@wowyuarm/dsh-agent-team 0.1.11 → 0.1.13

package/packages/agent-team/lib/ledger.js

@@ -1,46 +1,59 @@
 import { randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { formatTeamTimestamp } from "./time-format.js";
+import { resolveBodyMentions } from "./mentions.js";
 /** Stable Human Member identity shared by every replay of one dshHome Team. */
 export const AGENT_TEAM_HUMAN_MEMBER_ID = 'member:human';
+/**
+ * The handle the Human is addressed by in Message bodies. The body parser and
+ * the Member directory both read this one constant, so a configurable display
+ * name has a single place to land instead of a hard-coded literal per surface.
+ */
+export const AGENT_TEAM_HUMAN_HANDLE = 'human';
 /** Idempotency identity of the one Host bootstrap operation. */
 export const AGENT_TEAM_INITIALIZE_REQUEST_ID = 'agent-team:initialize:v1';
 const HUMAN_ACTOR = Object.freeze({
     kind: 'human',
     memberId: AGENT_TEAM_HUMAN_MEMBER_ID,
-    handle: 'human',
+    handle: AGENT_TEAM_HUMAN_HANDLE,
 });
 /** Resolve the one Human authority owned by this Team. */
 export function agentTeamHumanActor() {
     return HUMAN_ACTOR;
 }
 function emptyProjection() {
-    return { byRequest: new Map(), byOperation: new Map(), ordered: [], channels: new Map(), members: new Map(), memberships: new Map(),
+    return { byRequest: new Map(), byOperation: new Map(), ordered: [], channels: new Map(), members: new Map(), participations: new Map(), memberships: new Map(),
         claims: new Map(), tasks: new Map(), threads: new Map(), attention: new Map(), directMarkers: new Map(), activityMarkers: new Map(),
         orderedFacts: [], factsByThread: new Map(), channelRefByThread: new Map(), mentionsByMessage: new Map(), messageCountByThread: new Map(),
         messagesByRef: new Map(),
         attentionByThread: new Map(), previousSessions: new Map(), rolloverSeeds: new Map(),
         anchorByThread: new Map(), taskNumberByTask: new Map(), taskCountByChannel: new Map(), attentionThreadsByMember: new Map(),
+        threadsByWriter: new Map(),
         directMarkersByMember: new Map(), activityMarkersByMember: new Map(), observationsByThread: new Map() };
 }
-const EMPTY_PROGRESS_NUDGE_TARGETS = Object.freeze({
-    progress: Object.freeze([]),
-    claim: Object.freeze([]),
-});
 /** Exhaustiveness guard for the closed operation union: adding a kind must update every dispatch. */
 function assertUnhandledKind(operation) {
     throw new Error(`agent-team ledger does not handle operation kind '${operation.kind}'`);
 }
 /**
- * Opening-line preview for a direct-only Human Inbox row: the Thread anchor's
- * first line, trimmed, then capped at 120 characters with an explicit mark —
- * the same bound the Thread page applies to its Task title, so the row and
- * the page it opens never disagree about what a Thread is about.
+ * Opening-line preview for a Human Inbox row: the Thread anchor's first line,
+ * trimmed, then capped at 120 characters with an explicit mark — the same bound
+ * the Thread page applies to its Task title, so the row and the page it opens
+ * never disagree about what a Thread is about.
  */
 function boundedInboxPreview(body) {
     const firstLine = body.split('\n', 1)[0]?.trim() ?? '';
     return firstLine.length > 120 ? `${firstLine.slice(0, 119)}…` : firstLine;
 }
+/**
+ * How many Threads one Workspace's 「最近活跃」 slice may carry. It bounds what
+ * the Host hands over, not what the reader sees: the Client merges every
+ * visible Workspace's slice and trims the merged list to its own visible bound
+ * (`RECENT_ROWS_LIMIT`), which must stay at or below this one so no Workspace
+ * is cut short before the merge. The unread slice keeps its own `limit`
+ * request field.
+ */
+const RECENT_INBOX_LIMIT = 10;
 /**
  * Whether one operation's Inbox delta would change nothing. A read that finds
  * no unread fact for its reader and no marker to consume produces exactly this
@@ -252,7 +265,8 @@ export class AgentTeamLedger {
             if (handle === '')
                 throw new Error('member handle must not be empty');
             if (handle !== prior.handle)
-                this.assertHandleAvailable(prior.workspaceId, handle, prior.memberId);
+                for (const workspaceId of this.workspacesOf(prior.memberId))
+                    this.assertHandleAvailable(workspaceId, handle, prior.memberId);
             this.assertModelSelection(request.model);
             this.assertCapabilities(request.capabilities);
             // An absent model or capabilities field must CLEAR any override
@@ -439,80 +453,6 @@ export class AgentTeamLedger {
         }
         return active.sort((a, b) => a.claimRef.localeCompare(b.claimRef));
     }
-    /**
-     * Current progress-nudge candidacy for one Member: threads whose Thread
-     * progress reminder applies (active Claim, or following a taskless Thread)
-     * and tasks where the Claim reminder applies (following a still-`todo` Task
-     * with no Claim history for this Member). A deep read-only projection — the
-     * caller never re-derives attention, claim, task-resolution, or channel
-     * archive state. Archived channels and resolved tasks produce no candidacy;
-     * results are ordered by Thread revision descending, then threadRef.
-     */
-    progressNudgeTargets(memberId) {
-        const member = this.state.members.get(memberId);
-        if (member === undefined || member.state !== 'enabled')
-            return EMPTY_PROGRESS_NUDGE_TARGETS;
-        const progress = [];
-        const claim = [];
-        const seenProgress = new Set();
-        for (const claimRecord of this.state.claims.values()) {
-            if (claimRecord.owner !== memberId || claimRecord.state !== 'active')
-                continue;
-            const task = this.state.tasks.get(claimRecord.taskRef);
-            const thread = this.state.threads.get(claimRecord.threadRef);
-            if (task === undefined || thread === undefined || task.resolution !== 'open')
-                continue;
-            if (this.state.channels.get(task.channelRef)?.state === 'archived')
-                continue;
-            if (seenProgress.has(claimRecord.threadRef))
-                continue;
-            seenProgress.add(claimRecord.threadRef);
-            progress.push({ reason: 'active-claim', threadRef: claimRecord.threadRef, taskRef: claimRecord.taskRef });
-        }
-        for (const [threadRef, followers] of this.state.attentionByThread) {
-            if (!followers.has(memberId))
-                continue;
-            const thread = this.state.threads.get(threadRef);
-            if (thread === undefined)
-                continue;
-            const channelRef = this.state.channelRefByThread.get(threadRef);
-            if (channelRef === undefined || this.state.channels.get(channelRef)?.state === 'archived')
-                continue;
-            if (thread.taskRef === undefined) {
-                if (!seenProgress.has(threadRef)) {
-                    seenProgress.add(threadRef);
-                    progress.push({ reason: 'taskless-follower', threadRef });
-                }
-                continue;
-            }
-            // Claim reminder: only still-`todo` tasks with zero lifetime claims by
-            // this Member; once claimed (any state) the Member moved into the
-            // progress-reminder regime.
-            if (this.hasLifetimeClaimOnTask(memberId, thread.taskRef))
-                continue;
-            const task = this.state.tasks.get(thread.taskRef);
-            if (task === undefined || task.resolution !== 'open' || this.deriveTaskStatus(task.taskRef, this.state.claims.values()) !== 'todo')
-                continue;
-            claim.push({ threadRef, taskRef: thread.taskRef });
-        }
-        const byThreadRevision = (left, right) => {
-            const leftRevision = this.state.threads.get(left.threadRef)?.revision ?? 0;
-            const rightRevision = this.state.threads.get(right.threadRef)?.revision ?? 0;
-            return rightRevision - leftRevision || (left.threadRef < right.threadRef ? -1 : left.threadRef > right.threadRef ? 1 : 0);
-        };
-        return Object.freeze({
-            progress: Object.freeze(progress.sort(byThreadRevision)),
-            claim: Object.freeze(claim.sort(byThreadRevision)),
-        });
-    }
-    /** Whether this Member has ever held a Claim on the Task, in any state. */
-    hasLifetimeClaimOnTask(memberId, taskRef) {
-        for (const claim of this.state.claims.values()) {
-            if (claim.owner === memberId && claim.taskRef === taskRef)
-                return true;
-        }
-        return false;
-    }
     listMembers() {
         return Object.freeze([...this.state.members.values()]);
     }
@@ -526,8 +466,8 @@ export class AgentTeamLedger {
             this.assertHumanActor(request.actor);
             const channel = this.requireActiveChannel(request.workspaceId, request.channelRef);
             const member = this.requireMember(request.memberId);
-            if (member.workspaceId !== request.workspaceId)
-                throw new Error('Member and Channel must belong to one Workspace');
+            if (!this.participatesIn(member.memberId, request.workspaceId))
+                throw new Error('Agent Member does not participate in the Channel\'s Workspace');
             if (member.state !== 'enabled')
                 throw new Error(`Agent Member '${member.memberId}' is ${member.state}; only enabled Members can join a Channel`);
             if (this.isChannelMember(channel.channelRef, member.memberId))
@@ -551,7 +491,7 @@ export class AgentTeamLedger {
             this.assertHumanActor(request.actor);
             const channel = this.requireChannel(request.workspaceId, request.channelRef);
             const member = this.requireMember(request.memberId);
-            if (member.workspaceId !== channel.workspaceId || !this.isChannelMember(channel.channelRef, member.memberId)) {
+            if (!this.participatesIn(member.memberId, channel.workspaceId) || !this.isChannelMember(channel.channelRef, member.memberId)) {
                 throw new Error(`Agent Member '${member.memberId}' is not a member of Channel '${channel.channelRef}'`);
             }
             const threadRefs = this.channelThreadRefs(channel.channelRef);
@@ -576,6 +516,86 @@ export class AgentTeamLedger {
             return this.committed(this.channelMemberRemovalResult(operation));
         });
     }
+    /**
+     * Join one Agent Member to one additional Workspace. Participation is a
+     * pure relation — no Session is created or moved; the Member's Session
+     * stays rooted in its default Workspace and collaboration in the joined
+     * Workspace is ledger work addressed by the workspaceId.
+     */
+    joinWorkspace(request) {
+        return this.enqueue(async () => {
+            const existing = this.state.byRequest.get(request.requestId);
+            if (existing !== undefined) {
+                this.assertSameWorkspaceJoin(existing, request);
+                return this.resolved(this.workspaceJoinResult(existing));
+            }
+            this.assertHumanActor(request.actor);
+            const member = this.requireMember(request.memberId);
+            if (member.state === 'inactive')
+                throw new Error(`Agent Member '${member.memberId}' is inactive and cannot join a Workspace`);
+            if (member.state === 'archived')
+                throw new Error(`Agent Member '${member.memberId}' is archived and cannot join a Workspace`);
+            if (this.participatesIn(member.memberId, request.workspaceId))
+                throw new Error(`Agent Member '${member.memberId}' already participates in Workspace '${request.workspaceId}'`);
+            // Handles resolve per Workspace: a second live Member with the same
+            // handle in the target would make mentions ambiguous there.
+            this.assertHandleAvailable(request.workspaceId, member.handle);
+            const operation = Object.freeze({
+                ...this.operationBase(request, this.nextSequence()), kind: 'team/member-workspace-joined',
+                data: Object.freeze({ workspaceId: request.workspaceId, memberId: member.memberId }),
+            });
+            await this.table.put(operation.operationId, operation);
+            this.apply(operation);
+            return this.committed(this.workspaceJoinResult(operation));
+        });
+    }
+    /**
+     * Withdraw one Agent Member from one of its non-default Workspaces. The
+     * default Workspace cannot be left — ending it is the archive path. Every
+     * active Claim the Member holds on the Workspace's Threads releases with
+     * public Activities, its Attention and markers on those Threads clear, and
+     * its Channel memberships there end; identity, Session, and remaining
+     * participations are untouched.
+     */
+    leaveWorkspace(request) {
+        return this.enqueue(async () => {
+            const existing = this.state.byRequest.get(request.requestId);
+            if (existing !== undefined) {
+                this.assertSameWorkspaceLeave(existing, request);
+                return this.resolved(this.workspaceLeaveResult(existing));
+            }
+            this.assertHumanActor(request.actor);
+            const member = this.requireMember(request.memberId);
+            if (member.state === 'inactive')
+                throw new Error(`Agent Member '${member.memberId}' is already inactive`);
+            if (member.state === 'archived')
+                throw new Error(`Agent Member '${member.memberId}' is already archived`);
+            if (request.workspaceId === member.workspaceId)
+                throw new Error(`Agent Member '${member.memberId}' cannot leave its default Workspace '${request.workspaceId}'; archive the Member instead`);
+            if (!this.participatesIn(member.memberId, request.workspaceId))
+                throw new Error(`Agent Member '${member.memberId}' does not participate in Workspace '${request.workspaceId}'`);
+            const threadRefs = this.workspaceThreadRefs(request.workspaceId);
+            const releasedClaims = [...this.state.claims.values()]
+                .filter(claim => claim.owner === member.memberId && claim.state === 'active' && threadRefs.has(claim.threadRef))
+                .map(claim => Object.freeze({ ...claim, state: 'released' }));
+            const projectedClaims = new Map(this.state.claims);
+            for (const claim of releasedClaims)
+                projectedClaims.set(claim.claimRef, claim);
+            const sequence = this.nextSequence();
+            const activities = this.releaseSummaries(releasedClaims, member.memberId, sequence);
+            const threads = this.threadsForActivities(activities);
+            const tasks = this.tasksForClaims(releasedClaims, projectedClaims);
+            const inbox = this.removeMemberThreadInbox(member.memberId, threadRefs);
+            const operation = Object.freeze({
+                ...this.operationBase(request, sequence), kind: 'team/member-workspace-left',
+                data: Object.freeze({ workspaceId: request.workspaceId, memberId: member.memberId,
+                    claims: Object.freeze(releasedClaims), activities, tasks, threads, inbox }),
+            });
+            await this.table.put(operation.operationId, operation);
+            this.apply(operation);
+            return this.committed(this.workspaceLeaveResult(operation));
+        });
+    }
     /**
      * Archive one Channel: hidden from every surface, facts kept recoverable.
      * Every active Claim on the Channel's Threads releases with one public
@@ -620,12 +640,6 @@ export class AgentTeamLedger {
     }
     sendMessage(request) {
         return this.enqueue(async () => {
-            const recipients = this.normalizeRecipients(request.actor, request.recipients);
-            const existing = this.state.byRequest.get(request.requestId);
-            if (existing !== undefined) {
-                this.assertSameMessage(existing, request, recipients);
-                return this.resolved(this.messageResult(existing));
-            }
             const actor = this.assertActorForWorkspace(request.actor, request.workspaceId);
             const channel = this.requireActiveChannel(request.workspaceId, request.channelRef);
             if (actor.kind === 'member')
@@ -633,6 +647,15 @@ export class AgentTeamLedger {
             const body = request.body.trim();
             if (body === '')
                 throw new Error('message body must not be empty');
+            // Recipients are resolved before the request-id lookup: the stored
+            // operation carries the merged set, so a retry has to re-derive the same
+            // list for the collision check to prove it is the same request.
+            const recipients = this.mergeBodyMentions(actor.memberId, channel.channelRef, body, this.normalizeRecipients(request.actor, request.recipients));
+            const existing = this.state.byRequest.get(request.requestId);
+            if (existing !== undefined) {
+                this.assertSameMessage(existing, request, recipients);
+                return this.resolved(this.messageResult(existing));
+            }
             this.assertMentionTargets(channel, recipients);
             // Top-level Task creation is open to every actor: mentioned Members join
             // the new Thread as followers. Only existing-Thread invitations stay
@@ -667,32 +690,38 @@ export class AgentTeamLedger {
     }
     reply(request) {
         return this.enqueue(async () => {
-            const recipients = this.normalizeRecipients(request.actor, request.recipients);
-            const existing = this.state.byRequest.get(request.requestId);
-            if (existing !== undefined) {
-                this.assertSameReply(existing, request, recipients);
-                return this.resolved(this.replyResult(existing));
-            }
             const actor = this.assertActorForWorkspace(request.actor, request.workspaceId);
             const { task, thread, channelRef } = this.threadContextForActor(actor, request.workspaceId, request);
             const body = request.body.trim();
             if (body === '')
                 throw new Error('message body must not be empty');
-            this.assertMentionTargets(this.requireChannel(request.workspaceId, channelRef), recipients);
+            const channel = this.requireChannel(request.workspaceId, channelRef);
+            const recipients = this.mergeBodyMentions(actor.memberId, channelRef, body, this.normalizeRecipients(actor, request.recipients));
+            const existing = this.state.byRequest.get(request.requestId);
+            if (existing !== undefined) {
+                this.assertSameReply(existing, request, recipients);
+                return this.resolved(this.replyResult(existing, this.undeliverableRecipients(actor, thread.threadRef, recipients)));
+            }
+            this.assertMentionTargets(channel, recipients);
             const deferred = this.deferredThreadWrite(actor.memberId, task, thread, request.baseRevision);
             if (deferred !== undefined)
                 return this.resolved(deferred);
             if (task?.resolution === 'closed')
                 throw new Error(`Task '${task.taskRef}' is closed; reopen it before replying`);
-            const unfollowedAgents = recipients.filter(memberId => this.state.members.has(memberId) && !this.isFollowing(thread.threadRef, memberId));
-            if (unfollowedAgents.length > 0 && actor.kind === 'member') {
-                return this.resolved(this.memberNotFollowing(request.workspaceId, channelRef, unfollowedAgents, task, thread));
-            }
-            if (unfollowedAgents.length > 0 && request.confirmationToken === undefined) {
-                return this.resolved(this.issueConfirmation(request.actor, request.workspaceId, channelRef, body, recipients, task, thread));
+            // An Agent cannot invite into an existing Thread, so a body mention the
+            // Thread has never carried is dropped and reported back rather than
+            // failing the send. The Human keeps the confirmation step, which is what
+            // actually grants the invitation.
+            const undelivered = this.undeliverableRecipients(actor, thread.threadRef, recipients);
+            const delivered = undelivered.length === 0 ? recipients : recipients.filter(memberId => !undelivered.includes(memberId));
+            const unfollowedAgents = delivered.filter(memberId => this.state.members.has(memberId) && !this.isFollowing(thread.threadRef, memberId));
+            // A Member that once took part in this Thread is delivered to directly:
+            // re-joining a Thread it already belongs to is not an invitation.
+            if (unfollowedAgents.length > 0 && actor.kind === 'human' && request.confirmationToken === undefined) {
+                return this.resolved(this.issueConfirmation(request.actor, request.workspaceId, channelRef, body, delivered, task, thread));
             }
             if (request.confirmationToken !== undefined) {
-                this.consumeConfirmation(request.confirmationToken, request.actor, request.workspaceId, channelRef, task, thread, body, recipients);
+                this.consumeConfirmation(request.confirmationToken, request.actor, request.workspaceId, channelRef, task, thread, body, delivered);
             }
             const sequence = this.nextSequence();
             const base = this.operationBase(request, sequence);
@@ -704,15 +733,15 @@ export class AgentTeamLedger {
             });
             const nextThread = Object.freeze({ ...thread, revision: sequence });
             const started = unfollowedAgents.map(memberId => this.startAttention(memberId, thread.threadRef, sequence));
-            const inbox = this.messageInboxDelta(message, request.actor.memberId, recipients, started);
+            const inbox = this.messageInboxDelta(message, request.actor.memberId, delivered, started);
             const operation = Object.freeze({
                 ...base, kind: 'team/thread-replied',
                 data: Object.freeze({ workspaceId: request.workspaceId, baseRevision: request.baseRevision,
-                    mentions: recipients, message, ...(task === undefined ? {} : { task }), thread: nextThread, inbox }),
+                    mentions: delivered, message, ...(task === undefined ? {} : { task }), thread: nextThread, inbox }),
             });
             await this.table.put(operation.operationId, operation);
             this.apply(operation);
-            return this.committed(this.replyResult(operation));
+            return this.committed(this.replyResult(operation, undelivered));
         });
     }
     promoteThread(request) {
@@ -1027,7 +1056,7 @@ export class AgentTeamLedger {
             if (body === '')
                 throw new Error('DM body must not be empty');
             const recipient = this.requireMember(request.recipientMemberId);
-            if (recipient.workspaceId !== request.workspaceId)
+            if (!this.participatesIn(recipient.memberId, request.workspaceId))
                 throw new Error(`Agent Member '${recipient.memberId}' is not in Workspace '${request.workspaceId}'`);
             if (recipient.state !== 'enabled')
                 throw new Error(`Agent Member '${recipient.memberId}' is ${recipient.state}; DM delivery requires an enabled Member`);
@@ -1082,68 +1111,169 @@ export class AgentTeamLedger {
     }
     inbox(actor, request) {
         const authorized = this.assertActorForWorkspace(actor, request.workspaceId);
-        const limit = request.limit ?? 50;
+        return this.inboxForWorkspaces(authorized, [request.workspaceId], request.limit);
+    }
+    memberInbox(actor, request) {
+        const workspaces = this.workspacesOf(actor.memberId);
+        for (const workspaceId of workspaces)
+            this.assertActorForWorkspace(actor, workspaceId);
+        return this.inboxForWorkspaces(actor, workspaces, request.limit);
+    }
+    inboxForWorkspaces(authorized, workspaceIds, requestedLimit) {
+        const limit = requestedLimit ?? 50;
         if (!Number.isInteger(limit) || limit < 1 || limit > 100)
             throw new Error('inbox limit must be an integer between 1 and 100');
-        // The Human direct-only slice serves the Client's mention queue: rows show
-        // only Threads with an unread mention, `totalUnreadCount` collapses to the
-        // direct total so a badge on this call cannot bypass follow unread, and
-        // each row carries its Channel display name plus the Thread's opening line
-        // so the Client renders without a Channel view per row. The ordinary
-        // (agent-facing) projection stays body-free.
-        const directOnly = request.directOnly === true;
-        const taskNumbers = directOnly ? this.taskNumbers(request.workspaceId) : undefined;
+        // One unread slice serves every reader: Threads the reader follows or
+        // holds a marker on, admitted whenever they hold an unread fact — mentions
+        // are counted inside it (`directCount`), never a separate admission rule.
+        // Every row carries its rendering material — Channel display name, Task
+        // ordinal, opening line, and the person the row's instant came from — so the
+        // Client renders a row without a Channel or Member view per row. Carrying
+        // the opening line on the agent-facing projection is
+        // safe: model-visible notifications read the refs and the facts, never this.
+        // A Human reader additionally receives the separate 「最近活跃」 slice below;
+        // `items` stays exactly the unread queue for every reader, so the badge
+        // totals and the agent-facing `team_inbox` result cannot drift with it.
+        const taskNumbers = new Map(workspaceIds.flatMap(workspaceId => [...this.taskNumbers(workspaceId)]));
         const items = [];
-        for (const threadRef of this.inboxCandidateThreads(authorized.memberId, directOnly)) {
+        const unreadThreads = new Set();
+        for (const threadRef of this.inboxCandidateThreads(authorized.memberId)) {
             const thread = this.state.threads.get(threadRef);
             if (thread === undefined)
                 continue;
             const channelRef = this.channelRefForThread(thread.threadRef);
             if (channelRef === undefined)
                 continue;
-            if (this.state.channels.get(channelRef)?.workspaceId !== request.workspaceId)
+            const channel = this.state.channels.get(channelRef);
+            if (channel === undefined || !workspaceIds.includes(channel.workspaceId))
                 continue;
+            // Archived Channels do not exist on Team API surfaces: their Threads
+            // reach neither Inbox slice, matching ref resolution and the feed.
+            if (channel.state === 'archived')
+                continue;
+            const workspaceId = channel.workspaceId;
             if (authorized.kind === 'member' && !this.isChannelMember(channelRef, authorized.memberId))
                 continue;
             const unread = this.unreadFor(authorized.memberId, thread.threadRef);
             if (unread.length === 0)
                 continue;
+            unreadThreads.add(thread.threadRef);
             const task = thread.taskRef === undefined ? undefined : this.state.tasks.get(thread.taskRef);
             const directCount = unread.filter(item => item.direct).length;
-            if (directOnly && directCount === 0)
-                continue;
             const attention = this.attentionFor(authorized.memberId, thread.threadRef);
             // Same snapshot, same source as newestSequence: the instant hangs off
             // the newest unread fact itself, never a second lookup that could
             // observe a different commit between the two reads.
             const newest = unread.at(-1).fact;
-            const taskNumber = directOnly && task !== undefined ? taskNumbers?.get(task.taskRef) : undefined;
-            items.push(Object.freeze({ channelRef,
-                ...(directOnly ? { channelName: this.state.channels.get(channelRef)?.name ?? '' } : {}),
+            const taskNumber = task === undefined ? undefined : taskNumbers.get(task.taskRef);
+            items.push(Object.freeze({ workspaceId, channelRef,
+                channelName: this.state.channels.get(channelRef)?.name ?? '',
                 ...(task === undefined ? {} : { task }), ...(taskNumber === undefined ? {} : { taskNumber }), thread,
                 unreadCount: unread.length, directCount,
-                ...(directOnly ? { previewText: boundedInboxPreview(this.threadAnchor(thread.threadRef).body) } : {}),
-                newestSequence: newest.sequence, newestOccurredAt: newest.occurredAt, ...(attention === undefined ? {} : { attention }) }));
+                previewText: boundedInboxPreview(this.threadAnchor(thread.threadRef).body),
+                newestSequence: newest.sequence, newestOccurredAt: newest.occurredAt,
+                newestActor: this.inboxActorFor(newest), claimOwners: this.liveClaimOwners(task),
+                ...(attention === undefined ? {} : { attention }) }));
         }
         items.sort((left, right) => right.directCount - left.directCount || right.newestSequence - left.newestSequence || left.thread.threadRef.localeCompare(right.thread.threadRef));
         const selected = items.slice(0, limit);
-        return Object.freeze({ items: Object.freeze(selected),
-            totalUnreadCount: directOnly
-                ? items.reduce((sum, item) => sum + item.directCount, 0)
-                : items.reduce((sum, item) => sum + item.unreadCount, 0),
+        const recent = authorized.kind === 'human'
+            ? this.recentInboxItems(authorized.memberId, workspaceIds[0], unreadThreads, taskNumbers)
+            : Object.freeze([]);
+        return Object.freeze({ items: Object.freeze(selected), recent,
+            totalUnreadCount: items.reduce((sum, item) => sum + item.unreadCount, 0),
             totalDirectCount: items.reduce((sum, item) => sum + item.directCount, 0) });
     }
+    /**
+     * The one person a row names: whoever committed the fact that row's instant
+     * came from — a Message's sender, an activity's actor — resolved to the handle
+     * the row draws. Resolving it here is what spares every Client row a Member
+     * view of its own, and a Member the roster no longer names still reads as
+     * themselves through their raw id rather than as nobody.
+     */
+    inboxActorFor(fact) {
+        return this.memberActor(fact.kind === 'message' ? fact.message.sender : fact.activity.actor);
+    }
+    /** One Member as a row draws them: the id carries the identity hue, the handle the initial. */
+    memberActor(memberId) {
+        return Object.freeze({ memberId, name: this.state.members.get(memberId)?.handle ?? memberId });
+    }
+    /**
+     * The people a Task still has on it, resolved the way a row draws them: owners
+     * of its live Claims, in claim order, deduped. A released Claim is not work,
+     * and a done or closed Task keeps its Claims as history rather than as
+     * presence — deliberately the same rule the Channel feed applies to the same
+     * Task, so 「谁在这个 Task 上」 never acquires a second definition.
+     */
+    liveClaimOwners(task) {
+        if (task === undefined || (task.status !== 'in_progress' && task.status !== 'in_review'))
+            return Object.freeze([]);
+        const owners = [];
+        for (const claim of this.claimsForTask(task.taskRef)) {
+            if (claim.state === 'released' || owners.includes(claim.owner))
+                continue;
+            owners.push(claim.owner);
+        }
+        return Object.freeze(owners.map(owner => this.memberActor(owner)));
+    }
+    /**
+     * The Human Inbox's 「最近活跃」 slice: the Threads this reader has written in
+     * — the durable way back into work instead of a mention-only queue.
+     * Participation is the whole admission rule: a reader who replied to somebody
+     * else's Thread is here whether or not they follow it, and so is one who
+     * started a Thread nobody has answered yet, because starting one is writing
+     * its anchor. Attention deliberately plays no part — it decides what notifies
+     * a reader (a reply does not implicitly follow a Thread), and reading it here
+     * as well is what once hid every Thread a reader had replied to without
+     * following. A Thread the reader later unfollowed stays: they did take part
+     * in it, and unfollowing stops the notifications, not the record. Every
+     * Thread still holding unread is excluded because the queue above already
+     * carries it, and the slice is newest-activity first, bounded by
+     * `RECENT_INBOX_LIMIT`. Rows are the same shape as unread rows with every
+     * count at zero — they are the same row to render.
+     */
+    recentInboxItems(memberId, workspaceId, unreadThreads, taskNumbers) {
+        const recent = [];
+        for (const threadRef of this.state.threadsByWriter.get(memberId) ?? []) {
+            if (unreadThreads.has(threadRef))
+                continue;
+            const thread = this.state.threads.get(threadRef);
+            if (thread === undefined)
+                continue;
+            const channelRef = this.channelRefForThread(thread.threadRef);
+            if (channelRef === undefined)
+                continue;
+            const channel = this.state.channels.get(channelRef);
+            if (channel === undefined || channel.workspaceId !== workspaceId)
+                continue;
+            // Archived Channels do not exist on Team API surfaces, so their Threads
+            // are no way back into work either — participation ends at archival.
+            if (channel.state === 'archived')
+                continue;
+            const facts = this.state.factsByThread.get(thread.threadRef) ?? [];
+            const newest = facts.at(-1);
+            if (newest === undefined)
+                continue;
+            const task = thread.taskRef === undefined ? undefined : this.state.tasks.get(thread.taskRef);
+            const taskNumber = task === undefined ? undefined : taskNumbers.get(task.taskRef);
+            recent.push(Object.freeze({ workspaceId, channelRef,
+                channelName: this.state.channels.get(channelRef)?.name ?? '',
+                ...(task === undefined ? {} : { task }), ...(taskNumber === undefined ? {} : { taskNumber }), thread,
+                unreadCount: 0, directCount: 0,
+                previewText: boundedInboxPreview(this.threadAnchor(thread.threadRef).body),
+                newestSequence: newest.sequence, newestOccurredAt: newest.occurredAt,
+                newestActor: this.inboxActorFor(newest), claimOwners: this.liveClaimOwners(task) }));
+        }
+        recent.sort((left, right) => right.newestSequence - left.newestSequence || left.thread.threadRef.localeCompare(right.thread.threadRef));
+        return Object.freeze(recent.slice(0, RECENT_INBOX_LIMIT));
+    }
     /**
      * Threads that can hold unread facts for one reader, from the per-reader
      * derived indexes: Attention follows plus direct and activity markers.
      * Every unread source is covered — ordinary unread requires Attention, and
-     * marker unread requires a marker — so no full Thread scan is needed. The
-     * direct-only slice needs only the direct-marker threads, since a row
-     * requires at least one direct unread.
+     * marker unread requires a marker — so no full Thread scan is needed.
      */
-    inboxCandidateThreads(memberId, directOnly) {
-        if (directOnly)
-            return this.state.directMarkersByMember.get(memberId)?.keys() ?? [];
+    inboxCandidateThreads(memberId) {
         const refs = new Set();
         for (const source of [this.state.attentionThreadsByMember.get(memberId), this.state.directMarkersByMember.get(memberId), this.state.activityMarkersByMember.get(memberId)]) {
             for (const threadRef of source?.keys() ?? [])
@@ -1154,9 +1284,10 @@ export class AgentTeamLedger {
     /** Model-visible notification material derived from the recipient's current durable unread state. */
     notificationFacts(memberId, request) {
         const member = this.requireMember(memberId);
-        if (member.workspaceId !== request.workspaceId)
+        if (request !== undefined && !this.participatesIn(memberId, request.workspaceId))
             throw new Error('Member cannot inspect another Workspace');
-        const inbox = this.inbox({ kind: 'member', memberId, handle: member.handle }, request);
+        const actor = { kind: 'member', memberId, handle: member.handle };
+        const inbox = request === undefined ? this.memberInbox(actor, {}) : this.inbox(actor, request);
         return Object.freeze(inbox.items.map(item => Object.freeze({ item,
             facts: this.unreadFor(memberId, item.thread.threadRef) })));
     }
@@ -1278,7 +1409,7 @@ export class AgentTeamLedger {
             throw new Error('cursor must be a non-negative integer sequence');
         if (memberId !== undefined) {
             const member = this.requireMember(memberId);
-            if (member.workspaceId !== request.workspaceId)
+            if (!this.participatesIn(member.memberId, request.workspaceId))
                 throw new Error('Member cannot view another Workspace');
         }
         if (request.channelRef !== undefined) {
@@ -1361,6 +1492,7 @@ export class AgentTeamLedger {
             const task = thread.taskRef === undefined ? undefined : this.state.tasks.get(thread.taskRef);
             const facts = this.state.factsByThread.get(thread.threadRef) ?? [];
             return Object.freeze({ message, mentions: fact.mentions, ...(task === undefined ? {} : { task, taskNumber: taskNumbers.get(task.taskRef) ?? 0 }), thread,
+                claimOwners: this.liveClaimOwners(task),
                 messageCount: this.state.messageCountByThread.get(thread.threadRef) ?? 0,
                 lastActivityAt: facts.at(-1)?.occurredAt ?? '' });
         });
@@ -1368,6 +1500,8 @@ export class AgentTeamLedger {
         const nextCursor = selected.length === 0 ? cursor : direction === 'before' ? selected[0].sequence : selected.at(-1).sequence;
         return Object.freeze({
             humanMemberId: initialization.data.humanMemberId,
+            workspaces: Object.freeze(memberId === undefined ? [] : this.workspacesOfFrom(this.state, memberId)
+                .map(workspaceId => Object.freeze({ workspaceId, default: workspaceId === this.state.members.get(memberId)?.workspaceId }))),
             channels: Object.freeze(channels),
             members: Object.freeze([...this.state.memberships.entries()].filter(([channelRef]) => channelRefs.has(channelRef)).flatMap(([channelRef, ids]) => [...ids].filter(id => {
                 const state = this.state.members.get(id)?.state;
@@ -1446,6 +1580,10 @@ export class AgentTeamLedger {
         }
         return scopes;
     }
+    /** One workspace change scope per Workspace the Member participates in — member-level commits wake every panel that lists it. */
+    memberWorkspaceScopes(memberId) {
+        return [...(this.state.participations.get(memberId) ?? [])].map(workspaceId => ({ kind: 'workspace', workspaceId }));
+    }
     /**
      * Durable position of the newest shared-projection commit: the version every
      * change waiter outside the presence scope observes. It only moves when a
@@ -1474,9 +1612,13 @@ export class AgentTeamLedger {
             case 'team/member-session-rolled-over':
             case 'team/member-updated':
             case 'team/member-removed':
-                return [{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }];
+                return this.memberWorkspaceScopes(operation.data.member.memberId);
             case 'team/member-archived':
-                return this.withReleasedActivityScopes([{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }], operation.data.tasks, operation.data.activities);
+                return this.withReleasedActivityScopes(this.memberWorkspaceScopes(operation.data.member.memberId), operation.data.tasks, operation.data.activities);
+            case 'team/member-workspace-joined':
+                return [{ kind: 'workspace', workspaceId: operation.data.workspaceId }];
+            case 'team/member-workspace-left':
+                return this.withReleasedActivityScopes([{ kind: 'workspace', workspaceId: operation.data.workspaceId }], operation.data.tasks, operation.data.activities);
             case 'team/channel-member-added':
                 return [{ kind: 'workspace', workspaceId: operation.data.workspaceId }, { kind: 'channel', channelRef: operation.data.channelRef }];
             case 'team/channel-member-removed':
@@ -1539,6 +1681,8 @@ export class AgentTeamLedger {
             for (const follower of this.state.attentionByThread.get(threadRef) ?? [])
                 members.add(follower);
         }
+        if (operation.kind === 'team/member-workspace-joined' || operation.kind === 'team/member-workspace-left')
+            members.add(operation.data.memberId);
         if (operation.actor.kind === 'member')
             members.add(operation.actor.memberId);
         return [...members];
@@ -1560,11 +1704,13 @@ export class AgentTeamLedger {
             case 'team/channel-archived':
             case 'team/member-removed':
             case 'team/member-archived':
+            case 'team/member-workspace-left':
                 return operation.data.activities.map(activity => activity.threadRef);
             case 'team/initialized':
             case 'team/channel-created':
             case 'team/channel-updated':
             case 'team/member-added':
+            case 'team/member-workspace-joined':
             case 'team/member-suspended':
             case 'team/member-resumed':
             case 'team/member-session-restarted':
@@ -1646,7 +1792,7 @@ export class AgentTeamLedger {
                 throw new Error('invalid initial Channel members');
             for (const memberId of memberIds) {
                 const member = projection.members.get(memberId);
-                if (member === undefined || member.workspaceId !== channel.workspaceId || member.state !== 'enabled')
+                if (member === undefined || !this.participatesInFrom(projection, member.memberId, channel.workspaceId) || member.state !== 'enabled')
                     throw new Error('invalid initial Channel Member');
             }
             return;
@@ -1744,10 +1890,10 @@ export class AgentTeamLedger {
                 || operation.data.member.presetId !== prior.presetId
                 || operation.data.member.privateMemoryPath !== prior.privateMemoryPath)
                 throw new Error('invalid Member update');
-            // The renamed handle must stay unique among the workspace's other live Members.
+            // The renamed handle must stay unique among the live Members sharing any Workspace participation.
             const normalized = operation.data.member.handle.normalize('NFKC').trim().toLowerCase();
             for (const other of projection.members.values()) {
-                if (other.memberId !== prior.memberId && other.state !== 'inactive' && other.workspaceId === prior.workspaceId
+                if (other.memberId !== prior.memberId && other.state !== 'inactive' && this.participationOverlapFrom(projection, other.memberId, prior.memberId)
                     && other.handle.normalize('NFKC').trim().toLowerCase() === normalized)
                     throw new Error('invalid Member update handle');
             }
@@ -1757,7 +1903,7 @@ export class AgentTeamLedger {
             assertHuman();
             const channel = projection.channels.get(operation.data.channelRef);
             const member = projection.members.get(operation.data.memberId);
-            if (channel === undefined || member === undefined || member.workspaceId !== channel.workspaceId || operation.data.workspaceId !== channel.workspaceId || projection.memberships.get(channel.channelRef)?.has(member.memberId))
+            if (channel === undefined || member === undefined || !this.participatesInFrom(projection, member.memberId, channel.workspaceId) || operation.data.workspaceId !== channel.workspaceId || projection.memberships.get(channel.channelRef)?.has(member.memberId))
                 throw new Error('invalid Channel membership');
             return;
         }
@@ -1766,12 +1912,32 @@ export class AgentTeamLedger {
             const channel = projection.channels.get(operation.data.channelRef);
             const member = projection.members.get(operation.data.memberId);
             if (channel === undefined || member === undefined || operation.data.workspaceId !== channel.workspaceId
-                || member.workspaceId !== channel.workspaceId || !projection.memberships.get(channel.channelRef)?.has(member.memberId))
+                || !this.participatesInFrom(projection, member.memberId, channel.workspaceId) || !projection.memberships.get(channel.channelRef)?.has(member.memberId))
                 throw new Error('invalid Channel membership removal');
             const threadRefs = new Set([...projection.threads.keys()].filter(threadRef => this.channelRefForThreadFrom(projection, threadRef) === channel.channelRef));
             this.validateReleaseCleanup(operation.data, projection, member.memberId, threadRefs, operation.sequence, refs);
             return;
         }
+        if (operation.kind === 'team/member-workspace-joined') {
+            assertHuman();
+            const member = projection.members.get(operation.data.memberId);
+            if (member === undefined || member.state === 'inactive' || member.state === 'archived'
+                || this.participatesInFrom(projection, member.memberId, operation.data.workspaceId))
+                throw new Error('invalid Workspace join');
+            this.assertHandleAvailableFrom(projection, operation.data.workspaceId, member.handle);
+            return;
+        }
+        if (operation.kind === 'team/member-workspace-left') {
+            assertHuman();
+            const member = projection.members.get(operation.data.memberId);
+            if (member === undefined || member.state === 'inactive' || member.state === 'archived'
+                || operation.data.workspaceId === member.workspaceId
+                || !this.participatesInFrom(projection, member.memberId, operation.data.workspaceId))
+                throw new Error('invalid Workspace leave');
+            const threadRefs = this.workspaceThreadRefsFrom(projection, operation.data.workspaceId);
+            this.validateReleaseCleanup(operation.data, projection, member.memberId, threadRefs, operation.sequence, refs);
+            return;
+        }
         if (operation.kind === 'team/channel-archived') {
             assertHuman();
             const prior = projection.channels.get(operation.data.channel.channelRef);
@@ -1839,7 +2005,10 @@ export class AgentTeamLedger {
             if (isThreadReadSnapshot(data)) {
                 // The pre-receipt form froze the whole picture, so its expected value
                 // is re-derived the same way it was written: from this record's prior
-                // projection only, never from the live one.
+                // projection only, never from the live one. That shape stays frozen —
+                // a field added after it, like the orientation count, is not compared
+                // here, because no stored legacy record carries it and inventing one
+                // would reject every upgrade of a ledger written before the field.
                 const expected = this.prepareReadFrom(projection, data.memberId, data.workspaceId, target);
                 const expectedData = Object.freeze({ workspaceId: data.workspaceId, memberId: data.memberId,
                     ...(expected.task === undefined ? {} : { task: expected.task }), thread: expected.thread, claims: expected.claims, anchor: expected.anchor,
@@ -2030,7 +2199,7 @@ export class AgentTeamLedger {
         if (operation.kind === 'team/dm-sent') {
             const sender = assertMember();
             const recipient = projection.members.get(operation.data.recipientMemberId);
-            if (recipient === undefined || recipient.workspaceId !== operation.data.workspaceId
+            if (recipient === undefined || !this.participatesInFrom(projection, recipient.memberId, operation.data.workspaceId)
                 || recipient.state !== 'enabled' || recipient.memberId === AGENT_TEAM_HUMAN_MEMBER_ID
                 || operation.data.senderMemberId !== sender.memberId
                 || operation.data.recipientMemberId === sender.memberId
@@ -2196,7 +2365,7 @@ export class AgentTeamLedger {
         // Top-level mentions are open to every actor; only a Member reply may not
         // pull an unfollowed Member into an existing Thread.
         if (operation.actor.kind === 'member' && operation.kind === 'team/thread-replied'
-            && mentionedAgents.some(memberId => !this.isFollowingFrom(projection, message.threadRef, memberId))) {
+            && mentionedAgents.some(memberId => !this.everParticipatedFrom(projection, message.threadRef, memberId))) {
             throw new Error('invalid Agent mention projection');
         }
         const started = operation.kind === 'team/message-sent'
@@ -2221,8 +2390,9 @@ export class AgentTeamLedger {
         if (memberId === AGENT_TEAM_HUMAN_MEMBER_ID)
             return true;
         const member = projection.members.get(memberId);
+        const channelWorkspaceId = projection.channels.get(channelRef)?.workspaceId;
         return member !== undefined && member.state !== 'inactive' && member.state !== 'archived'
-            && projection.channels.get(channelRef)?.workspaceId === member.workspaceId
+            && channelWorkspaceId !== undefined && this.participatesInFrom(projection, memberId, channelWorkspaceId)
             && this.isChannelMemberFrom(projection, channelRef, memberId);
     }
     apply(operation) {
@@ -2247,6 +2417,9 @@ export class AgentTeamLedger {
         }
         if (operation.kind === 'team/member-added') {
             target.members.set(operation.data.member.memberId, operation.data.member);
+            // Creation seeds the first Workspace participation; member.workspaceId
+            // stays the default Workspace the Session roots in, immutable after add.
+            target.participations.set(operation.data.member.memberId, new Set([operation.data.member.workspaceId]));
             for (const channelRef of operation.data.channelRefs)
                 this.addMembership(target, channelRef, operation.data.member.memberId);
             return;
@@ -2305,6 +2478,23 @@ export class AgentTeamLedger {
             this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
             return;
         }
+        if (operation.kind === 'team/member-workspace-joined') {
+            const workspaces = target.participations.get(operation.data.memberId) ?? new Set();
+            workspaces.add(operation.data.workspaceId);
+            target.participations.set(operation.data.memberId, workspaces);
+            return;
+        }
+        if (operation.kind === 'team/member-workspace-left') {
+            target.participations.get(operation.data.memberId)?.delete(operation.data.workspaceId);
+            // Departure ends Channel memberships inside the left Workspace — unlike
+            // archival, which keeps them hidden for a possible restore.
+            for (const channel of target.channels.values()) {
+                if (channel.workspaceId === operation.data.workspaceId)
+                    target.memberships.get(channel.channelRef)?.delete(operation.data.memberId);
+            }
+            this.applyReleaseSnapshot(target, operation, operation.data, operation.occurredAt);
+            return;
+        }
         if (operation.kind === 'team/channel-archived') {
             // Archival keeps Memberships: hidden state, not departure — a future
             // restore returns every Member to the Channel. Visibility filters by
@@ -2420,6 +2610,11 @@ export class AgentTeamLedger {
         // The ref index is written in this same step, so it is exactly the set of
         // replayed Messages: a validator lookup can never reach a later record.
         target.messagesByRef.set(message.messageRef, message);
+        // Participation is indexed per writer as the fact lands, so the Human
+        // recent slice asks who wrote where without scanning the whole ledger.
+        const written = target.threadsByWriter.get(message.sender) ?? new Set();
+        written.add(message.threadRef);
+        target.threadsByWriter.set(message.sender, written);
     }
     appendActivityFact(target, activity, occurredAt) {
         const fact = Object.freeze({ kind: 'activity', sequence: activity.sequence, activity, occurredAt });
@@ -2596,9 +2791,21 @@ export class AgentTeamLedger {
         const combined = [...background.map(fact => this.readFactFrom(projection, memberId, fact, false)), ...receipt.unread.slice(0, 20)]
             .sort((left, right) => left.fact.sequence - right.fact.sequence);
         const remainingUnreadCount = this.remainingUnreadAfter(projection, memberId, receipt);
+        // What this bounded read leaves behind it: the Thread facts that precede the
+        // watermark it reaches, which is where this reader now stands in the Thread
+        // and how much of it that position has never shown it. Anchoring on the
+        // watermark rather than on the response's own oldest fact is what keeps a
+        // returning reader honest — the background window starts at the Thread's
+        // first fact whenever the Thread is short enough to fit it, so measuring
+        // from the response would report nothing behind a reader that has in fact
+        // never read the Thread. Derived from the projection the read resolved
+        // against, like every other field of this picture, so a replay re-derives
+        // the same number.
+        const earlierFactCount = this.threadFactsFrom(projection, thread.threadRef)
+            .filter(fact => fact.sequence < receipt.readThroughSequence).length;
         return Object.freeze({ ...receipt, claims: task === undefined ? Object.freeze([]) : this.claimsForTaskFrom(projection, task.taskRef), anchor,
             anchorMentions: projection.mentionsByMessage.get(anchor.messageRef) ?? [],
-            facts: Object.freeze(combined), remainingUnreadCount });
+            facts: Object.freeze(combined), remainingUnreadCount, earlierFactCount });
     }
     readFactFrom(projection, memberId, fact, unread) {
         return Object.freeze({ fact, unread, direct: fact.kind === 'message'
@@ -2849,15 +3056,11 @@ export class AgentTeamLedger {
             if (memberId === AGENT_TEAM_HUMAN_MEMBER_ID)
                 continue;
             const member = this.requireMember(memberId);
-            if (member.state === 'inactive' || member.state === 'archived' || member.workspaceId !== channel.workspaceId || !this.isChannelMember(channel.channelRef, memberId)) {
+            if (member.state === 'inactive' || member.state === 'archived' || !this.participatesIn(member.memberId, channel.workspaceId) || !this.isChannelMember(channel.channelRef, memberId)) {
                 throw new Error(`Agent Member '${memberId}' is not authorized for Channel '${channel.channelRef}'`);
             }
         }
     }
-    memberNotFollowing(workspaceId, channelRef, memberIds, task, thread) {
-        return Object.freeze({ kind: 'member_not_following', workspaceId, channelRef, memberIds: Object.freeze(memberIds),
-            ...(task === undefined ? {} : { taskRef: task.taskRef }), ...(thread === undefined ? {} : { threadRef: thread.threadRef, revision: thread.revision }) });
-    }
     unreadRequired(task, thread, unread) {
         return Object.freeze({ kind: 'unread_required', ...(task === undefined ? {} : { taskRef: task.taskRef }), threadRef: thread.threadRef,
             revision: thread.revision, unreadCount: unread.length, directCount: unread.filter(item => item.direct).length });
@@ -2917,10 +3120,11 @@ export class AgentTeamLedger {
         return undefined;
     }
     /** Commit projections shared by the Message-sent and Thread-replied results. */
-    committedMessageResult(operation) {
+    committedMessageResult(operation, undelivered = []) {
         return { kind: 'committed', receipt: this.receipt(operation), message: operation.data.message,
             ...(operation.data.task === undefined ? {} : { task: operation.data.task }), thread: operation.data.thread, attention: operation.data.inbox.attention.set,
-            directMarkers: operation.data.inbox.directMarkers.added };
+            directMarkers: operation.data.inbox.directMarkers.added,
+            ...(undelivered.length === 0 ? {} : { undeliveredMentions: undelivered }) };
     }
     threadAnchor(threadRef) {
         return this.threadAnchorFrom(this.state, threadRef);
@@ -2997,7 +3201,7 @@ export class AgentTeamLedger {
             return actor;
         }
         const member = this.assertMemberActor(actor);
-        if (member.workspaceId !== workspaceId)
+        if (!this.participatesIn(member.memberId, workspaceId))
             throw new Error('Member cannot mutate another Workspace');
         return actor;
     }
@@ -3174,10 +3378,50 @@ export class AgentTeamLedger {
     channelThreadRefsFrom(projection, channelRef) {
         return new Set([...projection.threads.keys()].filter(threadRef => this.channelRefForThreadFrom(projection, threadRef) === channelRef));
     }
+    /** The Workspace authorization question: does this Member participate in this Workspace. */
+    participatesIn(memberId, workspaceId) {
+        return this.participatesInFrom(this.state, memberId, workspaceId);
+    }
+    participatesInFrom(projection, memberId, workspaceId) {
+        return projection.participations.get(memberId)?.has(workspaceId) === true;
+    }
+    /** Every Workspace the Member participates in: the default first, then the rest sorted. */
+    workspacesOf(memberId) {
+        return Object.freeze(this.workspacesOfFrom(this.state, memberId));
+    }
+    workspacesOfFrom(projection, memberId) {
+        const member = projection.members.get(memberId);
+        if (member === undefined)
+            return [];
+        const rest = [...(projection.participations.get(memberId) ?? new Set())]
+            .filter(workspaceId => workspaceId !== member.workspaceId).sort();
+        return [member.workspaceId, ...rest];
+    }
+    /** Whether two Members share at least one Workspace participation — the handle-uniqueness scope. */
+    participationOverlapFrom(projection, leftMemberId, rightMemberId) {
+        const left = projection.participations.get(leftMemberId);
+        const right = projection.participations.get(rightMemberId);
+        if (left === undefined || right === undefined)
+            return false;
+        for (const workspaceId of left)
+            if (right.has(workspaceId))
+                return true;
+        return false;
+    }
+    /** Every Thread in the Workspace — the scope a Workspace leave replays its cleanup against. */
+    workspaceThreadRefs(workspaceId) {
+        return this.workspaceThreadRefsFrom(this.state, workspaceId);
+    }
+    workspaceThreadRefsFrom(projection, workspaceId) {
+        return new Set([...projection.threads.keys()].filter(threadRef => {
+            const channelRef = this.channelRefForThreadFrom(projection, threadRef);
+            return channelRef !== undefined && projection.channels.get(channelRef)?.workspaceId === workspaceId;
+        }));
+    }
     assertJoinableMember(workspaceId, memberId) {
         const member = this.requireMember(memberId);
-        if (member.workspaceId !== workspaceId)
-            throw new Error(`Agent Member '${memberId}' does not belong to Workspace '${workspaceId}'`);
+        if (!this.participatesIn(memberId, workspaceId))
+            throw new Error(`Agent Member '${memberId}' does not participate in Workspace '${workspaceId}'`);
         if (member.state !== 'enabled')
             throw new Error(`Agent Member '${memberId}' is ${member.state}; only enabled Members can join a Channel`);
     }
@@ -3193,13 +3437,78 @@ export class AgentTeamLedger {
             throw new Error(`${label} contains duplicate Member refs`);
         return Object.freeze([...unique].sort());
     }
+    /**
+     * Names a Message body may address in one Channel: every live Member of that
+     * Channel plus the Human. A name outside this set stays prose, which is what
+     * keeps an incidental name-drop from reaching someone the Channel cannot
+     * deliver to.
+     */
+    mentionCandidatesFor(channelRef) {
+        const candidates = [{ memberId: AGENT_TEAM_HUMAN_MEMBER_ID, handle: AGENT_TEAM_HUMAN_HANDLE }];
+        for (const member of this.state.members.values()) {
+            if (member.state === 'inactive' || member.state === 'archived')
+                continue;
+            if (!this.isChannelMember(channelRef, member.memberId))
+                continue;
+            candidates.push({ memberId: member.memberId, handle: member.handle });
+        }
+        return Object.freeze(candidates);
+    }
+    /**
+     * Merge the `@Handle` mentions authored in `body` into an explicit recipient
+     * set. Body mentions are the primary channel now: an Agent has no recipient
+     * parameter to forget, and the same scan serves Human input typed by hand.
+     * The result stays a plain recipient set, so every downstream projection —
+     * delivery markers, chip rendering, confirmation — is unchanged.
+     */
+    mergeBodyMentions(sender, channelRef, body, explicit) {
+        const candidates = this.mentionCandidatesFor(channelRef);
+        const resolution = resolveBodyMentions(body, candidates, sender);
+        // `@all` stands for its expansion as of this write: the Member set is
+        // snapshotted into the recipient list, so a later roster change cannot
+        // retroactively alter what this operation delivered.
+        const authored = resolution.all ? candidates.map(candidate => candidate.memberId) : resolution.memberIds;
+        const merged = new Set([...explicit, ...authored]);
+        merged.delete(sender);
+        return Object.freeze([...merged].sort());
+    }
+    /**
+     * Whether one Member has ever held Attention on one Thread. Committed Inbox
+     * deltas append a follow/unfollow observation, and the live index covers the
+     * Thread-creating Message whose initial Attention is never observed — so the
+     * two together answer "was this Member ever part of this Thread" without
+     * adding a second durable authority.
+     */
+    everParticipated(threadRef, memberId) {
+        return this.everParticipatedFrom(this.state, threadRef, memberId);
+    }
+    everParticipatedFrom(projection, threadRef, memberId) {
+        if (this.isFollowingFrom(projection, threadRef, memberId))
+            return true;
+        return (projection.observationsByThread.get(threadRef) ?? []).some(observation => observation.memberId === memberId);
+    }
+    /**
+     * Split the Agent recipients an existing Thread cannot deliver to: those the
+     * body named that the Thread has never carried. The send still commits — a
+     * text mention must never fail the write — and the author is told through the
+     * result, because inviting a Member into an existing Thread stays a Human
+     * decision.
+     */
+    undeliverableRecipients(actor, threadRef, recipients) {
+        if (actor.kind !== 'member')
+            return Object.freeze([]);
+        return Object.freeze(recipients.filter(memberId => this.state.members.has(memberId) && !this.everParticipated(threadRef, memberId)));
+    }
     normalizeDirection(direction) {
         return direction.normalize('NFKC').trim().replace(/\s+/gu, ' ').toLowerCase();
     }
     assertHandleAvailable(workspaceId, handle, exceptMemberId) {
+        this.assertHandleAvailableFrom(this.state, workspaceId, handle, exceptMemberId);
+    }
+    assertHandleAvailableFrom(projection, workspaceId, handle, exceptMemberId) {
         const normalized = handle.normalize('NFKC').trim().toLowerCase();
-        if ([...this.state.members.values()].some(member => member.memberId !== exceptMemberId && member.state !== 'inactive'
-            && member.workspaceId === workspaceId
+        if ([...projection.members.values()].some(member => member.memberId !== exceptMemberId && member.state !== 'inactive'
+            && this.participatesInFrom(projection, member.memberId, workspaceId)
             && member.handle.normalize('NFKC').trim().toLowerCase() === normalized)) {
             throw new Error(`Agent Member handle '${handle}' is already active in Workspace '${workspaceId}'`);
         }
@@ -3301,6 +3610,16 @@ export class AgentTeamLedger {
             || operation.data.workspaceId !== request.workspaceId || operation.data.channelRef !== request.channelRef || operation.data.memberId !== request.memberId)
             this.throwRequestCollision(request.requestId);
     }
+    assertSameWorkspaceJoin(operation, request) {
+        if (operation.kind !== 'team/member-workspace-joined' || !this.sameActor(operation.actor, request.actor)
+            || operation.data.workspaceId !== request.workspaceId || operation.data.memberId !== request.memberId)
+            this.throwRequestCollision(request.requestId);
+    }
+    assertSameWorkspaceLeave(operation, request) {
+        if (operation.kind !== 'team/member-workspace-left' || !this.sameActor(operation.actor, request.actor)
+            || operation.data.workspaceId !== request.workspaceId || operation.data.memberId !== request.memberId)
+            this.throwRequestCollision(request.requestId);
+    }
     assertSameChannelArchival(operation, request) {
         if (operation.kind !== 'team/channel-archived' || !this.sameActor(operation.actor, request.actor)
             || operation.data.workspaceId !== request.workspaceId || operation.data.channel.channelRef !== request.channelRef)
@@ -3456,6 +3775,13 @@ export class AgentTeamLedger {
         return Object.freeze({ receipt: this.receipt(operation), channelRef: operation.data.channelRef, memberId: operation.data.memberId,
             releasedClaims: operation.data.claims, removedAttention: operation.data.inbox.attention.removed });
     }
+    workspaceJoinResult(operation) {
+        return Object.freeze({ receipt: this.receipt(operation), memberId: operation.data.memberId, workspaceId: operation.data.workspaceId });
+    }
+    workspaceLeaveResult(operation) {
+        return Object.freeze({ receipt: this.receipt(operation), memberId: operation.data.memberId, workspaceId: operation.data.workspaceId,
+            releasedClaims: operation.data.claims, removedAttention: operation.data.inbox.attention.removed });
+    }
     channelArchivalResult(operation) {
         return Object.freeze({ receipt: this.receipt(operation), channel: operation.data.channel,
             releasedClaims: operation.data.claims });
@@ -3463,8 +3789,8 @@ export class AgentTeamLedger {
     messageResult(operation) {
         return Object.freeze(this.committedMessageResult(operation));
     }
-    replyResult(operation) {
-        return Object.freeze(this.committedMessageResult(operation));
+    replyResult(operation, undelivered = []) {
+        return Object.freeze(this.committedMessageResult(operation, undelivered));
     }
     claimResult(operation) {
         const attention = operation.data.inbox.attention.set.find(candidate => candidate.memberId === operation.data.claim.owner);
@@ -3494,6 +3820,7 @@ export class AgentTeamLedger {
         return Object.freeze({ ...(prepared.task === undefined ? {} : { task: prepared.task }), thread: prepared.thread,
             claims: prepared.claims, anchor: prepared.anchor, anchorMentions: prepared.anchorMentions, facts: prepared.facts,
             readThroughSequence: prepared.readThroughSequence, remainingUnreadCount: prepared.remainingUnreadCount,
+            earlierFactCount: prepared.earlierFactCount,
             ...(prepared.attention === undefined ? {} : { attention: prepared.attention }),
             consumedDirectMarkers: prepared.inbox.directMarkers.removed });
     }