harnery 0.42.0 → 0.44.0

package/dist/commands/web-fetch.js

@@ -14,9 +14,11 @@ import { fileURLToPath } from "node:url";
  * harnery repo at the *matching version tag* into a cache dir and install the
  * web app's deps. Subsequent runs reuse the cache.
  *
- * The only thing `web/` pulls from `src/` is `harnery/core/journal` (a single,
- * dependency-free module), so the install is `web/` deps only: no root install,
- * no Playwright browser download.
+ * `web/` imports readers from `src/`, and `web/next.config.ts` resolves the
+ * root `playwright` package, so the install covers the repository root and
+ * then `web/`. Installing the `playwright` package downloads no browsers.
+ * Installing `web/` alone left `harn web up` failing with
+ * `Cannot find module 'playwright/package.json'`.
  */
 const DEFAULT_REPO_URL = "https://github.com/ryanjkelly/harnery.git";
 /** harnery's own package root: src/commands/ -> ../.. ; valid in both src/ and dist/. */
@@ -46,8 +48,8 @@ function webCacheRoot(ref) {
     return path.join(base, "harnery", "web", safeRef);
 }
 /** bun if available (preferred), else npm. Both support `<runner> install` and `<runner> run <script>`. */
-export function webRunner() {
-    const r = spawnSync("bun", ["--version"], { stdio: "ignore" });
+export function webRunner(spawn = spawnSync) {
+    const r = spawn("bun", ["--version"], { stdio: "ignore" });
     return r.status === 0 ? "bun" : "npm";
 }
 /**
@@ -55,13 +57,14 @@ export function webRunner() {
  * its path, fetching (clone + install) on first use. Returns null on failure
  * (after emitting an actionable error).
  */
-export function lazyFetchWebRoot(emit) {
+export function lazyFetchWebRoot(emit, spawn = spawnSync) {
     const { version, repoUrl } = readPkg();
     const ref = resolveRef(version);
     const cacheRoot = webCacheRoot(ref);
     const webDir = path.join(cacheRoot, "web");
-    // node_modules in the cached web/ is the "fetched + installed" marker.
-    if (existsSync(path.join(webDir, "node_modules"))) {
+    // node_modules in both the cached root and web/ is the "fetched + installed" marker.
+    if (existsSync(path.join(cacheRoot, "node_modules")) &&
+        existsSync(path.join(webDir, "node_modules"))) {
         emit.log(`harn web · using cached dashboard (${ref})`, "info");
         return webDir;
     }
@@ -71,7 +74,7 @@ export function lazyFetchWebRoot(emit) {
     if (existsSync(cacheRoot))
         rmSync(cacheRoot, { recursive: true, force: true });
     mkdirSync(path.dirname(cacheRoot), { recursive: true });
-    const clone = spawnSync("git", ["clone", "--depth", "1", "--branch", ref, repoUrl, cacheRoot], {
+    const clone = spawn("git", ["clone", "--depth", "1", "--branch", ref, repoUrl, cacheRoot], {
         stdio: "inherit",
     });
     if (clone.status !== 0) {
@@ -84,16 +87,19 @@ export function lazyFetchWebRoot(emit) {
         });
         return null;
     }
-    const runner = webRunner();
-    emit.log(`harn web · installing dashboard deps (${runner} install in web/)`, "info");
-    const install = spawnSync(runner, ["install"], { cwd: webDir, stdio: "inherit" });
-    if (install.status !== 0) {
-        emit.error({
-            code: "web_fetch_failed",
-            message: `${runner} install in ${webDir} failed (status ${install.status})`,
-            hint: `Try manually: cd ${webDir} && ${runner} install`,
-        });
-        return null;
+    const runner = webRunner(spawn);
+    for (const dir of [cacheRoot, webDir]) {
+        const where = dir === webDir ? "web/" : "the harnery root";
+        emit.log(`harn web · installing dashboard deps (${runner} install in ${where})`, "info");
+        const install = spawn(runner, ["install"], { cwd: dir, stdio: "inherit" });
+        if (install.status !== 0) {
+            emit.error({
+                code: "web_fetch_failed",
+                message: `${runner} install in ${dir} failed (status ${install.status})`,
+                hint: `Try manually: cd ${dir} && ${runner} install`,
+            });
+            return null;
+        }
     }
     emit.log(`harn web · dashboard ready (cached at ${webDir})`, "info");
     return webDir;

package/dist/commands/web.d.ts

@@ -19,7 +19,13 @@ export declare function resolveMaxOldSpaceMb(flag?: string): number;
  * wins without clobbering flags the caller set (source maps, inspector, …).
  */
 export declare function nodeOptionsWithHeapCap(mb: number): string | undefined;
-/** Preload the request diagnostics hook without replacing Next's HTTP server. */
+/**
+ * Preload the dashboard's server hooks (keep-alive and request diagnostics)
+ * without replacing Next's HTTP server. NODE_OPTIONS reaches the child that
+ * `next dev` forks, but Next re-parses every `--import` into one value, so
+ * this names the single combined preload; a second, different `--import`
+ * would collapse into an unloadable path (web/server-preload.mjs).
+ */
 export declare function nodeOptionsWithWebDiagnostics(webDir: string, mb: number): string;
 export declare function webPerformanceLogDestination(coordRoot: string, env?: Readonly<Record<string, string | undefined>>): string;
 /**

package/dist/commands/web.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../../src/commands/web.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA8CnD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAM1D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKrE;AAED,iFAAiF;AACjF,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAKhF;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,MAAM,CAQR;AAmDD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAevE;AAsBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA2N5E"}
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../../src/commands/web.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA8CnD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAM1D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKrE;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAKhF;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,MAAM,CAQR;AAmDD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAevE;AAsBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA2N5E"}

package/dist/commands/web.js

@@ -71,12 +71,18 @@ export function nodeOptionsWithHeapCap(mb) {
         return inherited;
     return `${inherited} --max-old-space-size=${mb}`.trim();
 }
-/** Preload the request diagnostics hook without replacing Next's HTTP server. */
+/**
+ * Preload the dashboard's server hooks (keep-alive and request diagnostics)
+ * without replacing Next's HTTP server. NODE_OPTIONS reaches the child that
+ * `next dev` forks, but Next re-parses every `--import` into one value, so
+ * this names the single combined preload; a second, different `--import`
+ * would collapse into an unloadable path (web/server-preload.mjs).
+ */
 export function nodeOptionsWithWebDiagnostics(webDir, mb) {
     const inherited = nodeOptionsWithHeapCap(mb) ?? "";
-    if (inherited.includes("server-performance.mjs"))
+    if (inherited.includes("server-preload.mjs"))
         return inherited;
-    const preload = pathToFileURL(path.join(webDir, "server-performance.mjs")).href;
+    const preload = pathToFileURL(path.join(webDir, "server-preload.mjs")).href;
     return `${inherited} --import=${preload}`.trim();
 }
 export function webPerformanceLogDestination(coordRoot, env = process.env) {

package/dist/commands/workflow.js

@@ -472,10 +472,10 @@ export function registerWorkflowCommand(program, emit) {
     });
     workflow
         .command("reclaim <run-id>")
-        .description("Resolve a workspace preserved because it was dirty: salvage the work to its branch, then release.")
+        .description("Preview reclaim of an inactive owned workspace, or confirm salvage or discard and release.")
         .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
         .option("--discard", "Throw the uncommitted work away instead of salvaging it")
-        .option("--json", "Emit the reclaim preparation and cleanup result as JSON")
+        .option("--json", "Emit the reclaim preview or confirmed result as JSON")
         .action(async (runId, opts) => {
         const coordRoot = resolveCoordRoot();
         if (!coordRoot) {
@@ -485,50 +485,44 @@ export function registerWorkflowCommand(program, emit) {
             });
             process.exit(1);
         }
-        if (!opts.yes) {
-            emit.error({
-                code: "reclaim_confirmation_required",
-                message: opts.discard
-                    ? "reclaim --discard permanently destroys uncommitted work; pass --yes to confirm"
-                    : "workspace reclaim commits uncommitted work to its branch and then releases the worktree; pass --yes to confirm",
-            });
-            process.exit(1);
-        }
         try {
-            const { inspectWorkflowWorkspace, prepareReclaim, cleanupWorkspace } = await import("../core/workflow/index.js");
-            const inspection = inspectWorkflowWorkspace(coordRoot, runId);
-            if (!inspection.ok) {
-                emit.error({ code: "workflow_reclaim_failed", message: inspection.error });
-                process.exit(1);
-            }
-            const allocation = inspection.value.allocation;
-            if (!allocation) {
+            const { createLocalGitWorktreeProvider, readWorkflowRunManifest } = await import("../core/workflow/index.js");
+            const binding = readWorkflowRunManifest(coordRoot, runId).execution.workspace_binding;
+            if (binding?.provider.id !== "local-git-worktree") {
                 emit.error({
                     code: "workflow_reclaim_unavailable",
                     message: `run ${runId} has no provider-owned Git workspace to reclaim`,
                 });
                 process.exit(1);
             }
-            const preparation = prepareReclaim({
-                worktreePath: allocation.active_root,
+            const provider = createLocalGitWorktreeProvider({ coordRoot });
+            const result = await provider.reclaim(binding, {
                 mode: opts.discard ? "discard" : "salvage",
-                runId,
+                yes: opts.yes,
             });
-            // Cleanup still owns removal. Reclaim only changes whether the tree it
-            // finds is dirty, so there is one audited release path, not two.
-            const provider = await builtInProviderForRun(coordRoot, runId);
-            const cleanup = await cleanupWorkspace({ coordRoot, runId, provider });
             if (opts.json) {
                 emit.config({ format: "json" });
-                emit.data({ preparation, cleanup });
+                emit.data(result);
+                return;
+            }
+            if (result.action === "preview") {
+                const holders = result.lease_holder.map((holder) => `${holder.scope}: ${holder.owner_id ?? "unknown"}${holder.pid ? ` (pid ${holder.pid})` : ""}${holder.detail ? `; ${holder.detail}` : ""}`);
+                emit.text(`reclaim preview: ${result.run_id}\n` +
+                    `mode: ${result.mode}\nliveness: ${result.liveness}\nownership: ${result.ownership}\n` +
+                    `lease holder: ${holders.length > 0 ? holders.join(", ") : "none observed"}\n` +
+                    `dirty paths: ${result.dirty_paths === null ? "unknown" : result.dirty_paths.length > 0 ? result.dirty_paths.join(", ") : "none"}\n` +
+                    (result.ownership_detail ? `ownership detail: ${result.ownership_detail}\n` : "") +
+                    `Pass --yes to confirm ${result.mode} and release after all checks pass.\n`);
                 return;
             }
-            emit.text(`reclaim ${preparation.action}: ${preparation.detail}\n` +
-                `workspace cleanup ${cleanup.status}: ${cleanup.binding_id}\n`);
+            emit.text(`reclaim ${result.preparation.action}: ${result.preparation.detail}\n` +
+                `workspace cleanup ${result.cleanup.status}: ${result.cleanup.binding_id}\n`);
         }
         catch (error) {
             emit.error({
-                code: "workflow_reclaim_failed",
+                code: error instanceof Error && "code" in error && typeof error.code === "string"
+                    ? error.code
+                    : "workflow_reclaim_failed",
                 message: error instanceof Error ? error.message : String(error),
             });
             process.exit(1);

package/dist/core/agents/live-authority-v3.d.ts

@@ -38,6 +38,7 @@ interface LiveAuthorityBaseV3 {
     nativeSessionId: string;
     adapter: Adapter;
     observationId?: string;
+    expectedGenerationId?: `gen_${string}`;
 }
 /**
  * Establish the missing generation authority for one adapter-native session,

package/dist/core/agents/live-authority-v3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-authority-v3.d.ts","sourceRoot":"","sources":["../../../src/core/agents/live-authority-v3.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C,OAAO,EAAE,KAAK,gBAAgB,EAA2B,MAAM,yBAAyB,CAAC;AAgBzF,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,iDAAiD,CAAC;AASzD,OAAO,EAEL,KAAK,SAAS,EAMf,MAAM,6BAA6B,CAAC;AAQrC,eAAO,MAAM,gCAAgC,EAAG,iBAA0B,CAAC;AAE3E,qBAAa,gCAAiC,SAAQ,KAAK;aAC7B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI3C;AAED,MAAM,MAAM,iCAAiC,GACzC;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,GACtB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,mCAAmC,CAAA;CAAE,CAAC;AAEvE,MAAM,WAAW,oCAAoC;IACnD,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,mBAAmB,EAAE,OAAO,MAAM,EAAE,CAAC;IACrC,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uCAAuC;IACtD,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;IAC/B,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,+BAA+B;IAC9C,KAAK,EAAE,WAAW,GAAG,UAAU,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,UAAU,mBAAmB;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG,uCAAuC,CA6H1C;AAqED;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;CACvC,GAAG,+BAA+B,CAmFlC;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,oCAAoC,CAqDvC;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C,iCAAiC,CAiCnC;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mBAAmB,GAAG;IAC3B,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,iCAAiC,CAoCnC;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,mBAAmB,GAAG;IAC3B,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3B,GACA,iCAAiC,CAwCnC;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChE,iCAAiC,CAwBnC;AAuDD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAI/E;AAaD,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,MAAM,EAAE,CAa3F"}
+{"version":3,"file":"live-authority-v3.d.ts","sourceRoot":"","sources":["../../../src/core/agents/live-authority-v3.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C,OAAO,EAAE,KAAK,gBAAgB,EAA2B,MAAM,yBAAyB,CAAC;AAgBzF,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,iDAAiD,CAAC;AASzD,OAAO,EAEL,KAAK,SAAS,EAMf,MAAM,6BAA6B,CAAC;AAQrC,eAAO,MAAM,gCAAgC,EAAG,iBAA0B,CAAC;AAE3E,qBAAa,gCAAiC,SAAQ,KAAK;aAC7B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI3C;AAED,MAAM,MAAM,iCAAiC,GACzC;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,GACtB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,mCAAmC,CAAA;CAAE,CAAC;AAEvE,MAAM,WAAW,oCAAoC;IACnD,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,mBAAmB,EAAE,OAAO,MAAM,EAAE,CAAC;IACrC,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uCAAuC;IACtD,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;IAC/B,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,+BAA+B;IAC9C,KAAK,EAAE,WAAW,GAAG,UAAU,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,UAAU,mBAAmB;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG,uCAAuC,CA6H1C;AAqED;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;CACvC,GAAG,+BAA+B,CAmFlC;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,oCAAoC,CAqDvC;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C,iCAAiC,CAiCnC;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mBAAmB,GAAG;IAC3B,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,iCAAiC,CAoCnC;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,mBAAmB,GAAG;IAC3B,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3B,GACA,iCAAiC,CAwCnC;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChE,iCAAiC,CAwBnC;AA8DD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAI/E;AAsBD,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,MAAM,EAAE,CAa3F"}

package/dist/core/agents/live-authority-v3.js

@@ -419,6 +419,10 @@ function recordLiveAuthority(input, signal, observation, expected, desired, appl
         platform: livePlatformV3(),
         expected_prior_state_digest: coordinationAuthorityStateDigestV3(expected),
         desired_state_digest: coordinationAuthorityStateDigestV3(desired),
+        expected_generation_id: input.expectedGenerationId ??
+            (subject === input.owner
+                ? expected.v3_generation_id
+                : readLiveCoordinationRow(input.coordRoot, input.owner)?.v3_generation_id),
         reconciler: {
             readStateDigest: () => {
                 const heartbeat = readHeartbeat(input.coordRoot, subject);
@@ -448,9 +452,16 @@ export function liveCoordinationWriteModeV3(coordRoot) {
     return route.mode;
 }
 function requireHeartbeat(input, owner) {
+    if (input.expectedGenerationId &&
+        readLiveCoordinationRow(input.coordRoot, owner)?.v3_generation_id !== input.expectedGenerationId) {
+        throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
+    }
     const heartbeat = ensureLiveCoordinationHeartbeat(input.coordRoot, owner, owner === input.owner ? input.nativeSessionId : owner, input.adapter);
     if (!heartbeat)
         throw new LiveCoordinationAuthorityV3Error(`heartbeat_missing:${owner}`);
+    if (input.expectedGenerationId && heartbeat.v3_generation_id !== input.expectedGenerationId) {
+        throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
+    }
     return heartbeat;
 }
 export function coordinationAuthorityStateDigestV3(heartbeat) {

package/dist/core/agents/live-lifecycle-v3.d.ts

@@ -11,10 +11,12 @@ interface LiveLifecycleObservationBaseV3 {
     adapter: EventAdapterIdV3;
     observedAt?: string;
 }
-export declare function recordLiveSweepObservationV3(input: LiveLifecycleObservationBaseV3 & {
+interface LiveSweepObservationV3Input extends LiveLifecycleObservationBaseV3 {
+    expectedGenerationId: `gen_${string}` | null;
     observation: "stale_heartbeat" | "killed" | "unparseable_heartbeat" | "missing_timestamp";
     ageMs: number;
-}): LiveLifecycleObservationV3Result;
+}
+export declare function recordLiveSweepObservationV3(input: LiveSweepObservationV3Input): LiveLifecycleObservationV3Result;
 export declare function recordLiveResumeObservationV3(input: LiveLifecycleObservationBaseV3): LiveLifecycleObservationV3Result;
 export {};
 //# sourceMappingURL=live-lifecycle-v3.d.ts.map

package/dist/core/agents/live-lifecycle-v3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-lifecycle-v3.d.ts","sourceRoot":"","sources":["../../../src/core/agents/live-lifecycle-v3.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAaxD,MAAM,MAAM,gCAAgC,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAErF,UAAU,8BAA8B;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,8BAA8B,GAAG;IACtC,WAAW,EAAE,iBAAiB,GAAG,QAAQ,GAAG,uBAAuB,GAAG,mBAAmB,CAAC;IAC1F,KAAK,EAAE,MAAM,CAAC;CACf,GACA,gCAAgC,CAOlC;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,8BAA8B,GACpC,gCAAgC,CAQlC"}
+{"version":3,"file":"live-lifecycle-v3.d.ts","sourceRoot":"","sources":["../../../src/core/agents/live-lifecycle-v3.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAcxD,MAAM,MAAM,gCAAgC,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAErF,UAAU,8BAA8B;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,2BAA4B,SAAQ,8BAA8B;IAC1E,oBAAoB,EAAE,OAAO,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7C,WAAW,EAAE,iBAAiB,GAAG,QAAQ,GAAG,uBAAuB,GAAG,mBAAmB,CAAC;IAC1F,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,2BAA2B,GACjC,gCAAgC,CAqBlC;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,8BAA8B,GACpC,gCAAgC,CAalC"}

package/dist/core/agents/live-lifecycle-v3.js

@@ -3,17 +3,27 @@ import { buildEventV3 } from "../events/v3/builder.js";
 import { normalizeNativeIdV3 } from "../events/v3/canonical.js";
 import { readEventV3ControlState } from "../events/v3/control.js";
 import { fingerprintContextV3 } from "../events/v3/fingerprint-keys.js";
+import { withGenerationCustodyV3 } from "../events/v3/generation-custody.js";
 import { liveInstanceIdV3, livePlatformV3, resolveLiveEventLedgerRouteV3, } from "../events/v3/live-routing.js";
 import { readJoinableHookProducerStateV3 } from "../events/v3/producers/recorder.js";
 import { writeEventV3 } from "../events/v3/writer.js";
 import { LiveCoordinationAuthorityV3Error } from "./live-authority-v3.js";
 import { liveCoordinationAdapterV3 } from "./state/live-coordination-view.js";
 export function recordLiveSweepObservationV3(input) {
-    return recordObservation(input, "lifecycle.sweep_observed", {
-        subject_instance_id: liveInstanceIdV3(input.owner),
-        observation: input.observation,
-        provisional: true,
-        age_ms: Math.max(0, Math.floor(input.ageMs)),
+    input = { ...input };
+    // Reject stale observations before preparing durable custody state. The
+    // in-custody checks cover replacement while acquiring custody and reentry.
+    requireSweepHookState(input);
+    return withGenerationCustodyV3(input.coordRoot, [liveInstanceIdV3(input.owner)], () => {
+        requireSweepHookState(input);
+        return recordObservation(input, "lifecycle.sweep_observed", {
+            subject_instance_id: liveInstanceIdV3(input.owner),
+            observation: input.observation,
+            provisional: true,
+            age_ms: Math.max(0, Math.floor(input.ageMs)),
+        }, () => {
+            requireSweepHookState(input);
+        });
     });
 }
 export function recordLiveResumeObservationV3(input) {
@@ -23,9 +33,9 @@ export function recordLiveResumeObservationV3(input) {
         prior_generation_id: hook.generation_id,
         continuity: "native",
         evidence_reference: "heartbeat_recreated",
-    });
+    }, () => { });
 }
-function recordObservation(input, eventType, payload) {
+function recordObservation(input, eventType, payload, beforeWrite) {
     const route = resolveLiveEventLedgerRouteV3(input.coordRoot);
     if (route.state === "blocked")
         throw new LiveCoordinationAuthorityV3Error(route.reason);
@@ -73,6 +83,7 @@ function recordObservation(input, eventType, payload) {
         monotonic_ns: process.hrtime.bigint().toString(),
     };
     const event = buildEventV3(eventType, { ...common, payload });
+    beforeWrite();
     const durability = writeEventV3(input.coordRoot, event, {
         expectedGenesisId: control.genesis.event.payload.genesis_id,
     });
@@ -81,6 +92,16 @@ function recordObservation(input, eventType, payload) {
     }
     return { state: "recorded", event };
 }
+function requireSweepHookState(input) {
+    if (typeof input.expectedGenerationId !== "string" ||
+        !/^gen_[a-zA-Z0-9._-]+$/.test(input.expectedGenerationId)) {
+        throw new LiveCoordinationAuthorityV3Error("hook_generation_not_joinable");
+    }
+    const hook = requireHookState(withAttestedAdapter(input));
+    if (hook.generation_id !== input.expectedGenerationId) {
+        throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
+    }
+}
 function withAttestedAdapter(input) {
     const adapter = liveCoordinationAdapterV3(input.coordRoot, input.owner);
     if (!adapter)

package/dist/core/agents/mailbox.d.ts

@@ -9,13 +9,14 @@
  * shown to them, because nothing surfaces another session's journal.
  *
  * This module addresses the durable persona name instead of the instance, so a
- * message can be queued before its recipient exists. Delivery happens on the
- * recipient's side: their next SessionStart or prompt drains the queue, shows
- * the messages, and records them in their journal.
+ * message can be queued before its recipient exists. The recipient's next
+ * SessionStart or prompt can drain the queue for injection. A drain does not
+ * confirm that the adapter emitted the context or that anyone read it.
  *
  * Storage: `.harnery/mailbox/<slug>.jsonl`, one JSON record per line, appended
- * by senders and removed by an atomic claim on the recipient's side. Delivered
- * records are appended to `.harnery/mailbox/delivered/<slug>.jsonl` for audit.
+ * by senders and removed by an atomic claim on the recipient's side. Drained
+ * records are appended to `.harnery/mailbox/delivered/<slug>.jsonl` for audit,
+ * with injection explicitly unconfirmed.
  *
  * Related but distinct: `core/inbox` is an instance-keyed transport with a
  * storage-framework service behind it. This mailbox is name-keyed, file-only,
@@ -81,10 +82,10 @@ export declare function peekMailbox(coordRoot: string, name: string): MailboxMes
 /**
  * Claim and return every pending message for a name.
  *
- * The claim is an atomic rename, so two sessions sharing a name cannot deliver
+ * The claim is an atomic rename, so two sessions sharing a name cannot claim
  * the same message twice: whichever rename wins owns the batch. Claimed records
- * are appended to the delivered archive before the claim file is removed, so a
- * crash between the two leaves an auditable copy rather than a silent loss.
+ * are archived before the claim file is removed. The archive records only the
+ * drain; output, recipient read, and turn completion remain unconfirmed.
  */
 export declare function drainMailbox(coordRoot: string, name: string): MailboxMessageV1[];
 /** Render a drained batch as the context block a recipient reads. */

package/dist/core/agents/mailbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mailbox.d.ts","sourceRoot":"","sources":["../../../src/core/agents/mailbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAqBH,eAAO,MAAM,sBAAsB,EAAG,4BAAqC,CAAC;AAE5E;mCACmC;AACnC,eAAO,MAAM,cAAc,OAAO,CAAC;AACnC,qEAAqE;AACrE,eAAO,MAAM,WAAW,KAAK,CAAC;AAI9B,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;qEACiE;IACjE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,eAAe,CAAC;AAEnE,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAFb,WAAW,EAAE,qBAAqB,EAClC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM;CAOzB;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGjD;AAYD,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAqBD;;+DAE+D;AAC/D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAU1E;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAiBjF;AAiBD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CA6BlE;AAED,0DAA0D;AAC1D,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAa/E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAmDhF;AA8CD,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GACpC,MAAM,CAcR"}
+{"version":3,"file":"mailbox.d.ts","sourceRoot":"","sources":["../../../src/core/agents/mailbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAqBH,eAAO,MAAM,sBAAsB,EAAG,4BAAqC,CAAC;AAE5E;mCACmC;AACnC,eAAO,MAAM,cAAc,OAAO,CAAC;AACnC,qEAAqE;AACrE,eAAO,MAAM,WAAW,KAAK,CAAC;AAI9B,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;qEACiE;IACjE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,eAAe,CAAC;AAEnE,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAFb,WAAW,EAAE,qBAAqB,EAClC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM;CAOzB;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGjD;AAYD,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAqBD;;+DAE+D;AAC/D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAU1E;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAiBjF;AAiBD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CA6BlE;AAED,0DAA0D;AAC1D,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAa/E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CA2DhF;AA8CD,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GACpC,MAAM,CAcR"}

package/dist/core/agents/mailbox.js

@@ -9,13 +9,14 @@
  * shown to them, because nothing surfaces another session's journal.
  *
  * This module addresses the durable persona name instead of the instance, so a
- * message can be queued before its recipient exists. Delivery happens on the
- * recipient's side: their next SessionStart or prompt drains the queue, shows
- * the messages, and records them in their journal.
+ * message can be queued before its recipient exists. The recipient's next
+ * SessionStart or prompt can drain the queue for injection. A drain does not
+ * confirm that the adapter emitted the context or that anyone read it.
  *
  * Storage: `.harnery/mailbox/<slug>.jsonl`, one JSON record per line, appended
- * by senders and removed by an atomic claim on the recipient's side. Delivered
- * records are appended to `.harnery/mailbox/delivered/<slug>.jsonl` for audit.
+ * by senders and removed by an atomic claim on the recipient's side. Drained
+ * records are appended to `.harnery/mailbox/delivered/<slug>.jsonl` for audit,
+ * with injection explicitly unconfirmed.
  *
  * Related but distinct: `core/inbox` is an instance-keyed transport with a
  * storage-framework service behind it. This mailbox is name-keyed, file-only,
@@ -34,8 +35,8 @@ export const MAILBOX_MESSAGE_SCHEMA = "harnery.mailbox-message/v1";
 export const MAX_BODY_BYTES = 4000;
 /** Pending messages held for one name before senders are refused. */
 export const MAX_PENDING = 25;
-/** Delivered-archive ceiling; the file is truncated from the head past this. */
-const MAX_DELIVERED_BYTES = 256 * 1024;
+/** Drain-archive ceiling; the file is truncated from the head past this. */
+const MAX_ARCHIVE_BYTES = 256 * 1024;
 export class MailboxCapacityError extends Error {
     reason_code;
     current;
@@ -68,7 +69,7 @@ export function mailboxDir(coordRoot) {
 export function mailboxPath(coordRoot, name) {
     return join(mailboxDir(coordRoot), `${slugFor(name)}.jsonl`);
 }
-function deliveredPath(coordRoot, name) {
+function archivePath(coordRoot, name) {
     return join(mailboxDir(coordRoot), "delivered", `${slugFor(name)}.jsonl`);
 }
 function parseLines(content) {
@@ -196,10 +197,10 @@ export function peekMailbox(coordRoot, name) {
 /**
  * Claim and return every pending message for a name.
  *
- * The claim is an atomic rename, so two sessions sharing a name cannot deliver
+ * The claim is an atomic rename, so two sessions sharing a name cannot claim
  * the same message twice: whichever rename wins owns the batch. Claimed records
- * are appended to the delivered archive before the claim file is removed, so a
- * crash between the two leaves an auditable copy rather than a silent loss.
+ * are archived before the claim file is removed. The archive records only the
+ * drain; output, recipient read, and turn completion remain unconfirmed.
  */
 export function drainMailbox(coordRoot, name) {
     let path;
@@ -233,10 +234,16 @@ export function drainMailbox(coordRoot, name) {
     }
     if (messages.length > 0) {
         try {
-            const archive = deliveredPath(coordRoot, name);
+            const archive = archivePath(coordRoot, name);
             mkdirSync(join(mailboxDir(coordRoot), "delivered"), { recursive: true });
-            const deliveredAt = new Date().toISOString();
-            appendFileSync(archive, `${messages.map((m) => JSON.stringify({ ...m, delivered_at: deliveredAt })).join("\n")}\n`, "utf8");
+            const drainedAt = new Date().toISOString();
+            appendFileSync(archive, `${messages
+                .map((m) => JSON.stringify({
+                ...m,
+                drained_at: drainedAt,
+                delivery_status: "injection-unconfirmed",
+            }))
+                .join("\n")}\n`, "utf8");
             trimArchive(archive);
         }
         catch {
@@ -291,7 +298,7 @@ function sweepStaleClaims(coordRoot) {
 }
 function trimArchive(path) {
     try {
-        if (statSync(path).size <= MAX_DELIVERED_BYTES)
+        if (statSync(path).size <= MAX_ARCHIVE_BYTES)
             return;
         const lines = readFileSync(path, "utf8").split("\n").filter(Boolean);
         const keep = lines.slice(Math.floor(lines.length / 2));
@@ -307,8 +314,8 @@ export function formatMailboxDelivery(coordRoot, messages) {
         return "";
     const bin = resolveBinName(coordRoot);
     const header = messages.length === 1
-        ? `Message from a peer agent (delivered now, recorded in your journal):`
-        : `${messages.length} messages from peer agents (delivered now, recorded in your journal):`;
+        ? `Message from a peer agent (prepared for injection, recorded in your journal):`
+        : `${messages.length} messages from peer agents (prepared for injection, recorded in your journal):`;
     const body = messages
         .map((m) => {
         const when = m.created_at.replace("T", " ").replace(/\.\d+Z$/, "Z");

package/dist/core/agents/render/prompt-context.d.ts

@@ -55,6 +55,8 @@ export interface PromptContextOpts {
      * being bounced into a retry. Not hash-deduped, same rationale as the
      * status footer. */
     turnRitualNudge?: string;
+    /** The emitter acknowledges exactly these IDs only after output succeeds. */
+    onInboxPrepared?: (messageIds: readonly string[]) => void;
 }
 /**
  * Build the combined UserPromptSubmit additionalContext string. Returns "" when

package/dist/core/agents/render/prompt-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-context.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/render/prompt-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAgDH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;8EAC0E;IAC1E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;kFAC8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;kFAC8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;uEACmE;IACnE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;wBAIoB;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAkFnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CA6CtF"}
+{"version":3,"file":"prompt-context.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/render/prompt-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAiDH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;8EAC0E;IAC1E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;kFAC8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;kFAC8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;uEACmE;IACnE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;wBAIoB;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;CAC3D;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CA8EnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CA6CtF"}

package/dist/core/agents/render/prompt-context.js

@@ -37,13 +37,14 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, w
 import { join } from "node:path";
 import { coordEnv } from "../../../lib/env.js";
 import { endOfTurnStatusCommand, hostPromptReminder, resolveBinName } from "../../config.js";
+import { formatPeerInbox, peerInbox } from "../../inbox/peer-messages.js";
 import { readRemoteMachines } from "../../presence/index.js";
 import { readResourceStatus } from "../../resources/status.js";
-import { drainMailbox, formatMailboxDelivery } from "../mailbox.js";
 import { sessionNameDisplayBlock, sessionNameDisplayPending } from "../session-name-display.js";
 import { heartbeatPath } from "../state/heartbeat-reader.js";
 import { readLiveCoordinationRow, readLiveCoordinationRows, } from "../state/live-coordination-view.js";
-import { formatPendingCouncils, recordDeliveredMessages } from "./session-context.js";
+import { forkRelationLabels } from "../state/names.js";
+import { formatPendingCouncils } from "./session-context.js";
 /**
  * Build the combined UserPromptSubmit additionalContext string. Returns "" when
  * nothing has changed since the last call (so the caller can skip the JSON emit).
@@ -59,16 +60,12 @@ export function renderPromptContext(opts) {
     // Every name-addressed section below (messages, councils) is silently
     // skipped without it.
     const resolvedName = agentName ?? readLiveCoordinationRow(coordRoot, instanceId)?.name;
-    // 1. Peer messages. Drained first and never deduped: a message is delivered
-    // exactly once, and it is the one section here that carries new information
-    // from another agent rather than a reminder.
-    //
-    if (resolvedName) {
-        const delivered = drainMailbox(coordRoot, resolvedName);
-        if (delivered.length > 0) {
-            recordDeliveredMessages(instanceId, delivered);
-            sections.push(formatMailboxDelivery(coordRoot, delivered));
-        }
+    // 1. Instance-bound messages. Rendering is read-only; failed output leaves
+    // this same batch pending rather than losing it before a prompt sees it.
+    const delivered = peerInbox(coordRoot).prepareSurface(instanceId);
+    if (delivered.length > 0) {
+        opts.onInboxPrepared?.(delivered.map(({ message_id }) => message_id));
+        sections.push(formatPeerInbox(coordRoot, delivered));
     }
     // 2. Peer table with hash dedup.
     const peerTable = computePeerTableIfChanged(coordRoot, instanceId, sessionId);
@@ -337,7 +334,7 @@ function computePeerTableIfChanged(coordRoot, selfInstanceId, selfSessionIdFallb
     if (oldHash && oldHash === newHash)
         return "";
     // Render peer table via the same formatter used at SessionStart.
-    const local = formatPeerTable(peers, mySessionId);
+    const local = formatPeerTable(peers, mySessionId, forkRelationLabels(coordRoot, selfInstanceId, new Set(peers.map((p) => p.instance_id ?? ""))));
     const remoteTable = formatRemoteTable(remote);
     const table = [local, remoteTable].filter(Boolean).join("\n\n");
     if (!table)
@@ -458,7 +455,7 @@ function writeHashFile(path, value) {
  * intentionally co-located here so the prompt-context renderer is self-contained
  * (no cross-file imports of formatting internals). If both renderers diverge,
  * pull the shared bits into a small util module. */
-function formatPeerTable(peers, mySessionId) {
+function formatPeerTable(peers, mySessionId, relations = new Map()) {
     if (peers.length === 0)
         return "";
     const nowSec = Math.floor(Date.now() / 1000);
@@ -474,9 +471,13 @@ function formatPeerTable(peers, mySessionId) {
         .map((p) => {
         const folded = fold[p.instance_id ?? ""] ?? [];
         const display = Array.from(new Set([...(p.files_touched ?? []), ...folded])).sort();
-        return { ...p, display_files: display };
+        const relation = relations.get(p.instance_id ?? "");
+        return { ...p, display_files: display, ...(relation ? { relation } : {}) };
     });
-    const blocking = rows.filter((p) => p.session_id !== mySessionId).sort(byStartedAt);
+    // Related sessions sort first so a fork parent never hides in "+N more".
+    const blocking = rows
+        .filter((p) => p.session_id !== mySessionId)
+        .sort((a, b) => Number(!!b.relation) - Number(!!a.relation) || byStartedAt(a, b));
     const group = rows.filter((p) => p.session_id === mySessionId).sort(byStartedAt);
     const out = [];
     const blk = renderSubtable(blocking, "Other agent groups active (their files block you):", nowSec);
@@ -508,7 +509,8 @@ function formatRow(r, nowSec) {
     // Prefer a short instance_id over a bare "unknown" so an incomplete row is
     // still identifiable.
     const label = r.name ?? (r.instance_id ? r.instance_id.slice(0, 8) : "unknown");
-    return `  - agent-${label}${taskPart}   (${statePart}, ${ageFrom}, ${filesPart})`;
+    const relation = r.relation ? ` [${r.relation}]` : "";
+    return `  - agent-${label}${relation}${taskPart}   (${statePart}, ${ageFrom}, ${filesPart})`;
 }
 function formatState(r) {
     const activity = r.activity ?? "unknown";