@wowyuarm/dsh-agent-team 0.1.10 → 0.1.12

package/packages/agent-team/lib/ledger.js

@@ -1,14 +1,21 @@
 import { randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { formatTeamTimestamp } from "./time-format.js";
+import { resolveBodyMentions } from "./mentions.js";
 /** Stable Human Member identity shared by every replay of one dshHome Team. */
 export const AGENT_TEAM_HUMAN_MEMBER_ID = 'member:human';
+/**
+ * The handle the Human is addressed by in Message bodies. The body parser and
+ * the Member directory both read this one constant, so a configurable display
+ * name has a single place to land instead of a hard-coded literal per surface.
+ */
+export const AGENT_TEAM_HUMAN_HANDLE = 'human';
 /** Idempotency identity of the one Host bootstrap operation. */
 export const AGENT_TEAM_INITIALIZE_REQUEST_ID = 'agent-team:initialize:v1';
 const HUMAN_ACTOR = Object.freeze({
     kind: 'human',
     memberId: AGENT_TEAM_HUMAN_MEMBER_ID,
-    handle: 'human',
+    handle: AGENT_TEAM_HUMAN_HANDLE,
 });
 /** Resolve the one Human authority owned by this Team. */
 export function agentTeamHumanActor() {
@@ -16,18 +23,61 @@ export function agentTeamHumanActor() {
 }
 function emptyProjection() {
     return { byRequest: new Map(), byOperation: new Map(), ordered: [], channels: new Map(), members: new Map(), memberships: new Map(),
-        claims: new Map(), messages: [], tasks: new Map(), threads: new Map(), attention: new Map(), directMarkers: new Map(), activityMarkers: new Map(),
+        claims: new Map(), tasks: new Map(), threads: new Map(), attention: new Map(), directMarkers: new Map(), activityMarkers: new Map(),
         orderedFacts: [], factsByThread: new Map(), channelRefByThread: new Map(), mentionsByMessage: new Map(), messageCountByThread: new Map(),
-        attentionByThread: new Map(), previousSessions: new Map(), rolloverSeeds: new Map() };
+        messagesByRef: new Map(),
+        attentionByThread: new Map(), previousSessions: new Map(), rolloverSeeds: new Map(),
+        anchorByThread: new Map(), taskNumberByTask: new Map(), taskCountByChannel: new Map(), attentionThreadsByMember: new Map(),
+        threadsByWriter: new Map(),
+        directMarkersByMember: new Map(), activityMarkersByMember: new Map(), observationsByThread: new Map() };
 }
-const EMPTY_PROGRESS_NUDGE_TARGETS = Object.freeze({
-    progress: Object.freeze([]),
-    claim: Object.freeze([]),
-});
 /** Exhaustiveness guard for the closed operation union: adding a kind must update every dispatch. */
 function assertUnhandledKind(operation) {
     throw new Error(`agent-team ledger does not handle operation kind '${operation.kind}'`);
 }
+/**
+ * Opening-line preview for a Human Inbox row: the Thread anchor's first line,
+ * trimmed, then capped at 120 characters with an explicit mark — the same bound
+ * the Thread page applies to its Task title, so the row and the page it opens
+ * never disagree about what a Thread is about.
+ */
+function boundedInboxPreview(body) {
+    const firstLine = body.split('\n', 1)[0]?.trim() ?? '';
+    return firstLine.length > 120 ? `${firstLine.slice(0, 119)}…` : firstLine;
+}
+/**
+ * How many Threads one Workspace's 「最近活跃」 slice may carry. It bounds what
+ * the Host hands over, not what the reader sees: the Client merges every
+ * visible Workspace's slice and trims the merged list to its own visible bound
+ * (`RECENT_ROWS_LIMIT`), which must stay at or below this one so no Workspace
+ * is cut short before the merge. The unread slice keeps its own `limit`
+ * request field.
+ */
+const RECENT_INBOX_LIMIT = 10;
+/**
+ * Whether one operation's Inbox delta would change nothing. A read that finds
+ * no unread fact for its reader and no marker to consume produces exactly this
+ * delta, which is why such a read is a no-op rather than a durable operation.
+ */
+function isEmptyInboxDelta(delta) {
+    return delta.attention.set.length === 0 && delta.attention.removed.length === 0
+        && delta.directMarkers.added.length === 0 && delta.directMarkers.removed.length === 0
+        && delta.activityMarkers.added.length === 0 && delta.activityMarkers.removed.length === 0;
+}
+/**
+ * Which of the two durable Thread-read forms one record holds. Both schemas are
+ * strict and structurally disjoint — only the pre-receipt snapshot carries the
+ * Thread picture — so `thread` decides it for every stored record.
+ */
+export function isThreadReadSnapshot(data) {
+    return 'thread' in data;
+}
+/** The Thread and optional Task one read targeted, whichever form the record holds. */
+export function threadReadTargetOf(data) {
+    return isThreadReadSnapshot(data)
+        ? { threadRef: data.thread.threadRef, ...(data.task === undefined ? {} : { taskRef: data.task.taskRef }) }
+        : { threadRef: data.threadRef, ...(data.taskRef === undefined ? {} : { taskRef: data.taskRef }) };
+}
 /** Deep-freeze a Member capability overlay; absent stays absent. */
 function freezeCapabilities(capabilities) {
     if (capabilities === undefined)
@@ -50,12 +100,35 @@ export class AgentTeamLedger {
     createOccurredAt;
     createRef;
     operationTail = Promise.resolve();
+    /**
+     * Head of the durable records the constructor's record-level replay
+     * validated, adoptable once by the invariant mount. See `validateAtMount`.
+     */
+    bootValidation;
+    /**
+     * Sequence of the newest committed record that invalidated the shared
+     * projection — the durable position the Client's change cursors compare
+     * against, rebuilt by replay like every other index.
+     *
+     * Records whose commit is private read progress or audit-only
+     * (`changeScopesOf` derives no scope for them) never move it, so one
+     * Member's Thread read cannot make a parked Client believe that something it
+     * watches changed. Being a ledger position rather than a process counter, it
+     * also stays monotone across a restart.
+     */
+    projectionVersion = 0;
     constructor(table, options = {}) {
         this.table = table;
         this.createOperationId = options.operationId ?? (() => `operation:${randomUUID()}`);
         this.createOccurredAt = options.occurredAt ?? (() => new Date().toISOString());
         this.createRef = options.ref ?? (kind => `${kind}:${randomUUID()}`);
         this.replay();
+        const head = this.state.ordered.at(-1);
+        this.bootValidation = Object.freeze({
+            records: this.state.ordered.length,
+            lastSequence: head?.sequence ?? 0,
+            lastOperationId: head?.operationId ?? null,
+        });
     }
     initialize(request = {
         requestId: AGENT_TEAM_INITIALIZE_REQUEST_ID,
@@ -379,80 +452,6 @@ export class AgentTeamLedger {
         }
         return active.sort((a, b) => a.claimRef.localeCompare(b.claimRef));
     }
-    /**
-     * Current progress-nudge candidacy for one Member: threads whose Thread
-     * progress reminder applies (active Claim, or following a taskless Thread)
-     * and tasks where the Claim reminder applies (following a still-`todo` Task
-     * with no Claim history for this Member). A deep read-only projection — the
-     * caller never re-derives attention, claim, task-resolution, or channel
-     * archive state. Archived channels and resolved tasks produce no candidacy;
-     * results are ordered by Thread revision descending, then threadRef.
-     */
-    progressNudgeTargets(memberId) {
-        const member = this.state.members.get(memberId);
-        if (member === undefined || member.state !== 'enabled')
-            return EMPTY_PROGRESS_NUDGE_TARGETS;
-        const progress = [];
-        const claim = [];
-        const seenProgress = new Set();
-        for (const claimRecord of this.state.claims.values()) {
-            if (claimRecord.owner !== memberId || claimRecord.state !== 'active')
-                continue;
-            const task = this.state.tasks.get(claimRecord.taskRef);
-            const thread = this.state.threads.get(claimRecord.threadRef);
-            if (task === undefined || thread === undefined || task.resolution !== 'open')
-                continue;
-            if (this.state.channels.get(task.channelRef)?.state === 'archived')
-                continue;
-            if (seenProgress.has(claimRecord.threadRef))
-                continue;
-            seenProgress.add(claimRecord.threadRef);
-            progress.push({ reason: 'active-claim', threadRef: claimRecord.threadRef, taskRef: claimRecord.taskRef });
-        }
-        for (const [threadRef, followers] of this.state.attentionByThread) {
-            if (!followers.has(memberId))
-                continue;
-            const thread = this.state.threads.get(threadRef);
-            if (thread === undefined)
-                continue;
-            const channelRef = this.state.channelRefByThread.get(threadRef);
-            if (channelRef === undefined || this.state.channels.get(channelRef)?.state === 'archived')
-                continue;
-            if (thread.taskRef === undefined) {
-                if (!seenProgress.has(threadRef)) {
-                    seenProgress.add(threadRef);
-                    progress.push({ reason: 'taskless-follower', threadRef });
-                }
-                continue;
-            }
-            // Claim reminder: only still-`todo` tasks with zero lifetime claims by
-            // this Member; once claimed (any state) the Member moved into the
-            // progress-reminder regime.
-            if (this.hasLifetimeClaimOnTask(memberId, thread.taskRef))
-                continue;
-            const task = this.state.tasks.get(thread.taskRef);
-            if (task === undefined || task.resolution !== 'open' || this.deriveTaskStatus(task.taskRef, this.state.claims.values()) !== 'todo')
-                continue;
-            claim.push({ threadRef, taskRef: thread.taskRef });
-        }
-        const byThreadRevision = (left, right) => {
-            const leftRevision = this.state.threads.get(left.threadRef)?.revision ?? 0;
-            const rightRevision = this.state.threads.get(right.threadRef)?.revision ?? 0;
-            return rightRevision - leftRevision || (left.threadRef < right.threadRef ? -1 : left.threadRef > right.threadRef ? 1 : 0);
-        };
-        return Object.freeze({
-            progress: Object.freeze(progress.sort(byThreadRevision)),
-            claim: Object.freeze(claim.sort(byThreadRevision)),
-        });
-    }
-    /** Whether this Member has ever held a Claim on the Task, in any state. */
-    hasLifetimeClaimOnTask(memberId, taskRef) {
-        for (const claim of this.state.claims.values()) {
-            if (claim.owner === memberId && claim.taskRef === taskRef)
-                return true;
-        }
-        return false;
-    }
     listMembers() {
         return Object.freeze([...this.state.members.values()]);
     }
@@ -560,12 +559,6 @@ export class AgentTeamLedger {
     }
     sendMessage(request) {
         return this.enqueue(async () => {
-            const recipients = this.normalizeRecipients(request.actor, request.recipients);
-            const existing = this.state.byRequest.get(request.requestId);
-            if (existing !== undefined) {
-                this.assertSameMessage(existing, request, recipients);
-                return this.resolved(this.messageResult(existing));
-            }
             const actor = this.assertActorForWorkspace(request.actor, request.workspaceId);
             const channel = this.requireActiveChannel(request.workspaceId, request.channelRef);
             if (actor.kind === 'member')
@@ -573,6 +566,15 @@ export class AgentTeamLedger {
             const body = request.body.trim();
             if (body === '')
                 throw new Error('message body must not be empty');
+            // Recipients are resolved before the request-id lookup: the stored
+            // operation carries the merged set, so a retry has to re-derive the same
+            // list for the collision check to prove it is the same request.
+            const recipients = this.mergeBodyMentions(actor.memberId, channel.channelRef, body, this.normalizeRecipients(request.actor, request.recipients));
+            const existing = this.state.byRequest.get(request.requestId);
+            if (existing !== undefined) {
+                this.assertSameMessage(existing, request, recipients);
+                return this.resolved(this.messageResult(existing));
+            }
             this.assertMentionTargets(channel, recipients);
             // Top-level Task creation is open to every actor: mentioned Members join
             // the new Thread as followers. Only existing-Thread invitations stay
@@ -607,32 +609,38 @@ export class AgentTeamLedger {
     }
     reply(request) {
         return this.enqueue(async () => {
-            const recipients = this.normalizeRecipients(request.actor, request.recipients);
-            const existing = this.state.byRequest.get(request.requestId);
-            if (existing !== undefined) {
-                this.assertSameReply(existing, request, recipients);
-                return this.resolved(this.replyResult(existing));
-            }
             const actor = this.assertActorForWorkspace(request.actor, request.workspaceId);
             const { task, thread, channelRef } = this.threadContextForActor(actor, request.workspaceId, request);
             const body = request.body.trim();
             if (body === '')
                 throw new Error('message body must not be empty');
-            this.assertMentionTargets(this.requireChannel(request.workspaceId, channelRef), recipients);
+            const channel = this.requireChannel(request.workspaceId, channelRef);
+            const recipients = this.mergeBodyMentions(actor.memberId, channelRef, body, this.normalizeRecipients(actor, request.recipients));
+            const existing = this.state.byRequest.get(request.requestId);
+            if (existing !== undefined) {
+                this.assertSameReply(existing, request, recipients);
+                return this.resolved(this.replyResult(existing, this.undeliverableRecipients(actor, thread.threadRef, recipients)));
+            }
+            this.assertMentionTargets(channel, recipients);
             const deferred = this.deferredThreadWrite(actor.memberId, task, thread, request.baseRevision);
             if (deferred !== undefined)
                 return this.resolved(deferred);
             if (task?.resolution === 'closed')
                 throw new Error(`Task '${task.taskRef}' is closed; reopen it before replying`);
-            const unfollowedAgents = recipients.filter(memberId => this.state.members.has(memberId) && !this.isFollowing(thread.threadRef, memberId));
-            if (unfollowedAgents.length > 0 && actor.kind === 'member') {
-                return this.resolved(this.memberNotFollowing(request.workspaceId, channelRef, unfollowedAgents, task, thread));
-            }
-            if (unfollowedAgents.length > 0 && request.confirmationToken === undefined) {
-                return this.resolved(this.issueConfirmation(request.actor, request.workspaceId, channelRef, body, recipients, task, thread));
+            // An Agent cannot invite into an existing Thread, so a body mention the
+            // Thread has never carried is dropped and reported back rather than
+            // failing the send. The Human keeps the confirmation step, which is what
+            // actually grants the invitation.
+            const undelivered = this.undeliverableRecipients(actor, thread.threadRef, recipients);
+            const delivered = undelivered.length === 0 ? recipients : recipients.filter(memberId => !undelivered.includes(memberId));
+            const unfollowedAgents = delivered.filter(memberId => this.state.members.has(memberId) && !this.isFollowing(thread.threadRef, memberId));
+            // A Member that once took part in this Thread is delivered to directly:
+            // re-joining a Thread it already belongs to is not an invitation.
+            if (unfollowedAgents.length > 0 && actor.kind === 'human' && request.confirmationToken === undefined) {
+                return this.resolved(this.issueConfirmation(request.actor, request.workspaceId, channelRef, body, delivered, task, thread));
             }
             if (request.confirmationToken !== undefined) {
-                this.consumeConfirmation(request.confirmationToken, request.actor, request.workspaceId, channelRef, task, thread, body, recipients);
+                this.consumeConfirmation(request.confirmationToken, request.actor, request.workspaceId, channelRef, task, thread, body, delivered);
             }
             const sequence = this.nextSequence();
             const base = this.operationBase(request, sequence);
@@ -644,15 +652,15 @@ export class AgentTeamLedger {
             });
             const nextThread = Object.freeze({ ...thread, revision: sequence });
             const started = unfollowedAgents.map(memberId => this.startAttention(memberId, thread.threadRef, sequence));
-            const inbox = this.messageInboxDelta(message, request.actor.memberId, recipients, started);
+            const inbox = this.messageInboxDelta(message, request.actor.memberId, delivered, started);
             const operation = Object.freeze({
                 ...base, kind: 'team/thread-replied',
                 data: Object.freeze({ workspaceId: request.workspaceId, baseRevision: request.baseRevision,
-                    mentions: recipients, message, ...(task === undefined ? {} : { task }), thread: nextThread, inbox }),
+                    mentions: delivered, message, ...(task === undefined ? {} : { task }), thread: nextThread, inbox }),
             });
             await this.table.put(operation.operationId, operation);
             this.apply(operation);
-            return this.committed(this.replyResult(operation));
+            return this.committed(this.replyResult(operation, undelivered));
         });
     }
     promoteThread(request) {
@@ -1025,8 +1033,24 @@ export class AgentTeamLedger {
         const limit = request.limit ?? 50;
         if (!Number.isInteger(limit) || limit < 1 || limit > 100)
             throw new Error('inbox limit must be an integer between 1 and 100');
+        // One unread slice serves every reader: Threads the reader follows or
+        // holds a marker on, admitted whenever they hold an unread fact — mentions
+        // are counted inside it (`directCount`), never a separate admission rule.
+        // Every row carries its rendering material — Channel display name, Task
+        // ordinal, opening line, and the person the row's instant came from — so the
+        // Client renders a row without a Channel or Member view per row. Carrying
+        // the opening line on the agent-facing projection is
+        // safe: model-visible notifications read the refs and the facts, never this.
+        // A Human reader additionally receives the separate 「最近活跃」 slice below;
+        // `items` stays exactly the unread queue for every reader, so the badge
+        // totals and the agent-facing `team_inbox` result cannot drift with it.
+        const taskNumbers = this.taskNumbers(request.workspaceId);
         const items = [];
-        for (const thread of this.state.threads.values()) {
+        const unreadThreads = new Set();
+        for (const threadRef of this.inboxCandidateThreads(authorized.memberId)) {
+            const thread = this.state.threads.get(threadRef);
+            if (thread === undefined)
+                continue;
             const channelRef = this.channelRefForThread(thread.threadRef);
             if (channelRef === undefined)
                 continue;
@@ -1037,6 +1061,7 @@ export class AgentTeamLedger {
             const unread = this.unreadFor(authorized.memberId, thread.threadRef);
             if (unread.length === 0)
                 continue;
+            unreadThreads.add(thread.threadRef);
             const task = thread.taskRef === undefined ? undefined : this.state.tasks.get(thread.taskRef);
             const directCount = unread.filter(item => item.direct).length;
             const attention = this.attentionFor(authorized.memberId, thread.threadRef);
@@ -1044,15 +1069,117 @@ export class AgentTeamLedger {
             // the newest unread fact itself, never a second lookup that could
             // observe a different commit between the two reads.
             const newest = unread.at(-1).fact;
-            items.push(Object.freeze({ channelRef, ...(task === undefined ? {} : { task }), thread, unreadCount: unread.length, directCount,
-                newestSequence: newest.sequence, newestOccurredAt: newest.occurredAt, ...(attention === undefined ? {} : { attention }) }));
+            const taskNumber = task === undefined ? undefined : taskNumbers.get(task.taskRef);
+            items.push(Object.freeze({ channelRef,
+                channelName: this.state.channels.get(channelRef)?.name ?? '',
+                ...(task === undefined ? {} : { task }), ...(taskNumber === undefined ? {} : { taskNumber }), thread,
+                unreadCount: unread.length, directCount,
+                previewText: boundedInboxPreview(this.threadAnchor(thread.threadRef).body),
+                newestSequence: newest.sequence, newestOccurredAt: newest.occurredAt,
+                newestActor: this.inboxActorFor(newest), claimOwners: this.liveClaimOwners(task),
+                ...(attention === undefined ? {} : { attention }) }));
         }
         items.sort((left, right) => right.directCount - left.directCount || right.newestSequence - left.newestSequence || left.thread.threadRef.localeCompare(right.thread.threadRef));
         const selected = items.slice(0, limit);
-        return Object.freeze({ items: Object.freeze(selected),
+        const recent = authorized.kind === 'human'
+            ? this.recentInboxItems(authorized.memberId, request.workspaceId, unreadThreads, taskNumbers)
+            : Object.freeze([]);
+        return Object.freeze({ items: Object.freeze(selected), recent,
             totalUnreadCount: items.reduce((sum, item) => sum + item.unreadCount, 0),
             totalDirectCount: items.reduce((sum, item) => sum + item.directCount, 0) });
     }
+    /**
+     * The one person a row names: whoever committed the fact that row's instant
+     * came from — a Message's sender, an activity's actor — resolved to the handle
+     * the row draws. Resolving it here is what spares every Client row a Member
+     * view of its own, and a Member the roster no longer names still reads as
+     * themselves through their raw id rather than as nobody.
+     */
+    inboxActorFor(fact) {
+        return this.memberActor(fact.kind === 'message' ? fact.message.sender : fact.activity.actor);
+    }
+    /** One Member as a row draws them: the id carries the identity hue, the handle the initial. */
+    memberActor(memberId) {
+        return Object.freeze({ memberId, name: this.state.members.get(memberId)?.handle ?? memberId });
+    }
+    /**
+     * The people a Task still has on it, resolved the way a row draws them: owners
+     * of its live Claims, in claim order, deduped. A released Claim is not work,
+     * and a done or closed Task keeps its Claims as history rather than as
+     * presence — deliberately the same rule the Channel feed applies to the same
+     * Task, so 「谁在这个 Task 上」 never acquires a second definition.
+     */
+    liveClaimOwners(task) {
+        if (task === undefined || (task.status !== 'in_progress' && task.status !== 'in_review'))
+            return Object.freeze([]);
+        const owners = [];
+        for (const claim of this.claimsForTask(task.taskRef)) {
+            if (claim.state === 'released' || owners.includes(claim.owner))
+                continue;
+            owners.push(claim.owner);
+        }
+        return Object.freeze(owners.map(owner => this.memberActor(owner)));
+    }
+    /**
+     * The Human Inbox's 「最近活跃」 slice: the Threads this reader has written in
+     * — the durable way back into work instead of a mention-only queue.
+     * Participation is the whole admission rule: a reader who replied to somebody
+     * else's Thread is here whether or not they follow it, and so is one who
+     * started a Thread nobody has answered yet, because starting one is writing
+     * its anchor. Attention deliberately plays no part — it decides what notifies
+     * a reader (a reply does not implicitly follow a Thread), and reading it here
+     * as well is what once hid every Thread a reader had replied to without
+     * following. A Thread the reader later unfollowed stays: they did take part
+     * in it, and unfollowing stops the notifications, not the record. Every
+     * Thread still holding unread is excluded because the queue above already
+     * carries it, and the slice is newest-activity first, bounded by
+     * `RECENT_INBOX_LIMIT`. Rows are the same shape as unread rows with every
+     * count at zero — they are the same row to render.
+     */
+    recentInboxItems(memberId, workspaceId, unreadThreads, taskNumbers) {
+        const recent = [];
+        for (const threadRef of this.state.threadsByWriter.get(memberId) ?? []) {
+            if (unreadThreads.has(threadRef))
+                continue;
+            const thread = this.state.threads.get(threadRef);
+            if (thread === undefined)
+                continue;
+            const channelRef = this.channelRefForThread(thread.threadRef);
+            if (channelRef === undefined)
+                continue;
+            if (this.state.channels.get(channelRef)?.workspaceId !== workspaceId)
+                continue;
+            const facts = this.state.factsByThread.get(thread.threadRef) ?? [];
+            const newest = facts.at(-1);
+            if (newest === undefined)
+                continue;
+            const task = thread.taskRef === undefined ? undefined : this.state.tasks.get(thread.taskRef);
+            const taskNumber = task === undefined ? undefined : taskNumbers.get(task.taskRef);
+            recent.push(Object.freeze({ channelRef,
+                channelName: this.state.channels.get(channelRef)?.name ?? '',
+                ...(task === undefined ? {} : { task }), ...(taskNumber === undefined ? {} : { taskNumber }), thread,
+                unreadCount: 0, directCount: 0,
+                previewText: boundedInboxPreview(this.threadAnchor(thread.threadRef).body),
+                newestSequence: newest.sequence, newestOccurredAt: newest.occurredAt,
+                newestActor: this.inboxActorFor(newest), claimOwners: this.liveClaimOwners(task) }));
+        }
+        recent.sort((left, right) => right.newestSequence - left.newestSequence || left.thread.threadRef.localeCompare(right.thread.threadRef));
+        return Object.freeze(recent.slice(0, RECENT_INBOX_LIMIT));
+    }
+    /**
+     * Threads that can hold unread facts for one reader, from the per-reader
+     * derived indexes: Attention follows plus direct and activity markers.
+     * Every unread source is covered — ordinary unread requires Attention, and
+     * marker unread requires a marker — so no full Thread scan is needed.
+     */
+    inboxCandidateThreads(memberId) {
+        const refs = new Set();
+        for (const source of [this.state.attentionThreadsByMember.get(memberId), this.state.directMarkersByMember.get(memberId), this.state.activityMarkersByMember.get(memberId)]) {
+            for (const threadRef of source?.keys() ?? [])
+                refs.add(threadRef);
+        }
+        return refs;
+    }
     /** Model-visible notification material derived from the recipient's current durable unread state. */
     notificationFacts(memberId, request) {
         const member = this.requireMember(memberId);
@@ -1067,22 +1194,31 @@ export class AgentTeamLedger {
             const existing = this.state.byRequest.get(request.requestId);
             if (existing !== undefined) {
                 this.assertSameThreadRead(existing, request);
-                return this.resolved(this.threadReadResult(existing));
+                // A retry reports the original receipt with the picture the current
+                // projection derives, and never advances a watermark a second time.
+                const current = this.prepareRead(existing.data.memberId, existing.data.workspaceId, request);
+                return Object.freeze({ value: Object.freeze({ receipt: this.receipt(existing), ...this.readPicture(current) }), committed: false });
             }
             const actor = this.assertActorForWorkspace(request.actor, request.workspaceId);
             const prepared = this.prepareRead(actor.memberId, request.workspaceId, request);
+            // A read whose Inbox delta is empty writes nothing: the watermark does
+            // not advance and no marker is consumed. It answers with the same picture
+            // and no receipt, so the caller learns "no operation" from the result's
+            // committed flag, never from a sequence this read did not write.
+            if (isEmptyInboxDelta(prepared.inbox))
+                return Object.freeze({ value: this.readPicture(prepared), committed: false });
+            // The record carries progress, not the picture: the Thread, its facts,
+            // the anchor and the reader's Attention are projection state every replay
+            // already holds.
+            const data = Object.freeze({ workspaceId: request.workspaceId, memberId: actor.memberId,
+                threadRef: prepared.thread.threadRef, ...(prepared.task === undefined ? {} : { taskRef: prepared.task.taskRef }),
+                readThroughSequence: prepared.readThroughSequence, inbox: prepared.inbox });
             const operation = Object.freeze({
-                ...this.operationBase(request, this.nextSequence()), kind: 'team/thread-read',
-                data: Object.freeze({ workspaceId: request.workspaceId, memberId: actor.memberId,
-                    ...(prepared.task === undefined ? {} : { task: prepared.task }),
-                    thread: prepared.thread, claims: prepared.claims, anchor: prepared.anchor, anchorMentions: prepared.anchorMentions,
-                    facts: prepared.facts,
-                    readThroughSequence: prepared.readThroughSequence, remainingUnreadCount: prepared.remainingUnreadCount,
-                    ...(prepared.attention === undefined ? {} : { attention: prepared.attention }), inbox: prepared.inbox }),
+                ...this.operationBase(request, this.nextSequence()), kind: 'team/thread-read', data,
             });
             await this.table.put(operation.operationId, operation);
             this.apply(operation);
-            return this.committed(this.threadReadResult(operation));
+            return Object.freeze({ value: Object.freeze({ receipt: this.receipt(operation), ...this.readPicture(prepared) }), committed: true });
         });
     }
     threadObservations(actor, request) {
@@ -1092,33 +1228,13 @@ export class AgentTeamLedger {
         if (!Number.isInteger(limit) || limit < 1 || limit > 100)
             throw new Error('observation limit must be an integer between 1 and 100');
         const threadRef = thread.threadRef;
-        const current = new Map();
-        const observations = [];
-        for (const operation of this.state.ordered) {
-            const delta = this.attentionDelta(operation);
-            if (delta === undefined)
-                continue;
-            for (const removed of delta.attention.removed) {
-                if (removed.threadRef !== threadRef)
-                    continue;
-                if (!current.delete(removed.memberId))
-                    continue;
-                observations.push(Object.freeze({ sequence: operation.sequence, threadRef, ...(task === undefined ? {} : { taskRef: task.taskRef }),
-                    memberId: removed.memberId, action: 'unfollow' }));
-            }
-            for (const next of delta.attention.set) {
-                if (next.threadRef !== threadRef)
-                    continue;
-                const prior = current.get(next.memberId);
-                current.set(next.memberId, next);
-                // Task creation establishes initial Attention; reads only advance its watermark.
-                if (operation.kind === 'team/message-sent' || (prior !== undefined && prior.startSequence === next.startSequence))
-                    continue;
-                observations.push(Object.freeze({ sequence: operation.sequence, threadRef, ...(task === undefined ? {} : { taskRef: task.taskRef }),
-                    memberId: next.memberId, action: 'follow' }));
-            }
-        }
-        return Object.freeze({ items: Object.freeze(observations.slice(-limit)), followers: Object.freeze([...current.keys()]) });
+        // Both slices are replay-derived: the observation log is appended by
+        // committed Inbox deltas in ledger order, and the live follower set is
+        // the same Attention index the follow history converges to.
+        const observations = (this.state.observationsByThread.get(threadRef) ?? []).slice(-limit)
+            .map(event => Object.freeze({ sequence: event.sequence, threadRef, ...(task === undefined ? {} : { taskRef: task.taskRef }),
+            memberId: event.memberId, action: event.action }));
+        return Object.freeze({ items: Object.freeze(observations), followers: Object.freeze([...this.state.attentionByThread.get(threadRef) ?? []]) });
     }
     /** Every operation carrying an inbox delta drives the Inbox projection; the payload shape decides, not a per-kind list. */
     attentionDelta(operation) {
@@ -1216,7 +1332,8 @@ export class AgentTeamLedger {
             && channel.state !== 'archived'
             && (memberId === undefined || this.isChannelMember(channel.channelRef, memberId)));
         const channelRefs = new Set(channels.map(channel => channel.channelRef));
-        const allFacts = this.state.orderedFacts.filter(fact => {
+        const before = request.cursor ?? this.state.ordered.length + 1;
+        const matches = (fact) => {
             const threadRef = fact.kind === 'message' ? fact.message.threadRef : fact.activity.threadRef;
             const channelRef = this.channelRefForThread(threadRef);
             if (channelRef === undefined || !channelRefs.has(channelRef))
@@ -1229,9 +1346,40 @@ export class AgentTeamLedger {
                 return false;
             if (request.includeActivities === false && fact.kind === 'activity')
                 return false;
-            return direction === 'before' ? fact.sequence < (request.cursor ?? this.state.ordered.length + 1) : fact.sequence > cursor;
-        });
-        const selected = direction === 'before' ? allFacts.slice(-limit) : allFacts.slice(0, limit);
+            return direction === 'before' ? fact.sequence < before : fact.sequence > cursor;
+        };
+        // Walk from the end the direction starts at and stop once `limit` matches
+        // are collected plus one more proves `hasMore` — `limit` bounds only the
+        // returned items, never the scan below a single extra match. A sidebar
+        // asking for one item no longer sweeps the whole fact ledger.
+        const selected = [];
+        let hasMore = false;
+        if (direction === 'before') {
+            for (let index = this.state.orderedFacts.length - 1; index >= 0; index -= 1) {
+                const fact = this.state.orderedFacts[index];
+                if (!matches(fact))
+                    continue;
+                if (selected.length < limit)
+                    selected.push(fact);
+                else {
+                    hasMore = true;
+                    break;
+                }
+            }
+            selected.reverse();
+        }
+        else {
+            for (const fact of this.state.orderedFacts) {
+                if (!matches(fact))
+                    continue;
+                if (selected.length < limit)
+                    selected.push(fact);
+                else {
+                    hasMore = true;
+                    break;
+                }
+            }
+        }
         const visibleTasks = [...this.state.tasks.values()].filter(task => channelRefs.has(task.channelRef)
             && (request.channelRef === undefined || task.channelRef === request.channelRef)
             && (request.threadRef === undefined || task.threadRef === request.threadRef));
@@ -1266,7 +1414,7 @@ export class AgentTeamLedger {
             claims: this.claimsForVisibleTasks(visibleTasks),
             activities: Object.freeze(selected.filter((fact) => fact.kind === 'activity').map(fact => fact.activity)),
             cursor: nextCursor,
-            hasMore: allFacts.length > selected.length,
+            hasMore,
         });
     }
     status() {
@@ -1277,6 +1425,31 @@ export class AgentTeamLedger {
     validate() {
         this.validateRecords(this.sortedRecords());
     }
+    /**
+     * Validate the durable ledger for the invariant's mount check, reusing the
+     * constructor's record-level replay once instead of paying a second identical
+     * one at startup.
+     *
+     * The adoption is gated on the operations table's single-writer identity —
+     * this ledger's commit path is the only caller of `table.put` — so an
+     * unchanged record count, head sequence and head operation id mean a
+     * mount-time replay would re-derive precisely the records the constructor
+     * already re-derived against its own scratch projection. Any commit between
+     * construction and mount, and every later call, falls back to the full
+     * replay. The check is never narrowed: the reused conclusion is still that
+     * same independent replay of every durable record.
+     */
+    validateAtMount() {
+        const boot = this.bootValidation;
+        this.bootValidation = undefined;
+        const head = this.state.ordered.at(-1);
+        if (boot !== undefined
+            && boot.records === this.state.ordered.length
+            && boot.lastSequence === (head?.sequence ?? 0)
+            && boot.lastOperationId === (head?.operationId ?? null))
+            return;
+        this.validate();
+    }
     hasCommitted(requestId) {
         return this.state.byRequest.has(requestId);
     }
@@ -1284,6 +1457,33 @@ export class AgentTeamLedger {
     getOperation(operationId) {
         return this.state.byOperation.get(operationId);
     }
+    /**
+     * Claim releases are thread-visible facts: an open Channel page and every
+     * affected Thread page must refetch alongside the workspace-wide change. Each
+     * released activity contributes its own Thread scope plus the Channel that
+     * owns its Task, deduplicated against the caller's initial scopes — which is
+     * why the caller passes them in rather than the helper inventing them.
+     */
+    withReleasedActivityScopes(scopes, tasks, activities) {
+        const channelByTask = new Map(tasks.map(task => [task.taskRef, task.channelRef]));
+        for (const activity of activities) {
+            scopes.push({ kind: 'thread', threadRef: activity.threadRef });
+            const channelRef = channelByTask.get(activity.taskRef);
+            if (channelRef !== undefined && !scopes.some(scope => scope.kind === 'channel' && scope.channelRef === channelRef)) {
+                scopes.push({ kind: 'channel', channelRef });
+            }
+        }
+        return scopes;
+    }
+    /**
+     * Durable position of the newest shared-projection commit: the version every
+     * change waiter outside the presence scope observes. It only moves when a
+     * commit has scopes somebody could refetch (`changeScopesOf`), never for
+     * private read progress or an audit-only record.
+     */
+    projectionSequence() {
+        return this.projectionVersion;
+    }
     /** Scopes whose projections one committed operation invalidates; undefined wakes every waiter. */
     changeScopesOf(operation) {
         switch (operation.kind) {
@@ -1304,37 +1504,15 @@ export class AgentTeamLedger {
             case 'team/member-updated':
             case 'team/member-removed':
                 return [{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }];
-            case 'team/member-archived': {
-                // Claim releases are thread-visible facts: open Channel and Thread
-                // pages refetch alongside the workspace-wide roster change.
-                const channelByTask = new Map(operation.data.tasks.map(task => [task.taskRef, task.channelRef]));
-                const scopes = [{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }];
-                for (const activity of operation.data.activities) {
-                    scopes.push({ kind: 'thread', threadRef: activity.threadRef });
-                    const channelRef = channelByTask.get(activity.taskRef);
-                    if (channelRef !== undefined && !scopes.some(scope => scope.kind === 'channel' && scope.channelRef === channelRef)) {
-                        scopes.push({ kind: 'channel', channelRef });
-                    }
-                }
-                return scopes;
-            }
+            case 'team/member-archived':
+                return this.withReleasedActivityScopes([{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }], operation.data.tasks, operation.data.activities);
             case 'team/channel-member-added':
                 return [{ kind: 'workspace', workspaceId: operation.data.workspaceId }, { kind: 'channel', channelRef: operation.data.channelRef }];
-            case 'team/channel-member-removed': {
-                const channelByTask = new Map(operation.data.tasks.map(task => [task.taskRef, task.channelRef]));
-                const scopes = [
+            case 'team/channel-member-removed':
+                return this.withReleasedActivityScopes([
                     { kind: 'workspace', workspaceId: operation.data.workspaceId },
                     { kind: 'channel', channelRef: operation.data.channelRef },
-                ];
-                for (const activity of operation.data.activities) {
-                    scopes.push({ kind: 'thread', threadRef: activity.threadRef });
-                    const channelRef = channelByTask.get(activity.taskRef);
-                    if (channelRef !== undefined && !scopes.some(scope => scope.kind === 'channel' && scope.channelRef === channelRef)) {
-                        scopes.push({ kind: 'channel', channelRef });
-                    }
-                }
-                return scopes;
-            }
+                ], operation.data.tasks, operation.data.activities);
             case 'team/channel-archived': {
                 const scopes = [
                     { kind: 'workspace', workspaceId: operation.data.workspaceId },
@@ -1632,7 +1810,7 @@ export class AgentTeamLedger {
                 || operation.data.channel.createdAtSequence !== prior.createdAtSequence)
                 throw new Error('invalid Channel archival');
             const threadRefs = new Set([...projection.threads.keys()].filter(threadRef => this.channelRefForThreadFrom(projection, threadRef) === prior.channelRef));
-            this.validateChannelArchivalCleanup(operation.data, projection, threadRefs, operation.sequence, refs);
+            this.validateReleaseCleanup(operation.data, projection, undefined, threadRefs, operation.sequence, refs);
             return;
         }
         if (operation.kind === 'team/member-removed') {
@@ -1683,20 +1861,41 @@ export class AgentTeamLedger {
                 assertMember();
             else
                 assertHuman();
-            if (operation.data.memberId !== operation.actor.memberId)
+            const data = operation.data;
+            if (data.memberId !== operation.actor.memberId)
                 throw new Error('Thread read has wrong actor');
-            const expected = this.prepareReadFrom(projection, operation.data.memberId, operation.data.workspaceId, {
-                threadRef: operation.data.thread.threadRef,
-                ...(operation.data.task === undefined ? {} : { taskRef: operation.data.task.taskRef }),
-            });
-            const expectedData = Object.freeze({ workspaceId: operation.data.workspaceId, memberId: operation.data.memberId,
-                ...(expected.task === undefined ? {} : { task: expected.task }), thread: expected.thread, claims: expected.claims, anchor: expected.anchor,
-                anchorMentions: expected.anchorMentions, facts: expected.facts,
-                readThroughSequence: expected.readThroughSequence, remainingUnreadCount: expected.remainingUnreadCount,
-                ...(expected.attention === undefined ? {} : { attention: expected.attention }), inbox: expected.inbox });
-            if (!isDeepStrictEqual(operation.data, expectedData))
-                throw new Error('invalid Thread read projection');
-            this.validateInboxDelta(operation.data.inbox, projection, refs);
+            const target = threadReadTargetOf(data);
+            if (isThreadReadSnapshot(data)) {
+                // The pre-receipt form froze the whole picture, so its expected value
+                // is re-derived the same way it was written: from this record's prior
+                // projection only, never from the live one. That shape stays frozen —
+                // a field added after it, like the orientation count, is not compared
+                // here, because no stored legacy record carries it and inventing one
+                // would reject every upgrade of a ledger written before the field.
+                const expected = this.prepareReadFrom(projection, data.memberId, data.workspaceId, target);
+                const expectedData = Object.freeze({ workspaceId: data.workspaceId, memberId: data.memberId,
+                    ...(expected.task === undefined ? {} : { task: expected.task }), thread: expected.thread, claims: expected.claims, anchor: expected.anchor,
+                    anchorMentions: expected.anchorMentions, facts: expected.facts,
+                    readThroughSequence: expected.readThroughSequence, remainingUnreadCount: expected.remainingUnreadCount,
+                    ...(expected.attention === undefined ? {} : { attention: expected.attention }), inbox: expected.inbox });
+                if (!isDeepStrictEqual(data, expectedData))
+                    throw new Error('invalid Thread read projection');
+            }
+            else {
+                // A receipt claims progress and its Inbox delta, nothing else, so the
+                // independent derivation stops there too: the picture and the unread
+                // count left behind are projection state a replay re-derives for the
+                // surfaces that need them, not content of this record. The Task ref is
+                // derived rather than copied back, so a Task Thread read cannot drop
+                // the Task it belongs to and shrink its own claim unchecked.
+                const expected = this.prepareReadReceiptFrom(projection, data.memberId, data.workspaceId, target);
+                const expectedData = Object.freeze({ workspaceId: data.workspaceId, memberId: data.memberId, threadRef: data.threadRef,
+                    ...(expected.task === undefined ? {} : { taskRef: expected.task.taskRef }),
+                    readThroughSequence: expected.readThroughSequence, inbox: expected.inbox });
+                if (!isDeepStrictEqual(data, expectedData))
+                    throw new Error('invalid Thread read receipt');
+            }
+            this.validateInboxDelta(data.inbox, projection, refs);
             return;
         }
         if (operation.kind === 'team/thread-promoted') {
@@ -1874,11 +2073,23 @@ export class AgentTeamLedger {
         }
         assertUnhandledKind(operation);
     }
+    /**
+     * Validation of one operation's Inbox delta against the projection it was
+     * derived from.
+     *
+     * Direct marker references resolve through the replay-derived Message index:
+     * this runs once per inbox-carrying record, so a rescan of the Message list
+     * here would make every record cost the whole ledger. The index is written by
+     * the same fact appends that build `factsByThread`, so a lookup sees exactly
+     * the records replayed before this one and can never reach a Message that
+     * arrives later — which is why the operation's own entity, not yet in the
+     * projection, needs the `additional*` fallbacks. The commit path resolved the
+     * projection first and then its own record, and that precedence is kept.
+     */
     validateInboxDelta(delta, projection, _refs, additionalThreadRefs = [], additionalMessages = [], additionalActivities = []) {
         const attentionKeys = new Set();
-        const knownThreadRefs = new Set([...projection.threads.keys(), ...additionalThreadRefs]);
         for (const attention of delta.attention.set) {
-            if (!knownThreadRefs.has(attention.threadRef) || attention.startSequence < 1
+            if ((!projection.threads.has(attention.threadRef) && !additionalThreadRefs.includes(attention.threadRef)) || attention.startSequence < 1
                 || attention.readThroughSequence < attention.startSequence - 1) {
                 throw new Error('invalid Attention delta');
             }
@@ -1892,13 +2103,12 @@ export class AgentTeamLedger {
                 throw new Error('conflicting Attention delta');
         }
         const markerKeys = new Set();
-        const messages = [...projection.messages, ...additionalMessages];
         for (const marker of delta.directMarkers.added) {
             const key = this.directMarkerKey(marker);
             if (markerKeys.has(key) || projection.directMarkers.has(key))
                 throw new Error('invalid direct marker addition');
             markerKeys.add(key);
-            const message = messages.find(candidate => candidate.messageRef === marker.messageRef);
+            const message = projection.messagesByRef.get(marker.messageRef) ?? additionalMessages.find(candidate => candidate.messageRef === marker.messageRef);
             if (message === undefined || message.threadRef !== marker.threadRef || message.sequence !== marker.sequence
                 || !this.validMentionTarget(projection, message.channelRef, marker.memberId))
                 throw new Error('invalid direct marker addition');
@@ -1909,17 +2119,20 @@ export class AgentTeamLedger {
                 throw new Error('invalid direct marker removal');
             markerKeys.add(key);
             const current = projection.directMarkers.get(key);
-            const message = messages.find(candidate => candidate.messageRef === marker.messageRef);
+            const message = projection.messagesByRef.get(marker.messageRef) ?? additionalMessages.find(candidate => candidate.messageRef === marker.messageRef);
             if (!isDeepStrictEqual(current, marker) || message === undefined || message.threadRef !== marker.threadRef
                 || message.sequence !== marker.sequence || !this.validMentionTarget(projection, message.channelRef, marker.memberId)) {
                 throw new Error('invalid direct marker removal');
             }
         }
         const activityMarkerKeys = new Set();
-        const activities = [...projection.orderedFacts.filter(fact => fact.kind === 'activity').map(fact => fact.activity), ...additionalActivities];
         for (const marker of delta.activityMarkers.added) {
             const key = this.activityMarkerKey(marker);
-            const activity = activities.find(candidate => candidate.activityRef === marker.activityRef);
+            // Every activity marker is minted for the activity the same record
+            // carries (promotion, close, reopen, acceptance), and a removal never
+            // looks an activity up, so this record's own list is the whole
+            // resolution space: scanning recorded activities would add nothing.
+            const activity = additionalActivities.find(candidate => candidate.activityRef === marker.activityRef);
             if (activityMarkerKeys.has(key) || projection.activityMarkers.has(key) || activity === undefined
                 || activity.threadRef !== marker.threadRef || activity.sequence !== marker.sequence)
                 throw new Error('invalid activity marker addition');
@@ -1933,73 +2146,31 @@ export class AgentTeamLedger {
             activityMarkerKeys.add(key);
         }
     }
+    /**
+     * Replay validation of one departure's release snapshot against the
+     * projection it was derived from. `memberId` scopes everything to a single
+     * departing Member; `undefined` validates every owner, which is what
+     * archiving a whole Channel releases. The two scopes differ in exactly four
+     * ways, all of them visible here rather than spread over two copies:
+     *
+     * 1. released Claims are owner-filtered for a Member, unfiltered for a Channel;
+     * 2. Activities group per (owner, Thread) with owners sorted, which for a
+     *    single departing Member collapses to one Activity per Thread — the shape
+     *    the commit path writes;
+     * 3. the inbox cleanup covers the departing Member's Attention and markers, or
+     *    every Member's on the archived Channel's Threads;
+     * 4. the failure message names which of the two paths lost its cleanup.
+     */
     validateReleaseCleanup(data, projection, memberId, threadRefs, sequence, refs) {
         const releasedClaims = [...projection.claims.values()]
-            .filter(claim => claim.owner === memberId && claim.state === 'active' && threadRefs.has(claim.threadRef))
-            .map(claim => Object.freeze({ ...claim, state: 'released' }));
-        if (data.claims.length !== releasedClaims.length || data.claims.some((claim, index) => {
-            const expected = releasedClaims[index];
-            return expected === undefined || !this.sameClaim(expected, claim);
-        }))
-            throw new Error('invalid released Claim projection');
-        const byThread = new Map();
-        for (const claim of releasedClaims)
-            byThread.set(claim.threadRef, [...(byThread.get(claim.threadRef) ?? []), claim]);
-        const expectedActivities = [...byThread.entries()].map(([threadRef, claims]) => ({
-            kind: 'claims_released', taskRef: claims[0].taskRef, threadRef, actor: memberId, sequence,
-            claimRefs: claims.map(claim => claim.claimRef).sort(),
-        }));
-        if (data.activities.length !== expectedActivities.length || data.activities.some((activity, index) => {
-            const expected = expectedActivities[index];
-            return expected === undefined || activity.kind !== expected.kind || activity.taskRef !== expected.taskRef
-                || activity.threadRef !== expected.threadRef || activity.actor !== expected.actor || activity.sequence !== expected.sequence
-                || !this.sameList(activity.claimRefs, expected.claimRefs);
-        }))
-            throw new Error('invalid released Claim activities');
-        for (const claim of data.claims) {
-            const prior = projection.claims.get(claim.claimRef);
-            if (prior === undefined)
-                throw new Error('invalid released Claim reference');
-        }
-        for (const activity of data.activities)
-            this.addRef(refs, activity.activityRef);
-        const projectedClaims = new Map(projection.claims);
-        for (const claim of releasedClaims)
-            projectedClaims.set(claim.claimRef, claim);
-        const expectedTasks = [...new Set(releasedClaims.map(claim => claim.taskRef))].map(taskRef => {
-            const task = projection.tasks.get(taskRef);
-            return Object.freeze({ ...task, status: this.deriveResolvedTaskStatus(task, projectedClaims.values()) });
-        });
-        const expectedThreads = expectedActivities.map(activity => {
-            const thread = projection.threads.get(activity.threadRef);
-            return Object.freeze({ ...thread, revision: sequence });
-        });
-        if (!isDeepStrictEqual(data.tasks, expectedTasks) || !isDeepStrictEqual(data.threads, expectedThreads)) {
-            throw new Error('invalid released Claim Task or Thread projection');
-        }
-        const expectedAttention = [...projection.attention.values()]
-            .filter(attention => attention.memberId === memberId && threadRefs.has(attention.threadRef))
-            .map(attention => ({ memberId: attention.memberId, threadRef: attention.threadRef }));
-        const expectedMarkers = [...projection.directMarkers.values()]
-            .filter(marker => marker.memberId === memberId && threadRefs.has(marker.threadRef));
-        const expectedActivityMarkers = [...projection.activityMarkers.values()]
-            .filter(marker => marker.memberId === memberId && threadRefs.has(marker.threadRef));
-        const expectedInbox = this.inboxDelta([], expectedAttention, [], expectedMarkers, [], expectedActivityMarkers);
-        if (!isDeepStrictEqual(data.inbox, expectedInbox))
-            throw new Error('invalid Member inbox cleanup');
-        this.validateInboxDelta(data.inbox, projection, refs);
-    }
-    /** Replay validation of one Channel archival's release snapshot across every owner. */
-    validateChannelArchivalCleanup(data, projection, threadRefs, sequence, refs) {
-        const releasedClaims = [...projection.claims.values()]
-            .filter(claim => claim.state === 'active' && threadRefs.has(claim.threadRef))
+            .filter(claim => (memberId === undefined || claim.owner === memberId) && claim.state === 'active' && threadRefs.has(claim.threadRef))
             .map(claim => Object.freeze({ ...claim, state: 'released' }));
         if (data.claims.length !== releasedClaims.length || data.claims.some((claim, index) => {
             const expected = releasedClaims[index];
             return expected === undefined || !this.sameClaim(expected, claim);
         }))
             throw new Error('invalid released Claim projection');
-        // One activity per (owner, Thread), owners sorted like the commit path.
+        // One Activity per (owner, Thread), owners sorted like the commit path.
         const byOwner = new Map();
         for (const claim of releasedClaims) {
             const byThread = byOwner.get(claim.owner) ?? new Map();
@@ -2038,17 +2209,17 @@ export class AgentTeamLedger {
         if (!isDeepStrictEqual(data.tasks, expectedTasks) || !isDeepStrictEqual(data.threads, expectedThreads)) {
             throw new Error('invalid released Claim Task or Thread projection');
         }
-        // Attention and marker cleanup covers EVERY Member on the archived Threads.
         const expectedAttention = [...projection.attention.values()]
-            .filter(attention => threadRefs.has(attention.threadRef))
+            .filter(attention => (memberId === undefined || attention.memberId === memberId) && threadRefs.has(attention.threadRef))
             .map(attention => ({ memberId: attention.memberId, threadRef: attention.threadRef }));
         const expectedMarkers = [...projection.directMarkers.values()]
-            .filter(marker => threadRefs.has(marker.threadRef));
+            .filter(marker => (memberId === undefined || marker.memberId === memberId) && threadRefs.has(marker.threadRef));
         const expectedActivityMarkers = [...projection.activityMarkers.values()]
-            .filter(marker => threadRefs.has(marker.threadRef));
+            .filter(marker => (memberId === undefined || marker.memberId === memberId) && threadRefs.has(marker.threadRef));
         const expectedInbox = this.inboxDelta([], expectedAttention, [], expectedMarkers, [], expectedActivityMarkers);
-        if (!isDeepStrictEqual(data.inbox, expectedInbox))
-            throw new Error('invalid Channel archival inbox cleanup');
+        if (!isDeepStrictEqual(data.inbox, expectedInbox)) {
+            throw new Error(memberId === undefined ? 'invalid Channel archival inbox cleanup' : 'invalid Member inbox cleanup');
+        }
         this.validateInboxDelta(data.inbox, projection, refs);
     }
     validateMessageInbox(operation, projection) {
@@ -2057,7 +2228,7 @@ export class AgentTeamLedger {
         // Top-level mentions are open to every actor; only a Member reply may not
         // pull an unfollowed Member into an existing Thread.
         if (operation.actor.kind === 'member' && operation.kind === 'team/thread-replied'
-            && mentionedAgents.some(memberId => !this.isFollowingFrom(projection, message.threadRef, memberId))) {
+            && mentionedAgents.some(memberId => !this.everParticipatedFrom(projection, message.threadRef, memberId))) {
             throw new Error('invalid Agent mention projection');
         }
         const started = operation.kind === 'team/message-sent'
@@ -2088,6 +2259,12 @@ export class AgentTeamLedger {
     }
     apply(operation) {
         this.applyTo(this.state, operation);
+        // Live apply only: the record-validation replay re-derives each record
+        // against its own scratch projection, so a scope derivation there would be
+        // discarded.
+        const scopes = this.changeScopesOf(operation);
+        if (scopes === undefined || scopes.length !== 0)
+            this.projectionVersion = operation.sequence;
     }
     applyTo(target, operation) {
         target.ordered.push(operation);
@@ -2157,15 +2334,7 @@ export class AgentTeamLedger {
         }
         if (operation.kind === 'team/channel-member-removed') {
             target.memberships.get(operation.data.channelRef)?.delete(operation.data.memberId);
-            for (const claim of operation.data.claims)
-                target.claims.set(claim.claimRef, claim);
-            for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity, operation.occurredAt);
-            for (const task of operation.data.tasks)
-                target.tasks.set(task.taskRef, task);
-            for (const thread of operation.data.threads)
-                target.threads.set(thread.threadRef, thread);
-            this.applyInboxDelta(target, operation.data.inbox);
+            this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
             return;
         }
         if (operation.kind === 'team/channel-archived') {
@@ -2173,30 +2342,14 @@ export class AgentTeamLedger {
             // restore returns every Member to the Channel. Visibility filters by
             // channel state instead.
             target.channels.set(operation.data.channel.channelRef, operation.data.channel);
-            for (const claim of operation.data.claims)
-                target.claims.set(claim.claimRef, claim);
-            for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity, operation.occurredAt);
-            for (const task of operation.data.tasks)
-                target.tasks.set(task.taskRef, task);
-            for (const thread of operation.data.threads)
-                target.threads.set(thread.threadRef, thread);
-            this.applyInboxDelta(target, operation.data.inbox);
+            this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
             return;
         }
         if (operation.kind === 'team/member-removed') {
             target.members.set(operation.data.member.memberId, operation.data.member);
             for (const membership of target.memberships.values())
                 membership.delete(operation.data.member.memberId);
-            for (const claim of operation.data.claims)
-                target.claims.set(claim.claimRef, claim);
-            for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity, operation.occurredAt);
-            for (const task of operation.data.tasks)
-                target.tasks.set(task.taskRef, task);
-            for (const thread of operation.data.threads)
-                target.threads.set(thread.threadRef, thread);
-            this.applyInboxDelta(target, operation.data.inbox);
+            this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
             return;
         }
         if (operation.kind === 'team/member-archived') {
@@ -2204,34 +2357,37 @@ export class AgentTeamLedger {
             // restore returns the Member to its Channels. Visibility filters by
             // member state instead.
             target.members.set(operation.data.member.memberId, operation.data.member);
-            for (const claim of operation.data.claims)
-                target.claims.set(claim.claimRef, claim);
-            for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity, operation.occurredAt);
-            for (const task of operation.data.tasks)
-                target.tasks.set(task.taskRef, task);
-            for (const thread of operation.data.threads)
-                target.threads.set(thread.threadRef, thread);
-            this.applyInboxDelta(target, operation.data.inbox);
+            this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
             return;
         }
         if (operation.kind === 'team/thread-promoted') {
             this.appendActivityFact(target, operation.data.activity, operation.occurredAt);
             target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
+            this.recordTaskNumber(target, operation.data.task);
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
         if (operation.kind === 'team/message-sent' || operation.kind === 'team/thread-replied') {
             const { message, mentions } = operation.data;
-            target.messages.push(message);
             target.mentionsByMessage.set(message.messageRef, Object.freeze([...mentions]));
             this.appendMessageFact(target, message, mentions, message.occurredAt ?? operation.occurredAt);
             if (operation.data.task !== undefined)
                 target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
-            if (message.topLevel)
+            if (message.topLevel) {
                 target.channelRefByThread.set(message.threadRef, message.channelRef);
+                // The anchor is the Thread's first topLevel Message; a later topLevel
+                // Message (none today) must not displace it, matching the linear scan.
+                if (!target.anchorByThread.has(message.threadRef))
+                    target.anchorByThread.set(message.threadRef, message);
+            }
+            // Only message-sent mints a Task ordinal; thread-replied may echo the
+            // Task without renumbering it, like the operation scan it replaces.
+            if (operation.kind === 'team/message-sent' && operation.data.task !== undefined)
+                this.recordTaskNumber(target, operation.data.task);
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
@@ -2240,6 +2396,7 @@ export class AgentTeamLedger {
             this.appendActivityFact(target, operation.data.activity, operation.occurredAt);
             target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
@@ -2249,10 +2406,12 @@ export class AgentTeamLedger {
             this.appendActivityFact(target, operation.data.activity, operation.occurredAt);
             target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
         if (operation.kind === 'team/thread-attention-changed' || operation.kind === 'team/thread-read') {
+            this.recordAttentionObservations(target, operation, operation.data.inbox);
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
@@ -2263,6 +2422,25 @@ export class AgentTeamLedger {
         }
         assertUnhandledKind(operation);
     }
+    /**
+     * Replay the departure snapshot a releasing operation carries. The order is
+     * replay semantics, not style: Claims land before the Activities that
+     * reference them, and Tasks/Threads before the inbox delta that reads them.
+     * Each caller still applies its own identifying writes (member, membership,
+     * channel) around this call.
+     */
+    applyReleaseSnapshot(target, operation, data, occurredAt) {
+        for (const claim of data.claims)
+            target.claims.set(claim.claimRef, claim);
+        for (const activity of data.activities)
+            this.appendActivityFact(target, activity, occurredAt);
+        for (const task of data.tasks)
+            target.tasks.set(task.taskRef, task);
+        for (const thread of data.threads)
+            target.threads.set(thread.threadRef, thread);
+        this.recordAttentionObservations(target, operation, data.inbox);
+        this.applyInboxDelta(target, data.inbox);
+    }
     /** Facts arrive in ledger sequence order, so global and per-thread lists stay sorted by append only. */
     appendMessageFact(target, message, mentions, occurredAt) {
         const fact = Object.freeze({ kind: 'message', sequence: message.sequence, message, mentions, occurredAt });
@@ -2271,6 +2449,14 @@ export class AgentTeamLedger {
         facts.push(fact);
         target.factsByThread.set(message.threadRef, facts);
         target.messageCountByThread.set(message.threadRef, (target.messageCountByThread.get(message.threadRef) ?? 0) + 1);
+        // The ref index is written in this same step, so it is exactly the set of
+        // replayed Messages: a validator lookup can never reach a later record.
+        target.messagesByRef.set(message.messageRef, message);
+        // Participation is indexed per writer as the fact lands, so the Human
+        // recent slice asks who wrote where without scanning the whole ledger.
+        const written = target.threadsByWriter.get(message.sender) ?? new Set();
+        written.add(message.threadRef);
+        target.threadsByWriter.set(message.sender, written);
     }
     appendActivityFact(target, activity, occurredAt) {
         const fact = Object.freeze({ kind: 'activity', sequence: activity.sequence, activity, occurredAt });
@@ -2279,6 +2465,44 @@ export class AgentTeamLedger {
         facts.push(fact);
         target.factsByThread.set(activity.threadRef, facts);
     }
+    /** Display ordinals are a per-Channel creation counter; the workspace filter happens at read time. */
+    recordTaskNumber(target, task) {
+        const ordinal = (target.taskCountByChannel.get(task.channelRef) ?? 0) + 1;
+        target.taskCountByChannel.set(task.channelRef, ordinal);
+        target.taskNumberByTask.set(task.taskRef, ordinal);
+    }
+    /**
+     * Replay-order Attention observations, appended from committed Inbox deltas
+     * only (the hypothetical read projection applies its delta directly). The
+     * follow/unfollow decision mirrors the full replay scan it replaces: a
+     * removal records only when Attention existed, and a set records unless it
+     * is the Thread-creating Message (initial Attention) or merely advances the
+     * same follow's watermark. Removals are evaluated before sets, exactly like
+     * the scan's loop order.
+     */
+    recordAttentionObservations(target, operation, delta) {
+        if (delta.attention.removed.length === 0 && delta.attention.set.length === 0)
+            return;
+        const retired = new Set();
+        for (const key of delta.attention.removed) {
+            retired.add(this.attentionKey(key.memberId, key.threadRef));
+            if (!target.attention.has(this.attentionKey(key.memberId, key.threadRef)))
+                continue;
+            this.appendObservation(target, key.threadRef, { sequence: operation.sequence, memberId: key.memberId, action: 'unfollow' });
+        }
+        for (const next of delta.attention.set) {
+            const key = this.attentionKey(next.memberId, next.threadRef);
+            const prior = retired.has(key) ? undefined : target.attention.get(key);
+            if (operation.kind === 'team/message-sent' || (prior !== undefined && prior.startSequence === next.startSequence))
+                continue;
+            this.appendObservation(target, next.threadRef, { sequence: operation.sequence, memberId: next.memberId, action: 'follow' });
+        }
+    }
+    appendObservation(target, threadRef, observation) {
+        const observations = target.observationsByThread.get(threadRef) ?? [];
+        observations.push(Object.freeze(observation));
+        target.observationsByThread.set(threadRef, observations);
+    }
     applyInboxDelta(target, delta) {
         for (const key of delta.attention.removed) {
             target.attention.delete(this.attentionKey(key.memberId, key.threadRef));
@@ -2288,27 +2512,76 @@ export class AgentTeamLedger {
                 if (followers.size === 0)
                     target.attentionByThread.delete(key.threadRef);
             }
+            const threads = target.attentionThreadsByMember.get(key.memberId);
+            if (threads !== undefined) {
+                threads.delete(key.threadRef);
+                if (threads.size === 0)
+                    target.attentionThreadsByMember.delete(key.memberId);
+            }
         }
         for (const attention of delta.attention.set) {
             target.attention.set(this.attentionKey(attention.memberId, attention.threadRef), attention);
             const followers = target.attentionByThread.get(attention.threadRef) ?? new Set();
             followers.add(attention.memberId);
             target.attentionByThread.set(attention.threadRef, followers);
+            const threads = target.attentionThreadsByMember.get(attention.memberId) ?? new Set();
+            threads.add(attention.threadRef);
+            target.attentionThreadsByMember.set(attention.memberId, threads);
         }
-        for (const marker of delta.directMarkers.removed)
+        for (const marker of delta.directMarkers.removed) {
             target.directMarkers.delete(this.directMarkerKey(marker));
-        for (const marker of delta.directMarkers.added)
+            this.removeBucketedMarker(target.directMarkersByMember, marker.memberId, marker.threadRef, this.directMarkerKey(marker), candidate => this.directMarkerKey(candidate));
+        }
+        for (const marker of delta.directMarkers.added) {
             target.directMarkers.set(this.directMarkerKey(marker), marker);
-        for (const marker of delta.activityMarkers.removed)
+            this.insertBucketedMarker(target.directMarkersByMember, marker.memberId, marker.threadRef, marker);
+        }
+        for (const marker of delta.activityMarkers.removed) {
             target.activityMarkers.delete(this.activityMarkerKey(marker));
-        for (const marker of delta.activityMarkers.added)
+            this.removeBucketedMarker(target.activityMarkersByMember, marker.memberId, marker.threadRef, this.activityMarkerKey(marker), candidate => this.activityMarkerKey(candidate));
+        }
+        for (const marker of delta.activityMarkers.added) {
             target.activityMarkers.set(this.activityMarkerKey(marker), marker);
+            this.insertBucketedMarker(target.activityMarkersByMember, marker.memberId, marker.threadRef, marker);
+        }
+    }
+    /** Insert into the Member's Thread bucket keeping the sequence order the read path must see. */
+    insertBucketedMarker(index, memberId, threadRef, marker) {
+        const threads = index.get(memberId) ?? new Map();
+        index.set(memberId, threads);
+        const bucket = threads.get(threadRef) ?? [];
+        threads.set(threadRef, bucket);
+        let position = bucket.length;
+        while (position > 0 && bucket[position - 1].sequence > marker.sequence)
+            position -= 1;
+        bucket.splice(position, 0, marker);
+    }
+    removeBucketedMarker(index, memberId, threadRef, key, identityOf) {
+        const threads = index.get(memberId);
+        const bucket = threads?.get(threadRef);
+        if (bucket === undefined)
+            return;
+        const position = bucket.findIndex(item => identityOf(item) === key);
+        if (position >= 0)
+            bucket.splice(position, 1);
+        if (bucket.length === 0) {
+            threads.delete(threadRef);
+            if (threads.size === 0)
+                index.delete(memberId);
+        }
     }
     prepareRead(memberId, workspaceId, request) {
         return this.prepareReadFrom(this.state, memberId, workspaceId, request);
     }
-    /** Derive the only legal durable result of one Thread read from a prior projection. */
-    prepareReadFrom(projection, memberId, workspaceId, request) {
+    /**
+     * Derive the durable receipt of one Thread read from a prior projection: the
+     * Thread it targeted, the watermark it reaches, the Attention row it writes
+     * and the Inbox delta it consumes. This is the whole durable content of a
+     * receipt-shaped read and the only thing `validateRecords` re-derives for
+     * one; the picture derivation below builds on the same result, so the two can
+     * never drift.
+     */
+    prepareReadReceiptFrom(projection, memberId, workspaceId, request) {
         const { task, thread, channelRef } = this.threadContextFrom(projection, workspaceId, request);
         if (memberId !== AGENT_TEAM_HUMAN_MEMBER_ID) {
             const member = projection.members.get(memberId);
@@ -2316,21 +2589,9 @@ export class AgentTeamLedger {
                 throw new Error(`Agent Member '${memberId}' is not authorized for Channel '${channelRef}'`);
             }
         }
-        const anchor = this.threadAnchorFrom(projection, thread.threadRef);
         const attention = this.attentionForFrom(projection, memberId, thread.threadRef);
         const unread = this.unreadForFrom(projection, memberId, thread.threadRef);
         const unreadFacts = unread.slice(0, 20);
-        const unreadFactKeys = new Set(unread.map(item => this.threadFactKey(item.fact)));
-        const firstRead = attention !== undefined && attention.readThroughSequence < attention.startSequence;
-        const background = firstRead
-            ? projection.messages.filter(message => message.threadRef === thread.threadRef && message.sequence < attention.startSequence)
-                .map(message => Object.freeze({ kind: 'message', sequence: message.sequence, message,
-                mentions: projection.mentionsByMessage.get(message.messageRef) ?? [],
-                occurredAt: this.occurredAtForFactFrom(projection, message.sequence, message.occurredAt) }))
-                .filter(fact => !unreadFactKeys.has(this.threadFactKey(fact))).slice(-12)
-            : [];
-        const combined = [...background.map(fact => this.readFactFrom(projection, memberId, fact, false)), ...unreadFacts]
-            .sort((left, right) => left.fact.sequence - right.fact.sequence);
         // Direct markers are sparse acknowledgements, not part of the contiguous
         // follower watermark. Consuming an old marker after a later follow must
         // never move that watermark backwards.
@@ -2346,24 +2607,48 @@ export class AgentTeamLedger {
         const activityMarkers = this.activityMarkersForFrom(projection, memberId, thread.threadRef)
             .filter(marker => unreadFacts.some(item => item.fact.kind === 'activity' && item.fact.activity.activityRef === marker.activityRef));
         const inbox = this.inboxDelta(nextAttention, [], [], consumed, [], activityMarkers);
-        // The hypothetical projection copies every map that its inbox delta can
-        // mutate, including the follower sets inside attentionByThread; the fact
-        // indexes are read-only here and stay shared.
-        const nextProjection = {
-            ...projection,
-            attention: new Map(projection.attention),
-            directMarkers: new Map(projection.directMarkers),
-            activityMarkers: new Map(projection.activityMarkers),
-            attentionByThread: new Map([...projection.attentionByThread].map(([threadRef, followers]) => [threadRef, new Set(followers)])),
-        };
-        this.applyInboxDelta(nextProjection, inbox);
-        const remainingUnreadCount = this.unreadForFrom(nextProjection, memberId, thread.threadRef).length;
-        return Object.freeze({ ...(task === undefined ? {} : { task }), thread, claims: task === undefined ? Object.freeze([]) : this.claimsForTaskFrom(projection, task.taskRef), anchor,
-            anchorMentions: projection.mentionsByMessage.get(anchor.messageRef) ?? [],
-            facts: Object.freeze(combined),
-            readThroughSequence, remainingUnreadCount, ...(attention === undefined ? {} : { attention: nextAttention[0] ?? attention }),
+        return Object.freeze({ ...(task === undefined ? {} : { task }), thread, unread,
+            ...(attention === undefined ? {} : { attentionBefore: attention }), readThroughSequence,
+            ...(attention === undefined ? {} : { attention: nextAttention[0] ?? attention }),
             consumedDirectMarkers: Object.freeze(consumed), inbox });
     }
+    /** Derive the only legal durable result of one Thread read from a prior projection. */
+    prepareReadFrom(projection, memberId, workspaceId, request) {
+        const receipt = this.prepareReadReceiptFrom(projection, memberId, workspaceId, request);
+        const { task, thread } = receipt;
+        const anchor = this.threadAnchorFrom(projection, thread.threadRef);
+        // The first read of a Thread after following also shows the bounded
+        // background that preceded the follow, so a reader sees what they joined.
+        const firstRead = receipt.attentionBefore !== undefined && receipt.attentionBefore.readThroughSequence < receipt.attentionBefore.startSequence;
+        const unreadFactKeys = new Set(receipt.unread.map(item => this.threadFactKey(item.fact)));
+        const background = firstRead
+            ? this.threadFactsFrom(projection, thread.threadRef)
+                .filter((fact) => fact.kind === 'message'
+                && fact.sequence < receipt.attentionBefore.startSequence)
+                .map(fact => Object.freeze({ kind: 'message', sequence: fact.sequence, message: fact.message,
+                mentions: projection.mentionsByMessage.get(fact.message.messageRef) ?? [],
+                occurredAt: this.occurredAtForFactFrom(projection, fact.sequence, fact.message.occurredAt) }))
+                .filter(fact => !unreadFactKeys.has(this.threadFactKey(fact))).slice(-12)
+            : [];
+        const combined = [...background.map(fact => this.readFactFrom(projection, memberId, fact, false)), ...receipt.unread.slice(0, 20)]
+            .sort((left, right) => left.fact.sequence - right.fact.sequence);
+        const remainingUnreadCount = this.remainingUnreadAfter(projection, memberId, receipt);
+        // What this bounded read leaves behind it: the Thread facts that precede the
+        // watermark it reaches, which is where this reader now stands in the Thread
+        // and how much of it that position has never shown it. Anchoring on the
+        // watermark rather than on the response's own oldest fact is what keeps a
+        // returning reader honest — the background window starts at the Thread's
+        // first fact whenever the Thread is short enough to fit it, so measuring
+        // from the response would report nothing behind a reader that has in fact
+        // never read the Thread. Derived from the projection the read resolved
+        // against, like every other field of this picture, so a replay re-derives
+        // the same number.
+        const earlierFactCount = this.threadFactsFrom(projection, thread.threadRef)
+            .filter(fact => fact.sequence < receipt.readThroughSequence).length;
+        return Object.freeze({ ...receipt, claims: task === undefined ? Object.freeze([]) : this.claimsForTaskFrom(projection, task.taskRef), anchor,
+            anchorMentions: projection.mentionsByMessage.get(anchor.messageRef) ?? [],
+            facts: Object.freeze(combined), remainingUnreadCount, earlierFactCount });
+    }
     readFactFrom(projection, memberId, fact, unread) {
         return Object.freeze({ fact, unread, direct: fact.kind === 'message'
                 && projection.directMarkers.has(this.directMarkerKey({ memberId, threadRef: fact.message.threadRef,
@@ -2374,23 +2659,60 @@ export class AgentTeamLedger {
     }
     unreadForFrom(projection, memberId, threadRef) {
         const attention = this.attentionForFrom(projection, memberId, threadRef);
-        const facts = this.threadFactsFrom(projection, threadRef);
-        const direct = this.directMarkersForFrom(projection, memberId, threadRef);
-        const directKeys = new Set(direct.map(marker => this.directMarkerKey(marker)));
+        const directKeys = new Set(this.directMarkersForFrom(projection, memberId, threadRef).map(marker => this.directMarkerKey(marker)));
         const activityKeys = new Set(this.activityMarkersForFrom(projection, memberId, threadRef).map(marker => this.activityMarkerKey(marker)));
         const result = [];
-        for (const fact of facts) {
-            const marker = fact.kind === 'message' && directKeys.has(this.directMarkerKey({ memberId, threadRef,
-                messageRef: fact.message.messageRef, sequence: fact.sequence }));
-            const activityMarker = fact.kind === 'activity' && activityKeys.has(this.activityMarkerKey({ memberId, threadRef,
-                activityRef: fact.activity.activityRef, sequence: fact.sequence }));
-            const ordinary = attention !== undefined && fact.sequence >= attention.startSequence
-                && fact.sequence > attention.readThroughSequence && this.visibleToFollower(fact, memberId);
-            if (marker || activityMarker || ordinary)
+        for (const fact of this.threadFactsFrom(projection, threadRef)) {
+            if (this.isUnreadFact(fact, memberId, threadRef, attention, directKeys, activityKeys)) {
                 result.push(this.readFactFrom(projection, memberId, fact, true));
+            }
         }
         return Object.freeze(result);
     }
+    /**
+     * The single authority on "this fact is unread for this reader". The picture
+     * derivation and the remaining-count derivation both go through it, so the
+     * count a read reports can never disagree with the facts it lists. Marker
+     * membership arrives as key sets: the caller may be looking at a state the
+     * projection has not applied yet.
+     */
+    isUnreadFact(fact, memberId, threadRef, attention, directKeys, activityKeys) {
+        const marker = fact.kind === 'message' && directKeys.has(this.directMarkerKey({ memberId, threadRef,
+            messageRef: fact.message.messageRef, sequence: fact.sequence }));
+        const activityMarker = fact.kind === 'activity' && activityKeys.has(this.activityMarkerKey({ memberId, threadRef,
+            activityRef: fact.activity.activityRef, sequence: fact.sequence }));
+        const ordinary = attention !== undefined && fact.sequence >= attention.startSequence
+            && fact.sequence > attention.readThroughSequence && this.visibleToFollower(fact, memberId);
+        return marker || activityMarker || ordinary;
+    }
+    /**
+     * Unread count once this read's own Inbox delta has been applied, derived
+     * without materializing a hypothetical projection. The delta can only touch
+     * the reader's own Attention row and its own marker keys in one Thread, and
+     * every lookup in `isUnreadFact` is scoped to that same (member, Thread)
+     * pair, so the post-delta state is the Attention row the receipt already
+     * derived plus those marker keys with the delta's own removals and additions
+     * applied.
+     */
+    remainingUnreadAfter(projection, memberId, receipt) {
+        const threadRef = receipt.thread.threadRef;
+        const directKeys = new Set(this.directMarkersForFrom(projection, memberId, threadRef).map(marker => this.directMarkerKey(marker)));
+        for (const marker of receipt.inbox.directMarkers.removed)
+            directKeys.delete(this.directMarkerKey(marker));
+        for (const marker of receipt.inbox.directMarkers.added)
+            directKeys.add(this.directMarkerKey(marker));
+        const activityKeys = new Set(this.activityMarkersForFrom(projection, memberId, threadRef).map(marker => this.activityMarkerKey(marker)));
+        for (const marker of receipt.inbox.activityMarkers.removed)
+            activityKeys.delete(this.activityMarkerKey(marker));
+        for (const marker of receipt.inbox.activityMarkers.added)
+            activityKeys.add(this.activityMarkerKey(marker));
+        let count = 0;
+        for (const fact of this.threadFactsFrom(projection, threadRef)) {
+            if (this.isUnreadFact(fact, memberId, threadRef, receipt.attention, directKeys, activityKeys))
+                count += 1;
+        }
+        return count;
+    }
     visibleToFollower(fact, memberId) {
         const sender = fact.kind === 'message' ? fact.message.sender : fact.activity.actor;
         return sender !== memberId;
@@ -2535,12 +2857,14 @@ export class AgentTeamLedger {
         return this.directMarkersForFrom(this.state, memberId, threadRef);
     }
     directMarkersForFrom(projection, memberId, threadRef) {
-        return Object.freeze([...projection.directMarkers.values()].filter(marker => marker.memberId === memberId && marker.threadRef === threadRef)
-            .sort((left, right) => left.sequence - right.sequence));
+        // A frozen copy, not the live bucket: callers may hand the array to an
+        // Inbox delta that freezes it, which must not freeze the derived index.
+        const markers = projection.directMarkersByMember.get(memberId)?.get(threadRef);
+        return markers === undefined ? [] : Object.freeze([...markers]);
     }
     activityMarkersForFrom(projection, memberId, threadRef) {
-        return Object.freeze([...projection.activityMarkers.values()].filter(marker => marker.memberId === memberId && marker.threadRef === threadRef)
-            .sort((left, right) => left.sequence - right.sequence));
+        const markers = projection.activityMarkersByMember.get(memberId)?.get(threadRef);
+        return markers === undefined ? [] : Object.freeze([...markers]);
     }
     issueConfirmation(actor, workspaceId, channelRef, body, recipients, task, thread) {
         if (actor.kind !== 'human')
@@ -2579,10 +2903,6 @@ export class AgentTeamLedger {
             }
         }
     }
-    memberNotFollowing(workspaceId, channelRef, memberIds, task, thread) {
-        return Object.freeze({ kind: 'member_not_following', workspaceId, channelRef, memberIds: Object.freeze(memberIds),
-            ...(task === undefined ? {} : { taskRef: task.taskRef }), ...(thread === undefined ? {} : { threadRef: thread.threadRef, revision: thread.revision }) });
-    }
     unreadRequired(task, thread, unread) {
         return Object.freeze({ kind: 'unread_required', ...(task === undefined ? {} : { taskRef: task.taskRef }), threadRef: thread.threadRef,
             revision: thread.revision, unreadCount: unread.length, directCount: unread.filter(item => item.direct).length });
@@ -2642,16 +2962,17 @@ export class AgentTeamLedger {
         return undefined;
     }
     /** Commit projections shared by the Message-sent and Thread-replied results. */
-    committedMessageResult(operation) {
+    committedMessageResult(operation, undelivered = []) {
         return { kind: 'committed', receipt: this.receipt(operation), message: operation.data.message,
             ...(operation.data.task === undefined ? {} : { task: operation.data.task }), thread: operation.data.thread, attention: operation.data.inbox.attention.set,
-            directMarkers: operation.data.inbox.directMarkers.added };
+            directMarkers: operation.data.inbox.directMarkers.added,
+            ...(undelivered.length === 0 ? {} : { undeliveredMentions: undelivered }) };
     }
     threadAnchor(threadRef) {
         return this.threadAnchorFrom(this.state, threadRef);
     }
     threadAnchorFrom(projection, threadRef) {
-        const anchor = projection.messages.find(message => message.threadRef === threadRef && message.topLevel);
+        const anchor = projection.anchorByThread.get(threadRef);
         if (anchor === undefined)
             throw new Error(`Thread '${threadRef}' has no anchor Message`);
         return anchor;
@@ -2663,20 +2984,17 @@ export class AgentTeamLedger {
      * Display numbers for Tasks: one counter per home Channel, in creation
      * order. This is the single numbering authority — Channel cards, Thread
      * headings, cross-channel ref resolution, and inbox renders all show the
-     * ordinal the Task holds inside its own Channel.
+     * ordinal the Task holds inside its own Channel. The ordinals are derived
+     * at replay time (`taskNumberByTask`); this read only filters them to one
+     * Workspace.
      */
     taskNumbers(workspaceId) {
         const numbers = new Map();
-        const next = new Map();
-        for (const operation of this.state.ordered) {
-            const task = operation.kind === 'team/message-sent' || operation.kind === 'team/thread-promoted' ? operation.data.task : undefined;
-            if (task === undefined)
-                continue;
-            if (this.state.channels.get(task.channelRef)?.workspaceId !== workspaceId)
+        for (const [taskRef, taskNumber] of this.state.taskNumberByTask) {
+            const task = this.state.tasks.get(taskRef);
+            if (task === undefined || this.state.channels.get(task.channelRef)?.workspaceId !== workspaceId)
                 continue;
-            const ordinal = (next.get(task.channelRef) ?? 0) + 1;
-            next.set(task.channelRef, ordinal);
-            numbers.set(task.taskRef, ordinal);
+            numbers.set(taskRef, taskNumber);
         }
         return numbers;
     }
@@ -2921,6 +3239,68 @@ export class AgentTeamLedger {
             throw new Error(`${label} contains duplicate Member refs`);
         return Object.freeze([...unique].sort());
     }
+    /**
+     * Names a Message body may address in one Channel: every live Member of that
+     * Channel plus the Human. A name outside this set stays prose, which is what
+     * keeps an incidental name-drop from reaching someone the Channel cannot
+     * deliver to.
+     */
+    mentionCandidatesFor(channelRef) {
+        const candidates = [{ memberId: AGENT_TEAM_HUMAN_MEMBER_ID, handle: AGENT_TEAM_HUMAN_HANDLE }];
+        for (const member of this.state.members.values()) {
+            if (member.state === 'inactive' || member.state === 'archived')
+                continue;
+            if (!this.isChannelMember(channelRef, member.memberId))
+                continue;
+            candidates.push({ memberId: member.memberId, handle: member.handle });
+        }
+        return Object.freeze(candidates);
+    }
+    /**
+     * Merge the `@Handle` mentions authored in `body` into an explicit recipient
+     * set. Body mentions are the primary channel now: an Agent has no recipient
+     * parameter to forget, and the same scan serves Human input typed by hand.
+     * The result stays a plain recipient set, so every downstream projection —
+     * delivery markers, chip rendering, confirmation — is unchanged.
+     */
+    mergeBodyMentions(sender, channelRef, body, explicit) {
+        const candidates = this.mentionCandidatesFor(channelRef);
+        const resolution = resolveBodyMentions(body, candidates, sender);
+        // `@all` stands for its expansion as of this write: the Member set is
+        // snapshotted into the recipient list, so a later roster change cannot
+        // retroactively alter what this operation delivered.
+        const authored = resolution.all ? candidates.map(candidate => candidate.memberId) : resolution.memberIds;
+        const merged = new Set([...explicit, ...authored]);
+        merged.delete(sender);
+        return Object.freeze([...merged].sort());
+    }
+    /**
+     * Whether one Member has ever held Attention on one Thread. Committed Inbox
+     * deltas append a follow/unfollow observation, and the live index covers the
+     * Thread-creating Message whose initial Attention is never observed — so the
+     * two together answer "was this Member ever part of this Thread" without
+     * adding a second durable authority.
+     */
+    everParticipated(threadRef, memberId) {
+        return this.everParticipatedFrom(this.state, threadRef, memberId);
+    }
+    everParticipatedFrom(projection, threadRef, memberId) {
+        if (this.isFollowingFrom(projection, threadRef, memberId))
+            return true;
+        return (projection.observationsByThread.get(threadRef) ?? []).some(observation => observation.memberId === memberId);
+    }
+    /**
+     * Split the Agent recipients an existing Thread cannot deliver to: those the
+     * body named that the Thread has never carried. The send still commits — a
+     * text mention must never fail the write — and the author is told through the
+     * result, because inviting a Member into an existing Thread stays a Human
+     * decision.
+     */
+    undeliverableRecipients(actor, threadRef, recipients) {
+        if (actor.kind !== 'member')
+            return Object.freeze([]);
+        return Object.freeze(recipients.filter(memberId => this.state.members.has(memberId) && !this.everParticipated(threadRef, memberId)));
+    }
     normalizeDirection(direction) {
         return direction.normalize('NFKC').trim().replace(/\s+/gu, ' ').toLowerCase();
     }
@@ -3106,8 +3486,8 @@ export class AgentTeamLedger {
     assertSameThreadRead(operation, request) {
         if (operation.kind !== 'team/thread-read' || !this.sameActor(operation.actor, request.actor)
             || operation.data.workspaceId !== request.workspaceId
-            || (request.threadRef !== undefined && operation.data.thread.threadRef !== request.threadRef)
-            || (request.taskRef !== undefined && operation.data.task?.taskRef !== request.taskRef)
+            || (request.threadRef !== undefined && threadReadTargetOf(operation.data).threadRef !== request.threadRef)
+            || (request.taskRef !== undefined && threadReadTargetOf(operation.data).taskRef !== request.taskRef)
             || (request.threadRef === undefined && request.taskRef === undefined))
             this.throwRequestCollision(request.requestId);
     }
@@ -3191,8 +3571,8 @@ export class AgentTeamLedger {
     messageResult(operation) {
         return Object.freeze(this.committedMessageResult(operation));
     }
-    replyResult(operation) {
-        return Object.freeze(this.committedMessageResult(operation));
+    replyResult(operation, undelivered = []) {
+        return Object.freeze(this.committedMessageResult(operation, undelivered));
     }
     claimResult(operation) {
         const attention = operation.data.inbox.attention.set.find(candidate => candidate.memberId === operation.data.claim.owner);
@@ -3212,14 +3592,19 @@ export class AgentTeamLedger {
         return Object.freeze({ kind: 'committed', receipt: this.receipt(operation), activity: operation.data.activity,
             task: operation.data.task, thread: operation.data.thread });
     }
-    threadReadResult(operation) {
-        // Loaded records are normalized by sortedRecords(); fresh writes always carry instants.
-        const { anchor, facts } = operation.data;
-        return Object.freeze({ receipt: this.receipt(operation), ...(operation.data.task === undefined ? {} : { task: operation.data.task }), thread: operation.data.thread,
-            claims: operation.data.claims, anchor, anchorMentions: operation.data.anchorMentions, facts,
-            readThroughSequence: operation.data.readThroughSequence, remainingUnreadCount: operation.data.remainingUnreadCount,
-            ...(operation.data.attention === undefined ? {} : { attention: operation.data.attention }),
-            consumedDirectMarkers: operation.data.inbox.directMarkers.removed });
+    /**
+     * The Thread picture a read answers with, derived from the projection the
+     * read resolved against. Committed reads, no-op reads and retries all share
+     * this one derivation, so a read that writes nothing still returns the same
+     * Attention, facts, watermark and unread count a committed one would.
+     */
+    readPicture(prepared) {
+        return Object.freeze({ ...(prepared.task === undefined ? {} : { task: prepared.task }), thread: prepared.thread,
+            claims: prepared.claims, anchor: prepared.anchor, anchorMentions: prepared.anchorMentions, facts: prepared.facts,
+            readThroughSequence: prepared.readThroughSequence, remainingUnreadCount: prepared.remainingUnreadCount,
+            earlierFactCount: prepared.earlierFactCount,
+            ...(prepared.attention === undefined ? {} : { attention: prepared.attention }),
+            consumedDirectMarkers: prepared.inbox.directMarkers.removed });
     }
     receipt(operation) {
         return Object.freeze({ operationId: operation.operationId, requestId: operation.requestId, sequence: operation.sequence, occurredAt: operation.occurredAt });
@@ -3300,10 +3685,17 @@ export class AgentTeamLedger {
     legacyChannelThreadRefs(projection, channelRef) {
         return new Set([...projection.tasks.values()].filter(task => task.channelRef === channelRef).map(task => task.threadRef));
     }
-    /** Ledgers written before message occurredAt existed store bare messages; Thread reads resolve instants from the originating operations. */
+    /**
+     * Ledgers written before message occurredAt existed store bare messages;
+     * snapshot-shaped Thread reads resolve instants from the originating
+     * operations. A receipt-shaped read carries no message at all, so it passes
+     * through untouched — the load path must never touch a shape it does not
+     * have, and it never writes either form back.
+     */
     normalizeOperation(operation, occurrences, instants) {
-        if (operation.kind !== 'team/thread-read')
+        if (operation.kind !== 'team/thread-read' || !isThreadReadSnapshot(operation.data))
             return operation;
+        const data = operation.data;
         const stamp = (message) => (message.occurredAt === undefined
             ? { ...message, occurredAt: occurrences.get(message.messageRef) ?? operation.occurredAt }
             : { ...message, occurredAt: message.occurredAt });
@@ -3312,8 +3704,8 @@ export class AgentTeamLedger {
                 occurredAt: envelope.occurredAt ?? envelope.message.occurredAt ?? occurrences.get(envelope.message.messageRef) ?? operation.occurredAt }
             : { kind: 'activity', sequence: envelope.sequence, activity: envelope.activity,
                 occurredAt: envelope.occurredAt ?? instants.get(envelope.sequence) ?? operation.occurredAt };
-        const facts = operation.data.facts.map((fact) => ({ ...fact, fact: stampEnvelope(fact.fact) }));
-        return { ...operation, data: { ...operation.data, anchor: stamp(operation.data.anchor), facts } };
+        const facts = data.facts.map((fact) => ({ ...fact, fact: stampEnvelope(fact.fact) }));
+        return { ...operation, data: { ...data, anchor: stamp(data.anchor), facts } };
     }
     enqueue(operation) {
         const result = this.operationTail.then(operation);