agents-can-communicate 0.6.3 → 0.7.1

package/node_modules/@agents-can-communicate/cli/src/doctor-command.mjs

@@ -267,7 +267,19 @@ export async function runDoctor({ options, context, runtime }) {
   // command documented as saying "what to run next" said it only to `--json`.
   // A person running `acc doctor` on a client wired to an older plugin was told
   // the store was healthy and nothing else.
-  const text = [`store healthy; ${describePresence(status.counts)}; `
+  // Named rather than left to be inferred: staging files are reclaimed a
+  // bounded amount at a time, so a store still carrying a large accumulation
+  // should say so instead of reading as if nothing were held.
+  const held = [
+    report.staged > 0 ? `${report.staged} staged` : null,
+    report.partials > 0 ? `${report.partials} partial` : null,
+    // A retired journal entry has no reader at all, so a count above zero says
+    // the automatic pass has not caught up rather than that anything is wrong.
+    report.retired > 0 ? `${report.retired} retired journal` : null,
+    report.trimmedThrough === null ? null : `history from ${report.trimmedThrough}`,
+  ].filter(Boolean);
+  const staging = held.length === 0 ? "" : ` (${held.join(", ")})`;
+  const text = [`store healthy${staging}; ${describePresence(status.counts)}; `
     + `protection ${status.protection}; ${installed} of ${adapters.length} adapter(s) installed`,
   ...adapters.filter(adapter => (adapter.present || adapter.installed)
     && adapter.nativeDelivery.reasonCode === "native_delivery_unsupported"

package/node_modules/@agents-can-communicate/cli/src/help.mjs

@@ -17,7 +17,7 @@ import { needsOwner } from "./session-owner.mjs";
  * protocol's enum choices before a caller has to attempt a mutation.
  */
 const GROUPS = Object.freeze([
-  ["Set up", ["install", "uninstall", "doctor", "config"]],
+  ["Set up", ["install", "uninstall", "doctor", "config", "prune"]],
   ["In a session", ["status", "sync", "work", "claim", "release", "inbox", "reply",
     "ack", "message", "request", "finish"]],
   ["Session lifecycle", ["attach", "heartbeat", "detach"]],
@@ -30,6 +30,7 @@ const SUMMARY = Object.freeze({
   doctor: "clients, versions, install health, and what to run next",
   config: "write or check acc.workspace.json (init | validate)",
   status: "who else is here, what they hold, how protected this workspace is",
+  prune: "report what this workspace no longer needs; --apply to reclaim it",
   sync: "events since a cursor, or bounded message history",
   work: "publish what this session is doing, or --clear when it has stopped",
   claim: "reserve a resource; exit 5 when someone else already holds it",

package/node_modules/@agents-can-communicate/cli/src/main.mjs

@@ -174,6 +174,20 @@ export function describePresence({ live = 0, stale = 0 } = {}) {
   return `${live} live (${stale} not answering)`;
 }
 
+export function describeStatus(status) {
+  // `live` counts everyone present, which includes sessions gone stale - a
+  // client that exited without its session being closed keeps a record that
+  // stops being answered but does not disappear. Printing the number alone
+  // said "1 live" about a workspace where the last agent had left minutes
+  // before, which is the one thing a person reads this line to find out.
+  const line = `${describePresence(status.counts)}; ${status.counts.claims} claim(s); `
+    + `protection ${status.protection}`;
+  // A transport accepting a message is not a model reading it. Said only when
+  // it is true of something, so the everyday line stays the everyday line.
+  const offered = status.counts.unretrieved?.offered ?? 0;
+  return offered === 0 ? line : `${line}; ${offered} offered, not retrieved`;
+}
+
 const HANDLERS = Object.freeze({
   attach: async ({ options, context }) => {
     const session = await context.service.openSession({
@@ -336,14 +350,7 @@ const HANDLERS = Object.freeze({
   status: async ({ options, context }) => {
     const status = await context.service.collectStatus({
       participantId: options.participant, all: options.all === true });
-    // `live` counts everyone present, which includes sessions gone stale - a
-    // client that exited without its session being closed keeps a record that
-    // stops being answered but does not disappear. Printing the number alone
-    // said "1 live" about a workspace where the last agent had left minutes
-    // before, which is the one thing a person reads this line to find out.
-    const text = `${describePresence(status.counts)}; ${status.counts.claims} claim(s); `
-      + `protection ${status.protection}`;
-    return { data: status, text };
+    return { data: status, text: describeStatus(status) };
   },
 
   config: async ({ options, runtime }) => {
@@ -379,6 +386,24 @@ const HANDLERS = Object.freeze({
   uninstall: async ({ options, runtime }) =>
     runInstallCommand({ options, runtime, action: "uninstall" }),
 
+  prune: async ({ options, context }) => {
+    const result = await context.service.prune({
+      classes: options.class, before: options.before,
+      apply: options.apply === true, limit: Infinity });
+    const named = Object.entries(result.counts)
+      .map(([name, count]) => `${count} ${name}`).join(", ");
+    // The reporting run says what it would do; the applying run says what the
+    // store gave back, which is not the same number - a record and the markers
+    // it owns leave together.
+    const text = result.applied
+      ? `reclaimed ${result.reclaimed} file(s) from ${named}`
+        + (result.trimmedThrough === null ? "" : `; history starts after ${result.trimmedThrough}`)
+        + (result.skipped > 0 ? `; ${result.skipped} changed and were left` : "")
+        + (result.remaining ? "; more remains, run it again" : "")
+      : `would prune ${named}; nothing was changed, add --apply to act`;
+    return { data: result, text };
+  },
+
   doctor: async ({ options, context, runtime }) => runDoctor({ options, context, runtime }),
 
   update: async ({ options, runtime }) => runUpdateCommand({ options, runtime }),

package/node_modules/@agents-can-communicate/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/core",
-  "version": "0.6.3",
+  "version": "0.7.1",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/core/src/attention.mjs

@@ -3,6 +3,7 @@ import { AccError, EXIT } from "@agents-can-communicate/protocol";
 import { overlaps } from "./claims.mjs";
 import { classifySessionPresence } from "./sessions.mjs";
 import { decisionView, isCurrentDecision } from "./decision-state.mjs";
+import { isCurrentIntent } from "./intents.mjs";
 
 export const ATTENTION_PRIORITY = Object.freeze({
   reply_required: 1,
@@ -65,7 +66,11 @@ function expiredClaims(snapshot, session, now) {
 }
 
 function claimConflicts(snapshot, session, now) {
-  const mine = (snapshot.intents ?? []).find(intent => intent.sessionId === session?.sessionId);
+  // Both kinds read resourceHints as a statement of what a session means to
+  // touch. Finishing that work retracts the statement, so a done record must
+  // not keep raising conflicts on either side of it.
+  const mine = (snapshot.intents ?? []).find(intent => intent.sessionId === session?.sessionId
+    && isCurrentIntent(intent));
   if (mine === undefined) return [];
   return (snapshot.claims ?? []).filter(claim => claim.ownerSessionId !== session.sessionId
     && Date.parse(claim.expiresAt) > Date.parse(now)
@@ -78,7 +83,7 @@ function claimConflicts(snapshot, session, now) {
 function claimContended(snapshot, session, now) {
   if (session == null) return [];
   const peerIntents = (snapshot.intents ?? [])
-    .filter(intent => intent.sessionId !== session.sessionId);
+    .filter(intent => intent.sessionId !== session.sessionId && isCurrentIntent(intent));
   return (snapshot.claims ?? []).filter(claim => claim.ownerSessionId === session.sessionId
     && Date.parse(claim.expiresAt) > Date.parse(now)).flatMap(claim => {
     const peer = peerIntents.find(intent => intent.resourceHints

package/node_modules/@agents-can-communicate/core/src/conversations.mjs

@@ -292,8 +292,8 @@ export function createConversationService(ports, sessions) {
     return (await nextTurnDelivery(input)).queuedMessages;
   }
 
-  function nextTurnDelivery(input) {
-    return selectNextTurnDelivery(store, input);
+  function nextTurnDelivery(input = {}) {
+    return selectNextTurnDelivery(store, { ...input, now: clock.now() });
   }
 
   return { sendMessage, finishSession, pendingMessages, nextTurnDelivery };

package/node_modules/@agents-can-communicate/core/src/intents.mjs

@@ -3,6 +3,22 @@ import { AccError, EXIT, SCHEMA_VERSION, validateRecord }
 
 import { isMaterialised } from "./materialisation.mjs";
 
+/**
+ * Does this record still answer "what is this session doing now?".
+ *
+ * `clearIntent` marks a durable intent done instead of erasing it, so the
+ * workspace keeps what each session worked on. That leaves every reader to
+ * exclude the finished ones, and this is the single place that decides which
+ * states count - status and attention disagreeing about the same record is
+ * exactly the defect this exists to prevent.
+ *
+ * Stopped is not finished. A blocked or waiting session still owns its work and
+ * the resourceHints that announce it, so only "done" gives them up.
+ */
+export function isCurrentIntent(intent) {
+  return intent.state !== "done";
+}
+
 // Intent answers "what is this session doing now?". It is awareness, not
 // authorisation: an edit intent never substitutes for a claim, which is why
 // resourceHints are advisory strings rather than reservations.

package/node_modules/@agents-can-communicate/core/src/next-turn-delivery.mjs

@@ -1,7 +1,10 @@
+import { decisionView, isCurrentDecision } from "./decision-state.mjs";
+import { dueForRepeat, offerFacts } from "./receipts.mjs";
+
 export async function nextTurnDelivery(store, input = {}) {
   if (typeof input.participantId !== "string" || input.participantId === "") {
     return { queuedMessages: [], liveOfferedMessageIds: [], reminderMessageIds: [],
-      roomMessageIds: [] };
+      roomMessageIds: [], repeatMessages: [], repeatOffers: [] };
   }
   const snapshot = await store.snapshot(input.workspaceId ?? store.workspaceId,
     { kinds: ["message", "receipt"] });
@@ -13,19 +16,33 @@ export async function nextTurnDelivery(store, input = {}) {
     && message.fromSessionId !== input.exceptSessionId)
     .sort((left, right) => left.sentAt.localeCompare(right.sentAt)
       || left.messageId.localeCompare(right.messageId));
+  // Only a caller that will show them asks. A repeat taken out of the reminder
+  // lists and then never shown would be the one message this turn forgot.
+  const repeatMessages = input.repeats === true
+    ? eligible.filter(message => dueForRepeat(message,
+      receiptByMessage.get(message.messageId), input.now))
+    : [];
+  const repeating = new Set(repeatMessages.map(message => message.messageId));
   return {
     queuedMessages: eligible.filter(message =>
       receiptByMessage.get(message.messageId).state === "queued"),
     liveOfferedMessageIds: eligible.filter(message => message.toParticipantIds.length > 0
-      && receiptByMessage.get(message.messageId).state === "offered")
+      && receiptByMessage.get(message.messageId).state === "offered"
+      && !repeating.has(message.messageId))
       .map(message => message.messageId),
     // A missing body is not evidence of delivery: a degraded adapter may have
     // withheld it. Only this recipient's durable receipt permits a reminder.
     reminderMessageIds: eligible.filter(message => message.obligation !== "none"
-      && ["offered", "retrieved"].includes(receiptByMessage.get(message.messageId).state))
+      && ["offered", "retrieved"].includes(receiptByMessage.get(message.messageId).state)
+      && !repeating.has(message.messageId))
       .map(message => message.messageId),
     roomMessageIds: eligible.filter(message => message.toParticipantIds.length === 0)
       .map(message => message.messageId),
+    // After the queued bodies, so a new message wins the byte budget first.
+    repeatMessages,
+    repeatOffers: repeatMessages.map(message => {
+      const { transport, at } = offerFacts(receiptByMessage.get(message.messageId));
+      return { messageId: message.messageId, transport, at };
+    }),
   };
 }
-import { decisionView, isCurrentDecision } from "./decision-state.mjs";

package/node_modules/@agents-can-communicate/core/src/prune.mjs

@@ -0,0 +1,241 @@
+import { AccError, EXIT } from "@agents-can-communicate/protocol";
+
+import { classifySessionPresence } from "./sessions.mjs";
+
+// What an operator can ask to reclaim. The workspace record is deliberately
+// absent: removing it would not clean a workspace, it would erase one.
+export const PRUNE_CLASSES = Object.freeze(["sessions", "intents", "claims", "participants"]);
+
+function assertClasses(classes) {
+  for (const name of classes) {
+    if (!PRUNE_CLASSES.includes(name)) {
+      throw new AccError(EXIT.USAGE,
+        `prune class is one of ${PRUNE_CLASSES.join(", ")}`, { class: name });
+    }
+  }
+}
+
+const of = (envelopes, kind) => envelopes.filter(envelope => envelope.kind === kind);
+
+const CURSOR = /^[0-9]{16}$/;
+const EVENT_PAGE = 500;
+
+function assertBefore(before) {
+  if (typeof before !== "string" || !CURSOR.test(before)) {
+    throw new AccError(EXIT.USAGE,
+      "before is the 16-digit cursor a previous sync returned", { before });
+  }
+  return before;
+}
+
+/**
+ * Read the log up to the boundary, counting it and naming what it recorded.
+ *
+ * The boundary is a cursor rather than a date on purpose: a cursor is what
+ * `sync` already returns and what a peer already holds, so an operator trimming
+ * to one names the same point its readers name. A duration would have to be
+ * resolved to a sequence anyway, and the resolution could move between the
+ * report and the apply.
+ */
+async function readBelow(store, workspaceId, before) {
+  const messageIds = new Set();
+  let events = 0;
+  let cursor = null;
+  for (;;) {
+    const page = await store.eventsSince(workspaceId, cursor, EVENT_PAGE);
+    if (page.events.length === 0) break;
+    let past = false;
+    for (const event of page.events) {
+      if (event.sequence > before) {
+        past = true;
+        break;
+      }
+      events += 1;
+      if (event.type === "message.recorded") messageIds.add(event.payload.messageId);
+    }
+    if (past) break;
+    cursor = page.cursor;
+  }
+  return { events, messageIds };
+}
+
+/**
+ * A message is resolved when nobody is still owed it.
+ *
+ * Offered is not read and retrieved is not model attention, so only an
+ * acknowledged receipt settles the obligation. A recipient that no longer
+ * exists cannot acknowledge anything, and holding the message for it would
+ * keep the whole thread forever.
+ */
+function resolvedMessages(envelopes, messageIds) {
+  const participants = new Set(of(envelopes, "participant").map(envelope => envelope.id));
+  const open = new Set(of(envelopes, "receipt").map(envelope => envelope.record)
+    .filter(receipt => receipt.state !== "acknowledged"
+      && participants.has(receipt.recipientParticipantId))
+    .map(receipt => receipt.messageId));
+  return of(envelopes, "message")
+    .filter(envelope => messageIds.has(envelope.id) && !open.has(envelope.id));
+}
+
+/**
+ * Which records describe work that has stopped for good.
+ *
+ * Only `offline` qualifies for a session, which is a confirmed dead pid or a
+ * full day without a heartbeat. `stale` is a session that has gone quiet, and a
+ * quiet session is still someone's.
+ */
+function eligibleSessions(envelopes, now, pidIsAlive) {
+  // A live claim names the session that holds it, and that name is how a peer
+  // blocked by the claim finds someone to ask. Removing the session leaves the
+  // claim reading as owned by nobody, so a session keeping a live lease stays
+  // however long it has been quiet. Its claim expiring makes both eligible.
+  const holding = new Set(of(envelopes, "claim")
+    .filter(envelope => Date.parse(envelope.record.expiresAt) > Date.parse(now))
+    .map(envelope => envelope.record.ownerSessionId));
+  return of(envelopes, "session")
+    .filter(envelope => !holding.has(envelope.id)
+      && classifySessionPresence(envelope.record, now, pidIsAlive) === "offline");
+}
+
+/**
+ * A participant is kept while anything still points at it.
+ *
+ * `removedSessions` is what this pass actually takes, not what it could take.
+ * The difference matters when an operator names classes: asked for participants
+ * alone, every session stays, so every participant is still pointed at and none
+ * is eligible. Judging by what is merely *eligible* would remove a participant
+ * and leave its sessions naming a roster entry that is gone.
+ *
+ * Messages are not pruned unless a boundary says so, and the roster is where
+ * "who sent this" is answered, so a name on a surviving message stays too.
+ */
+function eligibleParticipants(envelopes, removedSessions, messages) {
+  const surviving = new Set(of(envelopes, "session")
+    .filter(envelope => !removedSessions.has(envelope.id))
+    .map(envelope => envelope.record.participantId));
+  const named = new Set(messages.flatMap(message =>
+    [message.fromParticipantId, ...message.toParticipantIds]));
+  return of(envelopes, "participant")
+    .filter(envelope => !surviving.has(envelope.id) && !named.has(envelope.id));
+}
+
+export function createPruneService(ports) {
+  const { store, clock, pidIsAlive } = ports;
+
+  /**
+   * What `prune` would reclaim, as records rather than as counts.
+   *
+   * The plan is computed outside the writer mutex and applied inside it, so
+   * every entry carries the generation that proves it is still the record this
+   * judged. A claim renewed in between is skipped by the store rather than
+   * removed.
+   */
+  async function planPrune(input = {}) {
+    const classes = input.classes ?? PRUNE_CLASSES;
+    assertClasses(classes);
+    const workspaceId = input.workspaceId ?? store.workspaceId;
+    const now = clock.now();
+    const envelopes = await store.stateEnvelopes(workspaceId);
+    const wants = name => classes.includes(name);
+
+    const eligible = wants("sessions") || wants("intents") || wants("participants")
+      ? eligibleSessions(envelopes, now, pidIsAlive)
+      : [];
+    const sessions = wants("sessions") ? eligible : [];
+    const removedSessions = new Set(sessions.map(envelope => envelope.id));
+    const eligibleSessionIds = new Set(eligible.map(envelope => envelope.id));
+
+    // An intent belongs to one session and outlives nothing, so a session
+    // leaving takes its intent with it whether or not the operator named the
+    // class. Asking for intents alone reaches further: every intent whose
+    // session has stopped, including sessions this pass is keeping. Nothing
+    // points at an intent, so removing one leaves nothing dangling - but
+    // leaving one behind when its session goes would.
+    const owning = wants("intents") ? eligibleSessionIds : removedSessions;
+    const intents = of(envelopes, "intent")
+      .filter(envelope => owning.has(envelope.record.sessionId));
+    const claims = wants("claims")
+      ? of(envelopes, "claim")
+        .filter(envelope => Date.parse(envelope.record.expiresAt) <= Date.parse(now))
+      : [];
+
+    // History is named by a boundary rather than by a class, because there is
+    // no such thing as an event that has stopped being true - only one the
+    // operator has decided nobody will read again.
+    const before = input.before === undefined ? null : assertBefore(input.before);
+    const below = before === null ? { events: 0, messageIds: new Set() }
+      : await readBelow(store, workspaceId, before);
+    const messages = before === null ? [] : resolvedMessages(envelopes, below.messageIds);
+    const doomedMessages = new Set(messages.map(envelope => envelope.id));
+    const receipts = of(envelopes, "receipt")
+      .filter(envelope => doomedMessages.has(envelope.record.messageId));
+
+    // Decided after the messages, and against the ones that will survive this
+    // pass. A participant named only by a message the same run removes is a
+    // participant nothing will point at once the run finishes; judging it
+    // against every message that exists now would keep it, report no work
+    // remaining, and need a second identical run to reclaim it.
+    const participants = wants("participants")
+      ? eligibleParticipants(envelopes, removedSessions, of(envelopes, "message")
+        .map(envelope => envelope.record).filter(record => !doomedMessages.has(record.messageId)))
+      : [];
+
+    const named = { sessions, intents, claims, participants, messages, receipts };
+    // Ordered so that anything holding a reference goes before what it refers
+    // to. A pass can stop at its budget or its deadline, and what it has done
+    // by then is a prefix of this list - so the prefix has to be a state the
+    // store can be left in. A receipt names a message, a message and an intent
+    // and a claim each name a session, and a session names a participant.
+    // Removing them in that order means an interrupted pass never leaves a
+    // record pointing at one that is already gone.
+    const order = ["receipts", "messages", "intents", "claims", "sessions", "participants"];
+    const entries = order.flatMap(name => named[name])
+      .map(({ kind, id, generation }) => ({ kind, id, generation }));
+    return { workspaceId,
+      before,
+      counts: { ...Object.fromEntries(Object.entries(named)
+        .map(([name, list]) => [name, list.length])), events: below.events },
+      entries };
+  }
+
+  /**
+   * Reclaim what the plan named, or report it and change nothing.
+   *
+   * The dry run is the default because this is the one command that takes
+   * records out of the store. A caller that means it says so.
+   */
+  async function prune(input = {}) {
+    let plan = await planPrune(input);
+    if (input.apply !== true) {
+      return { ...plan, applied: false, reclaimed: 0, skipped: 0, remaining: false,
+        trimmedThrough: null };
+    }
+    // Decided again inside the writer mutex, and that second reading is the one
+    // acted on. Eligibility here is relational - a participant is eligible
+    // because no session of theirs survives - and a generation proves only that
+    // one record did not change. A session opening between the report and the
+    // apply changes the answer without changing any record this had named.
+    let decided = plan;
+    const result = await store.reclaimRecords(async () => {
+      decided = await planPrune(input);
+      return decided.entries;
+    }, { limit: input.limit, deadlineAt: input.deadlineAt });
+    if (decided.before === null) {
+      return { ...decided, applied: true, ...result, trimmedThrough: null };
+    }
+    plan = decided;
+    // Records first, then the log. A message removed while its recording event
+    // survives reads as history describing a record that is gone, which is
+    // ordinary. The reverse - an event log that starts after a message it never
+    // mentions - is the gap the floor is there to report.
+    const trimmed = await store.trimHistory(plan.before,
+      { limit: input.limit, deadlineAt: input.deadlineAt });
+    return { ...plan, applied: true,
+      reclaimed: result.reclaimed + trimmed.reclaimed,
+      skipped: result.skipped,
+      trimmedThrough: trimmed.trimmedThrough,
+      remaining: result.remaining || trimmed.remaining };
+  }
+
+  return { planPrune, prune };
+}

package/node_modules/@agents-can-communicate/core/src/receipts.mjs

@@ -3,6 +3,42 @@ import { AccError, EXIT, SCHEMA_VERSION, advanceReceipt }
 
 import { receiptId } from "./conversations.mjs";
 
+// How long a live offer may stand with nothing after it before the next turn
+// shows the body once more. Above the 90th percentile of the time models took
+// to retrieve, acknowledge or answer an offered message on real stores.
+export const REPEAT_OFFER_AFTER_MS = 15 * 60 * 1000;
+
+/**
+ * How and when a transport accepted this receipt's message, if anyone recorded it.
+ *
+ * Kept in `extensions` because a new receipt field would fail validation in an
+ * older ACC reading the same store. A receipt that an older ACC offered carries
+ * nothing here, and reads as `null`: unknown, never guessed.
+ */
+export function offerFacts(receipt) {
+  const offer = receipt?.extensions?.offer;
+  if (offer === null || typeof offer !== "object" || Array.isArray(offer)
+    || typeof offer.transport !== "string" || typeof offer.at !== "string"
+    || !Number.isFinite(Date.parse(offer.at))) return null;
+  return { transport: offer.transport, at: offer.at,
+    repeatedAt: offer.repeatedAt == null ? null : String(offer.repeatedAt) };
+}
+
+/**
+ * A live transport accepted this message, and nothing followed for long enough.
+ *
+ * A next-turn offer is recorded only after the hook's stdout carried the body,
+ * which is as close to the model as ACC can see, so it is never repeated. A live
+ * offer proves a transport took the bytes. Once, the next turn shows it again.
+ */
+export function dueForRepeat(message, receipt, now) {
+  const offer = offerFacts(receipt);
+  return message != null && message.toParticipantIds.length > 0
+    && receipt?.state === "offered" && offer !== null
+    && offer.transport !== "next-turn" && offer.repeatedAt === null
+    && Date.parse(now) - Date.parse(offer.at) >= REPEAT_OFFER_AFTER_MS;
+}
+
 export const SAFE_OFFER_ERROR_CODES = Object.freeze([
   "ambiguous_recipient_sessions",
   "delivery_disabled",
@@ -59,28 +95,48 @@ export function createReceiptService(ports) {
   }
 
   async function recordOfferSucceeded(input) {
+    const repeat = input.repeat === true;
+    if (repeat && input.transport !== "next-turn") {
+      throw new AccError(EXIT.DATA, "a repeated offer travels only through the next turn",
+        { messageId: input.messageId, transport: input.transport });
+    }
     const now = clock.now();
     return store.transaction(tx => {
       const id = receiptId(input.messageId, input.recipientParticipantId);
       const receipt = requireOfferableReceipt(tx, input, { allowRoomNextTurn: true });
       const target = requireTarget(tx, input, { mustBeOpen: true });
+      const success = extra => tx.append({ schemaVersion: SCHEMA_VERSION,
+        eventId: ids.next("event"), workspaceId: receipt.workspaceId,
+        actorSessionId: target.sessionId, type: "message.offer_succeeded", occurredAt: now,
+        payload: { messageId: input.messageId,
+          recipientParticipantId: input.recipientParticipantId,
+          targetSessionId: input.targetSessionId,
+          targetGeneration: input.targetGeneration,
+          transport: input.transport, adapterId: input.adapterId,
+          clientVersion: input.clientVersion, ...extra } });
+      if (repeat) {
+        // Judged again under the writer: a retrieval, an acknowledgement or
+        // another hook's repeat may have landed since this one was selected.
+        // The receipt keeps its state and its time; only the attempt is new.
+        if (!dueForRepeat(tx.get("message", input.messageId), receipt, now)) return receipt;
+        // Spread from the stored object, never from offerFacts: a later ACC
+        // may keep more about an offer, and this write must not drop it.
+        const repeated = { ...receipt, extensions: { ...receipt.extensions,
+          offer: { ...receipt.extensions.offer, repeatedAt: now } } };
+        tx.put("receipt", id, repeated, tx.generationOf("receipt", id));
+        success({ repeat: true });
+        return repeated;
+      }
       // A retrieval or acknowledgement may win after a transport accepted but
       // before this transaction acquired the writer. That stronger truth must
       // remain in place. The same rule makes a repeated successful commit a
       // read-only operation rather than another success event.
       if (receipt.state !== "queued") return receipt;
       const offered = { ...receipt, state: advanceReceipt(receipt.state, "offered"),
-        updatedAt: now };
+        updatedAt: now, extensions: { ...receipt.extensions,
+          offer: { transport: input.transport, at: now, repeatedAt: null } } };
       tx.put("receipt", id, offered, tx.generationOf("receipt", id));
-      tx.append({ schemaVersion: SCHEMA_VERSION, eventId: ids.next("event"),
-        workspaceId: receipt.workspaceId, actorSessionId: target.sessionId,
-        type: "message.offer_succeeded", occurredAt: now,
-        payload: { messageId: input.messageId,
-          recipientParticipantId: input.recipientParticipantId,
-          targetSessionId: input.targetSessionId,
-          targetGeneration: input.targetGeneration,
-          transport: input.transport, adapterId: input.adapterId,
-          clientVersion: input.clientVersion } });
+      success({});
       return offered;
     }, { kinds: ["session", "message", "receipt"], deadlineAt: input.deadlineAt });
   }

package/node_modules/@agents-can-communicate/core/src/service.mjs

@@ -5,6 +5,7 @@ import { createIntentService } from "./intents.mjs";
 import { createInboxService } from "./inbox.mjs";
 import { defaultPidIsAlive } from "./pid.mjs";
 import { assertPorts } from "./ports.mjs";
+import { createPruneService } from "./prune.mjs";
 import { createReceiptService } from "./receipts.mjs";
 import { createSessionService } from "./sessions.mjs";
 import { createGuardStateService, createStatusService } from "./status.mjs";
@@ -37,6 +38,7 @@ export function createCoordinationService({ store, clock, ids,
   const sync = createSyncService(ports, sessions);
   const status = createStatusService(ports, sessions, deliveryBindings);
   const guardState = createGuardStateService(ports);
+  const prune = createPruneService(ports);
   return Object.freeze({
     store,
     clock,
@@ -62,6 +64,7 @@ export function createCoordinationService({ store, clock, ids,
     ...receipts,
     ...sync,
     ...status,
+    ...prune,
     guardState,
   });
 }

package/node_modules/@agents-can-communicate/core/src/status.mjs

@@ -1,5 +1,7 @@
 import { classifySessionPresence } from "./sessions.mjs";
 import { computeAttention } from "./attention.mjs";
+import { isCurrentIntent } from "./intents.mjs";
+import { decisionView, isCurrentDecision } from "./decision-state.mjs";
 
 /**
  * Protection level, reported from what is actually enforceable.
@@ -86,6 +88,22 @@ export function createStatusService(ports, sessions, deliveryBindings) {
     const claims = snapshot.claims
       .filter(claim => Date.parse(claim.expiresAt) > Date.parse(now));
     const currentBindings = await deliveryBindings.currentBindings(now);
+    // What each recipient has not fetched yet, and how far it got. Offered is
+    // not read: a transport took the bytes. Queued sits beside it so "0
+    // offered" cannot be mistaken for "nothing waits". Replaced decisions
+    // leave these counts exactly as they leave the inbox.
+    const current = new Set(snapshot.messages.map(decisionView(snapshot.messages))
+      .filter(isCurrentDecision).map(message => message.messageId));
+    const unretrieved = new Map();
+    const tally = key => unretrieved.get(key) ?? { queued: 0, offered: 0 };
+    for (const receipt of snapshot.receipts) {
+      if (!current.has(receipt.messageId)
+        || !["queued", "offered"].includes(receipt.state)) continue;
+      for (const key of [receipt.recipientParticipantId, null]) {
+        const counts = tally(key);
+        unretrieved.set(key, { ...counts, [receipt.state]: counts[receipt.state] + 1 });
+      }
+    }
 
     return {
       workspaceId,
@@ -108,7 +126,12 @@ export function createStatusService(ports, sessions, deliveryBindings) {
         enforcement: session.enforcement ?? "advisory",
         lifecycle: session.lifecycle ?? "manual",
         presence,
-        intent: intents.find(intent => intent.sessionId === session.sessionId)?.summary ?? null,
+        // A finished intent reads as no intent at all. `--clear` exists so a
+        // peer stops seeing work that has stopped, and reporting the summary of
+        // a done record made the command and this line contradict each other.
+        intent: intents.find(intent => intent.sessionId === session.sessionId
+          && isCurrentIntent(intent))?.summary ?? null,
+        unretrieved: tally(session.participantId),
       })),
       // The owner is named twice on purpose. Every command that reaches a peer
       // takes a participant id, so a claim that gave only a session id sent the
@@ -143,6 +166,7 @@ export function createStatusService(ports, sessions, deliveryBindings) {
         stale: live.filter(item => item.presence === "stale").length,
         claims: claims.length,
         messages: snapshot.messages.length,
+        unretrieved: tally(null),
       },
     };
   }