instar 1.3.732 → 1.3.733

package/dist/core/ConversationRegistry.d.ts

@@ -1,3 +1,4 @@
+import { ConversationTuple } from './conversationIdentity.js';
 /** Entry origins (§3.4). `deliverToConversation` resolves ONLY the three local
  *  origins; a pure `replicated` entry is read-context (KYP, §3.5). */
 export type ConversationOrigin = 'adopted-legacy-hash' | 'minted-probed' | 'adopted-replicated' | 'replicated';
@@ -95,6 +96,16 @@ export interface ConversationRegistryDeps {
     snapshotAdaptiveStep?: number;
     snapshotMaxIntervalMs?: number;
 }
+/** §5.0(a) pinned E1 constants (R3-M1/R7-M2). Exported for the §10 tests. */
+export declare const AMBIGUOUS_DEDUP_TTL_MS = 604800000;
+export declare const CONTENT_HASH_DEDUP_WINDOW_MS = 900000;
+/** §5.0(a) pathological TRIPWIRE, not a correctness bound (R4-M2/R5-minor-1):
+ *  reached-with-all-live raises ONE aggregated attention item while the new
+ *  entry is STILL journaled + retained — nothing is ever dropped. */
+export declare const AMBIGUOUS_SENDS_HARD_CAP = 1000;
+/** §5.1 reachability flap dampening (R3-minor). */
+export declare const REACHABILITY_FLAP_THRESHOLD = 3;
+export declare const REACHABILITY_FLAP_WINDOW_MS = 86400000;
 export declare class ConversationRegistry {
     private readonly d;
     private readonly snapshotPath;
@@ -109,6 +120,11 @@ export declare class ConversationRegistry {
     private bindPins;
     private ambiguousSends;
     private sendIntents;
+    /** R9-minor-1: parseable send-intent lines with the lane field STRIPPED —
+     *  resolved toward RETRY at replay, surfaced once (never a suppressor). */
+    private missingLaneIntents;
+    /** §5.1 reachability flap tracking (in-memory, advisory — R3-minor). */
+    private reachabilityFlips;
     private workspacePin;
     private seqCounter;
     private snapshotHighWaterSeq;
@@ -224,6 +240,12 @@ export declare class ConversationRegistry {
     resolve(id: number): ConversationDescriptor | null;
     /** Forward lookup by canonical key OR transport sessionKey — mints NOTHING (§8). */
     resolveByKey(keyOrSessionKey: string): ConversationDescriptor | null;
+    /**
+     * §4 READ-ONLY id for a routing key (integration-nit): the existing entry's
+     * id, else the B6 collision-checked candidate — NEVER a registration. A pure
+     * comparison callsite must not acquire a get-or-create WRITE side-effect.
+     */
+    readIdForRoutingKey(routingKey: string): number | null;
     /**
      * `idForSessionKey` — GET-OR-CREATE (§6.0 #12, a named mint chokepoint).
      * Positive numeric session keys pass through; Slack routing keys mint.
@@ -239,6 +261,79 @@ export declare class ConversationRegistry {
     }>;
     aliasTable(): Record<string, number>;
     entryCount(): number;
+    /**
+     * Record a durable bind on a minted id (§3.5.2 property 2/4): the pin binds
+     * the id to the TUPLE it resolves to AT BIND TIME, refcounted per live
+     * binding, journaled (`op:"bind-pin"`, fsynced — the bind's own WAL line).
+     * Returns the bind-time tuple (the caller denormalizes it as `boundTuple`
+     * onto the binding record — property 5), or null when the id is unresolvable.
+     */
+    bindPin(id: number): ConversationTuple | null;
+    /** Release one refcount on a bind-pin (`op:"bind-release"`, §3.5.2 property 4).
+     *  The pin is released only at ZERO — a commitment closing never strands a
+     *  still-live sibling binding on the same id. No-op on a missing pin. */
+    bindRelease(id: number): void;
+    /** The live bind-pin tuple for an id (delivery-time overlay read — §3.5.2 property 3). */
+    getBindPinTuple(id: number): ConversationTuple | null;
+    private sendGuardKey;
+    /**
+     * Durable SEND-INTENT (R6-M1): appended+fsynced BEFORE the transport send,
+     * stamped with the caller's lane (R8-M1 — the boot-conversion discriminator,
+     * never inferred from the id's shape at boot).
+     */
+    recordSendIntent(conversationId: number, logicalSendId: string, lane: 'logical' | 'content-hash'): void;
+    /**
+     * Record the E1 suppressor entry — ONLY on a likely-posted outcome (success
+     * or ambiguous/ack-lost; NEVER a clean transient failure — R2-security-NEW-3).
+     * Durable (`op:"ambiguous-send"`, fsynced — R4-M2); resolves the pair's
+     * send-intent. The in-memory map is the loaded image of this durable state.
+     */
+    recordLikelyPosted(conversationId: number, logicalSendId: string, lane: 'logical' | 'content-hash'): void;
+    /** Retire a logical send (`op:"send-retire"` — delivered outcome advanced the
+     *  seq, or the commitment closed). Idempotent; also resolves the intent. */
+    retireSend(conversationId: number, logicalSendId: string): void;
+    /** Resolve a send-intent WITHOUT a suppressor (`op:"send-intent-resolved"`) —
+     *  the clean-transient-failure path (positive evidence the message never
+     *  posted), so the retry is NOT suppressed (R2-security-NEW-3/R6-M1). */
+    resolveSendIntent(conversationId: number, logicalSendId: string): void;
+    /**
+     * The E1 suppression read (§5.0(a) R3-M1/R7-M2): the LOGICAL lane is
+     * retirement-based (an unretired entry suppresses whenever the re-fire
+     * arrives, bounded only by the 7-day TTL backstop); the CONTENT-HASH lane is
+     * WINDOW-based (a windowless caller has nothing to retire — outside the
+     * 15-min window the same text delivers again).
+     */
+    isSendSuppressed(conversationId: number, logicalSendId: string, lane: 'logical' | 'content-hash'): boolean;
+    /** Prune RETIRED/EXPIRED stragglers only (never a live unretired logical
+     *  entry below its TTL — R4-M2 second arm). An expired content-hash entry
+     *  prunes exactly like a retired one (R7-M2). */
+    pruneSendGuardState(): void;
+    /**
+     * R8-M1 lane-scoped boot conversion of crash-orphaned send-intents: an intent
+     * that is the LAST word for its (conversationId, logicalSendId) PAIR (R7-M3
+     * composite keying — replay already resolved every superseded pair) resolves
+     * BY ITS RECORDED LANE: `logical` (beacon) converts into an ambiguous-send
+     * suppressor (the outcome is genuinely unknown and the beacon has a next
+     * tick); `content-hash` resolves toward RETRY (the suppressed send IS the
+     * message — replay appends the missing send-intent-resolved durably, so the
+     * verdict is decided once, not re-decided every boot). Staged appends land
+     * POST-compose, fsynced before the registry begins serving (R9-low-3 /
+     * R10-minor-1).
+     */
+    private convertOrphanedSendIntents;
+    /**
+     * Flip an entry's LOCAL-authoritative reachability (§5.1). IDEMPOTENT
+     * (already-in-state → no write) and journaled WITHOUT fsync — it rides the
+     * same batched flush, so a mass event coalesces into one write, never an
+     * O(N) write storm on the failure path (scalability-F2). Returns whether the
+     * state changed and whether the conversation is in the R3-minor FLAP-DAMPENED
+     * state (>3 flips in 24h — the caller coalesces its dead-letter attention
+     * into one per-window flap item instead of one per episode).
+     */
+    setReachability(id: number, state: 'ok' | 'unreachable'): {
+        changed: boolean;
+        dampened: boolean;
+    };
     /**
      * Idempotent boot-time ensure: pre-register channel-level conversations from
      * the channel registry with their legacy-hash ids, inside ONE batched-save

package/dist/core/ConversationRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConversationRegistry.d.ts","sourceRoot":"","sources":["../../src/core/ConversationRegistry.ts"],"names":[],"mappings":"AAkDA;sEACsE;AACtE,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GAAG,eAAe,GAAG,oBAAoB,GAAG,YAAY,CAAC;AAE/G,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,wFAAwF;IACxF,YAAY,EAAE,IAAI,GAAG,aAAa,CAAC;IACnC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,IAAI,CAAA;CAAE,GAC5D;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,YAAY,EAAE,IAAI,GAAG,aAAa,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN;;qDAEqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EACL,iBAAiB,GACjB,6BAA6B,GAC7B,oBAAoB,GACpB,iBAAiB,GACjB,gBAAgB,CAAC;CACtB;AAED;0CAC0C;AAC1C,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC1C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EACD,iBAAiB,GACjB,6BAA6B,GAC7B,iCAAiC,GACjC,oCAAoC,GACpC,cAAc,CAAC;CACpB,CAAC;AAEN,qFAAqF;AACrF,eAAO,MAAM,WAAW,gJAUd,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAmBrD,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC;;iFAE6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,0EAA0E;IAC1E,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC;IACnC,+EAA+E;IAC/E,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC;IACvC,2GAA2G;IAC3G,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC/C,8EAA8E;IAC9E,qBAAqB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACjD,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;qEACiE;IACjE,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAwBD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA2B;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAGrC,OAAO,CAAC,aAAa,CAAwC;IAC7D,OAAO,CAAC,IAAI,CAAwC;IACpD,OAAO,CAAC,OAAO,CAAwC;IACvD,OAAO,CAAC,OAAO,CAA6B;IAG5C,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,oBAAoB,CAA6B;IACzD,OAAO,CAAC,aAAa,CAAkC;IAGvD,OAAO,CAAC,QAAQ,CAAmF;IACnG,OAAO,CAAC,cAAc,CAA6C;IACnE,OAAO,CAAC,WAAW,CAAwE;IAE3F,OAAO,CAAC,YAAY,CAAkG;IAGtH,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,YAAY,CAAK;IACzB,gGAAgG;IAChG,OAAO,CAAC,mBAAmB,CAA0C;IAGrE,OAAO,CAAC,aAAa,CAA+B;IACpD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,aAAa,CAAS;IAG9B,OAAO,CAAC,cAAc,CAAgH;IACtI,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,YAAY,CAA0C;IAC9D,OAAO,CAAC,gBAAgB,CAAK;IAG7B,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,qBAAqB,CAAuB;IACpD,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,aAAa,CAAgF;IACrG,OAAO,CAAC,MAAM,CAAS;gBAEX,IAAI,EAAE,wBAAwB;IAM1C,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,GAAG;IAQX,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,gBAAgB;IAYxB;sEACkE;IAClE,IAAI,IAAI,IAAI;IA4BZ,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,YAAY;IAmDpB,mFAAmF;IACnF,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,aAAa;IAoFrB,uFAAuF;IACvF,OAAO,CAAC,kBAAkB;IAiG1B,OAAO,CAAC,UAAU;IAMlB,qFAAqF;IACrF,OAAO,CAAC,qBAAqB;IAmB7B;;uDAEmD;IACnD,OAAO,CAAC,0BAA0B;IAYlC;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAsBrB,OAAO,CAAC,QAAQ;IAahB,OAAO,CAAC,qBAAqB;IA0B7B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IA+B5B,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,gBAAgB;IAgBxB,4EAA4E;IACtE,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAoCpC,OAAO,CAAC,wBAAwB;IAUhC,iFAAiF;IACjF,UAAU,IAAI,IAAI;IAIlB,QAAQ,IAAI,IAAI;IAShB;;mDAE+C;IAC/C,OAAO,CAAC,iBAAiB;IASzB,+EAA+E;IAC/E,OAAO,CAAC,oBAAoB;IAM5B;;;OAGG;IACH,OAAO,CAAC,cAAc;IA8BtB,oGAAoG;IACpG,OAAO,CAAC,aAAa;IAuBrB;;;;OAIG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;IAOhF;;;;;OAKG;IACH,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;IAuCvF,0EAA0E;IAC1E,OAAO,CAAC,qBAAqB;IA2B7B,OAAO,CAAC,SAAS;IAsHjB,OAAO,CAAC,aAAa;IAQrB;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAS5B;oEACgE;IAChE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IAqBlD,oFAAoF;IACpF,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IAYpE;;;OAGG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAMlD,uDAAuD;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAYpG,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKpC,UAAU,IAAI,MAAM;IASpB;;;;;;OAMG;IACH,eAAe,CACb,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EACrD,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GACnD;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE;IAgCnD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAuDjC,mDAAmD;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAgB7B"}
+{"version":3,"file":"ConversationRegistry.d.ts","sourceRoot":"","sources":["../../src/core/ConversationRegistry.ts"],"names":[],"mappings":"AAoCA,OAAO,EACL,iBAAiB,EAWlB,MAAM,2BAA2B,CAAC;AAEnC;sEACsE;AACtE,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GAAG,eAAe,GAAG,oBAAoB,GAAG,YAAY,CAAC;AAE/G,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,wFAAwF;IACxF,YAAY,EAAE,IAAI,GAAG,aAAa,CAAC;IACnC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,IAAI,CAAA;CAAE,GAC5D;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,YAAY,EAAE,IAAI,GAAG,aAAa,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN;;qDAEqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EACL,iBAAiB,GACjB,6BAA6B,GAC7B,oBAAoB,GACpB,iBAAiB,GACjB,gBAAgB,CAAC;CACtB;AAED;0CAC0C;AAC1C,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC1C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EACD,iBAAiB,GACjB,6BAA6B,GAC7B,iCAAiC,GACjC,oCAAoC,GACpC,cAAc,CAAC;CACpB,CAAC;AAEN,qFAAqF;AACrF,eAAO,MAAM,WAAW,gJAUd,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAmBrD,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC;;iFAE6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,0EAA0E;IAC1E,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC;IACnC,+EAA+E;IAC/E,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC;IACvC,2GAA2G;IAC3G,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC/C,8EAA8E;IAC9E,qBAAqB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACjD,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;qEACiE;IACjE,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAgBD,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAChD,eAAO,MAAM,4BAA4B,SAAS,CAAC;AACnD;;qEAEqE;AACrE,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAC7C,eAAO,MAAM,2BAA2B,WAAW,CAAC;AAUpD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA2B;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAGrC,OAAO,CAAC,aAAa,CAAwC;IAC7D,OAAO,CAAC,IAAI,CAAwC;IACpD,OAAO,CAAC,OAAO,CAAwC;IACvD,OAAO,CAAC,OAAO,CAA6B;IAG5C,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,oBAAoB,CAA6B;IACzD,OAAO,CAAC,aAAa,CAAkC;IAGvD,OAAO,CAAC,QAAQ,CAAmF;IACnG,OAAO,CAAC,cAAc,CAAgF;IACtG,OAAO,CAAC,WAAW,CAAwE;IAC3F;+EAC2E;IAC3E,OAAO,CAAC,kBAAkB,CAAK;IAC/B,wEAAwE;IACxE,OAAO,CAAC,iBAAiB,CAA+B;IAExD,OAAO,CAAC,YAAY,CAAkG;IAGtH,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,YAAY,CAAK;IACzB,gGAAgG;IAChG,OAAO,CAAC,mBAAmB,CAA0C;IAGrE,OAAO,CAAC,aAAa,CAA+B;IACpD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,aAAa,CAAS;IAG9B,OAAO,CAAC,cAAc,CAAgH;IACtI,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,YAAY,CAA0C;IAC9D,OAAO,CAAC,gBAAgB,CAAK;IAG7B,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,qBAAqB,CAAuB;IACpD,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,aAAa,CAAgF;IACrG,OAAO,CAAC,MAAM,CAAS;gBAEX,IAAI,EAAE,wBAAwB;IAM1C,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,GAAG;IAQX,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,gBAAgB;IAYxB;sEACkE;IAClE,IAAI,IAAI,IAAI;IAqCZ,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,YAAY;IAwDpB,mFAAmF;IACnF,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,aAAa;IAoFrB,uFAAuF;IACvF,OAAO,CAAC,kBAAkB;IAsG1B,OAAO,CAAC,UAAU;IAMlB,qFAAqF;IACrF,OAAO,CAAC,qBAAqB;IAmB7B;;uDAEmD;IACnD,OAAO,CAAC,0BAA0B;IAYlC;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAsBrB,OAAO,CAAC,QAAQ;IAahB,OAAO,CAAC,qBAAqB;IA0B7B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IA+B5B,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,gBAAgB;IAgBxB,4EAA4E;IACtE,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAoCpC,OAAO,CAAC,wBAAwB;IAUhC,iFAAiF;IACjF,UAAU,IAAI,IAAI;IAIlB,QAAQ,IAAI,IAAI;IAShB;;mDAE+C;IAC/C,OAAO,CAAC,iBAAiB;IASzB,+EAA+E;IAC/E,OAAO,CAAC,oBAAoB;IAM5B;;;OAGG;IACH,OAAO,CAAC,cAAc;IA8BtB,oGAAoG;IACpG,OAAO,CAAC,aAAa;IAuBrB;;;;OAIG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;IAOhF;;;;;OAKG;IACH,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;IAuDvF,0EAA0E;IAC1E,OAAO,CAAC,qBAAqB;IA2B7B,OAAO,CAAC,SAAS;IA0HjB,OAAO,CAAC,aAAa;IAQrB;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAS5B;oEACgE;IAChE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IAqBlD,oFAAoF;IACpF,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IAYpE;;;;OAIG;IACH,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAUtD;;;OAGG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAMlD,uDAAuD;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAYpG,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKpC,UAAU,IAAI,MAAM;IASpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAc7C;;6EAEyE;IACzE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAW7B,0FAA0F;IAC1F,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAWrD,OAAO,CAAC,YAAY;IAIpB;;;;OAIG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,IAAI;IAOvG;;;;;OAKG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,IAAI;IAoBzG;gFAC4E;IAC5E,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAU/D;;6EAEyE;IACzE,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAStE;;;;;;OAMG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,OAAO;IAS1G;;qDAEiD;IACjD,mBAAmB,IAAI,IAAI;IAe3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,0BAA0B;IA6BlC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,aAAa,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE;IAuBjG;;;;;;OAMG;IACH,eAAe,CACb,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EACrD,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GACnD;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE;IAgCnD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IA6DjC,mDAAmD;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAgB7B"}

package/dist/core/ConversationRegistry.js

@@ -47,6 +47,16 @@ export const JOURNAL_OPS = [
     'send-intent',
     'send-intent-resolved',
 ];
+/** §5.0(a) pinned E1 constants (R3-M1/R7-M2). Exported for the §10 tests. */
+export const AMBIGUOUS_DEDUP_TTL_MS = 604800000; // 7 days — safety bound ONLY, never the suppression mechanism (logical lane)
+export const CONTENT_HASH_DEDUP_WINDOW_MS = 900000; // 15 min — the fallback lane's WINDOW (mirrors the Telegram exact-duplicate window)
+/** §5.0(a) pathological TRIPWIRE, not a correctness bound (R4-M2/R5-minor-1):
+ *  reached-with-all-live raises ONE aggregated attention item while the new
+ *  entry is STILL journaled + retained — nothing is ever dropped. */
+export const AMBIGUOUS_SENDS_HARD_CAP = 1000;
+/** §5.1 reachability flap dampening (R3-minor). */
+export const REACHABILITY_FLAP_THRESHOLD = 3;
+export const REACHABILITY_FLAP_WINDOW_MS = 86400000; // 24h
 const ENTRY_CEILING = 50000; // §3.4 JSON-store design ceiling
 const ENTRY_THRESHOLD = 40000; // 80% of ceiling — the pinned tripwire (R3-minor)
 const FILE_BYTES_THRESHOLD = 8 * 1024 * 1024; // 80% of ~10MB
@@ -67,10 +77,15 @@ export class ConversationRegistry {
     reservedCanonicals = new Map(); // cand → owning tupleKey
     displacedAssignments = new Map(); // offset → owning tupleKey (GLOBAL — R4-C1)
     candClaimants = new Map(); // cand → claimant tupleKeys
-    // ── §5.0(a)/§3.5.2 journal-applied state (writers land in later increments) ──
+    // ── §5.0(a)/§3.5.2 journal-applied state (writers: §6.1 increment 2) ──
     bindPins = new Map();
     ambiguousSends = new Map();
     sendIntents = new Map();
+    /** R9-minor-1: parseable send-intent lines with the lane field STRIPPED —
+     *  resolved toward RETRY at replay, surfaced once (never a suppressor). */
+    missingLaneIntents = 0;
+    /** §5.1 reachability flap tracking (in-memory, advisory — R3-minor). */
+    reachabilityFlips = new Map();
     workspacePin = null;
     // ── Journal state ──
     seqCounter = 0;
@@ -149,6 +164,11 @@ export class ConversationRegistry {
         this.replayJournal();
         this.rebuildDerivedIndexes();
         this.applyAliasAssignmentFilter(); // R6-M3 pin 2: the disjointness invariant holds at every BOOT fixpoint
+        this.convertOrphanedSendIntents(); // R8-M1 lane-scoped boot conversion (staged post-compose, fsynced before serving — R9-low-3/R10-minor-1)
+        this.pruneSendGuardState();
+        if (this.missingLaneIntents > 0) {
+            this.attention('conversation-registry:missing-lane-intent', 'Conversation registry: send-intent record(s) with a stripped lane field', `${this.missingLaneIntents} parseable send-intent journal record(s) carried no lane discriminator (R9-minor-1). Each was resolved toward RETRY (content-hash treatment — loss is never silent, never a suppressor). This indicates a serialization bug worth a look.`);
+        }
         if (this.unappliedUnknownOps.length > 0) {
             const first = this.unappliedUnknownOps[0];
             const kinds = [...new Set(this.unappliedUnknownOps.map((u) => u.op))].join(', ');
@@ -197,8 +217,12 @@ export class ConversationRegistry {
                 }
             }
             for (const [k, v] of Object.entries(raw.ambiguousSends ?? {})) {
-                if (v && typeof v.recordedAt === 'string')
-                    this.ambiguousSends.set(k, v);
+                if (v && typeof v.recordedAt === 'string') {
+                    this.ambiguousSends.set(k, {
+                        recordedAt: v.recordedAt,
+                        ...(v.lane === 'logical' || v.lane === 'content-hash' ? { lane: v.lane } : {}),
+                    });
+                }
             }
             for (const [k, v] of Object.entries(raw.sendIntents ?? {})) {
                 if (v && (v.lane === 'logical' || v.lane === 'content-hash') && typeof v.seq === 'number')
@@ -411,7 +435,10 @@ export class ConversationRegistry {
             case 'ambiguous-send': {
                 if (typeof rec.conversationId !== 'number' || !rec.logicalSendId)
                     return;
-                this.ambiguousSends.set(`${rec.conversationId}|${rec.logicalSendId}`, { recordedAt: rec.ts });
+                this.ambiguousSends.set(`${rec.conversationId}|${rec.logicalSendId}`, {
+                    recordedAt: rec.ts,
+                    ...(rec.lane === 'logical' || rec.lane === 'content-hash' ? { lane: rec.lane } : {}),
+                });
                 this.sendIntents.delete(`${rec.conversationId}|${rec.logicalSendId}`);
                 return;
             }
@@ -426,7 +453,10 @@ export class ConversationRegistry {
                 if (typeof rec.conversationId !== 'number' || !rec.logicalSendId)
                     return;
                 // Malformed/unknown lane resolves toward RETRY (content-hash treatment)
-                // — R9-minor-1/R10-low-2 (loss-is-never-silent picks retry).
+                // — R9-minor-1/R10-low-2 (loss-is-never-silent picks retry). Counted so
+                // the post-replay boot pass can raise ONE deduped attention item.
+                if (rec.lane !== 'logical' && rec.lane !== 'content-hash')
+                    this.missingLaneIntents++;
                 const lane = rec.lane === 'logical' ? 'logical' : 'content-hash';
                 this.sendIntents.set(`${rec.conversationId}|${rec.logicalSendId}`, { lane, seq: rec.seq });
                 return;
@@ -793,6 +823,19 @@ export class ConversationRegistry {
         const existing = this.byTuple.get(tupleKeyFor(tuple));
         if (existing) {
             this.maybeUpgradeWorkspace(existing);
+            // WAL rule at durable-bind time (§3.3): a pre-existing SPECULATIVE entry
+            // rode the batched snapshot only — its journal line may not exist yet. A
+            // durable binding is not re-derivable after a crash, so ensure the entry
+            // is durably journaled NOW (idempotent op:"mint" re-apply; fsynced)
+            // BEFORE the id is handed to the binding.
+            this.appendJournal({
+                op: 'mint',
+                key: canonicalKeyFor(tuple, existing.workspaceId),
+                tuple: [tuple.platform, tuple.channelId, tuple.threadTs],
+                id: existing.id,
+                origin: existing.origin,
+                hlc: existing.hlc,
+            }, { fsync: true });
             return { ok: true, id: existing.id, created: false };
         }
         const w = this.breakerWindow(tuple.channelId);
@@ -845,6 +888,11 @@ export class ConversationRegistry {
                 existing.label = opts.label; // write-on-change (§3.4 G4)
                 this.scheduleSnapshot();
             }
+            // §5.1 reachability auto-clear: an authenticated inbound on the tuple is
+            // positive evidence the conversation is reachable again (re-invited /
+            // un-archived channel is never stuck).
+            if (existing.reachability === 'unreachable')
+                this.setReachability(existing.id, 'ok');
             return { id: existing.id, created: false, registered: true };
         }
         const routingKey = routingKeyForTuple(tuple);
@@ -997,6 +1045,22 @@ export class ConversationRegistry {
         const entry = this.byTuple.get(tupleKeyFor(tuple));
         return entry ? this.resolve(entry.id) : null;
     }
+    /**
+     * §4 READ-ONLY id for a routing key (integration-nit): the existing entry's
+     * id, else the B6 collision-checked candidate — NEVER a registration. A pure
+     * comparison callsite must not acquire a get-or-create WRITE side-effect.
+     */
+    readIdForRoutingKey(routingKey) {
+        this.load();
+        const tuple = tupleForRoutingKey(routingKey);
+        if (!tuple)
+            return null;
+        const tKey = tupleKeyFor(tuple);
+        const existing = this.byTuple.get(tKey);
+        if (existing)
+            return existing.id;
+        return this.collisionCheckedRead(candidateIdForRoutingKey(routingKey), tKey);
+    }
     /**
      * `idForSessionKey` — GET-OR-CREATE (§6.0 #12, a named mint chokepoint).
      * Positive numeric session keys pass through; Slack routing keys mint.
@@ -1030,6 +1094,223 @@ export class ConversationRegistry {
         return this.conversations.size;
     }
     // ─────────────────────────────────────────────────────────────────────────
+    // Bind-pin overlay (§3.5.2 — increment 2 writers)
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Record a durable bind on a minted id (§3.5.2 property 2/4): the pin binds
+     * the id to the TUPLE it resolves to AT BIND TIME, refcounted per live
+     * binding, journaled (`op:"bind-pin"`, fsynced — the bind's own WAL line).
+     * Returns the bind-time tuple (the caller denormalizes it as `boundTuple`
+     * onto the binding record — property 5), or null when the id is unresolvable.
+     */
+    bindPin(id) {
+        this.load();
+        const entry = this.byId.get(this.aliases.get(id) ?? id);
+        if (!entry)
+            return null;
+        const tuple = ['slack', entry.channelId, entry.threadTs];
+        const pin = this.bindPins.get(id);
+        const refcount = pin ? pin.refcount + 1 : 1;
+        if (pin)
+            pin.refcount = refcount;
+        else
+            this.bindPins.set(id, { tuple, refcount });
+        this.appendJournal({ op: 'bind-pin', id, tuple, refcount }, { fsync: true });
+        this.scheduleSnapshot();
+        return { platform: 'slack', channelId: entry.channelId, threadTs: entry.threadTs };
+    }
+    /** Release one refcount on a bind-pin (`op:"bind-release"`, §3.5.2 property 4).
+     *  The pin is released only at ZERO — a commitment closing never strands a
+     *  still-live sibling binding on the same id. No-op on a missing pin. */
+    bindRelease(id) {
+        this.load();
+        const pin = this.bindPins.get(id);
+        if (!pin)
+            return;
+        const refcount = pin.refcount - 1;
+        this.appendJournal({ op: 'bind-release', id, refcount }, { fsync: true });
+        if (refcount <= 0)
+            this.bindPins.delete(id);
+        else
+            pin.refcount = refcount;
+        this.scheduleSnapshot();
+    }
+    /** The live bind-pin tuple for an id (delivery-time overlay read — §3.5.2 property 3). */
+    getBindPinTuple(id) {
+        this.load();
+        const pin = this.bindPins.get(id);
+        if (!pin)
+            return null;
+        return { platform: 'slack', channelId: pin.tuple[1], threadTs: pin.tuple[2] ?? null };
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // E1 ambiguous-outcome idempotency guard state (§5.0(a) — increment 2 writers)
+    // ─────────────────────────────────────────────────────────────────────────
+    sendGuardKey(conversationId, logicalSendId) {
+        return `${conversationId}|${logicalSendId}`;
+    }
+    /**
+     * Durable SEND-INTENT (R6-M1): appended+fsynced BEFORE the transport send,
+     * stamped with the caller's lane (R8-M1 — the boot-conversion discriminator,
+     * never inferred from the id's shape at boot).
+     */
+    recordSendIntent(conversationId, logicalSendId, lane) {
+        this.load();
+        const seq = this.appendJournal({ op: 'send-intent', conversationId, logicalSendId, lane }, { fsync: true });
+        this.sendIntents.set(this.sendGuardKey(conversationId, logicalSendId), { lane, seq });
+        this.scheduleSnapshot();
+    }
+    /**
+     * Record the E1 suppressor entry — ONLY on a likely-posted outcome (success
+     * or ambiguous/ack-lost; NEVER a clean transient failure — R2-security-NEW-3).
+     * Durable (`op:"ambiguous-send"`, fsynced — R4-M2); resolves the pair's
+     * send-intent. The in-memory map is the loaded image of this durable state.
+     */
+    recordLikelyPosted(conversationId, logicalSendId, lane) {
+        this.load();
+        this.pruneSendGuardState();
+        const key = this.sendGuardKey(conversationId, logicalSendId);
+        this.appendJournal({ op: 'ambiguous-send', conversationId, logicalSendId, lane }, { fsync: true });
+        this.ambiguousSends.set(key, { recordedAt: this.now().toISOString(), lane });
+        this.sendIntents.delete(key);
+        if (this.ambiguousSends.size > AMBIGUOUS_SENDS_HARD_CAP) {
+            // Pathological tripwire (R4-M2 scoped per R5-minor-1): loud, aggregated,
+            // and the new entry is STILL journaled + retained — nothing dropped, so a
+            // silent eviction can never re-open the double-post.
+            this.attention('conversation-registry:send-guard-cap', 'E1 send-guard entry population exceeded its pathological tripwire', `${this.ambiguousSends.size} unretired/unexpired ambiguous-send entries exceed the ${AMBIGUOUS_SENDS_HARD_CAP} cap (§5.0(a)). Live entries are bounded by open beacon commitments (~maxActiveBeacons) by construction — this population means an upstream cap was raised or a retirement path is broken. No entry was evicted or dropped.`);
+        }
+        this.scheduleSnapshot();
+    }
+    /** Retire a logical send (`op:"send-retire"` — delivered outcome advanced the
+     *  seq, or the commitment closed). Idempotent; also resolves the intent. */
+    retireSend(conversationId, logicalSendId) {
+        this.load();
+        const key = this.sendGuardKey(conversationId, logicalSendId);
+        if (!this.ambiguousSends.has(key) && !this.sendIntents.has(key))
+            return;
+        this.appendJournal({ op: 'send-retire', conversationId, logicalSendId }, { fsync: true });
+        this.ambiguousSends.delete(key);
+        this.sendIntents.delete(key);
+        this.scheduleSnapshot();
+    }
+    /** Resolve a send-intent WITHOUT a suppressor (`op:"send-intent-resolved"`) —
+     *  the clean-transient-failure path (positive evidence the message never
+     *  posted), so the retry is NOT suppressed (R2-security-NEW-3/R6-M1). */
+    resolveSendIntent(conversationId, logicalSendId) {
+        this.load();
+        const key = this.sendGuardKey(conversationId, logicalSendId);
+        if (!this.sendIntents.has(key))
+            return;
+        this.appendJournal({ op: 'send-intent-resolved', conversationId, logicalSendId }, { fsync: true });
+        this.sendIntents.delete(key);
+        this.scheduleSnapshot();
+    }
+    /**
+     * The E1 suppression read (§5.0(a) R3-M1/R7-M2): the LOGICAL lane is
+     * retirement-based (an unretired entry suppresses whenever the re-fire
+     * arrives, bounded only by the 7-day TTL backstop); the CONTENT-HASH lane is
+     * WINDOW-based (a windowless caller has nothing to retire — outside the
+     * 15-min window the same text delivers again).
+     */
+    isSendSuppressed(conversationId, logicalSendId, lane) {
+        this.load();
+        const entry = this.ambiguousSends.get(this.sendGuardKey(conversationId, logicalSendId));
+        if (!entry)
+            return false;
+        const age = this.now().getTime() - Date.parse(entry.recordedAt);
+        if (!Number.isFinite(age))
+            return false;
+        return lane === 'content-hash' ? age < CONTENT_HASH_DEDUP_WINDOW_MS : age < AMBIGUOUS_DEDUP_TTL_MS;
+    }
+    /** Prune RETIRED/EXPIRED stragglers only (never a live unretired logical
+     *  entry below its TTL — R4-M2 second arm). An expired content-hash entry
+     *  prunes exactly like a retired one (R7-M2). */
+    pruneSendGuardState() {
+        const nowMs = this.now().getTime();
+        let pruned = false;
+        for (const [key, entry] of this.ambiguousSends) {
+            const age = nowMs - Date.parse(entry.recordedAt);
+            if (!Number.isFinite(age))
+                continue;
+            const horizon = entry.lane === 'content-hash' ? CONTENT_HASH_DEDUP_WINDOW_MS : AMBIGUOUS_DEDUP_TTL_MS;
+            if (age > horizon) {
+                this.ambiguousSends.delete(key);
+                pruned = true;
+            }
+        }
+        if (pruned)
+            this.scheduleSnapshot();
+    }
+    /**
+     * R8-M1 lane-scoped boot conversion of crash-orphaned send-intents: an intent
+     * that is the LAST word for its (conversationId, logicalSendId) PAIR (R7-M3
+     * composite keying — replay already resolved every superseded pair) resolves
+     * BY ITS RECORDED LANE: `logical` (beacon) converts into an ambiguous-send
+     * suppressor (the outcome is genuinely unknown and the beacon has a next
+     * tick); `content-hash` resolves toward RETRY (the suppressed send IS the
+     * message — replay appends the missing send-intent-resolved durably, so the
+     * verdict is decided once, not re-decided every boot). Staged appends land
+     * POST-compose, fsynced before the registry begins serving (R9-low-3 /
+     * R10-minor-1).
+     */
+    convertOrphanedSendIntents() {
+        if (this.sendIntents.size === 0)
+            return;
+        for (const [key, intent] of [...this.sendIntents]) {
+            const sep = key.indexOf('|'); // conversationId prefix is numeric — the FIRST '|' always delimits (§3.4)
+            if (sep <= 0) {
+                this.sendIntents.delete(key);
+                continue;
+            }
+            const conversationId = Number(key.slice(0, sep));
+            const logicalSendId = key.slice(sep + 1);
+            if (!Number.isSafeInteger(conversationId) || !logicalSendId) {
+                this.sendIntents.delete(key);
+                continue;
+            }
+            if (intent.lane === 'logical') {
+                this.appendJournal({ op: 'ambiguous-send', conversationId, logicalSendId, lane: 'logical' }, { fsync: true });
+                this.ambiguousSends.set(key, { recordedAt: this.now().toISOString(), lane: 'logical' });
+            }
+            else {
+                this.appendJournal({ op: 'send-intent-resolved', conversationId, logicalSendId }, { fsync: true });
+            }
+            this.sendIntents.delete(key);
+        }
+        this.scheduleSnapshot();
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Reachability (§5.1 — increment 2 writer)
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Flip an entry's LOCAL-authoritative reachability (§5.1). IDEMPOTENT
+     * (already-in-state → no write) and journaled WITHOUT fsync — it rides the
+     * same batched flush, so a mass event coalesces into one write, never an
+     * O(N) write storm on the failure path (scalability-F2). Returns whether the
+     * state changed and whether the conversation is in the R3-minor FLAP-DAMPENED
+     * state (>3 flips in 24h — the caller coalesces its dead-letter attention
+     * into one per-window flap item instead of one per episode).
+     */
+    setReachability(id, state) {
+        this.load();
+        const entry = this.byId.get(this.aliases.get(id) ?? id);
+        if (!entry)
+            return { changed: false, dampened: false };
+        const nowMs = this.now().getTime();
+        const cutoff = nowMs - REACHABILITY_FLAP_WINDOW_MS;
+        const flips = (this.reachabilityFlips.get(entry.id) ?? []).filter((t) => t > cutoff);
+        if (entry.reachability === state) {
+            this.reachabilityFlips.set(entry.id, flips);
+            return { changed: false, dampened: flips.length > REACHABILITY_FLAP_THRESHOLD };
+        }
+        flips.push(nowMs);
+        this.reachabilityFlips.set(entry.id, flips);
+        entry.reachability = state;
+        this.appendJournal({ op: 'reachability', id: entry.id, reachability: state }, { fsync: false });
+        this.scheduleSnapshot();
+        return { changed: true, dampened: flips.length > REACHABILITY_FLAP_THRESHOLD };
+    }
+    // ─────────────────────────────────────────────────────────────────────────
     // Adoption pass (§6.2)
     // ─────────────────────────────────────────────────────────────────────────
     /**
@@ -1117,6 +1398,12 @@ export class ConversationRegistry {
                 journalQuarantinedAt: this.journalQuarantinedAt,
                 durabilityIncidents: this.durabilityIncidents,
             },
+            // §5.0(a)/§3.5.2 increment-2 observability.
+            sendGuard: {
+                unretiredEntries: this.ambiguousSends.size,
+                unresolvedIntents: this.sendIntents.size,
+                bindPins: this.bindPins.size,
+            },
             // Snapshot-suspension observability (R11-low-1).
             snapshotSuspended: this.unappliedUnknownOps.length > 0,
             firstUnappliedUnknownSeq: this.unappliedUnknownOps[0]?.seq ?? null,