.workspaceId, memberId: data.memberId, threadRef: data.threadRef,
+                    ...(expected.task === undefined ? {} : { taskRef: expected.task.taskRef }),
+                    readThroughSequence: expected.readThroughSequence, inbox: expected.inbox });
+                if (!isDeepStrictEqual(data, expectedData))
+                    throw new Error('invalid Thread read receipt');
+            }
+            this.validateInboxDelta(data.inbox, projection, refs);
             return;
         }
         if (operation.kind === 'team/thread-promoted') {
@@ -1874,11 +2041,23 @@ export class AgentTeamLedger {
         }
         assertUnhandledKind(operation);
     }
+    /**
+     * Validation of one operation's Inbox delta against the projection it was
+     * derived from.
+     *
+     * Direct marker references resolve through the replay-derived Message index:
+     * this runs once per inbox-carrying record, so a rescan of the Message list
+     * here would make every record cost the whole ledger. The index is written by
+     * the same fact appends that build `factsByThread`, so a lookup sees exactly
+     * the records replayed before this one and can never reach a Message that
+     * arrives later — which is why the operation's own entity, not yet in the
+     * projection, needs the `additional*` fallbacks. The commit path resolved the
+     * projection first and then its own record, and that precedence is kept.
+     */
     validateInboxDelta(delta, projection, _refs, additionalThreadRefs = [], additionalMessages = [], additionalActivities = []) {
         const attentionKeys = new Set();
-        const knownThreadRefs = new Set([...projection.threads.keys(), ...additionalThreadRefs]);
         for (const attention of delta.attention.set) {
-            if (!knownThreadRefs.has(attention.threadRef) || attention.startSequence < 1
+            if ((!projection.threads.has(attention.threadRef) && !additionalThreadRefs.includes(attention.threadRef)) || attention.startSequence < 1
                 || attention.readThroughSequence < attention.startSequence - 1) {
                 throw new Error('invalid Attention delta');
             }
@@ -1892,13 +2071,12 @@ export class AgentTeamLedger {
                 throw new Error('conflicting Attention delta');
         }
         const markerKeys = new Set();
-        const messages = [...projection.messages, ...additionalMessages];
         for (const marker of delta.directMarkers.added) {
             const key = this.directMarkerKey(marker);
             if (markerKeys.has(key) || projection.directMarkers.has(key))
                 throw new Error('invalid direct marker addition');
             markerKeys.add(key);
-            const message = messages.find(candidate => candidate.messageRef === marker.messageRef);
+            const message = projection.messagesByRef.get(marker.messageRef) ?? additionalMessages.find(candidate => candidate.messageRef === marker.messageRef);
             if (message === undefined || message.threadRef !== marker.threadRef || message.sequence !== marker.sequence
                 || !this.validMentionTarget(projection, message.channelRef, marker.memberId))
                 throw new Error('invalid direct marker addition');
@@ -1909,17 +2087,20 @@ export class AgentTeamLedger {
                 throw new Error('invalid direct marker removal');
             markerKeys.add(key);
             const current = projection.directMarkers.get(key);
-            const message = messages.find(candidate => candidate.messageRef === marker.messageRef);
+            const message = projection.messagesByRef.get(marker.messageRef) ?? additionalMessages.find(candidate => candidate.messageRef === marker.messageRef);
             if (!isDeepStrictEqual(current, marker) || message === undefined || message.threadRef !== marker.threadRef
                 || message.sequence !== marker.sequence || !this.validMentionTarget(projection, message.channelRef, marker.memberId)) {
                 throw new Error('invalid direct marker removal');
             }
         }
         const activityMarkerKeys = new Set();
-        const activities = [...projection.orderedFacts.filter(fact => fact.kind === 'activity').map(fact => fact.activity), ...additionalActivities];
         for (const marker of delta.activityMarkers.added) {
             const key = this.activityMarkerKey(marker);
-            const activity = activities.find(candidate => candidate.activityRef === marker.activityRef);
+            // Every activity marker is minted for the activity the same record
+            // carries (promotion, close, reopen, acceptance), and a removal never
+            // looks an activity up, so this record's own list is the whole
+            // resolution space: scanning recorded activities would add nothing.
+            const activity = additionalActivities.find(candidate => candidate.activityRef === marker.activityRef);
             if (activityMarkerKeys.has(key) || projection.activityMarkers.has(key) || activity === undefined
                 || activity.threadRef !== marker.threadRef || activity.sequence !== marker.sequence)
                 throw new Error('invalid activity marker addition');
@@ -1933,73 +2114,31 @@ export class AgentTeamLedger {
             activityMarkerKeys.add(key);
         }
     }
+    /**
+     * Replay validation of one departure's release snapshot against the
+     * projection it was derived from. `memberId` scopes everything to a single
+     * departing Member; `undefined` validates every owner, which is what
+     * archiving a whole Channel releases. The two scopes differ in exactly four
+     * ways, all of them visible here rather than spread over two copies:
+     *
+     * 1. released Claims are owner-filtered for a Member, unfiltered for a Channel;
+     * 2. Activities group per (owner, Thread) with owners sorted, which for a
+     *    single departing Member collapses to one Activity per Thread — the shape
+     *    the commit path writes;
+     * 3. the inbox cleanup covers the departing Member's Attention and markers, or
+     *    every Member's on the archived Channel's Threads;
+     * 4. the failure message names which of the two paths lost its cleanup.
+     */
     validateReleaseCleanup(data, projection, memberId, threadRefs, sequence, refs) {
         const releasedClaims = [...projection.claims.values()]
-            .filter(claim => claim.owner === memberId && claim.state === 'active' && threadRefs.has(claim.threadRef))
-            .map(claim => Object.freeze({ ...claim, state: 'released' }));
-        if (data.claims.length !== releasedClaims.length || data.claims.some((claim, index) => {
-            const expected = releasedClaims[index];
-            return expected === undefined || !this.sameClaim(expected, claim);
-        }))
-            throw new Error('invalid released Claim projection');
-        const byThread = new Map();
-        for (const claim of releasedClaims)
-            byThread.set(claim.threadRef, [...(byThread.get(claim.threadRef) ?? []), claim]);
-        const expectedActivities = [...byThread.entries()].map(([threadRef, claims]) => ({
-            kind: 'claims_released', taskRef: claims[0].taskRef, threadRef, actor: memberId, sequence,
-            claimRefs: claims.map(claim => claim.claimRef).sort(),
-        }));
-        if (data.activities.length !== expectedActivities.length || data.activities.some((activity, index) => {
-            const expected = expectedActivities[index];
-            return expected === undefined || activity.kind !== expected.kind || activity.taskRef !== expected.taskRef
-                || activity.threadRef !== expected.threadRef || activity.actor !== expected.actor || activity.sequence !== expected.sequence
-                || !this.sameList(activity.claimRefs, expected.claimRefs);
-        }))
-            throw new Error('invalid released Claim activities');
-        for (const claim of data.claims) {
-            const prior = projection.claims.get(claim.claimRef);
-            if (prior === undefined)
-                throw new Error('invalid released Claim reference');
-        }
-        for (const activity of data.activities)
-            this.addRef(refs, activity.activityRef);
-        const projectedClaims = new Map(projection.claims);
-        for (const claim of releasedClaims)
-            projectedClaims.set(claim.claimRef, claim);
-        const expectedTasks = [...new Set(releasedClaims.map(claim => claim.taskRef))].map(taskRef => {
-            const task = projection.tasks.get(taskRef);
-            return Object.freeze({ ...task, status: this.deriveResolvedTaskStatus(task, projectedClaims.values()) });
-        });
-        const expectedThreads = expectedActivities.map(activity => {
-            const thread = projection.threads.get(activity.threadRef);
-            return Object.freeze({ ...thread, revision: sequence });
-        });
-        if (!isDeepStrictEqual(data.tasks, expectedTasks) || !isDeepStrictEqual(data.threads, expectedThreads)) {
-            throw new Error('invalid released Claim Task or Thread projection');
-        }
-        const expectedAttention = [...projection.attention.values()]
-            .filter(attention => attention.memberId === memberId && threadRefs.has(attention.threadRef))
-            .map(attention => ({ memberId: attention.memberId, threadRef: attention.threadRef }));
-        const expectedMarkers = [...projection.directMarkers.values()]
-            .filter(marker => marker.memberId === memberId && threadRefs.has(marker.threadRef));
-        const expectedActivityMarkers = [...projection.activityMarkers.values()]
-            .filter(marker => marker.memberId === memberId && threadRefs.has(marker.threadRef));
-        const expectedInbox = this.inboxDelta([], expectedAttention, [], expectedMarkers, [], expectedActivityMarkers);
-        if (!isDeepStrictEqual(data.inbox, expectedInbox))
-            throw new Error('invalid Member inbox cleanup');
-        this.validateInboxDelta(data.inbox, projection, refs);
-    }
-    /** Replay validation of one Channel archival's release snapshot across every owner. */
-    validateChannelArchivalCleanup(data, projection, threadRefs, sequence, refs) {
-        const releasedClaims = [...projection.claims.values()]
-            .filter(claim => claim.state === 'active' && threadRefs.has(claim.threadRef))
+            .filter(claim => (memberId === undefined || claim.owner === memberId) && claim.state === 'active' && threadRefs.has(claim.threadRef))
             .map(claim => Object.freeze({ ...claim, state: 'released' }));
         if (data.claims.length !== releasedClaims.length || data.claims.some((claim, index) => {
             const expected = releasedClaims[index];
             return expected === undefined || !this.sameClaim(expected, claim);
         }))
             throw new Error('invalid released Claim projection');
-        // One activity per (owner, Thread), owners sorted like the commit path.
+        // One Activity per (owner, Thread), owners sorted like the commit path.
         const byOwner = new Map();
         for (const claim of releasedClaims) {
             const byThread = byOwner.get(claim.owner) ?? new Map();
@@ -2038,17 +2177,17 @@ export class AgentTeamLedger {
         if (!isDeepStrictEqual(data.tasks, expectedTasks) || !isDeepStrictEqual(data.threads, expectedThreads)) {
             throw new Error('invalid released Claim Task or Thread projection');
         }
-        // Attention and marker cleanup covers EVERY Member on the archived Threads.
         const expectedAttention = [...projection.attention.values()]
-            .filter(attention => threadRefs.has(attention.threadRef))
+            .filter(attention => (memberId === undefined || attention.memberId === memberId) && threadRefs.has(attention.threadRef))
             .map(attention => ({ memberId: attention.memberId, threadRef: attention.threadRef }));
         const expectedMarkers = [...projection.directMarkers.values()]
-            .filter(marker => threadRefs.has(marker.threadRef));
+            .filter(marker => (memberId === undefined || marker.memberId === memberId) && threadRefs.has(marker.threadRef));
         const expectedActivityMarkers = [...projection.activityMarkers.values()]
-            .filter(marker => threadRefs.has(marker.threadRef));
+            .filter(marker => (memberId === undefined || marker.memberId === memberId) && threadRefs.has(marker.threadRef));
         const expectedInbox = this.inboxDelta([], expectedAttention, [], expectedMarkers, [], expectedActivityMarkers);
-        if (!isDeepStrictEqual(data.inbox, expectedInbox))
-            throw new Error('invalid Channel archival inbox cleanup');
+        if (!isDeepStrictEqual(data.inbox, expectedInbox)) {
+            throw new Error(memberId === undefined ? 'invalid Channel archival inbox cleanup' : 'invalid Member inbox cleanup');
+        }
         this.validateInboxDelta(data.inbox, projection, refs);
     }
     validateMessageInbox(operation, projection) {
@@ -2088,6 +2227,12 @@ export class AgentTeamLedger {
     }
     apply(operation) {
         this.applyTo(this.state, operation);
+        // Live apply only: the record-validation replay re-derives each record
+        // against its own scratch projection, so a scope derivation there would be
+        // discarded.
+        const scopes = this.changeScopesOf(operation);
+        if (scopes === undefined || scopes.length !== 0)
+            this.projectionVersion = operation.sequence;
     }
     applyTo(target, operation) {
         target.ordered.push(operation);
@@ -2157,15 +2302,7 @@ export class AgentTeamLedger {
         }
         if (operation.kind === 'team/channel-member-removed') {
             target.memberships.get(operation.data.channelRef)?.delete(operation.data.memberId);
-            for (const claim of operation.data.claims)
-                target.claims.set(claim.claimRef, claim);
-            for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity, operation.occurredAt);
-            for (const task of operation.data.tasks)
-                target.tasks.set(task.taskRef, task);
-            for (const thread of operation.data.threads)
-                target.threads.set(thread.threadRef, thread);
-            this.applyInboxDelta(target, operation.data.inbox);
+            this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
             return;
         }
         if (operation.kind === 'team/channel-archived') {
@@ -2173,30 +2310,14 @@ export class AgentTeamLedger {
             // restore returns every Member to the Channel. Visibility filters by
             // channel state instead.
             target.channels.set(operation.data.channel.channelRef, operation.data.channel);
-            for (const claim of operation.data.claims)
-                target.claims.set(claim.claimRef, claim);
-            for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity, operation.occurredAt);
-            for (const task of operation.data.tasks)
-                target.tasks.set(task.taskRef, task);
-            for (const thread of operation.data.threads)
-                target.threads.set(thread.threadRef, thread);
-            this.applyInboxDelta(target, operation.data.inbox);
+            this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
             return;
         }
         if (operation.kind === 'team/member-removed') {
             target.members.set(operation.data.member.memberId, operation.data.member);
             for (const membership of target.memberships.values())
                 membership.delete(operation.data.member.memberId);
-            for (const claim of operation.data.claims)
-                target.claims.set(claim.claimRef, claim);
-            for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity, operation.occurredAt);
-            for (const task of operation.data.tasks)
-                target.tasks.set(task.taskRef, task);
-            for (const thread of operation.data.threads)
-                target.threads.set(thread.threadRef, thread);
-            this.applyInboxDelta(target, operation.data.inbox);
+            this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
             return;
         }
         if (operation.kind === 'team/member-archived') {
@@ -2204,34 +2325,37 @@ export class AgentTeamLedger {
             // restore returns the Member to its Channels. Visibility filters by
             // member state instead.
             target.members.set(operation.data.member.memberId, operation.data.member);
-            for (const claim of operation.data.claims)
-                target.claims.set(claim.claimRef, claim);
-            for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity, operation.occurredAt);
-            for (const task of operation.data.tasks)
-                target.tasks.set(task.taskRef, task);
-            for (const thread of operation.data.threads)
-                target.threads.set(thread.threadRef, thread);
-            this.applyInboxDelta(target, operation.data.inbox);
+            this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
             return;
         }
         if (operation.kind === 'team/thread-promoted') {
             this.appendActivityFact(target, operation.data.activity, operation.occurredAt);
             target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
+            this.recordTaskNumber(target, operation.data.task);
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
         if (operation.kind === 'team/message-sent' || operation.kind === 'team/thread-replied') {
             const { message, mentions } = operation.data;
-            target.messages.push(message);
             target.mentionsByMessage.set(message.messageRef, Object.freeze([...mentions]));
             this.appendMessageFact(target, message, mentions, message.occurredAt ?? operation.occurredAt);
             if (operation.data.task !== undefined)
                 target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
-            if (message.topLevel)
+            if (message.topLevel) {
                 target.channelRefByThread.set(message.threadRef, message.channelRef);
+                // The anchor is the Thread's first topLevel Message; a later topLevel
+                // Message (none today) must not displace it, matching the linear scan.
+                if (!target.anchorByThread.has(message.threadRef))
+                    target.anchorByThread.set(message.threadRef, message);
+            }
+            // Only message-sent mints a Task ordinal; thread-replied may echo the
+            // Task without renumbering it, like the operation scan it replaces.
+            if (operation.kind === 'team/message-sent' && operation.data.task !== undefined)
+                this.recordTaskNumber(target, operation.data.task);
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
@@ -2240,6 +2364,7 @@ export class AgentTeamLedger {
             this.appendActivityFact(target, operation.data.activity, operation.occurredAt);
             target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
@@ -2249,10 +2374,12 @@ export class AgentTeamLedger {
             this.appendActivityFact(target, operation.data.activity, operation.occurredAt);
             target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
         if (operation.kind === 'team/thread-attention-changed' || operation.kind === 'team/thread-read') {
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
@@ -2263,6 +2390,25 @@ export class AgentTeamLedger {
         }
         assertUnhandledKind(operation);
     }
+    /**
+     * Replay the departure snapshot a releasing operation carries. The order is
+     * replay semantics, not style: Claims land before the Activities that
+     * reference them, and Tasks/Threads before the inbox delta that reads them.
+     * Each caller still applies its own identifying writes (member, membership,
+     * channel) around this call.
+     */
+    applyReleaseSnapshot(target, operation, data, occurredAt) {
+        for (const claim of data.claims)
+            target.claims.set(claim.claimRef, claim);
+        for (const activity of data.activities)
+            this.appendActivityFact(target, activity, occurredAt);
+        for (const task of data.tasks)
+            target.tasks.set(task.taskRef, task);
+        for (const thread of data.threads)
+            target.threads.set(thread.threadRef, thread);
+        this.recordAttentionObservations(target, operation, data.inbox);
+        this.applyInboxDelta(target, data.inbox);
+    }
     /** Facts arrive in ledger sequence order, so global and per-thread lists stay sorted by append only. */
     appendMessageFact(target, message, mentions, occurredAt) {
         const fact = Object.freeze({ kind: 'message', sequence: message.sequence, message, mentions, occurredAt });
@@ -2271,6 +2417,9 @@ export class AgentTeamLedger {
         facts.push(fact);
         target.factsByThread.set(message.threadRef, facts);
         target.messageCountByThread.set(message.threadRef, (target.messageCountByThread.get(message.threadRef) ?? 0) + 1);
+        // The ref index is written in this same step, so it is exactly the set of
+        // replayed Messages: a validator lookup can never reach a later record.
+        target.messagesByRef.set(message.messageRef, message);
     }
     appendActivityFact(target, activity, occurredAt) {
         const fact = Object.freeze({ kind: 'activity', sequence: activity.sequence, activity, occurredAt });
@@ -2279,6 +2428,44 @@ export class AgentTeamLedger {
         facts.push(fact);
         target.factsByThread.set(activity.threadRef, facts);
     }
+    /** Display ordinals are a per-Channel creation counter; the workspace filter happens at read time. */
+    recordTaskNumber(target, task) {
+        const ordinal = (target.taskCountByChannel.get(task.channelRef) ?? 0) + 1;
+        target.taskCountByChannel.set(task.channelRef, ordinal);
+        target.taskNumberByTask.set(task.taskRef, ordinal);
+    }
+    /**
+     * Replay-order Attention observations, appended from committed Inbox deltas
+     * only (the hypothetical read projection applies its delta directly). The
+     * follow/unfollow decision mirrors the full replay scan it replaces: a
+     * removal records only when Attention existed, and a set records unless it
+     * is the Thread-creating Message (initial Attention) or merely advances the
+     * same follow's watermark. Removals are evaluated before sets, exactly like
+     * the scan's loop order.
+     */
+    recordAttentionObservations(target, operation, delta) {
+        if (delta.attention.removed.length === 0 && delta.attention.set.length === 0)
+            return;
+        const retired = new Set();
+        for (const key of delta.attention.removed) {
+            retired.add(this.attentionKey(key.memberId, key.threadRef));
+            if (!target.attention.has(this.attentionKey(key.memberId, key.threadRef)))
+                continue;
+            this.appendObservation(target, key.threadRef, { sequence: operation.sequence, memberId: key.memberId, action: 'unfollow' });
+        }
+        for (const next of delta.attention.set) {
+            const key = this.attentionKey(next.memberId, next.threadRef);
+            const prior = retired.has(key) ? undefined : target.attention.get(key);
+            if (operation.kind === 'team/message-sent' || (prior !== undefined && prior.startSequence === next.startSequence))
+                continue;
+            this.appendObservation(target, next.threadRef, { sequence: operation.sequence, memberId: next.memberId, action: 'follow' });
+        }
+    }
+    appendObservation(target, threadRef, observation) {
+        const observations = target.observationsByThread.get(threadRef) ?? [];
+        observations.push(Object.freeze(observation));
+        target.observationsByThread.set(threadRef, observations);
+    }
     applyInboxDelta(target, delta) {
         for (const key of delta.attention.removed) {
             target.attention.delete(this.attentionKey(key.memberId, key.threadRef));
@@ -2288,27 +2475,76 @@ export class AgentTeamLedger {
                 if (followers.size === 0)
                     target.attentionByThread.delete(key.threadRef);
             }
+            const threads = target.attentionThreadsByMember.get(key.memberId);
+            if (threads !== undefined) {
+                threads.delete(key.threadRef);
+                if (threads.size === 0)
+                    target.attentionThreadsByMember.delete(key.memberId);
+            }
         }
         for (const attention of delta.attention.set) {
             target.attention.set(this.attentionKey(attention.memberId, attention.threadRef), attention);
             const followers = target.attentionByThread.get(attention.threadRef) ?? new Set();
             followers.add(attention.memberId);
             target.attentionByThread.set(attention.threadRef, followers);
+            const threads = target.attentionThreadsByMember.get(attention.memberId) ?? new Set();
+            threads.add(attention.threadRef);
+            target.attentionThreadsByMember.set(attention.memberId, threads);
         }
-        for (const marker of delta.directMarkers.removed)
+        for (const marker of delta.directMarkers.removed) {
             target.directMarkers.delete(this.directMarkerKey(marker));
-        for (const marker of delta.directMarkers.added)
+            this.removeBucketedMarker(target.directMarkersByMember, marker.memberId, marker.threadRef, this.directMarkerKey(marker), candidate => this.directMarkerKey(candidate));
+        }
+        for (const marker of delta.directMarkers.added) {
             target.directMarkers.set(this.directMarkerKey(marker), marker);
-        for (const marker of delta.activityMarkers.removed)
+            this.insertBucketedMarker(target.directMarkersByMember, marker.memberId, marker.threadRef, marker);
+        }
+        for (const marker of delta.activityMarkers.removed) {
             target.activityMarkers.delete(this.activityMarkerKey(marker));
-        for (const marker of delta.activityMarkers.added)
+            this.removeBucketedMarker(target.activityMarkersByMember, marker.memberId, marker.threadRef, this.activityMarkerKey(marker), candidate => this.activityMarkerKey(candidate));
+        }
+        for (const marker of delta.activityMarkers.added) {
             target.activityMarkers.set(this.activityMarkerKey(marker), marker);
+            this.insertBucketedMarker(target.activityMarkersByMember, marker.memberId, marker.threadRef, marker);
+        }
+    }
+    /** Insert into the Member's Thread bucket keeping the sequence order the read path must see. */
+    insertBucketedMarker(index, memberId, threadRef, marker) {
+        const threads = index.get(memberId) ?? new Map();
+        index.set(memberId, threads);
+        const bucket = threads.get(threadRef) ?? [];
+        threads.set(threadRef, bucket);
+        let position = bucket.length;
+        while (position > 0 && bucket[position - 1].sequence > marker.sequence)
+            position -= 1;
+        bucket.splice(position, 0, marker);
+    }
+    removeBucketedMarker(index, memberId, threadRef, key, identityOf) {
+        const threads = index.get(memberId);
+        const bucket = threads?.get(threadRef);
+        if (bucket === undefined)
+            return;
+        const position = bucket.findIndex(item => identityOf(item) === key);
+        if (position >= 0)
+            bucket.splice(position, 1);
+        if (bucket.length === 0) {
+            threads.delete(threadRef);
+            if (threads.size === 0)
+                index.delete(memberId);
+        }
     }
     prepareRead(memberId, workspaceId, request) {
         return this.prepareReadFrom(this.state, memberId, workspaceId, request);
     }
-    /** Derive the only legal durable result of one Thread read from a prior projection. */
-    prepareReadFrom(projection, memberId, workspaceId, request) {
+    /**
+     * Derive the durable receipt of one Thread read from a prior projection: the
+     * Thread it targeted, the watermark it reaches, the Attention row it writes
+     * and the Inbox delta it consumes. This is the whole durable content of a
+     * receipt-shaped read and the only thing `validateRecords` re-derives for
+     * one; the picture derivation below builds on the same result, so the two can
+     * never drift.
+     */
+    prepareReadReceiptFrom(projection, memberId, workspaceId, request) {
         const { task, thread, channelRef } = this.threadContextFrom(projection, workspaceId, request);
         if (memberId !== AGENT_TEAM_HUMAN_MEMBER_ID) {
             const member = projection.members.get(memberId);
@@ -2316,21 +2552,9 @@ export class AgentTeamLedger {
                 throw new Error(`Agent Member '${memberId}' is not authorized for Channel '${channelRef}'`);
             }
         }
-        const anchor = this.threadAnchorFrom(projection, thread.threadRef);
         const attention = this.attentionForFrom(projection, memberId, thread.threadRef);
         const unread = this.unreadForFrom(projection, memberId, thread.threadRef);
         const unreadFacts = unread.slice(0, 20);
-        const unreadFactKeys = new Set(unread.map(item => this.threadFactKey(item.fact)));
-        const firstRead = attention !== undefined && attention.readThroughSequence < attention.startSequence;
-        const background = firstRead
-            ? projection.messages.filter(message => message.threadRef === thread.threadRef && message.sequence < attention.startSequence)
-                .map(message => Object.freeze({ kind: 'message', sequence: message.sequence, message,
-                mentions: projection.mentionsByMessage.get(message.messageRef) ?? [],
-                occurredAt: this.occurredAtForFactFrom(projection, message.sequence, message.occurredAt) }))
-                .filter(fact => !unreadFactKeys.has(this.threadFactKey(fact))).slice(-12)
-            : [];
-        const combined = [...background.map(fact => this.readFactFrom(projection, memberId, fact, false)), ...unreadFacts]
-            .sort((left, right) => left.fact.sequence - right.fact.sequence);
         // Direct markers are sparse acknowledgements, not part of the contiguous
         // follower watermark. Consuming an old marker after a later follow must
         // never move that watermark backwards.
@@ -2346,24 +2570,36 @@ export class AgentTeamLedger {
         const activityMarkers = this.activityMarkersForFrom(projection, memberId, thread.threadRef)
             .filter(marker => unreadFacts.some(item => item.fact.kind === 'activity' && item.fact.activity.activityRef === marker.activityRef));
         const inbox = this.inboxDelta(nextAttention, [], [], consumed, [], activityMarkers);
-        // The hypothetical projection copies every map that its inbox delta can
-        // mutate, including the follower sets inside attentionByThread; the fact
-        // indexes are read-only here and stay shared.
-        const nextProjection = {
-            ...projection,
-            attention: new Map(projection.attention),
-            directMarkers: new Map(projection.directMarkers),
-            activityMarkers: new Map(projection.activityMarkers),
-            attentionByThread: new Map([...projection.attentionByThread].map(([threadRef, followers]) => [threadRef, new Set(followers)])),
-        };
-        this.applyInboxDelta(nextProjection, inbox);
-        const remainingUnreadCount = this.unreadForFrom(nextProjection, memberId, thread.threadRef).length;
-        return Object.freeze({ ...(task === undefined ? {} : { task }), thread, claims: task === undefined ? Object.freeze([]) : this.claimsForTaskFrom(projection, task.taskRef), anchor,
-            anchorMentions: projection.mentionsByMessage.get(anchor.messageRef) ?? [],
-            facts: Object.freeze(combined),
-            readThroughSequence, remainingUnreadCount, ...(attention === undefined ? {} : { attention: nextAttention[0] ?? attention }),
+        return Object.freeze({ ...(task === undefined ? {} : { task }), thread, unread,
+            ...(attention === undefined ? {} : { attentionBefore: attention }), readThroughSequence,
+            ...(attention === undefined ? {} : { attention: nextAttention[0] ?? attention }),
             consumedDirectMarkers: Object.freeze(consumed), inbox });
     }
+    /** Derive the only legal durable result of one Thread read from a prior projection. */
+    prepareReadFrom(projection, memberId, workspaceId, request) {
+        const receipt = this.prepareReadReceiptFrom(projection, memberId, workspaceId, request);
+        const { task, thread } = receipt;
+        const anchor = this.threadAnchorFrom(projection, thread.threadRef);
+        // The first read of a Thread after following also shows the bounded
+        // background that preceded the follow, so a reader sees what they joined.
+        const firstRead = receipt.attentionBefore !== undefined && receipt.attentionBefore.readThroughSequence < receipt.attentionBefore.startSequence;
+        const unreadFactKeys = new Set(receipt.unread.map(item => this.threadFactKey(item.fact)));
+        const background = firstRead
+            ? this.threadFactsFrom(projection, thread.threadRef)
+                .filter((fact) => fact.kind === 'message'
+                && fact.sequence < receipt.attentionBefore.startSequence)
+                .map(fact => Object.freeze({ kind: 'message', sequence: fact.sequence, message: fact.message,
+                mentions: projection.mentionsByMessage.get(fact.message.messageRef) ?? [],
+                occurredAt: this.occurredAtForFactFrom(projection, fact.sequence, fact.message.occurredAt) }))
+                .filter(fact => !unreadFactKeys.has(this.threadFactKey(fact))).slice(-12)
+            : [];
+        const combined = [...background.map(fact => this.readFactFrom(projection, memberId, fact, false)), ...receipt.unread.slice(0, 20)]
+            .sort((left, right) => left.fact.sequence - right.fact.sequence);
+        const remainingUnreadCount = this.remainingUnreadAfter(projection, memberId, receipt);
+        return Object.freeze({ ...receipt, claims: task === undefined ? Object.freeze([]) : this.claimsForTaskFrom(projection, task.taskRef), anchor,
+            anchorMentions: projection.mentionsByMessage.get(anchor.messageRef) ?? [],
+            facts: Object.freeze(combined), remainingUnreadCount });
+    }
     readFactFrom(projection, memberId, fact, unread) {
         return Object.freeze({ fact, unread, direct: fact.kind === 'message'
                 && projection.directMarkers.has(this.directMarkerKey({ memberId, threadRef: fact.message.threadRef,
@@ -2374,23 +2610,60 @@ export class AgentTeamLedger {
     }
     unreadForFrom(projection, memberId, threadRef) {
         const attention = this.attentionForFrom(projection, memberId, threadRef);
-        const facts = this.threadFactsFrom(projection, threadRef);
-        const direct = this.directMarkersForFrom(projection, memberId, threadRef);
-        const directKeys = new Set(direct.map(marker => this.directMarkerKey(marker)));
+        const directKeys = new Set(this.directMarkersForFrom(projection, memberId, threadRef).map(marker => this.directMarkerKey(marker)));
         const activityKeys = new Set(this.activityMarkersForFrom(projection, memberId, threadRef).map(marker => this.activityMarkerKey(marker)));
         const result = [];
-        for (const fact of facts) {
-            const marker = fact.kind === 'message' && directKeys.has(this.directMarkerKey({ memberId, threadRef,
-                messageRef: fact.message.messageRef, sequence: fact.sequence }));
-            const activityMarker = fact.kind === 'activity' && activityKeys.has(this.activityMarkerKey({ memberId, threadRef,
-                activityRef: fact.activity.activityRef, sequence: fact.sequence }));
-            const ordinary = attention !== undefined && fact.sequence >= attention.startSequence
-                && fact.sequence > attention.readThroughSequence && this.visibleToFollower(fact, memberId);
-            if (marker || activityMarker || ordinary)
+        for (const fact of this.threadFactsFrom(projection, threadRef)) {
+            if (this.isUnreadFact(fact, memberId, threadRef, attention, directKeys, activityKeys)) {
                 result.push(this.readFactFrom(projection, memberId, fact, true));
+            }
         }
         return Object.freeze(result);
     }
+    /**
+     * The single authority on "this fact is unread for this reader". The picture
+     * derivation and the remaining-count derivation both go through it, so the
+     * count a read reports can never disagree with the facts it lists. Marker
+     * membership arrives as key sets: the caller may be looking at a state the
+     * projection has not applied yet.
+     */
+    isUnreadFact(fact, memberId, threadRef, attention, directKeys, activityKeys) {
+        const marker = fact.kind === 'message' && directKeys.has(this.directMarkerKey({ memberId, threadRef,
+            messageRef: fact.message.messageRef, sequence: fact.sequence }));
+        const activityMarker = fact.kind === 'activity' && activityKeys.has(this.activityMarkerKey({ memberId, threadRef,
+            activityRef: fact.activity.activityRef, sequence: fact.sequence }));
+        const ordinary = attention !== undefined && fact.sequence >= attention.startSequence
+            && fact.sequence > attention.readThroughSequence && this.visibleToFollower(fact, memberId);
+        return marker || activityMarker || ordinary;
+    }
+    /**
+     * Unread count once this read's own Inbox delta has been applied, derived
+     * without materializing a hypothetical projection. The delta can only touch
+     * the reader's own Attention row and its own marker keys in one Thread, and
+     * every lookup in `isUnreadFact` is scoped to that same (member, Thread)
+     * pair, so the post-delta state is the Attention row the receipt already
+     * derived plus those marker keys with the delta's own removals and additions
+     * applied.
+     */
+    remainingUnreadAfter(projection, memberId, receipt) {
+        const threadRef = receipt.thread.threadRef;
+        const directKeys = new Set(this.directMarkersForFrom(projection, memberId, threadRef).map(marker => this.directMarkerKey(marker)));
+        for (const marker of receipt.inbox.directMarkers.removed)
+            directKeys.delete(this.directMarkerKey(marker));
+        for (const marker of receipt.inbox.directMarkers.added)
+            directKeys.add(this.directMarkerKey(marker));
+        const activityKeys = new Set(this.activityMarkersForFrom(projection, memberId, threadRef).map(marker => this.activityMarkerKey(marker)));
+        for (const marker of receipt.inbox.activityMarkers.removed)
+            activityKeys.delete(this.activityMarkerKey(marker));
+        for (const marker of receipt.inbox.activityMarkers.added)
+            activityKeys.add(this.activityMarkerKey(marker));
+        let count = 0;
+        for (const fact of this.threadFactsFrom(projection, threadRef)) {
+            if (this.isUnreadFact(fact, memberId, threadRef, receipt.attention, directKeys, activityKeys))
+                count += 1;
+        }
+        return count;
+    }
     visibleToFollower(fact, memberId) {
         const sender = fact.kind === 'message' ? fact.message.sender : fact.activity.actor;
         return sender !== memberId;
@@ -2535,12 +2808,14 @@ export class AgentTeamLedger {
         return this.directMarkersForFrom(this.state, memberId, threadRef);
     }
     directMarkersForFrom(projection, memberId, threadRef) {
-        return Object.freeze([...projection.directMarkers.values()].filter(marker => marker.memberId === memberId && marker.threadRef === threadRef)
-            .sort((left, right) => left.sequence - right.sequence));
+        // A frozen copy, not the live bucket: callers may hand the array to an
+        // Inbox delta that freezes it, which must not freeze the derived index.
+        const markers = projection.directMarkersByMember.get(memberId)?.get(threadRef);
+        return markers === undefined ? [] : Object.freeze([...markers]);
     }
     activityMarkersForFrom(projection, memberId, threadRef) {
-        return Object.freeze([...projection.activityMarkers.values()].filter(marker => marker.memberId === memberId && marker.threadRef === threadRef)
-            .sort((left, right) => left.sequence - right.sequence));
+        const markers = projection.activityMarkersByMember.get(memberId)?.get(threadRef);
+        return markers === undefined ? [] : Object.freeze([...markers]);
     }
     issueConfirmation(actor, workspaceId, channelRef, body, recipients, task, thread) {
         if (actor.kind !== 'human')
@@ -2651,7 +2926,7 @@ export class AgentTeamLedger {
         return this.threadAnchorFrom(this.state, threadRef);
     }
     threadAnchorFrom(projection, threadRef) {
-        const anchor = projection.messages.find(message => message.threadRef === threadRef && message.topLevel);
+        const anchor = projection.anchorByThread.get(threadRef);
         if (anchor === undefined)
             throw new Error(`Thread '${threadRef}' has no anchor Message`);
         return anchor;
@@ -2663,20 +2938,17 @@ export class AgentTeamLedger {
      * Display numbers for Tasks: one counter per home Channel, in creation
      * order. This is the single numbering authority — Channel cards, Thread
      * headings, cross-channel ref resolution, and inbox renders all show the
-     * ordinal the Task holds inside its own Channel.
+     * ordinal the Task holds inside its own Channel. The ordinals are derived
+     * at replay time (`taskNumberByTask`); this read only filters them to one
+     * Workspace.
      */
     taskNumbers(workspaceId) {
         const numbers = new Map();
-        const next = new Map();
-        for (const operation of this.state.ordered) {
-            const task = operation.kind === 'team/message-sent' || operation.kind === 'team/thread-promoted' ? operation.data.task : undefined;
-            if (task === undefined)
-                continue;
-            if (this.state.channels.get(task.channelRef)?.workspaceId !== workspaceId)
+        for (const [taskRef, taskNumber] of this.state.taskNumberByTask) {
+            const task = this.state.tasks.get(taskRef);
+            if (task === undefined || this.state.channels.get(task.channelRef)?.workspaceId !== workspaceId)
                 continue;
-            const ordinal = (next.get(task.channelRef) ?? 0) + 1;
-            next.set(task.channelRef, ordinal);
-            numbers.set(task.taskRef, ordinal);
+            numbers.set(taskRef, taskNumber);
         }
         return numbers;
     }
@@ -3106,8 +3378,8 @@ export class AgentTeamLedger {
     assertSameThreadRead(operation, request) {
         if (operation.kind !== 'team/thread-read' || !this.sameActor(operation.actor, request.actor)
             || operation.data.workspaceId !== request.workspaceId
-            || (request.threadRef !== undefined && operation.data.thread.threadRef !== request.threadRef)
-            || (request.taskRef !== undefined && operation.data.task?.taskRef !== request.taskRef)
+            || (request.threadRef !== undefined && threadReadTargetOf(operation.data).threadRef !== request.threadRef)
+            || (request.taskRef !== undefined && threadReadTargetOf(operation.data).taskRef !== request.taskRef)
             || (request.threadRef === undefined && request.taskRef === undefined))
             this.throwRequestCollision(request.requestId);
     }
@@ -3212,14 +3484,18 @@ export class AgentTeamLedger {
         return Object.freeze({ kind: 'committed', receipt: this.receipt(operation), activity: operation.data.activity,
             task: operation.data.task, thread: operation.data.thread });
     }
-    threadReadResult(operation) {
-        // Loaded records are normalized by sortedRecords(); fresh writes always carry instants.
-        const { anchor, facts } = operation.data;
-        return Object.freeze({ receipt: this.receipt(operation), ...(operation.data.task === undefined ? {} : { task: operation.data.task }), thread: operation.data.thread,
-            claims: operation.data.claims, anchor, anchorMentions: operation.data.anchorMentions, facts,
-            readThroughSequence: operation.data.readThroughSequence, remainingUnreadCount: operation.data.remainingUnreadCount,
-            ...(operation.data.attention === undefined ? {} : { attention: operation.data.attention }),
-            consumedDirectMarkers: operation.data.inbox.directMarkers.removed });
+    /**
+     * The Thread picture a read answers with, derived from the projection the
+     * read resolved against. Committed reads, no-op reads and retries all share
+     * this one derivation, so a read that writes nothing still returns the same
+     * Attention, facts, watermark and unread count a committed one would.
+     */
+    readPicture(prepared) {
+        return Object.freeze({ ...(prepared.task === undefined ? {} : { task: prepared.task }), thread: prepared.thread,
+            claims: prepared.claims, anchor: prepared.anchor, anchorMentions: prepared.anchorMentions, facts: prepared.facts,
+            readThroughSequence: prepared.readThroughSequence, remainingUnreadCount: prepared.remainingUnreadCount,
+            ...(prepared.attention === undefined ? {} : { attention: prepared.attention }),
+            consumedDirectMarkers: prepared.inbox.directMarkers.removed });
     }
     receipt(operation) {
         return Object.freeze({ operationId: operation.operationId, requestId: operation.requestId, sequence: operation.sequence, occurredAt: operation.occurredAt });
@@ -3300,10 +3576,17 @@ export class AgentTeamLedger {
     legacyChannelThreadRefs(projection, channelRef) {
         return new Set([...projection.tasks.values()].filter(task => task.channelRef === channelRef).map(task => task.threadRef));
     }
-    /** Ledgers written before message occurredAt existed store bare messages; Thread reads resolve instants from the originating operations. */
+    /**
+     * Ledgers written before message occurredAt existed store bare messages;
+     * snapshot-shaped Thread reads resolve instants from the originating
+     * operations. A receipt-shaped read carries no message at all, so it passes
+     * through untouched — the load path must never touch a shape it does not
+     * have, and it never writes either form back.
+     */
     normalizeOperation(operation, occurrences, instants) {
-        if (operation.kind !== 'team/thread-read')
+        if (operation.kind !== 'team/thread-read' || !isThreadReadSnapshot(operation.data))
             return operation;
+        const data = operation.data;
         const stamp = (message) => (message.occurredAt === undefined
             ? { ...message, occurredAt: occurrences.get(message.messageRef) ?? operation.occurredAt }
             : { ...message, occurredAt: message.occurredAt });
@@ -3312,8 +3595,8 @@ export class AgentTeamLedger {
                 occurredAt: envelope.occurredAt ?? envelope.message.occurredAt ?? occurrences.get(envelope.message.messageRef) ?? operation.occurredAt }
             : { kind: 'activity', sequence: envelope.sequence, activity: envelope.activity,
                 occurredAt: envelope.occurredAt ?? instants.get(envelope.sequence) ?? operation.occurredAt };
-        const facts = operation.data.facts.map((fact) => ({ ...fact, fact: stampEnvelope(fact.fact) }));
-        return { ...operation, data: { ...operation.data, anchor: stamp(operation.data.anchor), facts } };
+        const facts = data.facts.map((fact) => ({ ...fact, fact: stampEnvelope(fact.fact) }));
+        return { ...operation, data: { ...data, anchor: stamp(data.anchor), facts } };
     }
     enqueue(operation) {
         const result = this.operationTail.then(operation);