vouchington-tooling 0.36.1 → 0.36.2

package/README.md

@@ -657,6 +657,27 @@ TypeScript and route rows from Markdown. Callers configure declaration names and
 runbook headings, then compare the returned data using their own route policy.
 See the [API contract](docs/basic-auth-doc-sync.md).
 
+## SQL view declarations
+
+`vouchington-tooling/sql-ast` exports `extractViewDeclarations(sql)` and the
+`ManagedViewDeclaration` type. Await `initSqlAst()` before calling the extractor. It returns the
+qualified, PostgreSQL-quoted names and kinds of top-level `CREATE VIEW` and
+`CREATE MATERIALIZED VIEW` declarations. It ignores comments, string literals, and other SQL
+statements. Keywords that cannot be bare relation names remain quoted. Blank or unparseable SQL returns an empty
+array; parser initialization and unexpected errors propagate. Consumers own view teardown and
+lifecycle decisions.
+
+## SQL index shapes
+
+`vouchington-tooling/sql-ast` exports `extractIndexShapes(sql)`. Await `initSqlAst()` before
+calling it. It returns `{ idxname, table, shapeKey }` for each named top-level `CREATE INDEX`.
+Consumers can group identical `shapeKey` values to find differently named index definitions
+with the same projected physical shape. The key normalizes effective sort and null ordering and
+removes parser locations from expressions and predicates. Invalid SQL throws. Anonymous indexes
+and indexes inside `DO` blocks are omitted. The projection does not model operator classes,
+collations, or `INCLUDE` columns, so callers using those features must extend it before relying
+on shape collisions.
+
 ## Publication writer inventory facts
 
 `vouchington-tooling/post-publication-inventory` exports

package/dist/agent-blackboard/client.d.mts

@@ -5,7 +5,12 @@ export type BlackboardConnection = {
 };
 export type BlackboardClientModule = {
     Sessions: new (connection: BlackboardConnection) => {
-        ensure(input: unknown): Promise<{
+        ensure(input: {
+            id: string;
+            parentSessionId: string | null;
+            agent: string;
+            version: string;
+        }): Promise<{
             status: 'created' | 'exists';
             session: {
                 data: Record<string, unknown>;

package/dist/agent-blackboard/feedback-delivery.d.mts

@@ -14,5 +14,9 @@ export declare function flushFeedbackOutbox(input: {
     pendingCount: number;
     deliveredCount: number;
     diagnostic?: FeedbackDiagnostic;
+    rejected?: Array<{
+        sourceEventId: string;
+        diagnostic: FeedbackDiagnostic;
+    }>;
     cleanupDiagnostic?: 'outbox-cleanup-failed';
 }>;

package/dist/agent-blackboard/feedback-delivery.mjs

@@ -1,9 +1,11 @@
 import { createFeedbackEnvelope, validateFeedbackEnvelope } from "./feedback-codec.mjs";
 import { validateFeedbackIdentity } from "./feedback-identity.mjs";
 import { deliverFeedbackOnline } from "./feedback-online.mjs";
-import { FeedbackDeliveryError, feedbackDiagnostic } from "./feedback-online-error.mjs";
+import { feedbackDiagnostic } from "./feedback-online-error.mjs";
 import { feedbackOutboxStatus, listFeedbackOutbox, persistFeedbackOutbox, removeFeedbackOutbox, } from "./feedback-outbox.mjs";
+import { rejectFeedbackOutbox } from "./feedback-outbox-rejected.mjs";
 export { FeedbackDeliveryError } from "./feedback-online-error.mjs";
+const PERMANENT = ['identity-conflict', 'event-conflict', 'archived-session'];
 export async function writeFeedback(input) {
     if (input.mode !== 'interactive' && input.mode !== 'autonomous')
         throw new Error('feedback mode must be explicitly interactive or autonomous');
@@ -30,8 +32,10 @@ export async function writeFeedback(input) {
     }
     catch (error) {
         const diagnostic = feedbackDiagnostic(error);
-        if (['identity-conflict', 'event-conflict', 'archived-session'].includes(diagnostic))
-            throw new FeedbackDeliveryError(diagnostic);
+        if (PERMANENT.includes(diagnostic)) {
+            rejectFeedbackOutbox(input.outboxDirectory, record);
+            throw error;
+        }
         return {
             status: 'pending',
             sourceEventId: envelope.sourceEventId,
@@ -50,6 +54,7 @@ export async function flushFeedbackOutbox(input) {
     let deliveredCount = 0;
     let diagnostic;
     let cleanupDiagnostic;
+    const rejected = [];
     for (const record of listFeedbackOutbox(input.directory)) {
         try {
             await deliverFeedbackOnline({
@@ -63,9 +68,11 @@ export async function flushFeedbackOutbox(input) {
         }
         catch (error) {
             const current = feedbackDiagnostic(error);
-            diagnostic ??= current;
-            if (['identity-conflict', 'event-conflict', 'archived-session'].includes(current))
+            if (PERMANENT.includes(current)) {
+                rejectFeedbackOutbox(input.directory, record);
+                rejected.push({ sourceEventId: record.envelope.sourceEventId, diagnostic: current });
                 continue;
+            }
             diagnostic = current;
             break;
         }
@@ -75,6 +82,7 @@ export async function flushFeedbackOutbox(input) {
         deliveredCount,
         ...(cleanupDiagnostic === undefined ? {} : { cleanupDiagnostic }),
         ...(diagnostic === undefined ? {} : { diagnostic }),
+        ...(rejected.length === 0 ? {} : { rejected }),
     };
 }
 function prepareEnvelope(input) {

package/dist/agent-blackboard/feedback-online-error.d.mts

@@ -2,6 +2,6 @@ import type { FeedbackDiagnostic } from './feedback-types.mts';
 export declare class FeedbackDeliveryError extends Error {
     readonly status = "blocked";
     readonly diagnostic: FeedbackDiagnostic;
-    constructor(diagnostic: FeedbackDiagnostic);
+    constructor(diagnostic: FeedbackDiagnostic, detail?: string);
 }
 export declare function feedbackDiagnostic(error: unknown): FeedbackDiagnostic;

package/dist/agent-blackboard/feedback-online-error.mjs

@@ -2,8 +2,8 @@ import { isObject } from "./snapshot-partition-guards.mjs";
 export class FeedbackDeliveryError extends Error {
     status = 'blocked';
     diagnostic;
-    constructor(diagnostic) {
-        super(`Blackboard feedback blocked: ${diagnostic}`);
+    constructor(diagnostic, detail) {
+        super(`Blackboard feedback blocked: ${diagnostic}${detail === undefined ? '' : `: ${detail}`}`);
         this.name = 'FeedbackDeliveryError';
         this.diagnostic = diagnostic;
     }

package/dist/agent-blackboard/feedback-online.mjs

@@ -5,14 +5,17 @@ import { loadClient, resolveBlackboardConnection } from "./client.mjs";
 import { normalizeRepositories, validateFeedbackEnvelope } from "./feedback-codec.mjs";
 import { validateFeedbackIdentity } from "./feedback-identity.mjs";
 import { isObject } from "./snapshot-partition-guards.mjs";
+function sessionInput(identity, version = identity.version) {
+    return {
+        id: identity.sessionId,
+        parentSessionId: identity.parentSessionId,
+        agent: identity.agent,
+        version,
+    };
+}
 async function ensureSession(sessions, identity) {
     try {
-        return await sessions.ensure({
-            id: identity.sessionId,
-            parentSessionId: identity.parentSessionId,
-            agent: identity.agent,
-            version: identity.version,
-        });
+        return { ensured: await sessions.ensure(sessionInput(identity)), storedVersion: undefined };
     }
     catch (error) {
         let existing;
@@ -22,11 +25,22 @@ async function ensureSession(sessions, identity) {
         catch {
             throw error;
         }
-        if (isObject(existing) &&
-            existing.id === identity.sessionId &&
-            ['parentSessionId', 'agent', 'version'].some((field) => (existing[field] ?? null) !== identity[field]))
-            throw new FeedbackDeliveryError('identity-conflict');
-        throw error;
+        if (!isObject(existing) || existing.id !== identity.sessionId)
+            throw error;
+        const differing = ['parentSessionId', 'agent', 'version'].filter((field) => (existing[field] ?? null) !== identity[field]);
+        if (differing.length === 0)
+            throw error;
+        const storedVersion = existing.version;
+        // Entries do not record a version, so a version-only difference (an agent CLI upgrade, or a
+        // session another writer created) delivers into the existing session under its stored version.
+        if (differing.length === 1 && differing[0] === 'version' && typeof storedVersion === 'string')
+            return {
+                ensured: await sessions.ensure(sessionInput(identity, storedVersion)),
+                storedVersion,
+            };
+        throw new FeedbackDeliveryError('identity-conflict', differing
+            .map((field) => `${field} stored ${JSON.stringify(existing[field] ?? null)}, supplied ${JSON.stringify(identity[field])}`)
+            .join('; '));
     }
 }
 async function findEvent(entries, envelope, expectedCreatedAt) {
@@ -91,7 +105,8 @@ export async function deliverFeedbackOnline(input, fresh = false) {
             const { Sessions, Entries } = client;
             const sessions = new Sessions(connection);
             const entries = new Entries(connection);
-            const ensured = await ensureSession(sessions, input.identity);
+            const { ensured, storedVersion } = await ensureSession(sessions, input.identity);
+            const stored = storedVersion === undefined ? {} : { storedVersion };
             if (ensured.session.archivedAt != null)
                 throw new FeedbackDeliveryError('archived-session');
             const existing = await findEvent(entries.get({ sessionId: input.identity.sessionId, format: 'jsonl' }), input.envelope);
@@ -115,6 +130,7 @@ export async function deliverFeedbackOnline(input, fresh = false) {
                     createdAt: existing.createdAt,
                     timestamp: existing.timestamp,
                     verified: true,
+                    ...stored,
                 };
             const appended = await entries.append({
                 sessionId: input.identity.sessionId,
@@ -135,10 +151,13 @@ export async function deliverFeedbackOnline(input, fresh = false) {
                 createdAt: confirmed.createdAt,
                 timestamp: confirmed.timestamp,
                 verified: true,
+                ...stored,
             };
         }
         catch (error) {
-            throw new FeedbackDeliveryError(feedbackDiagnostic(error));
+            throw error instanceof FeedbackDeliveryError
+                ? error
+                : new FeedbackDeliveryError(feedbackDiagnostic(error));
         }
     }, input.timeoutMs);
 }

package/dist/agent-blackboard/feedback-outbox-counts.d.mts

@@ -1,5 +1,8 @@
-/** Counts a session separately from all retry records in the shared worktree outbox. */
+/** Counts a session separately from all retry records in the shared worktree outbox. Rejected
+ * records are permanently refused notes kept for inspection; they are never pending. */
 export declare function feedbackOutboxCounts(directory: string, sessionId: string): {
     pendingCount: number;
     worktreePendingCount: number;
+    rejectedCount: number;
+    worktreeRejectedCount: number;
 };

package/dist/agent-blackboard/feedback-outbox-counts.mjs

@@ -1,11 +1,16 @@
 import { assertSessionId } from "./session-id.mjs";
 import { readFeedbackOutbox } from "./feedback-outbox.mjs";
-/** Counts a session separately from all retry records in the shared worktree outbox. */
+import { readRejectedFeedbackOutbox } from "./feedback-outbox-rejected.mjs";
+/** Counts a session separately from all retry records in the shared worktree outbox. Rejected
+ * records are permanently refused notes kept for inspection; they are never pending. */
 export function feedbackOutboxCounts(directory, sessionId) {
     assertSessionId(sessionId);
     const records = readFeedbackOutbox(directory);
+    const rejected = readRejectedFeedbackOutbox(directory);
     return {
         pendingCount: records.filter((record) => record.identity.sessionId === sessionId).length,
         worktreePendingCount: records.length,
+        rejectedCount: rejected.filter((record) => record.identity.sessionId === sessionId).length,
+        worktreeRejectedCount: rejected.length,
     };
 }

package/dist/agent-blackboard/feedback-outbox-rejected.d.mts

@@ -0,0 +1,9 @@
+import type { FeedbackOutboxRecord } from './feedback-types.mts';
+/**
+ * Moves a permanently rejected record out of the pending set into the rejected area of the outbox.
+ * The content is kept, never deleted, so a corrected retry of the same event is accepted while the
+ * rejected note stays inspectable. A record that is no longer pending is left alone.
+ */
+export declare function rejectFeedbackOutbox(directory: string, record: FeedbackOutboxRecord): void;
+/** Reads the rejected records without creating the outbox directory. */
+export declare function readRejectedFeedbackOutbox(directory: string): FeedbackOutboxRecord[];

package/dist/agent-blackboard/feedback-outbox-rejected.mjs

@@ -0,0 +1,34 @@
+import { readdirSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+import { withFileLock } from "../session-friction/lock.mjs";
+import { canonicalFeedback } from "./feedback-canonical.mjs";
+import { ensureOutboxDirectory } from "./feedback-outbox-directory.mjs";
+import { filename, outboxDirectory, readRecord, records, syncDirectory, } from "./feedback-outbox.mjs";
+const rejectedName = (record) => filename(record).replace(/\.json$/, '.rejected');
+/**
+ * Moves a permanently rejected record out of the pending set into the rejected area of the outbox.
+ * The content is kept, never deleted, so a corrected retry of the same event is accepted while the
+ * rejected note stays inspectable. A record that is no longer pending is left alone.
+ */
+export function rejectFeedbackOutbox(directory, record) {
+    const path = outboxDirectory(directory, true);
+    withFileLock(join(path, '.records'), () => {
+        const existing = records(path).find((item) => item.path === join(path, filename(record)));
+        if (!existing)
+            return;
+        if (canonicalFeedback(existing.record) !== canonicalFeedback(record))
+            throw new Error('feedback outbox changed during delivery');
+        renameSync(existing.path, join(path, rejectedName(record)));
+        syncDirectory(path);
+    });
+}
+/** Reads the rejected records without creating the outbox directory. */
+export function readRejectedFeedbackOutbox(directory) {
+    const path = outboxDirectory(directory, false);
+    if (!ensureOutboxDirectory(path, false))
+        return [];
+    return withFileLock(join(path, '.records'), () => readdirSync(path)
+        .filter((name) => /^[a-f0-9]{64}\.rejected$/.test(name))
+        .sort()
+        .map((name) => readRecord(join(path, name)).record));
+}

package/dist/agent-blackboard/feedback-outbox.d.mts

@@ -1,11 +1,24 @@
 import type { FeedbackOutboxRecord, FeedbackOutboxStatus } from './feedback-types.mts';
+export declare function outboxDirectory(directory: string, create: boolean): string;
+export declare function filename(record: FeedbackOutboxRecord): string;
+export declare function readRecord(path: string): {
+    record: FeedbackOutboxRecord;
+    bytes: number;
+};
+export declare function records(directory: string): Array<{
+    record: FeedbackOutboxRecord;
+    bytes: number;
+    path: string;
+}>;
+export declare function syncDirectory(directory: string): void;
 export declare function feedbackOutboxStatus(directory: string): FeedbackOutboxStatus;
 export declare function listFeedbackOutbox(directory: string): FeedbackOutboxRecord[];
 /** Reads the retained records without creating the outbox directory. */
 export declare function readFeedbackOutbox(directory: string): FeedbackOutboxRecord[];
 /**
  * Retains the record unless the same event is already retained, in which case that record stays:
- * the event is the session, `sourceEventId`, and content, and the earlier `timestamp` wins. The
+ * the event is the session identity (any `version`), `sourceEventId`, and content, and the earlier
+ * `timestamp` wins. The
  * returned record is the one to deliver.
  */
 export declare function persistFeedbackOutbox(directory: string, record: FeedbackOutboxRecord): FeedbackOutboxRecord;

package/dist/agent-blackboard/feedback-outbox.mjs

@@ -11,19 +11,19 @@ import { isObject } from "./snapshot-partition-guards.mjs";
 const FEEDBACK_OUTBOX_MAX_RECORDS = 128;
 const FEEDBACK_OUTBOX_MAX_BYTES = 2_000_000;
 const RECORD_MAX_BYTES = 18_000;
-function outboxDirectory(directory, create) {
+export function outboxDirectory(directory, create) {
     if (typeof directory !== 'string' || directory.length > 4096 || !isAbsolute(directory))
         throw new Error('feedback outbox requires an absolute directory');
     const path = resolve(directory);
     ensureOutboxDirectory(path, create);
     return path;
 }
-function filename(record) {
+export function filename(record) {
     return `${createHash('sha256')
         .update(JSON.stringify([record.identity.sessionId, record.envelope.sourceEventId]))
         .digest('hex')}.json`;
 }
-function readRecord(path) {
+export function readRecord(path) {
     const descriptor = openLogFile(path, constants.O_RDONLY);
     try {
         const status = fstatSync(descriptor);
@@ -42,8 +42,8 @@ function readRecord(path) {
         closeSync(descriptor);
     }
 }
-function records(directory) {
-    const paths = readdirSync(directory).filter((name) => name !== '.records.lock' && name !== '.records.lock.reap');
+export function records(directory) {
+    const paths = readdirSync(directory).filter((name) => !name.endsWith('.rejected') && !name.startsWith('.records.lock'));
     if (paths.length > FEEDBACK_OUTBOX_MAX_RECORDS)
         throw new Error('feedback outbox capacity exceeded; unsent records retained');
     const result = paths.sort().map((name) => {
@@ -59,7 +59,7 @@ function records(directory) {
         throw new Error('feedback outbox byte capacity exceeded; unsent records retained');
     return result;
 }
-function syncDirectory(directory) {
+export function syncDirectory(directory) {
     const descriptor = openSync(directory, constants.O_RDONLY | constants.O_NOFOLLOW);
     try {
         fsyncSync(descriptor);
@@ -90,7 +90,8 @@ export function readFeedbackOutbox(directory) {
 }
 /**
  * Retains the record unless the same event is already retained, in which case that record stays:
- * the event is the session, `sourceEventId`, and content, and the earlier `timestamp` wins. The
+ * the event is the session identity (any `version`), `sourceEventId`, and content, and the earlier
+ * `timestamp` wins. The
  * returned record is the one to deliver.
  */
 export function persistFeedbackOutbox(directory, record) {
@@ -103,7 +104,10 @@ export function persistFeedbackOutbox(directory, record) {
         const existing = current.find((item) => item.path === join(path, name));
         const serialized = JSON.stringify(record);
         if (existing) {
-            if (canonicalFeedback(existing.record.identity) !== canonicalFeedback(record.identity) ||
+            // A version-only difference is the same event: delivery accepts it into the stored session.
+            const { version: _retained, ...retainedIdentity } = existing.record.identity;
+            const { version: _supplied, ...suppliedIdentity } = record.identity;
+            if (canonicalFeedback(retainedIdentity) !== canonicalFeedback(suppliedIdentity) ||
                 canonicalFeedbackEvent(existing.record.envelope) !== canonicalFeedbackEvent(record.envelope))
                 throw new Error('feedback source event conflicts with a retained unsent record');
             return existing.record;

package/dist/agent-blackboard/feedback-types.d.mts

@@ -34,6 +34,8 @@ export type FeedbackReceipt = {
     /** The `timestamp` of the stored entry, which may be earlier than the attempt that confirmed it. */
     timestamp: string;
     verified: true;
+    /** Set when the session already stored a different `version`; the entry was delivered into it. */
+    storedVersion?: string;
 };
 export type FeedbackDiagnostic = 'blackboard-unavailable' | 'client-unavailable' | 'configuration-invalid' | 'authentication-rejected' | 'identity-conflict' | 'readback-unconfirmed' | 'event-conflict' | 'archived-session' | 'delivery-timeout';
 export type FeedbackDeliveryResult = {

package/dist/cli/commands/agent-blackboard.mjs

@@ -124,8 +124,10 @@ async function runJournal(args) {
         // Autonomous mode has no outbox, so its receipt must not depend on one.
         const counts = values.mode === 'autonomous'
             ? { pendingCount: 0, worktreePendingCount: 0 }
-            : feedbackOutboxCounts(required(values, 'outbox-directory'), required(values, 'session-id'));
-        process.stdout.write(`${JSON.stringify({ ...result, ...counts })}\n`);
+            : pendingCounts(required(values, 'outbox-directory'), required(values, 'session-id'));
+        const storedVersion = result.status === 'delivered' ? result.receipt.storedVersion : undefined;
+        // JSON.stringify drops an undefined `storedVersion`.
+        process.stdout.write(`${JSON.stringify({ ...result, storedVersion, ...counts })}\n`);
         return 0;
     }
     throw new Error('usage: agent-blackboard journal append|entries|flush|status');
@@ -150,6 +152,11 @@ function requiredRepositories(repositories) {
         throw new Error('--repository is required');
     return repositories;
 }
+/** An append receipt reports only unsent records; rejected records are not pending. */
+function pendingCounts(directory, sessionId) {
+    const { pendingCount, worktreePendingCount } = feedbackOutboxCounts(directory, sessionId);
+    return { pendingCount, worktreePendingCount };
+}
 function isNotFound(error) {
     return (typeof error === 'object' &&
         error !== null &&

package/dist/mcp-server/dispatch.mjs

@@ -16,7 +16,7 @@ const HANDLERS = {
     session_archive: sessionArchive,
 };
 const DIAGNOSTIC_HINTS = {
-    'identity-conflict': 'the session already exists with a different parent, agent, or version',
+    'identity-conflict': 'the session already exists with a different parent or agent, or an unusable stored version',
     'event-conflict': 'sourceEventId was already used with different content; use a new sourceEventId',
     'archived-session': 'the session is archived; write to a new session',
     'authentication-rejected': 'the blackboard rejected AGENT_BLACKBOARD_TOKEN',

package/dist/mcp-server/fake-blackboard.test-helpers.d.mts

@@ -13,7 +13,7 @@ export type FakeOptions = {
     omitArchive?: boolean;
     omitSnapshots?: boolean;
     exportResult?: unknown;
-    /** Makes `ensure` fail and `get` report a session with this different identity. */
+    /** Makes `ensure` fail for any other identity, and `get` report a session with this one. */
     conflictingSession?: {
         id: string;
         parentSessionId: null;

package/dist/mcp-server/fake-blackboard.test-helpers.mjs

@@ -24,7 +24,12 @@ export function fakeBlackboard(options = {}) {
     class Sessions {
         async ensure(input) {
             calls.ensure.push(input);
-            if (options.conflictingSession)
+            if (typeof input.id !== 'string')
+                throw new Error('ensure requires id');
+            if (options.conflictingSession &&
+                (options.conflictingSession.parentSessionId !== input.parentSessionId ||
+                    options.conflictingSession.agent !== input.agent ||
+                    options.conflictingSession.version !== input.version))
                 throw new Error('session identity differs');
             return {
                 status: 'created',

package/dist/mcp-server/handlers-journal.mjs

@@ -68,7 +68,15 @@ export const journalAppend = async (args, context) => {
     const counts = mode === 'interactive'
         ? outboxCounts(context.worktree, context.sessionId)
         : { pendingCount: 0, worktreePendingCount: 0 };
-    return { sessionId: context.sessionId, ...result, timestamp, ...counts };
+    // A version-only mismatch delivers into the existing session; say which version it stores.
+    const storedVersion = result.status === 'delivered' ? result.receipt.storedVersion : undefined;
+    return {
+        sessionId: context.sessionId,
+        ...result,
+        timestamp,
+        ...(storedVersion === undefined ? {} : { storedVersion }),
+        ...counts,
+    };
 };
 // `Entries.get` documents no order, and `createdAt` is a service-generated ISO 8601 UTC time whose
 // text order is time order. An entry without a usable `createdAt` sorts first rather than throwing.

package/dist/mcp-server/handlers-outbox.d.mts

@@ -2,6 +2,7 @@ import { type ToolHandler } from './context.mts';
 /**
  * The outbox belongs to the worktree, not to one session, so two counts are reported. `pendingCount`
  * is the caller's session only; `worktreePendingCount` is every session's records.
+ * `rejectedCount` and `worktreeRejectedCount` count permanently refused records kept for inspection.
  */
 export declare function outboxCounts(worktree: string, sessionId: string): {
     pendingCount: number;

package/dist/mcp-server/handlers-outbox.mjs

@@ -3,34 +3,34 @@ import { outboxDirectory } from "./context.mjs";
 /**
  * The outbox belongs to the worktree, not to one session, so two counts are reported. `pendingCount`
  * is the caller's session only; `worktreePendingCount` is every session's records.
+ * `rejectedCount` and `worktreeRejectedCount` count permanently refused records kept for inspection.
  */
 export function outboxCounts(worktree, sessionId) {
+    const { pendingCount, worktreePendingCount } = statusCounts(worktree, sessionId);
+    return { pendingCount, worktreePendingCount };
+}
+function statusCounts(worktree, sessionId) {
     return feedbackOutboxCounts(outboxDirectory(worktree), sessionId);
 }
 function sessionStatus(pendingCount) {
     return pendingCount === 0 ? 'empty' : 'pending';
 }
 export const outboxStatus = async (_args, context) => {
-    const counts = outboxCounts(context.worktree, context.sessionId);
+    const counts = statusCounts(context.worktree, context.sessionId);
     return { sessionId: context.sessionId, status: sessionStatus(counts.pendingCount), ...counts };
 };
 export const outboxFlush = async (_args, context) => {
     // Flushing creates the outbox directory, so an empty or absent outbox is reported as is.
-    if (outboxCounts(context.worktree, context.sessionId).worktreePendingCount === 0)
-        return {
-            sessionId: context.sessionId,
-            status: 'empty',
-            pendingCount: 0,
-            worktreePendingCount: 0,
-            deliveredCount: 0,
-        };
+    const before = statusCounts(context.worktree, context.sessionId);
+    if (before.worktreePendingCount === 0)
+        return { sessionId: context.sessionId, status: 'empty', ...before, deliveredCount: 0 };
     // The flush delivers every session's records; only the counts below are per session.
     const flushed = await flushFeedbackOutbox({
         directory: outboxDirectory(context.worktree),
         env: context.env,
         dependencies: context.dependencies,
     });
-    const counts = outboxCounts(context.worktree, context.sessionId);
+    const counts = statusCounts(context.worktree, context.sessionId);
     return {
         sessionId: context.sessionId,
         ...flushed,

package/dist/mcp-server/tools.mjs

@@ -103,10 +103,13 @@ export const TOOLS = [
         'entry is exactly as the blackboard returns it ({ sessionId, createdAt, data }), including ' +
         'non-journal types such as retrospective and legacy entries without a feedback envelope.', READ_ONLY),
     tool('outbox_status', 'Reports unsent journal records in the worktree outbox. pendingCount and status (empty or ' +
-        'pending) cover the caller sessionId only; worktreePendingCount covers every session.', READ_ONLY),
+        'pending) cover the caller sessionId only; worktreePendingCount covers every session. ' +
+        'rejectedCount (and worktreeRejectedCount) counts permanently rejected records kept aside.', READ_ONLY),
     tool('outbox_flush', 'Delivers every retained record in the worktree outbox, whichever session wrote it, and ' +
         'returns deliveredCount for the whole flush. pendingCount and status cover the remaining ' +
-        'records of the caller sessionId; worktreePendingCount covers every session.', IDEMPOTENT_ADDITIVE),
+        'records of the caller sessionId; worktreePendingCount covers every session. ' +
+        'A record with a permanent rejection moves to the rejected area and is listed in rejected ' +
+        'as sourceEventId and diagnostic.', IDEMPOTENT_ADDITIVE),
     tool('session_ensure', 'Idempotently creates a session, or verifies that an existing one has the same identity. ' +
         'Returns the session id and whether it was created.', IDEMPOTENT_ADDITIVE, IDENTITY, IDENTITY_REQUIRED),
     tool('snapshot_export', 'Exports non-archived sessions into a private local JSONL file chosen by the blackboard ' +

package/dist/pg-schema-snapshot/index.d.mts

@@ -4,6 +4,8 @@ export type { CatalogColumnRow, CatalogConstraintRow, CatalogEnumValueRow, Catal
 export { generateSchemaSnapshot, stableStringify, writeSchemaSnapshot } from './generate.mts';
 export { detectRenamedIndexes, indexShapeKey } from './index-rename-detect.mts';
 export type { RenamedIndex, SchemaIndexRenameSnapshot } from './index-rename-detect.mts';
+export { createPostgresReplayContext } from './replay-context.mts';
+export type { GeneratedColumnReferences, PostgresReplayContext } from './replay-context.mts';
 export { renderSchemaMarkdown } from './render-markdown.mts';
 export type { SchemaMarkdownFiles } from './render-markdown.mts';
 export { renderTableDocument } from './render-tables.mts';

package/dist/pg-schema-snapshot/index.mjs

@@ -2,5 +2,6 @@ export { buildSchemaSnapshot, buildTableSnapshots } from "./build-snapshot.mjs";
 export { readColumns, readConstraints, readEnums, readExtensions, readFunctions, readIndexes, readPolicies, readSchemaCatalog, readTables, readTriggers, readViews, } from "./catalog-queries.mjs";
 export { generateSchemaSnapshot, stableStringify, writeSchemaSnapshot } from "./generate.mjs";
 export { detectRenamedIndexes, indexShapeKey } from "./index-rename-detect.mjs";
+export { createPostgresReplayContext } from "./replay-context.mjs";
 export { renderSchemaMarkdown } from "./render-markdown.mjs";
 export { renderTableDocument } from "./render-tables.mjs";

package/dist/pg-schema-snapshot/replay-context.d.mts

@@ -0,0 +1,23 @@
+import type { SchemaSnapshot } from './types.mts';
+/** Column references for one STORED generated expression, projected from parser facts. */
+export type GeneratedColumnReferences = {
+    table: string;
+    column: string;
+    sourceColumns: readonly string[];
+};
+export type PostgresReplayContext = {
+    /** Unknown tables return undefined so callers can fail closed. */
+    triggerTextsForTable(table: string): readonly string[] | undefined;
+    /** Memoized per table; unknown tables return undefined and empty dependency sets return an empty map. */
+    generatedDependenciesForTable(table: string): ReadonlyMap<string, ReadonlySet<string>> | undefined;
+};
+/**
+ * Projects injected schema snapshot data and parser-derived generated-expression references for
+ * replay checks. The caller owns snapshot loading and SQL parsing. Every STORED generated column
+ * with an expression must have a corresponding reference fact, including expressions with no
+ * column references; missing facts throw instead of silently weakening the caller's check.
+ */
+export declare function createPostgresReplayContext(input: {
+    schema: SchemaSnapshot;
+    generatedColumnReferences: readonly GeneratedColumnReferences[];
+}): PostgresReplayContext;

package/dist/pg-schema-snapshot/replay-context.mjs

@@ -0,0 +1,45 @@
+/**
+ * Projects injected schema snapshot data and parser-derived generated-expression references for
+ * replay checks. The caller owns snapshot loading and SQL parsing. Every STORED generated column
+ * with an expression must have a corresponding reference fact, including expressions with no
+ * column references; missing facts throw instead of silently weakening the caller's check.
+ */
+export function createPostgresReplayContext(input) {
+    const referenceFacts = new Map();
+    for (const fact of input.generatedColumnReferences) {
+        const key = generatedColumnKey(fact.table, fact.column);
+        referenceFacts.set(key, new Set(fact.sourceColumns));
+    }
+    const dependencyCache = new Map();
+    return {
+        triggerTextsForTable(table) {
+            const snapshotTable = input.schema.tables[table];
+            return snapshotTable ? Object.values(snapshotTable.triggers) : undefined;
+        },
+        generatedDependenciesForTable(table) {
+            const cached = dependencyCache.get(table);
+            if (cached)
+                return cached;
+            const snapshotTable = input.schema.tables[table];
+            if (!snapshotTable)
+                return undefined;
+            const dependencies = new Map();
+            for (const [column, definition] of Object.entries(snapshotTable.columns)) {
+                if (definition.generated !== 'stored' || definition.generatedExpression === null)
+                    continue;
+                const key = generatedColumnKey(table, column);
+                const sources = referenceFacts.get(key);
+                if (!sources) {
+                    throw new Error(`Missing generated-column reference facts for ${table}.${column}`);
+                }
+                if (sources.size > 0)
+                    dependencies.set(column, sources);
+            }
+            dependencyCache.set(table, dependencies);
+            return dependencies;
+        },
+    };
+}
+function generatedColumnKey(table, column) {
+    return `${table}\0${column}`;
+}

package/dist/sql-ast/index-shapes.d.mts

@@ -0,0 +1,34 @@
+/**
+ * Extracts a canonical "shape key" for every top-level CREATE INDEX statement in the given SQL,
+ * for detecting index definitions that build the same physical index under different names.
+ *
+ * The key is built from normalized `IndexStmt` AST fields (table, uniqueness, access method, each
+ * indexed column/expression with its *effective* sort order and null ordering, and the predicate
+ * with position-dependent `location` fields stripped) rather than from raw source text. This
+ * canonicalizes cosmetic syntax variance that leaves the physical index unchanged:
+ * - implicit vs. explicit `ASC` (`SORTBY_DEFAULT` is normalized to `SORTBY_ASC`, PostgreSQL's
+ *   actual default for btree ordering);
+ * - implicit vs. explicit `NULLS FIRST`/`NULLS LAST` (PostgreSQL's real default depends on sort
+ *   direction — `NULLS LAST` for ascending, `NULLS FIRST` for descending — so
+ *   `SORTBY_NULLS_DEFAULT` is resolved against the effective ordering rather than compared as-is);
+ * - redundant parentheses in a predicate or expression (parentheses are pure grouping and leave no
+ *   trace in the parsed AST once `location` offsets — which shift under added parens even though
+ *   the tree shape is unchanged — are stripped before comparison).
+ *
+ * Operator classes, collations, and INCLUDE columns are intentionally NOT modeled; callers whose
+ * generators use them must extend the projection before using this collision policy for those SQL.
+ *
+ * @libpg-query/parser has no deparse/SQL-regeneration function, so this hashes a normalized JSON
+ * projection of the relevant AST subtrees instead of reconstructing SQL text.
+ *
+ * DO $$ ... END $$; blocks are opaque to the top-level parser — they appear as a single DoStmt,
+ * not individual IndexStmt nodes — so nested CREATE INDEX statements are not covered.
+ *
+ * Unparseable SQL throws rather than returning an empty shape list.
+ * Requires initSqlAst() to have resolved before the first call.
+ */
+export declare function extractIndexShapes(sql: string): {
+    idxname: string;
+    table: string;
+    shapeKey: string;
+}[];

package/dist/sql-ast/index-shapes.mjs

@@ -0,0 +1,85 @@
+import { parseSql } from "./parser.mjs";
+/**
+ * Extracts a canonical "shape key" for every top-level CREATE INDEX statement in the given SQL,
+ * for detecting index definitions that build the same physical index under different names.
+ *
+ * The key is built from normalized `IndexStmt` AST fields (table, uniqueness, access method, each
+ * indexed column/expression with its *effective* sort order and null ordering, and the predicate
+ * with position-dependent `location` fields stripped) rather than from raw source text. This
+ * canonicalizes cosmetic syntax variance that leaves the physical index unchanged:
+ * - implicit vs. explicit `ASC` (`SORTBY_DEFAULT` is normalized to `SORTBY_ASC`, PostgreSQL's
+ *   actual default for btree ordering);
+ * - implicit vs. explicit `NULLS FIRST`/`NULLS LAST` (PostgreSQL's real default depends on sort
+ *   direction — `NULLS LAST` for ascending, `NULLS FIRST` for descending — so
+ *   `SORTBY_NULLS_DEFAULT` is resolved against the effective ordering rather than compared as-is);
+ * - redundant parentheses in a predicate or expression (parentheses are pure grouping and leave no
+ *   trace in the parsed AST once `location` offsets — which shift under added parens even though
+ *   the tree shape is unchanged — are stripped before comparison).
+ *
+ * Operator classes, collations, and INCLUDE columns are intentionally NOT modeled; callers whose
+ * generators use them must extend the projection before using this collision policy for those SQL.
+ *
+ * @libpg-query/parser has no deparse/SQL-regeneration function, so this hashes a normalized JSON
+ * projection of the relevant AST subtrees instead of reconstructing SQL text.
+ *
+ * DO $$ ... END $$; blocks are opaque to the top-level parser — they appear as a single DoStmt,
+ * not individual IndexStmt nodes — so nested CREATE INDEX statements are not covered.
+ *
+ * Unparseable SQL throws rather than returning an empty shape list.
+ * Requires initSqlAst() to have resolved before the first call.
+ */
+export function extractIndexShapes(sql) {
+    if (!sql.trim())
+        return [];
+    const result = parseSql(sql);
+    const shapes = [];
+    for (const stmt of result.stmts ?? []) {
+        const node = stmt.stmt;
+        if (!node || !('IndexStmt' in node))
+            continue;
+        const indexStmt = node.IndexStmt;
+        const idxname = indexStmt.idxname;
+        if (!idxname)
+            continue;
+        const table = indexStmt.relation?.relname ?? '';
+        const canonical = {
+            table,
+            unique: Boolean(indexStmt.unique),
+            accessMethod: indexStmt.accessMethod ?? 'btree',
+            indexParams: (indexStmt.indexParams ?? []).map(normalizeIndexParam),
+            whereClause: indexStmt.whereClause ? stripLocations(indexStmt.whereClause) : null,
+        };
+        shapes.push({ idxname, table, shapeKey: JSON.stringify(canonical) });
+    }
+    return shapes;
+}
+function normalizeIndexParam(param) {
+    if (!('IndexElem' in param))
+        return stripLocations(param);
+    const elem = param.IndexElem;
+    const ordering = elem.ordering === undefined || elem.ordering === 'SORTBY_DEFAULT' ? 'SORTBY_ASC' : elem.ordering;
+    const nullsOrdering = elem.nulls_ordering === undefined || elem.nulls_ordering === 'SORTBY_NULLS_DEFAULT'
+        ? ordering === 'SORTBY_DESC'
+            ? 'SORTBY_NULLS_FIRST'
+            : 'SORTBY_NULLS_LAST'
+        : elem.nulls_ordering;
+    return {
+        key: elem.name ?? stripLocations(elem.expr),
+        ordering,
+        nullsOrdering,
+    };
+}
+function stripLocations(value) {
+    if (Array.isArray(value))
+        return value.map(stripLocations);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [key, val] of Object.entries(value)) {
+            if (key === 'location')
+                continue;
+            out[key] = stripLocations(val);
+        }
+        return out;
+    }
+    return value;
+}

package/dist/sql-ast/index.d.mts

@@ -7,6 +7,9 @@ export { extractDefaultFunction, extractFuncCallArgColumnNames } from './default
 export { extractDropIndexMetadata } from './drop-index.mts';
 export type { SqlDropIndexMetadata } from './drop-index.mts';
 export { extractCreateIndexMetadata } from './index-metadata.mts';
+export { extractIndexShapes } from './index-shapes.mts';
 export type { SqlCreateIndexMetadata, SqlIndexParam } from './index-metadata.mts';
 export { lineOfUtf8ByteOffset } from './line-of-offset.mts';
 export { initSqlAst, MissingSqlAstParserError, parseSql } from './parser.mts';
+export { extractViewDeclarations } from './view-declarations.mts';
+export type { ManagedViewDeclaration } from './view-declarations.mts';

package/dist/sql-ast/index.mjs

@@ -4,5 +4,7 @@ export { extractCreateTableMetadata } from "./create-table.mjs";
 export { extractDefaultFunction, extractFuncCallArgColumnNames } from "./default-function.mjs";
 export { extractDropIndexMetadata } from "./drop-index.mjs";
 export { extractCreateIndexMetadata } from "./index-metadata.mjs";
+export { extractIndexShapes } from "./index-shapes.mjs";
 export { lineOfUtf8ByteOffset } from "./line-of-offset.mjs";
 export { initSqlAst, MissingSqlAstParserError, parseSql } from "./parser.mjs";
+export { extractViewDeclarations } from "./view-declarations.mjs";

package/dist/sql-ast/parser.d.mts

@@ -8,4 +8,6 @@ export declare class MissingSqlAstParserError extends Error {
  */
 export declare function initSqlAst(importer?: () => Promise<LibPgQuery>): Promise<void>;
 export declare function parseSql(content: string): ReturnType<LibPgQuery['parseSync']>;
+export declare function isUnsafeUnquotedRelationKeyword(name: string): boolean;
+export declare function isSqlParseError(error: unknown): boolean;
 export {};

package/dist/sql-ast/parser.mjs

@@ -23,10 +23,20 @@ export function initSqlAst(importer = () => import('@libpg-query/parser')) {
     }));
 }
 export function parseSql(content) {
+    return getParser().parseSync(content);
+}
+export function isUnsafeUnquotedRelationKeyword(name) {
+    const keywordName = getParser().scanSync(name).tokens[0]?.keywordName;
+    return keywordName === 'RESERVED_KEYWORD' || keywordName === 'TYPE_FUNC_NAME_KEYWORD';
+}
+function getParser() {
     if (!parser) {
         throw new Error('initSqlAst() must be awaited before calling parse helpers');
     }
-    return parser.parseSync(content);
+    return parser;
+}
+export function isSqlParseError(error) {
+    return Boolean(parser?.SqlError && error instanceof parser.SqlError);
 }
 async function loadParser(importer) {
     try {

package/dist/sql-ast/view-declarations.d.mts

@@ -0,0 +1,11 @@
+export type ManagedViewDeclaration = {
+    name: string;
+    type: 'materialized view' | 'view';
+};
+/**
+ * Extracts typed declarations from CREATE [OR REPLACE] VIEW and CREATE MATERIALIZED VIEW
+ * statements in the given SQL string. Comments and string literals are ignored by the parser.
+ *
+ * Requires initSqlAst() to have resolved before the first call.
+ */
+export declare function extractViewDeclarations(sql: string): ManagedViewDeclaration[];

package/dist/sql-ast/view-declarations.mjs

@@ -0,0 +1,67 @@
+import { isSqlParseError, isUnsafeUnquotedRelationKeyword, parseSql } from "./parser.mjs";
+/**
+ * Returns a PostgreSQL-quoted identifier. Simple lowercase names valid as bare relation names
+ * are returned unquoted; keywords requiring quotes and names containing uppercase, spaces,
+ * punctuation, or other special characters are wrapped in double-quotes with internal quotes
+ * escaped as "".
+ */
+function quotePgName(name) {
+    if (/^[a-z_][a-z0-9_]*$/.test(name) && !isUnsafeUnquotedRelationKeyword(name))
+        return name;
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/**
+ * Builds the qualified view reference (schema.view or just view) from the
+ * unquoted identifiers the parser returns.
+ */
+function buildViewRef(view) {
+    const name = quotePgName(view.relname);
+    if (!view.schemaname)
+        return name;
+    return `${quotePgName(view.schemaname)}.${name}`;
+}
+/**
+ * Extracts typed declarations from CREATE [OR REPLACE] VIEW and CREATE MATERIALIZED VIEW
+ * statements in the given SQL string. Comments and string literals are ignored by the parser.
+ *
+ * Requires initSqlAst() to have resolved before the first call.
+ */
+export function extractViewDeclarations(sql) {
+    if (!sql.trim())
+        return [];
+    let result;
+    try {
+        result = parseSql(sql);
+    }
+    catch (error) {
+        if (isSqlParseError(error))
+            return [];
+        throw error;
+    }
+    const declarations = [];
+    for (const stmt of result.stmts ?? []) {
+        const node = stmt.stmt;
+        if (!node)
+            continue;
+        if ('ViewStmt' in node) {
+            const view = node.ViewStmt.view;
+            if (view?.relname) {
+                declarations.push({
+                    name: buildViewRef(view),
+                    type: 'view',
+                });
+            }
+            continue;
+        }
+        if ('CreateTableAsStmt' in node && node.CreateTableAsStmt.objtype === 'OBJECT_MATVIEW') {
+            const view = node.CreateTableAsStmt.into?.rel;
+            if (view?.relname) {
+                declarations.push({
+                    name: buildViewRef(view),
+                    type: 'materialized view',
+                });
+            }
+        }
+    }
+    return declarations;
+}

package/docs/mcp-server.md

@@ -80,15 +80,15 @@ Every tool takes an explicit `sessionId` (`^[A-Za-z0-9._:-]+$`, at most 256 char
 server never infers, and an optional `worktree`. Unknown arguments are rejected. Failures come back
 as MCP tool errors (`isError: true`) with an actionable message rather than crashing the server.
 
-| Tool              | Arguments besides `sessionId` and `worktree`                                                                                                                                       | Returns                                                                                                                                 |
-| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
-| `journal_append`  | `parentSessionId`, `agent`, `version`, `mode` (`interactive` or `autonomous`), `markdown`, `sourceEventId`, `workOutcome`, `repositories`, `feedbackCoverage`, optional `category` | `sessionId`, `timestamp`, delivery `status` (`delivered` with a verified receipt, or `pending`), `pendingCount`, `worktreePendingCount` |
-| `journal_entries` | none                                                                                                                                                                               | `sessionId` and `entries`, every entry oldest first                                                                                     |
-| `outbox_status`   | none                                                                                                                                                                               | `sessionId`, `status`, `pendingCount`, `worktreePendingCount`                                                                           |
-| `outbox_flush`    | none                                                                                                                                                                               | `sessionId`, `status`, `pendingCount`, `worktreePendingCount`, `deliveredCount`                                                         |
-| `session_ensure`  | `parentSessionId`, `agent`, `version`                                                                                                                                              | `sessionId`, `status` (`created` or `exists`), `archived`                                                                               |
-| `snapshot_export` | optional `agent`, `version`, `parentSessionId`, `data`, `dataArrayContains`, `inactiveForHours`                                                                                    | `sessionId`, `path`, `counts`, `checksum`, `manifest`, `cleanupToken`                                                                   |
-| `session_archive` | none                                                                                                                                                                               | `sessionId`, `archived: true`                                                                                                           |
+| Tool              | Arguments besides `sessionId` and `worktree`                                                                                                                                       | Returns                                                                                                                                          |
+| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `journal_append`  | `parentSessionId`, `agent`, `version`, `mode` (`interactive` or `autonomous`), `markdown`, `sourceEventId`, `workOutcome`, `repositories`, `feedbackCoverage`, optional `category` | `sessionId`, `timestamp`, delivery `status` (`delivered` with a verified receipt, or `pending`), `pendingCount`, `worktreePendingCount`          |
+| `journal_entries` | none                                                                                                                                                                               | `sessionId` and `entries`, every entry oldest first                                                                                              |
+| `outbox_status`   | none                                                                                                                                                                               | `sessionId`, `status`, `pendingCount`, `worktreePendingCount`, `rejectedCount`, `worktreeRejectedCount`                                          |
+| `outbox_flush`    | none                                                                                                                                                                               | `sessionId`, `status`, `pendingCount`, `worktreePendingCount`, `rejectedCount`, `worktreeRejectedCount`, `deliveredCount`, `rejected` (when any) |
+| `session_ensure`  | `parentSessionId`, `agent`, `version`                                                                                                                                              | `sessionId`, `status` (`created` or `exists`), `archived`                                                                                        |
+| `snapshot_export` | optional `agent`, `version`, `parentSessionId`, `data`, `dataArrayContains`, `inactiveForHours`                                                                                    | `sessionId`, `path`, `counts`, `checksum`, `manifest`, `cleanupToken`                                                                            |
+| `session_archive` | none                                                                                                                                                                               | `sessionId`, `archived: true`                                                                                                                    |
 
 `journal_append` validates the whole feedback envelope with `validateFeedbackEnvelope` before
 anything is written, so a missing required field writes nothing. It returns the verified read-back
@@ -111,6 +111,13 @@ entries exist, but the report names the earliest stored one and later retries re
 Admission freshness (`verifyFreshFeedback`) keeps its stricter rule: any earlier record of the event,
 whatever its timestamp, is a conflict.
 
+A session that already exists with a different `version` (an agent upgrade, or a session another
+writer created) is not a conflict: the entry is delivered into it and the result reports
+`storedVersion`, in `journal_append` and in `vouchington agent-blackboard journal append`. A
+different `parentSessionId` or `agent` is an `identity-conflict`, and the error names each
+differing field with its stored and supplied value, for example
+`identity-conflict: agent stored "claude", supplied "codex"`.
+
 `journal_entries` returns `{ sessionId, entries }`. Each entry is exactly what the `agent-blackboard`
 client returns (`sessionId`, `createdAt`, `data`), so `data` keeps its envelope fields such as
 `repositories`, `sourceEventId`, `workOutcome`, and `feedbackCoverage`. Entries of every type come
@@ -124,8 +131,13 @@ unsent records of the caller's `sessionId`, and `status` (`empty` or `pending`)
 `worktreePendingCount` is the number of unsent records of every session in the worktree outbox. Both
 are 0 in autonomous mode, which has no outbox. `outbox_flush` delivers every retained record in the
 worktree, whichever session wrote it, so its `deliveredCount` covers the whole flush while
-`pendingCount` and `worktreePendingCount` report what remains. A record that cannot be delivered, for
-example after an `event-conflict`, stays in the count of the session that wrote it. Flushing an empty
+`pendingCount` and `worktreePendingCount` report what remains. A record that fails transiently
+(unavailable, timeout, auth) stays in the count of the session that wrote it. A permanent rejection
+(`identity-conflict`, `event-conflict`, `archived-session`), whether it happens on `journal_append`
+or during `outbox_flush`, moves the record out of the pending set into the outbox's rejected area,
+keeping its content. `rejectedCount` and `worktreeRejectedCount` report those records, and a
+corrected retry with the same `sourceEventId` is accepted. `outbox_flush` also returns
+`rejected: [{ sourceEventId, diagnostic }]` for what it moved. Flushing an empty
 outbox does not create the directory. `snapshot_export` never accepts a destination: the
 `agent-blackboard` client chooses a private file and returns its path. `session_archive` is the one
 destructive tool; archived metadata is immutable, while entries stay appendable.

package/docs/postgres-replay-context.md

@@ -0,0 +1,16 @@
+# PostgreSQL replay context
+
+`createPostgresReplayContext` projects a caller-owned schema snapshot and generated-column
+reference facts into the two lookups used by replay checks. It does not load snapshots, parse SQL,
+or decide INSERT policy.
+
+The caller supplies one `{ table, column, sourceColumns }` fact for each snapshot column whose
+`generated` value is `stored` and whose `generatedExpression` is present. Build `sourceColumns` from
+the parser's typed expression column references, retaining each reference's final identifier
+component. Supply an empty array for a valid expression with no column references. Missing facts
+throw when that table's dependencies are requested, so parser failures cannot silently become an
+empty dependency set.
+
+Unknown tables return `undefined` from both lookups. Known tables return their trigger text and a
+map of STORED generated columns to nonempty dependency sets; VIRTUAL columns are excluded. A known
+table with no STORED dependencies returns an empty map. Dependency maps are memoized per table.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.36.1",
+  "version": "0.36.2",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {

package/skills/agent-workflow/SKILL.md

@@ -26,5 +26,21 @@ evidence record.
 Load only the references required by the current phase. Keep scope changes explicit; a discovered
 blocker or follow-up does not authorize widening the task.
 
+## Parallel by default
+
+Split work into independent units and run them concurrently, one worker and worktree each, within
+any cap the human set. Dispatching to a peer session in another repository is a unit.
+
+Serialize only on a named dependency:
+
+- A consumer change needs an upstream API or fix that is not yet released.
+- Units change the same files or contract. Stack them instead of waiting.
+- Units would write in the same worktree.
+
+For upstream work, open every independent pull request at once, shepherd them concurrently, merge
+the ready set together, and cut one release. Start each consumer adoption once an admitted release
+contains what it needs; start consumer work that does not need the unreleased change now. A ready,
+queued, or shepherding pull request does not pause other units.
+
 Consumer wrapper or local instructions own: default branch, runner class, documentation root,
 review system, merge policy, and command catalog.

package/skills/blackboard/SKILL.md

@@ -29,6 +29,10 @@ Every call takes an exact `sessionId`, never inferred, whose meaning depends on
   worktree, so `outbox_status` and `outbox_flush` report two counts: `pendingCount` is the unsent
   records of that `sessionId`, and `worktreePendingCount` is the unsent records of every session in
   the worktree outbox. `outbox_flush` delivers every retained record in the worktree.
+  A permanently rejected record (`identity-conflict`, `event-conflict`, `archived-session`) is moved out
+  of the pending set, not retained: `rejectedCount` and `worktreeRejectedCount` count the kept copies,
+  `outbox_flush` reports them as `rejected` (`sourceEventId` and `diagnostic`), and a corrected retry
+  with the same `sourceEventId` is accepted.
 
 Every call may take `worktree`, the absolute path of a worktree of the current repository (the
 launch worktree by default). Writing or retrying an entry needs no provider skill, temporary file,
@@ -121,7 +125,10 @@ retention, or delivery checks because the transport changed.
    `journal_append` ensures that session and merges the entry's `repositories` into the session's
    cumulative repository union, so list every repository the entry concerns. Never infer another
    repository from prose or create a child identity from a model guess. Call `session_ensure` with
-   the exact identity only when a runner must confirm the session before work starts.
+   the exact identity only when a runner must confirm the session before work starts. A session
+   that already stores a different `version` still receives the entry, and the result reports its
+   `storedVersion`. A different `parentSessionId` or `agent` is an `identity-conflict` whose error
+   names each differing field with its stored and supplied values.
 4. Select the repository's trusted `mode` (`interactive` or `autonomous`) explicitly. In interactive
    mode an outage may retain the validated, sanitized record in the bounded durable outbox, and
    `journal_append` reports it as pending. Report `pendingCount` (this session's unsent records),

package/skills/planning/SKILL.md

@@ -18,7 +18,8 @@ diagram, independent reviewer, or separate issue are required by this skill.
    fresh base. Record which evidence supports each proposed path.
 3. Map affected owners, contracts, operational boundaries, and tests. Use independent review or
    exploration when the change is cross-cutting or uncertain and local policy calls for it.
-4. Record the chosen approach, steps, validation, and unresolved decisions. Add rollout details
+4. Record the chosen approach, steps, validation, and unresolved decisions. Mark which steps run
+   concurrently and name the dependency that serializes each remaining step. Add rollout details
    only when an established deployment contract requires them.
 5. Save the plan once outside Git: an existing issue, a PR description, or a durable native plan
    file outside the repository. Do not commit task plans or count temporary scratch files as saved