job-application-agent 3.4.2 → 3.5.0

package/README.md

@@ -130,6 +130,8 @@ The bundled CLI handles private profile storage, résumé import, scoring, dupli
 
 Discovery combines the reviewed [`SOURCES.json`](job-application-agent/references/SOURCES.json) catalog with an anonymous community registry. Every confirmed application automatically contributes its canonical public job URL, company, role, application channel, and provider; prior confirmed ledger entries backfill during later commands after a one-command disclosure grace period. Jobs, repeatable boards, and feeds are logged pending and become visible in the public dashboard or CLI only after maintainer review. Disable both forms of community sharing independently from analytics with `sources sharing disable`.
 
+New rounds derive reviewed and qualified totals from private per-lead records, including rejection reasons and revision history. Delivery reconciliation subtracts verified failed emails from effective application totals without erasing history; email access is optional, and sent email without acknowledgement remains labelled receipt unknown. See [accounting](job-application-agent/references/ACCOUNTING.md).
+
 Rounds require recorded attempts across at least three distinct discovery sources, including a successful search, and source attribution for confirmed submissions. If more than 60% of submissions come from one source, the agent must explain the concentration. Blockers and empty results are reported; fit requirements never change to meet a source quota. See [round coverage](job-application-agent/references/RUNS.md#discovery-coverage).
 
 ## 🔐 Privacy

package/job-application-agent/SKILL.md

@@ -28,12 +28,16 @@ Use `scripts/job-application.mjs` for private state and deterministic checks. Re
 
 Never store passwords, MFA codes, government IDs, demographic data, CAPTCHA answers, browser session data, or inferred candidate facts.
 
+## Accounting
+
+Read [references/ACCOUNTING.md](references/ACCOUNTING.md) before recording delivery evidence, recovery attempts, or per-lead discovery. For new rounds, record each lead with `round lead --stdin` and derive source totals from those records. Email access is optional: visible browser success counts, verified email sends count with receipt unknown, and matched final delivery failures correct effective totals. Preserve historical events and use explicit corrections for conflicts.
+
 ## Discover and assess
 
 Read [references/SOURCES.md](references/SOURCES.md) before the first discovery pass in a workflow.
 
 1. Run `sources jobs` for recently confirmed direct job links and `sources list` (optionally filtered) for the highest-signal packaged and maintainer-reviewed discovery sources. Resolve every lead to the direct employer or ATS page.
-   For each round, select at least three distinct relevant discovery sources before applying. Search across them before working deeply through one feed; include alternatives to the previous round's dominant source. Record each actual search, including zero suitable results, or an observed access blocker with `round source --stdin`. Two YC views count as one network; recruiter inboxes and user-supplied links supplement discovery but do not satisfy the three-source minimum. Do not claim that listing the catalog means a board was searched. Keep a blocked source in the report and continue to accessible alternatives.
+   For each round, select at least three distinct relevant discovery sources before applying. Search across them before working deeply through one feed; include alternatives to the previous round's dominant source. Record individual reviewed leads first, then each actual search, including zero suitable results, or an observed access blocker with `round source --stdin`. Two YC views count as one network; recruiter inboxes and user-supplied links supplement discovery but do not satisfy the three-source minimum. Do not claim that listing the catalog means a board was searched. Keep a blocked source in the report and continue to accessible alternatives.
 2. Attribute the lead with coarse `discoverySource`, stable packaged or community `discoverySourceId` when known, and independent `applicationChannel`. Treat a one-off user link as `user-supplied`. Whenever a user or agent discovers a repeatable public board, feed, directory, or careers index that is not already listed, run `sources suggest --stdin`; the CLI contributes its sanitized metadata by default unless community sharing has been disabled.
 3. Verify the application channel immediately before assessment. Mark it `active`, `closed`, or `unclear`.
 4. Classify eligibility only after checking residence, location, work authorization, sponsorship, schedule, and employment type.
@@ -76,7 +80,8 @@ Check `round status` after the initial discovery pass and before submitting. Pre
 - Record outcomes with `ledger outcome --stdin`. Use structured rejection reasons and mark each as `explicit` or `inferred`. Do not treat an inference as a candidate fact.
 - After an interview, optionally record `interviewQuality` (`promising`, `viable`, `weak`, or `dead`) and a bounded `failurePoint`. Keep free-form interview notes private.
 - Rely on idempotent outcome recording; identical events do not append rows or emit duplicate telemetry.
-- Run `ledger review` for canonical unique submissions, duplicate-row counts, mature applications, reasons, interview-quality/failure-point counts, source and fit-score learning segments, and mature-cohort conversions.
+- Audit matched delivery failures with authorized email tools when available; otherwise report delivery not audited and continue. Keep delivery failures separate from hiring rejections.
+- Run `ledger review` for effective canonical unique submissions, duplicate-row counts, mature applications, reasons, interview-quality/failure-point counts, source and fit-score learning segments, and mature-cohort conversions.
 - Review submission hygiene after each ten newly acknowledged unique submissions.
 - Review outcome effectiveness only after at least 20 newly acknowledged applications have aged ten business days.
 - Generate proposals only. Change targeting, profile facts, resume claims, scoring thresholds, or answer guidance only with candidate approval.
@@ -98,6 +103,10 @@ node scripts/job-application.mjs profile field <allowed-field>
 node scripts/job-application.mjs resume import <google-doc-url-or-local-pdf>
 node scripts/job-application.mjs resume path
 node scripts/job-application.mjs score --stdin
+node scripts/job-application.mjs ledger delivery|retry --stdin
+node scripts/job-application.mjs ledger deliveries [application-id]
+node scripts/job-application.mjs round lead --stdin
+node scripts/job-application.mjs round leads [round-id]
 node scripts/job-application.mjs ledger check --stdin
 node scripts/job-application.mjs ledger add --stdin
 node scripts/job-application.mjs ledger outcome --stdin

package/job-application-agent/capabilities.json

@@ -1,5 +1,6 @@
 {
   "capabilities": [
-    "cloud-state-v2"
+    "cloud-state-v2",
+    "application-accounting-v1"
   ]
 }

package/job-application-agent/references/ACCOUNTING.md

@@ -0,0 +1,104 @@
+# Delivery and discovery accounting
+
+## Evidence and effective totals
+
+Browser applications count after visible ATS success. They do not require email access. Email-only applications count after a verified send to an employer-published recruiting address; describe them as **sent, receipt unknown**, not as confirmed receipt. Use authorized email tools when available before completing a round and during outcome reviews. Without access, report "delivery not audited" and continue. The CLI does not connect to Gmail or infer mailbox activity.
+
+Match a final delivery failure to the actual application attempt using its sent message, recipient, timing and returned failure evidence. Temporary delays, unrelated bounces, and hiring rejections are not delivery failures. A failed notification cannot overturn independent browser confirmation. Never guess an alternate address or automatically resend an uncertain transmission.
+
+`ledger review`, `round status`, and `round complete` share one effective-count projection. They expose `recordedSubmissionCount`, `effectiveSubmissionCount`, `failedDeliveryCount`, and `receiptUnknownEmailCount`. Existing `submittedTotal`/`confirmedCount` fields now reflect effective submissions, not proven email receipt. Conversion denominators exclude failed applications while historical outcomes remain visible. Review cadence and acknowledgement checkpoints use recorded canonical submissions and recorded mature applications, so a late failure does not postpone the next review. Public usage events remain historical activity metrics.
+
+A late failure preserves the original completion event. `shortfallCount` and `needsRecovery` flag the deficit; no run starts or round reopens automatically. Review the derived attention queue before a later authorized recovery.
+
+## Record delivery evidence
+
+```text
+node scripts/job-application.mjs ledger delivery --stdin
+node scripts/job-application.mjs ledger deliveries [application-id]
+```
+
+Example stdin (use your actual observation, never this synthetic evidence):
+
+```json
+{
+  "id": "failure-message-123",
+  "applicationId": "application-123",
+  "attemptId": "initial:application-123",
+  "type": "delivery-failed",
+  "occurredAt": "2026-09-13T10:00:00Z",
+  "evidenceType": "final-delivery-failure",
+  "evidence": "Final recipient failure matched to the original sent recruiting message.",
+  "messageRef": "private-provider-message-reference"
+}
+```
+
+Original attempts are derived as `initial:<applicationId>` without rewriting application rows. Evidence types are `employer-acknowledgement`, `final-delivery-failure`, `browser-confirmation`, `sent-email`, `ambiguous`, and `delivery-delay`. Event types are `receipt-confirmed`, `delivery-failed`, and `correction`. For a correction, set `supersedes` to the mistaken event ID (or an array of conflicting IDs), and `status` to `receipt-confirmed`, `delivery-failed`, or `unknown`. Supply new evidence and a new ID. Unknown restores the original transmission status; it does not assert receipt.
+
+Timestamps are required and normalized to UTC. IDs are optional deterministic content hashes; reuse the same input and observation timestamp when replaying an event. Reusing an ID with different content fails. Evidence is limited to 2,000 characters and message references to 500. Both stay private; omit raw email bodies, attachments, credentials, and unrelated personal data.
+
+Contradictory or ambiguous evidence remains counted but enters derived attention and blocks recovery. Resolve it with an explicit correction, rather than `attention resolve`.
+
+## Replacement attempts
+
+Recovery is allowed only when all attempts for the canonical application have verified failures and no conflicting evidence. Recheck employer eligibility and existing candidate authorization, then verify a published replacement channel within 24 hours before transmission. Preserve duplicate checks for every other application.
+
+In cloud mode, acquire the existing application lease and call `cloud intent-prepare --stdin` with the original `applicationId`, replacement `canonicalUrl`, `leaseId`, and `retry: true`. Use the returned intent ID as the new attempt ID. An uncertain transmission uses `cloud intent-sent` and must not be resent. A later confirmation can reconcile that same intent. Eligibility is checked when the intent is prepared; matching verified transmission evidence remains recordable if a later receipt or correction changes the original failure evidence. The confirming host still needs its active lease.
+
+After a verified replacement send, call `ledger retry --stdin`:
+
+```json
+{
+  "id": "replacement-123",
+  "applicationId": "application-123",
+  "attemptId": "returned-cloud-intent-id",
+  "channel": "browser",
+  "url": "https://employer.example/careers/123",
+  "channelVerifiedAt": "2026-09-13T11:00:00Z",
+  "occurredAt": "2026-09-13T11:10:00Z",
+  "approval": "STANDING AUTHORIZATION",
+  "evidenceType": "browser-confirmation",
+  "evidence": "Visible ATS success for the replacement application.",
+  "cloudIntentId": "returned-cloud-intent-id",
+  "cloudLeaseId": "active-lease-id"
+}
+```
+
+For email use `channel: "email"` and `evidenceType: "sent-email"`; the URL identifies the employer-published channel page. With local storage, omit cloud fields and choose a new stable attempt ID. Recovery appends delivery history, never a second application, a second community contribution, or a duplicate submission telemetry event. Revoked authorization, expired leases, and unresolved intents still stop new transmissions.
+
+## Per-lead discovery
+
+```text
+node scripts/job-application.mjs round lead --stdin
+node scripts/job-application.mjs round leads [round-id]
+```
+
+Record each reviewed job or careers page before reporting source totals:
+
+```json
+{
+  "roundId": "round-123",
+  "sourceId": "indeed",
+  "url": "https://employer.example/jobs/123",
+  "company": "Example Employer",
+  "role": "Senior Engineer",
+  "employerJobId": "REQ-123",
+  "disposition": "qualified",
+  "observedAt": "2026-09-13T09:00:00Z",
+  "evidence": "Active posting meets the unchanged eligibility and evidence requirements.",
+  "applicationId": "application-123"
+}
+```
+
+Dispositions: `qualified`, `duplicate`, `no-relevant-opening`, `location-authorization-conflict`, `compensation-below-floor`, `seniority-mismatch`, `insufficient-must-have-coverage`, `closed-stale`, `blocked`. Role, employer job ID and application ID are optional during initial discovery; link the actual application ID before round completion. Use `supersedes` and a new event ID when revising an assessment or adding the application link.
+
+A verified employer job ID merges requisition aliases. Without it, canonical URLs identify leads. Known tracking parameters are removed; unfamiliar parameters are preserved because they may identify distinct requisitions. Company punctuation and whitespace are normalized for verified requisition identity. A later verified ID can enrich the same URL. Repeated sightings do not increase counts; independent sources retain their sightings while unique totals deduplicate requisitions. Distinct requisitions remain separate. Conflicting revisions require an explicit superseding assessment and appear in attention. Existing-lead corrections remain possible after completion without reopening the round.
+
+New rounds store `discoveryPolicyVersion: 2`. `round source` still records real searches and blockers; its optional `reviewedCount` and `qualifiedCount` are assertions against recorded leads. Empty searches may have zero leads with search evidence. New rounds cannot complete without qualified lead/application linkage and resolved assessment conflicts. Always record real submissions even if that audit is incomplete.
+
+Existing rounds retain their historical policy and unsupported aggregates are marked `legacy-unverified`. Unfamiliar historical discovery records remain untouched. The three-source minimum and 60% concentration-explanation rule are unchanged.
+
+## Cloud compatibility and privacy
+
+The optional private backend must advertise `application-accounting-v1`. Deploy the updated Worker before installing the new client on cloud-configured hosts. Missing capability produces an upgrade error. A previously verified backend permits cached research and durable observed-evidence recording during a network outage, but never a new transmission intent.
+
+Delivery/discovery evidence stays in owner-only local streams or the authenticated private backend, and is included in private export and backup/restore. It never enters analytics or community sharing. Reconciliation uses stable event IDs and detects conflicts instead of selecting whichever record arrived last. Initial local-history import uses the existing `cloud reconcile` workflow; do not append new cloud recovery attempts through generic record APIs.

package/job-application-agent/references/CLOUD_STATE.md

@@ -17,3 +17,5 @@ Browser sessions, Gmail credentials, passwords, verification codes, CAPTCHA resp
 Normal profile, résumé, ledger, outcome, round, attention, review, and friction commands automatically reconcile through the configured backend. `cloud export` creates an owner-only JSON archive. During a cloud outage, continue cached research and drafts but do not transmit a new application.
 
 For a shared Linux host where Codex and another agent need separate credentials, follow [`VPS_CLIENTS.md`](VPS_CLIENTS.md). Keep a single scheduler and rely on the D1 lease—not local process assumptions—to enforce the one-writer rule.
+
+Accounting clients require the `application-accounting-v1` backend capability. Deploy Worker support before upgrading cloud-configured clients. Delivery and discovery streams participate in private reconciliation, export, and backup/restore. See [ACCOUNTING.md](ACCOUNTING.md).

package/job-application-agent/references/RUNS.md

@@ -21,6 +21,9 @@ Start input: `{ "requestedCount": 30 }`. Complete input: `{ "roundId": "round-..
 
 ## Discovery coverage
 
+For new rounds, first record every reviewed lead with `round lead --stdin`; see [ACCOUNTING.md](ACCOUNTING.md) for fields, revisions, and delivery accounting. Source counts are derived from those lead records. The optional counts in the example below are assertions and require matching records. Existing rounds retain legacy, unverified aggregate reports.
+
+
 Before submitting, search at least three relevant independent sources from `sources list`, including alternatives to the last round's dominant source. Listing the catalog or browsing multiple jobs on one board is not source coverage. Record a report after each actual search or observed access blocker:
 
 ```json
@@ -56,6 +59,9 @@ Coverage reports emit bounded `source_checked` analytics automatically. Only all
 
 ## Submission accounting
 
+Before completion, audit final email delivery failures through authorized email tools when available; otherwise report delivery not audited and continue. Verified email sends count with receipt unknown. Use `ledger delivery` to record matched failures, never `ledger outcome rejected`. Effective totals exclude failed attempts; completed rounds retain their completion record and expose a recovery shortfall. See [ACCOUNTING.md](ACCOUNTING.md) for safe linked replacement attempts.
+
+
 Count only unique applications with a visible employer/ATS confirmation or a verified sent recruiting email that were also added to the ledger with the same `roundId`. Filled forms, blockers, drafts, unsent email, and ambiguous confirmations never count. `round complete` rejects an under-target round.
 
 Run both company-level and requisition-level duplicate checks before filling and again immediately before transmission. Hard ledger-ID, canonical-URL, employer-job-ID, and requisition duplicates always stop. Same-role aliases require a verified distinct requisition and `NEW REQUISITION CONFIRMED`. A genuinely different role at the same company may proceed automatically only when `companyReapply.decision` is `eligible-after-cooldown`: 15 full days have passed since the latest company application and no outcome has been recorded. `cooldown-active` and `follow-up-present` require explicit candidate approval.

package/job-application-agent/references/SCHEMAS.md

@@ -221,3 +221,7 @@ Generate `ledger review` first. Acknowledge only after the candidate has reviewe
 The acknowledgement stores the current canonical unique-submission and mature-application counts in append-only `reviews.ndjson`.
 
 `ledger review` also returns `interviewLearningSegments`. Each row combines the canonical application's source and ten-point fit-score band with the latest recorded interview quality and failure point, plus a count. This supports evidence-based targeting reviews without exposing private notes or automatically changing score weights.
+
+## Delivery and per-lead accounting
+
+See [ACCOUNTING.md](ACCOUNTING.md) for versioned delivery events, explicit corrections, linked retry evidence, lead dispositions/revisions, and effective round/review output fields. These streams are private and append-only; they never become telemetry properties.

package/job-application-agent/scripts/application-accounting.mjs

@@ -0,0 +1,246 @@
+// Shared by the packaged CLI and private Worker. No candidate state or network access.
+import { createHash } from 'node:crypto';
+
+export const ACCOUNTING_CAPABILITY = 'application-accounting-v1';
+export const DISPOSITIONS = Object.freeze(['qualified', 'duplicate', 'no-relevant-opening', 'location-authorization-conflict', 'compensation-below-floor', 'seniority-mismatch', 'insufficient-must-have-coverage', 'closed-stale', 'blocked']);
+const DELIVERY_TYPES = ['receipt-confirmed', 'delivery-failed', 'correction', 'retry-confirmed'];
+const EVIDENCE_TYPES = ['employer-acknowledgement', 'final-delivery-failure', 'browser-confirmation', 'sent-email', 'ambiguous', 'delivery-delay'];
+function required(value, name, max = 300) {
+  if (typeof value !== 'string' || !value.trim() || value.length > max) throw new Error(`${name} must be nonempty text (maximum ${max}).`);
+  return value;
+}
+function date(value, name) { required(value, name, 80); if (!Number.isFinite(Date.parse(value))) throw new Error(`${name} must be an ISO date.`); return new Date(value).toISOString(); }
+function object(input, allowed) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Accounting event must be an object.');
+  for (const key of Object.keys(input)) if (!allowed.includes(key)) throw new Error(`Unknown accounting field: ${key}.`);
+}
+export function canonicalUrl(value) {
+  const url = new URL(required(value, 'url', 2048));
+  if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password) throw new Error('A public HTTP(S) URL is required.');
+  url.hash = '';
+  // Unknown parameters may identify a requisition (for example SAP career_job_req_id).
+  for (const key of [...url.searchParams.keys()]) if (/^(utm_.*|ref|refid|referrer|source|gh_src|tracking_?id|trk|trkinfo|gclid|fbclid|msclkid|mc_cid|mc_eid|lever-source|lever-origin)$/i.test(key)) url.searchParams.delete(key);
+  url.searchParams.sort();
+  url.pathname = url.pathname.replace(/\/+$/, '') || '/';
+  return url.href;
+}
+export function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(',')}]`;
+  if (value && typeof value === 'object') return `{${Object.keys(value).sort().map(k => `${JSON.stringify(k)}:${stableJson(value[k])}`).join(',')}}`;
+  return JSON.stringify(value);
+}
+const digest = value => createHash('sha256').update(stableJson(value)).digest('hex');
+export function eventId(value, prefix) { return `${prefix}-${digest(value)}`; }
+export function validateDelivery(input) {
+  object(input, ['version','id','applicationId','attemptId','type','occurredAt','evidenceType','evidence','messageRef','supersedes','status','channel','url','channelVerifiedAt','approval']);
+  const v = { ...input, version: 1 };
+  if (input.version != null && input.version !== 1) throw new Error('Unsupported delivery version.');
+  for (const name of ['applicationId','attemptId']) required(v[name], name);
+  if (!DELIVERY_TYPES.includes(v.type)) throw new Error('Invalid delivery type.');
+  if (!EVIDENCE_TYPES.includes(v.evidenceType)) throw new Error('Invalid evidenceType.');
+  required(v.evidence, 'evidence', 2000);
+  v.occurredAt = date(v.occurredAt, 'occurredAt');
+  if (v.messageRef != null) required(v.messageRef, 'messageRef', 500);
+  if (v.type === 'correction') {
+    if (!['receipt-confirmed','delivery-failed','unknown'].includes(v.status)) throw new Error('Invalid correction status.');
+    const refs = Array.isArray(v.supersedes) ? v.supersedes : [v.supersedes];
+    if (!refs.length || refs.length > 100) throw new Error('Correction requires superseded event IDs.');
+    refs.forEach(ref => required(ref,'supersedes'));
+    v.supersedes = [...new Set(refs)].sort();
+  } else if (v.supersedes != null || v.status != null) throw new Error('Only corrections supersede delivery evidence.');
+  if (v.type === 'retry-confirmed') {
+    if (!['email','browser'].includes(v.channel)) throw new Error('Retry channel must be email or browser.');
+    v.url = canonicalUrl(v.url);
+    v.channelVerifiedAt = date(v.channelVerifiedAt,'channelVerifiedAt');
+    if (Date.parse(v.channelVerifiedAt) > Date.parse(v.occurredAt) || Date.parse(v.occurredAt) - Date.parse(v.channelVerifiedAt) > 86400000) throw new Error('Retry channel must be verified within 24 hours before transmission.');
+    if (!['STANDING AUTHORIZATION','APPROVE SUBMIT'].includes(v.approval)) throw new Error('Retry requires existing candidate authorization.');
+    if (v.evidenceType !== (v.channel === 'email' ? 'sent-email' : 'browser-confirmation')) throw new Error('Retry requires verified transmission evidence.');
+    if (v.attemptId.startsWith('initial:')) throw new Error('Retry requires a new attemptId.');
+  } else if (['channel','url','channelVerifiedAt','approval'].some(k => v[k] != null)) throw new Error('Transmission fields are only allowed on retry-confirmed.');
+  v.id ??= eventId(v, 'delivery');
+  required(v.id, 'id');
+  return v;
+}
+
+// A revision graph, never last-write-wins. Different children of one revision conflict.
+function heads(events) {
+  const versions = new Map();
+  for (const e of events) {
+    const key = stableJson(e);
+    if (!versions.has(e.id)) versions.set(e.id, new Map());
+    versions.get(e.id).set(key, e);
+  }
+  const all = [...versions.values()].flatMap(v => [...v.values()]);
+  const invalidIds = new Set([...versions].filter(([,v]) => v.size > 1).map(([id]) => id));
+  const referenced = new Set(all.flatMap(e => e.supersedes == null ? [] : Array.isArray(e.supersedes) ? e.supersedes : [e.supersedes]));
+  const missing = [...referenced].some(id => !versions.has(id));
+  const current = all.filter(e => !referenced.has(e.id));
+  return { current, conflict: invalidIds.size > 0 || missing || (all.length > 0 && !current.length) };
+}
+function refs(event) { return event.supersedes == null ? [] : Array.isArray(event.supersedes) ? event.supersedes : [event.supersedes]; }
+const normalized = value => String(value ?? '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
+export function accountingApplicationKey(entry, fallback = '') {
+  if (entry.employerJobId) return `job:${normalized(entry.company)}:${String(entry.employerJobId).toLowerCase()}`;
+  if (entry.company && entry.role) return `legacy-role:${normalized(entry.company)}:${normalized(entry.role)}`;
+  if (entry.url) return `url:${canonicalUrl(entry.url).replace(/\/$/, '').toLowerCase()}`;
+  return `id:${entry.id ?? fallback}`;
+}
+export function deliveryProjection(entries, events = []) {
+  const applications = entries.map(app => {
+    const selected = events.filter(e => e.version === 1 && e.applicationId === app.id && DELIVERY_TYPES.includes(e.type));
+    const initial = { attemptId: `initial:${app.id}`, channel: (app.applicationChannel ?? app.source) === 'email' ? 'email' : 'browser', url: app.url };
+    // A stable representative keeps even conflicting retry projections independent of arrival order.
+    const retries = [...new Map(selected.filter(e => e.type === 'retry-confirmed').sort((a, b) => stableJson(a).localeCompare(stableJson(b))).map(e => [e.attemptId, e])).values()];
+    const attempts = [initial, ...retries].map(attempt => {
+      const observations = selected.filter(e => e.attemptId === attempt.attemptId && e.type !== 'retry-confirmed');
+      const graph = heads(observations);
+      const states = new Set();
+      const ancestors = event => {
+        const seen = new Set();
+        const pending = [...refs(event)];
+        while (pending.length) {
+          const id = pending.pop();
+          if (seen.has(id)) continue;
+          seen.add(id);
+          const parent = observations.find(e => e.id === id);
+          if (parent) pending.push(...refs(parent));
+        }
+        return seen;
+      };
+      const correctionFork = graph.current.some((left, index) => graph.current.slice(index + 1).some(right => {
+        if (left.status === right.status) return false;
+        const lineage = ancestors(left);
+        return [...ancestors(right)].some(id => lineage.has(id));
+      }));
+      let ambiguous = graph.conflict || correctionFork;
+      for (const e of graph.current) {
+        const status = e.type === 'correction' ? e.status : e.type;
+        if (status === 'unknown') continue;
+        if (e.evidenceType === 'delivery-delay') continue;
+        if (e.evidenceType === 'ambiguous') { ambiguous = true; continue; }
+        if (status === 'delivery-failed') {
+          if (e.evidenceType !== 'final-delivery-failure') { ambiguous = true; continue; }
+          if (attempt.channel === 'email') states.add('failed');
+        } else if (status === 'receipt-confirmed') {
+          if (!['employer-acknowledgement','browser-confirmation'].includes(e.evidenceType)) { ambiguous = true; continue; }
+          states.add('received');
+        }
+      }
+      const retryCopies = selected.filter(e => e.type === 'retry-confirmed' && e.attemptId === attempt.attemptId);
+      if (new Set(retryCopies.map(stableJson)).size > 1) ambiguous = true;
+      const conflict = ambiguous || states.size > 1;
+      const failed = !conflict && states.has('failed');
+      return { ...attempt, failed, conflict, counted: !failed, receiptUnknown: attempt.channel === 'email' && !failed && !states.has('received'), status: conflict ? 'needs-review' : failed ? 'delivery-failed' : attempt.channel !== 'email' || states.has('received') ? 'receipt-confirmed' : 'receipt-unknown' };
+    });
+    const orphan = selected.some(e => !attempts.some(a => a.attemptId === e.attemptId));
+    return { applicationId: app.id, counted: attempts.some(a => a.counted), failed: attempts.every(a => a.failed), receiptUnknown: attempts.some(a => a.counted && a.receiptUnknown), conflict: orphan || attempts.some(a => a.conflict), attempts };
+  });
+  // Preserve the established canonical grouping contract (job ID, otherwise URL).
+  const groups = new Map();
+  entries.forEach((app,index) => {
+    const key = accountingApplicationKey(app, index);
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(applications[index]);
+  });
+  const canonical = [...groups.values()];
+  return { applications, recordedSubmissionCount: canonical.length, effectiveSubmissionCount: canonical.filter(g => g.some(a => a.counted)).length, failedDeliveryCount: canonical.filter(g => g.every(a => a.failed)).length, receiptUnknownEmailCount: canonical.filter(g => g.some(a => a.receiptUnknown)).length };
+}
+export function validateDeliveryReferences(event, applications, events, { preparedRetry = false } = {}) {
+  const app = applications.find(a => a.id === event.applicationId);
+  if (!app) throw new Error('Delivery applicationId is not recorded.');
+  const existing = events.filter(e => e.id === event.id);
+  if (existing.some(e => stableJson(e) !== stableJson(event))) throw new Error('Conflicting event ID; append a correction with a new ID.');
+  if (existing.length) return;
+  if (event.type === 'retry-confirmed') {
+    const related = applications.filter(a => accountingApplicationKey(a) === accountingApplicationKey(app));
+    const all = deliveryProjection(related, events).applications;
+    const current = all.find(a => a.applicationId === app.id);
+    if (!preparedRetry && all.some(a => !a.failed || a.conflict)) throw new Error('Retry requires verified failure of every prior attempt and no conflicts.');
+    if (current.attempts.some(a => a.attemptId === event.attemptId)) throw new Error('Retry attemptId already exists.');
+  } else if (event.attemptId !== `initial:${app.id}` && !events.some(e => e.type === 'retry-confirmed' && e.attemptId === event.attemptId && e.applicationId === app.id)) throw new Error('Delivery attemptId is not recorded.');
+  for (const id of refs(event)) {
+    const parent = events.find(e => e.id === id);
+    if (!parent || parent.type === 'retry-confirmed' || parent.applicationId !== event.applicationId || parent.attemptId !== event.attemptId) throw new Error('Correction must reference existing evidence for the same attempt.');
+  }
+}
+
+export function validateLead(input) {
+  object(input,['version','type','id','roundId','sourceId','url','company','role','employerJobId','disposition','observedAt','evidence','applicationId','supersedes']);
+  if (input.version != null && input.version !== 1) throw new Error('Unsupported discovery version.');
+  if (input.type != null && input.type !== 'lead-reviewed') throw new Error('Invalid discovery event type.');
+  const v = { ...input, version: 1, type: 'lead-reviewed', url: canonicalUrl(input.url) };
+  for (const key of ['roundId','sourceId','company']) required(v[key],key);
+  for (const key of ['role','employerJobId','applicationId']) if(v[key] != null) required(v[key],key);
+  if (!DISPOSITIONS.includes(v.disposition)) throw new Error('Invalid lead disposition.');
+  v.observedAt = date(v.observedAt,'observedAt');
+  required(v.evidence,'evidence',2000);
+  if (v.supersedes != null) {
+    const parents = Array.isArray(v.supersedes) ? v.supersedes : [v.supersedes];
+    if (!parents.length || parents.length > 100) throw new Error('Invalid lead supersedes.');
+    parents.forEach(id => required(id,'supersedes'));
+    v.supersedes = [...new Set(parents)].sort();
+  }
+  v.id ??= eventId(v, 'lead'); required(v.id,'id');
+  return v;
+}
+function requisitionKey(e) { return e.employerJobId ? `${normalized(e.company)}:${e.employerJobId.toLowerCase()}` : canonicalUrl(e.url); }
+export function leadKey(e) { return `${e.roundId}:${e.sourceId}:${requisitionKey(e)}`; }
+export function validateLeadReferences(event, events) {
+  for (const previous of events.filter(e => e.id === event.id)) if (stableJson(previous) !== stableJson(event)) throw new Error('Conflicting lead event ID.');
+  const history = new Map(events.filter(e => e.version === 1 && e.type === 'lead-reviewed').map(e => [e.id, e]));
+  const parents = refs(event).map(id => history.get(id));
+  const sameScope = parent => parent && parent.roundId === event.roundId && parent.sourceId === event.sourceId && normalized(parent.company) === normalized(event.company);
+  const ancestors = parent => {
+    const seen = new Set(); const pending = [parent.id];
+    while (pending.length) {
+      const id = pending.pop(); const previous = history.get(id);
+      if (seen.has(id) || !sameScope(previous)) continue;
+      seen.add(id); pending.push(...refs(previous));
+    }
+    return seen;
+  };
+  // A disputed enrichment can choose an already-recorded ID only by explicitly
+  // superseding branches from the same lineage, never unrelated requisitions.
+  const lineages = parents.length > 1 && parents.every(sameScope) ? parents.map(ancestors) : [];
+  const resolvesFork = Boolean(event.employerJobId) && lineages.length > 1 && parents.some(parent => leadKey(parent) === leadKey(event)) && [...lineages[0]].some(id => lineages.every(lineage => lineage.has(id)));
+  for (const parent of parents) {
+    const enrichment = sameScope(parent) && canonicalUrl(parent.url) === canonicalUrl(event.url) && (!parent.employerJobId && Boolean(event.employerJobId));
+    if (!parent || (leadKey(parent) !== leadKey(event) && !enrichment && !resolvesFork)) throw new Error('Lead revision must reference the same round, source and requisition.');
+  }
+}
+export function discoveryProjection(events, { roundId } = {}) {
+  const selected = events.filter(e => e.version === 1 && e.type === 'lead-reviewed' && (roundId == null || e.roundId === roundId));
+  const aliases = new Map();
+  const aliasKey = e => `${e.roundId}:${normalized(e.company)}:${canonicalUrl(e.url)}`;
+  for (const e of selected.filter(e => e.employerJobId)) {
+    const key = aliasKey(e);
+    if (!aliases.has(key)) aliases.set(key, new Set());
+    aliases.get(key).add(requisitionKey(e));
+  }
+  const resolvedKey = e => !e.employerJobId && aliases.get(aliasKey(e))?.size === 1 ? [...aliases.get(aliasKey(e))][0] : requisitionKey(e);
+  const keyFor = e => `${e.roundId}:${e.sourceId}:${resolvedKey(e)}`;
+  const roots = new Map(selected.map(e => [keyFor(e), keyFor(e)]));
+  const root = key => { while (roots.get(key) !== key) key = roots.get(key); return key; };
+  const byId = new Map();
+  for (const e of selected) { if (!byId.has(e.id)) byId.set(e.id, []); byId.get(e.id).push(e); }
+  // Explicit revisions keep their lineage even when a shared careers URL later
+  // acquires another requisition. Forked enrichments stay together for conflict review.
+  for (const e of selected) for (const id of [e.id, ...refs(e)]) for (const parent of byId.get(id) ?? []) {
+    if (parent.roundId !== e.roundId || parent.sourceId !== e.sourceId) continue;
+    const left = root(keyFor(e)); const right = root(keyFor(parent));
+    if (left !== right) roots.set(left < right ? right : left, left < right ? left : right);
+  }
+  const groups = new Map();
+  for (const e of selected) { const key = root(keyFor(e)); if (!groups.has(key)) groups.set(key,[]); groups.get(key).push(e); }
+  const leads = []; const conflicts = [];
+  for (const [key, values] of groups) {
+    const graph = heads(values);
+    const comparable = e => stableJson(Object.fromEntries(Object.entries({ ...e, company: normalized(e.company), ...(e.employerJobId ? { employerJobId: e.employerJobId.toLowerCase() } : { url: canonicalUrl(e.url) }) }).filter(([k]) => !['id','observedAt','supersedes', ...(e.employerJobId ? ['url'] : [])].includes(k))));
+    const conflict = graph.conflict || new Set(graph.current.map(comparable)).size > 1;
+    if (conflict) conflicts.push({ key, eventIds: [...new Set(values.map(e => e.id))].sort() });
+    const lead = [...graph.current].sort((a,b) => a.id.localeCompare(b.id))[0] ?? values[0];
+    leads.push({ ...lead, key, conflict });
+  }
+  leads.sort((a,b) => a.key.localeCompare(b.key));
+  return { leads, conflicts, reviewedCount: leads.length, qualifiedCount: leads.filter(e => !e.conflict && e.disposition === 'qualified').length, uniqueLeadCount: new Set(leads.map(resolvedKey)).size, dispositionCounts: Object.fromEntries(DISPOSITIONS.map(d => [d,leads.filter(e => !e.conflict && e.disposition === d).length])) };
+}

package/job-application-agent/scripts/cloud-state-client.mjs

@@ -1,3 +1,4 @@
+import { ACCOUNTING_CAPABILITY, stableJson, validateDelivery, validateLead } from './application-accounting.mjs';
 import { createHash, randomUUID } from 'node:crypto';
 import { appendFile, chmod, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
 import { homedir, platform } from 'node:os';
@@ -8,6 +9,7 @@ export const CLOUD_STREAM_FILES = Object.freeze({
   outcomes: 'outcomes.ndjson',
   rounds: 'rounds.ndjson',
   discovery: 'discovery.ndjson',
+  delivery: 'delivery.ndjson',
   attention: 'attention.ndjson',
   reviews: 'reviews.ndjson',
   friction: 'friction.ndjson',
@@ -93,6 +95,7 @@ export async function enableCloudUpdateGuard({ home = homedir(), agentHome = pro
   catch (error) { if (error.code === 'ENOENT') return { guarded: false, reason: 'managed-install-not-found' }; throw error; }
   const required = new Set(config.requiredCapabilities ?? []);
   required.add('cloud-state-v2');
+  required.add(ACCOUNTING_CAPABILITY);
   await privateWrite(path, `${JSON.stringify({ ...config, requiredCapabilities: [...required].sort() }, null, 2)}\n`);
   return { guarded: true, capability: 'cloud-state-v2' };
 }
@@ -159,6 +162,23 @@ export class CloudStateClient {
     return { configured: true, url: config.url, configuredClient: { id: config.clientId ?? null, name: config.clientName ?? null, token: tokenSuffix(config.token) }, pendingLocalWrites: pending.length, ...remote };
   }
 
+  async requireAccounting() {
+    const config = await this.config(true);
+    if (!config) return;
+    const backend = hash(`${config.url}:${config.token}`);
+    try {
+      const status = await this.status();
+      if (!status.configured) return;
+      if (!status.capabilities?.includes(ACCOUNTING_CAPABILITY)) throw new Error('Private backend upgrade required: application-accounting-v1 is missing.');
+      await ensurePrivateDirectory(this.stateDir);
+      await privateWrite(join(this.stateDir, 'cloud-accounting-capability.json'), JSON.stringify({ supported: true, backend }));
+    } catch (error) {
+      if (!/^Cloud state unavailable:/.test(error.message)) throw error;
+      try { if (JSON.parse(await readFile(join(this.stateDir, 'cloud-accounting-capability.json'), 'utf8')).backend === backend) return; } catch {}
+      throw error;
+    }
+  }
+
   async getDocument(name) {
     const response = await this.request(`/v2/documents/${encodeURIComponent(name)}`);
     return response.json();
@@ -199,7 +219,7 @@ export class CloudStateClient {
     if (forbidden) throw new Error(`Cloud record contains forbidden field: ${forbidden}`);
     const payload = {
       recordKey: String(recordKey ?? value?.id ?? value?.roundId ?? randomUUID()),
-      idempotencyKey: String(idempotencyKey ?? `${stream}:${hash(JSON.stringify(value))}`),
+      idempotencyKey: String(idempotencyKey ?? `${stream}:${hash(stableJson(value))}`),
       occurredAt: occurredAt ?? value?.occurredAt ?? value?.submittedAt ?? new Date().toISOString(),
       provenance,
       value,
@@ -227,8 +247,20 @@ export class CloudStateClient {
   }
 
   async pendingWrites() {
-    try { return (await readFile(join(this.stateDir, 'cloud-pending.ndjson'), 'utf8')).split('\n').filter(Boolean).map(JSON.parse); }
-    catch (error) { if (error.code === 'ENOENT') return []; throw error; }
+    const events = await readNdjson(join(this.stateDir, 'cloud-pending.ndjson'));
+    const receipts = new Set((await readNdjson(join(this.stateDir, 'cloud-pending-receipts.ndjson'))).map(event => event.key));
+    return events.filter(event => !receipts.has(hash(stableJson(event))));
+  }
+
+  async flushAccountingWrites(stream) {
+    if (!['delivery','discovery'].includes(stream)) return;
+    for (const event of (await this.pendingWrites()).filter(event => event.type === 'append-record' && event.stream === stream)) {
+      await this.appendRecord(stream, event.payload.value, { ...event.payload, queueOnFailure: false });
+      const receipt = { key: hash(stableJson(event)) };
+      const path = join(this.stateDir, 'cloud-pending-receipts.ndjson');
+      await appendFile(path, `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+      await chmod(path, 0o600);
+    }
   }
 
   async putFile(name, bytes, revision) {
@@ -289,9 +321,15 @@ export class CloudStateClient {
   }
 
   async createIntent(value) {
+    await this.requireAccounting();
     return (await this.request('/v2/intents', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(value) })).json();
   }
 
+  async confirmRetry(intentId, delivery, leaseId) {
+    await this.requireAccounting();
+    return (await this.request(`/v2/intents/${encodeURIComponent(intentId)}/confirm`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ delivery, leaseId }) })).json();
+  }
+
   async markIntentSentUnverified(intentId, leaseId) {
     return (await this.request(`/v2/intents/${encodeURIComponent(intentId)}/sent-unverified`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ leaseId }) })).json();
   }
@@ -301,11 +339,23 @@ export class CloudStateClient {
   }
 
   async reconcile({ dryRun = true, provenance = 'local-reconcile' } = {}) {
+    await this.requireAccounting();
     const report = { dryRun, streams: {}, imported: 0, downloaded: 0 };
     for (const [stream, filename] of Object.entries(CLOUD_STREAM_FILES)) {
-      const local = await readNdjson(join(this.stateDir, filename));
+      if (!dryRun) await this.flushAccountingWrites(stream);
+      const normalize = value => stream === 'delivery' ? validateDelivery(value) : stream === 'discovery' && value.version === 1 && value.type === 'lead-reviewed' ? validateLead(value) : value;
+      let local = (await readNdjson(join(this.stateDir, filename))).map(normalize);
       const cloudRecords = await this.listStream(stream);
-      const cloud = cloudRecords.map((record) => record.value);
+      let cloud = cloudRecords.map((record) => normalize(record.value));
+      if (['delivery','discovery'].includes(stream)) {
+        const ids = new Map();
+        for (const value of [...local, ...cloud].filter(v => v.version === 1 && (stream === 'delivery' || v.type === 'lead-reviewed'))) {
+          if (ids.has(value.id) && stableJson(ids.get(value.id)) !== stableJson(value)) throw new Error('Conflicting accounting event ID during cloud reconciliation.');
+          ids.set(value.id, value);
+        }
+        const unique = values => values.filter((value,index) => value.version !== 1 || (stream === 'discovery' && value.type !== 'lead-reviewed') || values.findIndex(other => other.id === value.id && other.version === 1) === index);
+        local = unique(local); cloud = unique(cloud);
+      }
       const localCounts = multiset(local);
       const cloudCounts = multiset(cloud);
       const localOnly = multisetDifference(local, cloudCounts);
@@ -314,7 +364,7 @@ export class CloudStateClient {
       if (!dryRun) {
         const prepared = localOnly.map(({ value, index }) => ({
           recordKey: String(value?.id ?? value?.roundId ?? value?.applicationId ?? `${stream}-${index}`),
-          idempotencyKey: `reconcile:${hash(JSON.stringify(value))}:${index}`,
+          idempotencyKey: value.version === 1 && (stream === 'delivery' || (stream === 'discovery' && value.type === 'lead-reviewed')) ? `accounting:${value.id}` : `reconcile:${hash(stableJson(value))}:${index}`,
           occurredAt: value?.occurredAt ?? value?.submittedAt ?? new Date().toISOString(),
           provenance,
           value,
@@ -353,7 +403,7 @@ async function readNdjson(path) {
 }
 
 function key(value) {
-  return JSON.stringify(value);
+  return stableJson(value);
 }
 
 function multiset(values) {