@wowyuarm/dsh-agent-team 0.1.8 → 0.1.10

package/packages/agent-team/lib/ledger.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
+import { formatTeamTimestamp } from "./time-format.js";
 /** Stable Human Member identity shared by every replay of one dshHome Team. */
 export const AGENT_TEAM_HUMAN_MEMBER_ID = 'member:human';
 /** Idempotency identity of the one Host bootstrap operation. */
@@ -17,7 +18,7 @@ function emptyProjection() {
     return { byRequest: new Map(), byOperation: new Map(), ordered: [], channels: new Map(), members: new Map(), memberships: new Map(),
         claims: new Map(), messages: [], tasks: new Map(), threads: new Map(), attention: new Map(), directMarkers: new Map(), activityMarkers: new Map(),
         orderedFacts: [], factsByThread: new Map(), channelRefByThread: new Map(), mentionsByMessage: new Map(), messageCountByThread: new Map(),
-        attentionByThread: new Map() };
+        attentionByThread: new Map(), previousSessions: new Map(), rolloverSeeds: new Map() };
 }
 const EMPTY_PROGRESS_NUDGE_TARGETS = Object.freeze({
     progress: Object.freeze([]),
@@ -247,9 +248,137 @@ export class AgentTeamLedger {
             return this.committed(this.memberResult(operation));
         });
     }
+    /**
+     * Move one enabled Member onto its next context generation as itself. The
+     * actor is the calling Member — the Host executes the transition but is
+     * never the business actor — and the durable data records only the
+     * verifiable envelope (previous/new Session anchors, the successful handoff
+     * tool-result seq, checkpoint seed lineage, trigger). The private handoff
+     * prose stays in the Member's own Session log. An exact retry resolves to
+     * the recorded outcome; the same requestId with different data collides.
+     */
+    rolloverMemberSession(request) {
+        return this.enqueue(async () => {
+            const existing = this.state.byRequest.get(request.requestId);
+            if (existing !== undefined) {
+                this.assertSameMemberSessionRolledOver(existing, request);
+                return this.resolved(this.memberResult(existing));
+            }
+            if (request.actor.kind !== 'member')
+                throw new Error('Member session rollover requires Member authority');
+            const prior = this.requireMember(request.memberId);
+            if (request.actor.memberId !== request.memberId)
+                throw new Error(`Agent Member '${prior.handle}' cannot roll over another Member's Session`);
+            if (prior.state !== 'enabled')
+                throw new Error(`Agent Member '${prior.handle}' is ${prior.state}; only enabled Members can roll over their Session`);
+            if (prior.sessionId === request.newSessionId)
+                throw new Error(`Agent Member '${prior.handle}' already runs Session '${request.newSessionId}'`);
+            if (prior.sessionId !== request.previousSessionId)
+                throw new Error(`Agent Member '${prior.handle}' is no longer bound to Session '${request.previousSessionId}'`);
+            if ((request.checkpointRef !== undefined) !== (request.sourceSessionId !== undefined))
+                throw new Error('rollover checkpoint fields must appear together');
+            if (request.sourceSessionId !== undefined && request.sourceThroughSeq === undefined)
+                throw new Error('rollover checkpoint seed requires a through sequence');
+            if (request.sourceThroughSeq !== undefined && request.sourceSessionId === undefined)
+                throw new Error('rollover through sequence requires a source Session');
+            const member = Object.freeze({ ...prior, sessionId: request.newSessionId });
+            const operation = Object.freeze({
+                ...this.operationBase(request, this.nextSequence()), kind: 'team/member-session-rolled-over',
+                data: Object.freeze({
+                    member,
+                    previousSessionId: request.previousSessionId,
+                    newSessionId: request.newSessionId,
+                    handoffEventSeq: request.handoffEventSeq,
+                    trigger: request.trigger,
+                    ...(request.sourceSessionId === undefined ? {} : { sourceSessionId: request.sourceSessionId }),
+                    ...(request.sourceThroughSeq === undefined ? {} : { sourceThroughSeq: request.sourceThroughSeq }),
+                    ...(request.checkpointRef === undefined ? {} : { checkpointRef: request.checkpointRef }),
+                }),
+            });
+            await this.table.put(operation.operationId, operation);
+            this.apply(operation);
+            return this.committed(this.memberResult(operation));
+        });
+    }
     getMember(memberId) {
         return this.state.members.get(memberId);
     }
+    /**
+     * The retired Session this Member most recently left through a renewal or
+     * rollover — the lineage parent a crash between the durable binding commit
+     * and the new Session's activation must reconstruct a handoff from. Read
+     * from the audit projection; the Member record itself only names the
+     * current Session.
+     */
+    previousSessionForMember(memberId) {
+        return this.state.previousSessions.get(memberId);
+    }
+    /**
+     * The latest session transition this Member committed: the retired Session
+     * and the target it moved onto, through either a renewal or a rollover.
+     * Crash recovery binds carried-input redelivery to the recorded target —
+     * the CURRENT Session being that target proves the old generation's
+     * unconsumed input still belongs here, regardless of whether the handoff
+     * itself already landed.
+     */
+    lastTransitionForMember(memberId) {
+        const previousSessionId = this.state.previousSessions.get(memberId);
+        const member = this.state.members.get(memberId);
+        if (previousSessionId === undefined || member === undefined)
+            return undefined;
+        return { previousSessionId, targetSessionId: member.sessionId };
+    }
+    /**
+     * The Thread a Task overlay lives on, or undefined for an unknown or
+     * archived-Channel Task. Read-only input for attributing claim-mutation
+     * boundaries to the Thread whose context they entered.
+     */
+    threadForTask(taskRef) {
+        const task = this.state.tasks.get(taskRef);
+        if (task === undefined)
+            return undefined;
+        return this.state.channels.get(task.channelRef)?.state === 'archived' ? undefined : task.threadRef;
+    }
+    /**
+     * The seed envelope of this Member's most recent rollover, when that
+     * rollover was a checkpoint return: the recorded source Session, the
+     * exclusive end of its seeded prefix, and the checkpoint ref. A fresh
+     * rollover clears the envelope. Crash recovery reads this to rebuild the
+     * child generation from the recorded seed instead of an empty context.
+     */
+    rolloverSeedForMember(memberId, targetSessionId) {
+        const seed = this.state.rolloverSeeds.get(memberId);
+        // Bind the envelope to its recorded target: a later renewal or fresh
+        // rollover that reused or replaced the binding must never consume an
+        // older generation's seed.
+        return seed?.targetSessionId === targetSessionId ? seed : undefined;
+    }
+    /**
+     * Count one Member's active Claims on open Tasks in active Channels — the
+     * read-only input to the checkpoint single-Thread coverage guard: with
+     * more than one, a rewind cannot be proven to stay inside one Thread.
+     */
+    activeClaimCountForMember(memberId) {
+        return this.activeClaimsForMember(memberId).length;
+    }
+    /**
+     * One Member's active Claims on open Tasks in active Channels, oldest
+     * first — the read-only input for the pressure notice's Claim labels.
+     */
+    activeClaimsForMember(memberId) {
+        const active = [];
+        for (const claim of this.state.claims.values()) {
+            if (claim.owner !== memberId || claim.state !== 'active')
+                continue;
+            const task = this.state.tasks.get(claim.taskRef);
+            if (task === undefined || task.resolution !== 'open')
+                continue;
+            if (this.state.channels.get(task.channelRef)?.state === 'archived')
+                continue;
+            active.push(claim);
+        }
+        return active.sort((a, b) => a.claimRef.localeCompare(b.claimRef));
+    }
     /**
      * Current progress-nudge candidacy for one Member: threads whose Thread
      * progress reminder applies (active Claim, or following a taskless Thread)
@@ -666,6 +795,15 @@ export class AgentTeamLedger {
                     : claim);
             const releasedClaims = claims.filter(claim => claim.state === 'released' && this.state.claims.get(claim.claimRef)?.state === 'active');
             const completedClaims = claims.filter(claim => claim.state === 'done' && this.state.claims.get(claim.claimRef)?.state === 'active');
+            // Every done Claim at commit time — pre-finished and atomically
+            // completed alike — is the acceptance discriminator: the one list
+            // accept markers deliver from, so a normal accept no longer stays
+            // silent about the Members whose work it accepted. Sorted lexically
+            // so replay validation compares stably regardless of claim-ref
+            // generation order.
+            const acceptedClaims = request.action === 'accept'
+                ? claims.filter(claim => claim.state === 'done').sort((left, right) => left.claimRef.localeCompare(right.claimRef))
+                : [];
             const resolution = request.action === 'reopen' ? 'open' : request.action === 'accept' ? 'accepted' : 'closed';
             const status = resolution === 'accepted' ? 'done' : resolution === 'closed' ? 'closed'
                 : this.deriveTaskStatus(task.taskRef, claims);
@@ -674,12 +812,13 @@ export class AgentTeamLedger {
             const activity = Object.freeze({ activityRef: this.ref('activity'), kind: request.action,
                 taskRef: task.taskRef, threadRef: task.threadRef, actor: request.actor.memberId, sequence,
                 ...(releasedClaims.length === 0 ? {} : { releasedClaimRefs: Object.freeze(releasedClaims.map(claim => claim.claimRef)) }),
-                ...(completedClaims.length === 0 ? {} : { completedClaimRefs: Object.freeze(completedClaims.map(claim => claim.claimRef)) }) });
+                ...(completedClaims.length === 0 ? {} : { completedClaimRefs: Object.freeze(completedClaims.map(claim => claim.claimRef)) }),
+                ...(request.action === 'accept' ? { acceptedClaimRefs: Object.freeze(acceptedClaims.map(claim => claim.claimRef)) } : {}) });
             const inbox = request.action === 'close'
                 ? this.closeThreadInbox(activity, thread.threadRef)
                 : request.action === 'reopen'
                     ? this.reopenThreadInbox(activity, thread.threadRef)
-                    : this.acceptThreadInbox(activity, thread.threadRef, completedClaims.map(claim => claim.owner));
+                    : this.acceptThreadInbox(activity, thread.threadRef, acceptedClaims.map(claim => claim.owner));
             const operation = Object.freeze({
                 ...this.operationBase(request, sequence), kind: 'team/task-changed',
                 data: Object.freeze({ workspaceId: request.workspaceId, baseRevision: request.baseRevision,
@@ -871,7 +1010,7 @@ export class AgentTeamLedger {
             // mirror: the reader sent it to the other Member → (you → them).
             const direction = pair ? 'them → you' : 'you → them';
             const truncated = operation.data.body.length > 160 ? `${operation.data.body.slice(0, 160)}…` : operation.data.body;
-            return `(${direction}) ${truncated}`;
+            return `(${direction}, at ${formatTeamTimestamp(operation.occurredAt)}) ${truncated}`;
         }
         return undefined;
     }
@@ -901,8 +1040,12 @@ export class AgentTeamLedger {
             const task = thread.taskRef === undefined ? undefined : this.state.tasks.get(thread.taskRef);
             const directCount = unread.filter(item => item.direct).length;
             const attention = this.attentionFor(authorized.memberId, thread.threadRef);
+            // Same snapshot, same source as newestSequence: the instant hangs off
+            // the newest unread fact itself, never a second lookup that could
+            // observe a different commit between the two reads.
+            const newest = unread.at(-1).fact;
             items.push(Object.freeze({ channelRef, ...(task === undefined ? {} : { task }), thread, unreadCount: unread.length, directCount,
-                newestSequence: unread.at(-1).fact.sequence, ...(attention === undefined ? {} : { attention }) }));
+                newestSequence: newest.sequence, newestOccurredAt: newest.occurredAt, ...(attention === undefined ? {} : { attention }) }));
         }
         items.sort((left, right) => right.directCount - left.directCount || right.newestSequence - left.newestSequence || left.thread.threadRef.localeCompare(right.thread.threadRef));
         const selected = items.slice(0, limit);
@@ -1097,8 +1240,10 @@ export class AgentTeamLedger {
             const message = fact.message;
             const thread = this.requireThread(message.threadRef);
             const task = thread.taskRef === undefined ? undefined : this.state.tasks.get(thread.taskRef);
+            const facts = this.state.factsByThread.get(thread.threadRef) ?? [];
             return Object.freeze({ message, mentions: fact.mentions, ...(task === undefined ? {} : { task, taskNumber: taskNumbers.get(task.taskRef) ?? 0 }), thread,
-                messageCount: this.state.messageCountByThread.get(thread.threadRef) ?? 0 });
+                messageCount: this.state.messageCountByThread.get(thread.threadRef) ?? 0,
+                lastActivityAt: facts.at(-1)?.occurredAt ?? '' });
         });
         const initialization = this.initialization();
         const nextCursor = selected.length === 0 ? cursor : direction === 'before' ? selected[0].sequence : selected.at(-1).sequence;
@@ -1155,6 +1300,7 @@ export class AgentTeamLedger {
             case 'team/member-session-restarted':
             case 'team/member-context-cleared':
             case 'team/member-session-renewed':
+            case 'team/member-session-rolled-over':
             case 'team/member-updated':
             case 'team/member-removed':
                 return [{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }];
@@ -1275,6 +1421,7 @@ export class AgentTeamLedger {
             case 'team/member-session-restarted':
             case 'team/member-context-cleared':
             case 'team/member-session-renewed':
+            case 'team/member-session-rolled-over':
             case 'team/member-updated':
             case 'team/channel-member-added':
             case 'team/thread-read':
@@ -1407,6 +1554,29 @@ export class AgentTeamLedger {
                 throw new Error('invalid Member session renewal');
             return;
         }
+        if (operation.kind === 'team/member-session-rolled-over') {
+            // The rollover's business actor is the calling Member itself; the Host
+            // only executes the recorded transition. Authorization is self-scoped:
+            // the actor must be the enabled target Member on its currently bound
+            // Session, and the recorded transition moves exactly the sessionId.
+            const actorMember = assertMember();
+            const prior = projection.members.get(operation.data.member.memberId);
+            if (actorMember.memberId !== operation.data.member.memberId)
+                throw new Error('rolled-over Member must match its actor');
+            if (prior === undefined || prior.state !== 'enabled'
+                || prior.sessionId !== operation.data.previousSessionId
+                || operation.data.member.sessionId !== operation.data.newSessionId
+                || operation.data.member.sessionId === operation.data.previousSessionId
+                || !this.sameMemberFacts(prior, operation.data.member))
+                throw new Error('invalid Member session rollover');
+            if (operation.data.sourceSessionId !== undefined && operation.data.sourceThroughSeq === undefined)
+                throw new Error('rolled-over checkpoint seed requires a through sequence');
+            if (operation.data.sourceThroughSeq !== undefined && operation.data.sourceSessionId === undefined)
+                throw new Error('rolled-over through sequence requires a source Session');
+            if ((operation.data.checkpointRef !== undefined) !== (operation.data.sourceSessionId !== undefined))
+                throw new Error('rolled-over checkpoint fields must appear together');
+            return;
+        }
         if (operation.kind === 'team/channel-updated') {
             assertHuman();
             const prior = projection.channels.get(operation.data.channel.channelRef);
@@ -1640,13 +1810,24 @@ export class AgentTeamLedger {
             const expectedCompletedClaimRefs = operation.data.claims
                 .filter(claim => projection.claims.get(claim.claimRef)?.state === 'active' && claim.state === 'done')
                 .map(claim => claim.claimRef);
+            // New-shape accepts carry the acceptance discriminator: every done
+            // Claim at commit time, sorted. Legacy accepts predate it; the
+            // recorded wake semantics for them stay completed-only (the old rule)
+            // so every existing ledger replays unchanged.
+            const expectedAcceptedClaimRefs = operation.data.claims
+                .filter(claim => claim.state === 'done')
+                .map(claim => claim.claimRef)
+                .sort((left, right) => left.localeCompare(right));
             if (task.resolution !== expectedResolution || task.status !== expectedStatus
                 || (activity.kind !== 'close' && activity.releasedClaimRefs !== undefined)
                 || (activity.kind !== 'accept' && activity.completedClaimRefs !== undefined)
+                || (activity.kind !== 'accept' && activity.acceptedClaimRefs !== undefined)
                 || (activity.kind === 'close' && !this.sameList(activity.releasedClaimRefs ?? [], operation.data.claims
                     .filter(claim => projection.claims.get(claim.claimRef)?.state === 'active' && claim.state === 'released')
                     .map(claim => claim.claimRef)))
-                || !this.sameList(activity.completedClaimRefs ?? [], expectedCompletedClaimRefs)) {
+                || !this.sameList(activity.completedClaimRefs ?? [], expectedCompletedClaimRefs)
+                || (activity.kind === 'accept' && activity.acceptedClaimRefs !== undefined
+                    && !this.sameList(activity.acceptedClaimRefs, expectedAcceptedClaimRefs))) {
                 throw new Error('invalid Task state transition');
             }
             const priorClaims = [...projection.claims.values()].filter(claim => claim.taskRef === task.taskRef).sort((left, right) => left.claimRef.localeCompare(right.claimRef));
@@ -1670,7 +1851,10 @@ export class AgentTeamLedger {
                 ? this.closeThreadInboxFrom(projection, activity, thread.threadRef)
                 : activity.kind === 'reopen'
                     ? this.reopenThreadInboxFrom(projection, activity, thread.threadRef)
-                    : this.acceptThreadInboxFrom(projection, activity, thread.threadRef, expectedCompletedClaimRefs);
+                    // Presence of the discriminator picks the wake rule: new accepts
+                    // wake every done owner; legacy records keep the completed-only
+                    // delta exactly as recorded.
+                    : this.acceptThreadInboxFrom(projection, activity, thread.threadRef, activity.acceptedClaimRefs !== undefined ? activity.acceptedClaimRefs : expectedCompletedClaimRefs);
             if (!isDeepStrictEqual(operation.data.inbox, expectedInbox))
                 throw new Error('invalid Task inbox projection');
             this.validateInboxDelta(operation.data.inbox, projection, refs, [], [], [activity]);
@@ -1938,6 +2122,25 @@ export class AgentTeamLedger {
         }
         if (operation.kind === 'team/member-session-renewed') {
             target.members.set(operation.data.member.memberId, operation.data.member);
+            target.previousSessions.set(operation.data.member.memberId, operation.data.previousSessionId);
+            // A Human-side renewal is always a fresh start: a stale checkpoint
+            // seed from an earlier rollover must never re-seed it.
+            target.rolloverSeeds.delete(operation.data.member.memberId);
+            return;
+        }
+        if (operation.kind === 'team/member-session-rolled-over') {
+            target.members.set(operation.data.member.memberId, operation.data.member);
+            target.previousSessions.set(operation.data.member.memberId, operation.data.previousSessionId);
+            // A checkpoint return records its seed envelope: a crash between this
+            // commit and the new Session's activation rebuilds the child from the
+            // recorded source instead of an empty context.
+            const { sourceSessionId, sourceThroughSeq, checkpointRef } = operation.data;
+            if (sourceSessionId !== undefined && sourceThroughSeq !== undefined && checkpointRef !== undefined) {
+                target.rolloverSeeds.set(operation.data.member.memberId, { targetSessionId: operation.data.newSessionId, sourceSessionId, sourceThroughSeq, checkpointRef });
+            }
+            else {
+                target.rolloverSeeds.delete(operation.data.member.memberId);
+            }
             return;
         }
         if (operation.kind === 'team/channel-updated') {
@@ -1957,7 +2160,7 @@ export class AgentTeamLedger {
             for (const claim of operation.data.claims)
                 target.claims.set(claim.claimRef, claim);
             for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity);
+                this.appendActivityFact(target, activity, operation.occurredAt);
             for (const task of operation.data.tasks)
                 target.tasks.set(task.taskRef, task);
             for (const thread of operation.data.threads)
@@ -1973,7 +2176,7 @@ export class AgentTeamLedger {
             for (const claim of operation.data.claims)
                 target.claims.set(claim.claimRef, claim);
             for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity);
+                this.appendActivityFact(target, activity, operation.occurredAt);
             for (const task of operation.data.tasks)
                 target.tasks.set(task.taskRef, task);
             for (const thread of operation.data.threads)
@@ -1988,7 +2191,7 @@ export class AgentTeamLedger {
             for (const claim of operation.data.claims)
                 target.claims.set(claim.claimRef, claim);
             for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity);
+                this.appendActivityFact(target, activity, operation.occurredAt);
             for (const task of operation.data.tasks)
                 target.tasks.set(task.taskRef, task);
             for (const thread of operation.data.threads)
@@ -2004,7 +2207,7 @@ export class AgentTeamLedger {
             for (const claim of operation.data.claims)
                 target.claims.set(claim.claimRef, claim);
             for (const activity of operation.data.activities)
-                this.appendActivityFact(target, activity);
+                this.appendActivityFact(target, activity, operation.occurredAt);
             for (const task of operation.data.tasks)
                 target.tasks.set(task.taskRef, task);
             for (const thread of operation.data.threads)
@@ -2013,7 +2216,7 @@ export class AgentTeamLedger {
             return;
         }
         if (operation.kind === 'team/thread-promoted') {
-            this.appendActivityFact(target, operation.data.activity);
+            this.appendActivityFact(target, operation.data.activity, operation.occurredAt);
             target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
             this.applyInboxDelta(target, operation.data.inbox);
@@ -2023,7 +2226,7 @@ export class AgentTeamLedger {
             const { message, mentions } = operation.data;
             target.messages.push(message);
             target.mentionsByMessage.set(message.messageRef, Object.freeze([...mentions]));
-            this.appendMessageFact(target, message, mentions);
+            this.appendMessageFact(target, message, mentions, message.occurredAt ?? operation.occurredAt);
             if (operation.data.task !== undefined)
                 target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
@@ -2034,7 +2237,7 @@ export class AgentTeamLedger {
         }
         if (operation.kind === 'team/claim-created' || operation.kind === 'team/claim-done' || operation.kind === 'team/claim-released') {
             target.claims.set(operation.data.claim.claimRef, operation.data.claim);
-            this.appendActivityFact(target, operation.data.activity);
+            this.appendActivityFact(target, operation.data.activity, operation.occurredAt);
             target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
             this.applyInboxDelta(target, operation.data.inbox);
@@ -2043,7 +2246,7 @@ export class AgentTeamLedger {
         if (operation.kind === 'team/task-changed') {
             for (const claim of operation.data.claims)
                 target.claims.set(claim.claimRef, claim);
-            this.appendActivityFact(target, operation.data.activity);
+            this.appendActivityFact(target, operation.data.activity, operation.occurredAt);
             target.tasks.set(operation.data.task.taskRef, operation.data.task);
             target.threads.set(operation.data.thread.threadRef, operation.data.thread);
             this.applyInboxDelta(target, operation.data.inbox);
@@ -2061,16 +2264,16 @@ export class AgentTeamLedger {
         assertUnhandledKind(operation);
     }
     /** Facts arrive in ledger sequence order, so global and per-thread lists stay sorted by append only. */
-    appendMessageFact(target, message, mentions) {
-        const fact = Object.freeze({ kind: 'message', sequence: message.sequence, message, mentions });
+    appendMessageFact(target, message, mentions, occurredAt) {
+        const fact = Object.freeze({ kind: 'message', sequence: message.sequence, message, mentions, occurredAt });
         target.orderedFacts.push(fact);
         const facts = target.factsByThread.get(message.threadRef) ?? [];
         facts.push(fact);
         target.factsByThread.set(message.threadRef, facts);
         target.messageCountByThread.set(message.threadRef, (target.messageCountByThread.get(message.threadRef) ?? 0) + 1);
     }
-    appendActivityFact(target, activity) {
-        const fact = Object.freeze({ kind: 'activity', sequence: activity.sequence, activity });
+    appendActivityFact(target, activity, occurredAt) {
+        const fact = Object.freeze({ kind: 'activity', sequence: activity.sequence, activity, occurredAt });
         target.orderedFacts.push(fact);
         const facts = target.factsByThread.get(activity.threadRef) ?? [];
         facts.push(fact);
@@ -2122,7 +2325,8 @@ export class AgentTeamLedger {
         const background = firstRead
             ? projection.messages.filter(message => message.threadRef === thread.threadRef && message.sequence < attention.startSequence)
                 .map(message => Object.freeze({ kind: 'message', sequence: message.sequence, message,
-                mentions: projection.mentionsByMessage.get(message.messageRef) ?? [] }))
+                mentions: projection.mentionsByMessage.get(message.messageRef) ?? [],
+                occurredAt: this.occurredAtForFactFrom(projection, message.sequence, message.occurredAt) }))
                 .filter(fact => !unreadFactKeys.has(this.threadFactKey(fact))).slice(-12)
             : [];
         const combined = [...background.map(fact => this.readFactFrom(projection, memberId, fact, false)), ...unreadFacts]
@@ -2197,6 +2401,23 @@ export class AgentTeamLedger {
     threadFactsFrom(projection, threadRef) {
         return projection.factsByThread.get(threadRef) ?? [];
     }
+    /**
+     * The one per-fact instant projection: a fact's wall-clock time is the
+     * occurredAt of the ledger operation that committed it, looked up by
+     * sequence inside the same read snapshot. Every agent-facing surface
+     * (Thread facts, notifications, DM history, mutation results) resolves
+     * through this single path, never a second parallel lookup.
+     */
+    occurredAtForFactFrom(projection, sequence, fallback) {
+        if (fallback !== undefined)
+            return fallback;
+        // Facts arrive in ledger sequence order and `ordered` is append-only, so
+        // the entry at index sequence - 1 is the committing operation. The index
+        // read is guarded for hypothetical projections whose prefix has not yet
+        // caught up; those callers always pass an explicit fallback instead.
+        const operation = projection.ordered[sequence - 1];
+        return operation?.occurredAt ?? '';
+    }
     messageInboxDelta(message, sender, mentions, attention) {
         const markers = mentions.map(memberId => Object.freeze({ memberId, threadRef: message.threadRef,
             messageRef: message.messageRef, sequence: message.sequence }));
@@ -2216,22 +2437,24 @@ export class AgentTeamLedger {
         return this.inboxDelta([], removed, [], [...projection.directMarkers.values()].filter(marker => marker.threadRef === threadRef), activityMarkers, [...projection.activityMarkers.values()].filter(marker => marker.threadRef === threadRef));
     }
     /**
-     * Early acceptance completes open Claims inside the accept operation; their
-     * owners learn about it through activity markers regardless of whether they
-     * still follow the Thread. Plain accepts (no completed Claims) stay silent.
+     * Acceptance notifies every done Claim owner — pre-finished (the normal
+     * flow) and atomically completed (early acceptance) alike — through
+     * activity markers regardless of whether they still follow the Thread.
+     * The actor never notifies itself. Legacy records without the acceptance
+     * discriminator keep the old completed-only wake semantics on replay.
      */
-    acceptThreadInbox(activity, threadRef, completedOwners) {
-        if (completedOwners.length === 0)
+    acceptThreadInbox(activity, threadRef, acceptedOwners) {
+        if (acceptedOwners.length === 0)
             return this.inboxDelta();
-        const recipients = [...new Set(completedOwners)].filter(memberId => memberId !== activity.actor);
+        const recipients = [...new Set(acceptedOwners)].filter(memberId => memberId !== activity.actor);
         const markers = recipients.map(memberId => Object.freeze({ memberId, threadRef,
             activityRef: activity.activityRef, sequence: activity.sequence }));
         return this.inboxDelta([], [], [], [], markers);
     }
-    acceptThreadInboxFrom(projection, activity, threadRef, completedClaimRefs) {
-        if (completedClaimRefs.length === 0)
+    acceptThreadInboxFrom(projection, activity, threadRef, claimRefs) {
+        if (claimRefs.length === 0)
             return this.inboxDelta();
-        const owners = completedClaimRefs.map(claimRef => projection.claims.get(claimRef)?.owner).filter(owner => owner !== undefined);
+        const owners = claimRefs.map(claimRef => projection.claims.get(claimRef)?.owner).filter(owner => owner !== undefined);
         return this.acceptThreadInbox(activity, threadRef, owners);
     }
     reopenThreadInbox(activity, threadRef) {
@@ -2256,18 +2479,24 @@ export class AgentTeamLedger {
         return this.inboxDelta([], [], [], [], markers);
     }
     removeMemberThreadInbox(memberId, threadRefs) {
-        const removed = [...this.state.attention.values()].filter(attention => attention.memberId === memberId && threadRefs.has(attention.threadRef))
+        return this.removeMemberThreadInboxFrom(this.state, memberId, threadRefs);
+    }
+    removeMemberThreadInboxFrom(projection, memberId, threadRefs) {
+        const removed = [...projection.attention.values()].filter(attention => attention.memberId === memberId && threadRefs.has(attention.threadRef))
             .map(attention => Object.freeze({ memberId, threadRef: attention.threadRef }));
-        const markers = [...this.state.directMarkers.values()].filter(marker => marker.memberId === memberId && threadRefs.has(marker.threadRef));
-        const activityMarkers = [...this.state.activityMarkers.values()].filter(marker => marker.memberId === memberId && threadRefs.has(marker.threadRef));
+        const markers = [...projection.directMarkers.values()].filter(marker => marker.memberId === memberId && threadRefs.has(marker.threadRef));
+        const activityMarkers = [...projection.activityMarkers.values()].filter(marker => marker.memberId === memberId && threadRefs.has(marker.threadRef));
         return this.inboxDelta([], removed, [], markers, [], activityMarkers);
     }
     /** Attention and marker cleanup for EVERY Member on the given Threads. */
     channelArchivalInbox(threadRefs) {
-        const removed = [...this.state.attention.values()].filter(attention => threadRefs.has(attention.threadRef))
+        return this.channelArchivalInboxFrom(this.state, threadRefs);
+    }
+    channelArchivalInboxFrom(projection, threadRefs) {
+        const removed = [...projection.attention.values()].filter(attention => threadRefs.has(attention.threadRef))
             .map(attention => Object.freeze({ memberId: attention.memberId, threadRef: attention.threadRef }));
-        const markers = [...this.state.directMarkers.values()].filter(marker => threadRefs.has(marker.threadRef));
-        const activityMarkers = [...this.state.activityMarkers.values()].filter(marker => threadRefs.has(marker.threadRef));
+        const markers = [...projection.directMarkers.values()].filter(marker => threadRefs.has(marker.threadRef));
+        const activityMarkers = [...projection.activityMarkers.values()].filter(marker => threadRefs.has(marker.threadRef));
         return this.inboxDelta([], removed, [], markers, [], activityMarkers);
     }
     inboxDelta(set = [], removed = [], addedMarkers = [], removedMarkers = [], addedActivityMarkers = [], removedActivityMarkers = []) {
@@ -2666,8 +2895,12 @@ export class AgentTeamLedger {
     isChannelMemberFrom(projection, channelRef, memberId) {
         return projection.memberships.get(channelRef)?.has(memberId) === true;
     }
+    /** Every Thread of the Channel, taskful or taskless — the scope both cleanup validators replay against. */
     channelThreadRefs(channelRef) {
-        return new Set([...this.state.tasks.values()].filter(task => task.channelRef === channelRef).map(task => task.threadRef));
+        return this.channelThreadRefsFrom(this.state, channelRef);
+    }
+    channelThreadRefsFrom(projection, channelRef) {
+        return new Set([...projection.threads.keys()].filter(threadRef => this.channelRefForThreadFrom(projection, threadRef) === channelRef));
     }
     assertJoinableMember(workspaceId, memberId) {
         const member = this.requireMember(memberId);
@@ -2762,6 +2995,16 @@ export class AgentTeamLedger {
             || operation.data.member.memberId !== request.memberId || operation.data.member.sessionId !== request.sessionId)
             this.throwRequestCollision(request.requestId);
     }
+    assertSameMemberSessionRolledOver(operation, request) {
+        if (operation.kind !== 'team/member-session-rolled-over' || !this.sameActor(operation.actor, request.actor)
+            || operation.data.member.memberId !== request.memberId || operation.data.member.sessionId !== request.newSessionId
+            || operation.data.previousSessionId !== request.previousSessionId || operation.data.handoffEventSeq !== request.handoffEventSeq
+            || operation.data.trigger !== request.trigger
+            || operation.data.sourceSessionId !== request.sourceSessionId
+            || operation.data.sourceThroughSeq !== request.sourceThroughSeq
+            || operation.data.checkpointRef !== request.checkpointRef)
+            this.throwRequestCollision(request.requestId);
+    }
     assertSameChannelUpdate(operation, request) {
         if (operation.kind !== 'team/channel-updated' || !this.sameActor(operation.actor, request.actor)
             || operation.data.workspaceId !== request.workspaceId || operation.data.channel.channelRef !== request.channelRef
@@ -2979,7 +3222,7 @@ export class AgentTeamLedger {
             consumedDirectMarkers: operation.data.inbox.directMarkers.removed });
     }
     receipt(operation) {
-        return Object.freeze({ operationId: operation.operationId, requestId: operation.requestId, sequence: operation.sequence });
+        return Object.freeze({ operationId: operation.operationId, requestId: operation.requestId, sequence: operation.sequence, occurredAt: operation.occurredAt });
     }
     removalResult(operation) {
         return Object.freeze({ receipt: this.receipt(operation), member: operation.data.member,
@@ -3006,24 +3249,70 @@ export class AgentTeamLedger {
     sortedRecords() {
         const records = [...this.table.entries()].sort((left, right) => left[1].sequence - right[1].sequence);
         const occurrences = new Map();
+        const instants = new Map();
         for (const [, operation] of records) {
+            instants.set(operation.sequence, operation.occurredAt);
             if (operation.kind === 'team/message-sent' || operation.kind === 'team/thread-replied') {
                 occurrences.set(operation.data.message.messageRef, operation.data.message.occurredAt ?? operation.occurredAt);
             }
         }
-        return records.map(([id, operation]) => [id, this.normalizeOperation(operation, occurrences)]);
+        // Replay against a scratch projection while normalizing, so a legacy
+        // cleanup repair sees the same state its validator will.
+        const projection = emptyProjection();
+        return records.map(([id, operation]) => {
+            const normalized = this.repairLegacyChannelCleanup(this.normalizeOperation(operation, occurrences, instants), projection);
+            this.applyTo(projection, normalized);
+            return [id, normalized];
+        });
+    }
+    /**
+     * Releases up to 0.1.9 scoped Channel archival and Channel member-removal
+     * inbox cleanup to taskful Threads only (the collector read the Task
+     * projection), so archiving or member removal in a Channel holding a
+     * taskless Thread with Attention or markers wrote an incomplete inbox and
+     * every later load rejected the record, leaving the profile unable to boot.
+     * Records carrying exactly that legacy cleanup are repaired in memory the
+     * same way pre-envelope Thread reads are; any other inbox still fails
+     * validation, so a forgery is not silently accepted.
+     */
+    repairLegacyChannelCleanup(operation, projection) {
+        if (operation.kind === 'team/channel-archived') {
+            const channelRef = operation.data.channel.channelRef;
+            const expected = this.channelArchivalInboxFrom(projection, this.channelThreadRefsFrom(projection, channelRef));
+            if (!isDeepStrictEqual(operation.data.inbox, expected)
+                && isDeepStrictEqual(operation.data.inbox, this.channelArchivalInboxFrom(projection, this.legacyChannelThreadRefs(projection, channelRef)))) {
+                return { ...operation, data: { ...operation.data, inbox: expected } };
+            }
+            return operation;
+        }
+        if (operation.kind === 'team/channel-member-removed') {
+            const { channelRef, memberId } = operation.data;
+            const expected = this.removeMemberThreadInboxFrom(projection, memberId, this.channelThreadRefsFrom(projection, channelRef));
+            if (!isDeepStrictEqual(operation.data.inbox, expected)
+                && isDeepStrictEqual(operation.data.inbox, this.removeMemberThreadInboxFrom(projection, memberId, this.legacyChannelThreadRefs(projection, channelRef)))) {
+                return { ...operation, data: { ...operation.data, inbox: expected } };
+            }
+            return operation;
+        }
+        return operation;
+    }
+    /** The pre-fix Channel Thread scope: only Threads carrying a Task. */
+    legacyChannelThreadRefs(projection, channelRef) {
+        return new Set([...projection.tasks.values()].filter(task => task.channelRef === channelRef).map(task => task.threadRef));
     }
     /** Ledgers written before message occurredAt existed store bare messages; Thread reads resolve instants from the originating operations. */
-    normalizeOperation(operation, occurrences) {
+    normalizeOperation(operation, occurrences, instants) {
         if (operation.kind !== 'team/thread-read')
             return operation;
         const stamp = (message) => (message.occurredAt === undefined
             ? { ...message, occurredAt: occurrences.get(message.messageRef) ?? operation.occurredAt }
             : { ...message, occurredAt: message.occurredAt });
-        const facts = operation.data.facts.map((fact) => (fact.fact.kind === 'message'
-            ? { ...fact, fact: { kind: 'message', sequence: fact.fact.sequence, message: stamp(fact.fact.message),
-                    mentions: fact.fact.mentions } }
-            : { ...fact, fact: fact.fact }));
+        const stampEnvelope = (envelope) => envelope.kind === 'message'
+            ? { kind: 'message', sequence: envelope.sequence, message: stamp(envelope.message), mentions: envelope.mentions,
+                occurredAt: envelope.occurredAt ?? envelope.message.occurredAt ?? occurrences.get(envelope.message.messageRef) ?? operation.occurredAt }
+            : { kind: 'activity', sequence: envelope.sequence, activity: envelope.activity,
+                occurredAt: envelope.occurredAt ?? instants.get(envelope.sequence) ?? operation.occurredAt };
+        const facts = operation.data.facts.map((fact) => ({ ...fact, fact: stampEnvelope(fact.fact) }));
         return { ...operation, data: { ...operation.data, anchor: stamp(operation.data.anchor), facts } };
     }
     enqueue(operation) {