zigmini 0.8.0-beta.7 → 0.9.0-beta.2

package/src/store.ts

@@ -1,10 +1,11 @@
 import { Database } from "bun:sqlite";
 import { OMO_CHECK_BASELINE, omoCheckActionable, omoCheckDaytime } from "./omo-check-policy.ts";
-import { mkdirSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import type { ConversationInfo, DecisionAnswerRequest, NotificationMode, ReplyNotification } from "./protocol.ts";
 import type { NativeTurnStats } from "./turn-stats.ts";
+import { SecurityRuntimeError, securityDecision, type AllowedValue, type HeldState, type SecurityApprover, type SecurityHoldRecord, type SecurityIntent, type SecurityReceipt } from "./security-allow.ts";
 
 export interface StoredEvent {
 	seq: number;
@@ -358,7 +359,7 @@ export interface DecisionDismissal {
 }
 
 export class DecisionStoreError extends Error {
-	constructor(readonly code: "decision_not_found" | "decision_conflict" | "submission_conflict" | "source_conflict" | "invalid_decision" | "invalid_decision_answer" | "invalid_decision_cursor" | "invalid_decision_transition", readonly decision: Decision | null = null) {
+	constructor(readonly code: "security_endpoint_required" | "decision_not_found" | "decision_conflict" | "submission_conflict" | "source_conflict" | "invalid_decision" | "invalid_decision_answer" | "invalid_decision_cursor" | "invalid_decision_transition", readonly decision: Decision | null = null) {
 		super(code);
 	}
 }
@@ -461,9 +462,11 @@ function completeDecisionAnswer(method: DecisionMethod, payload: unknown, respon
 
 export class Store {
 	private readonly db: Database;
+	private readonly securityReceiptListeners = new Set<() => void>();
 
 	constructor(dataDir: string) {
-		mkdirSync(dataDir, { recursive: true });
+		mkdirSync(dataDir, { recursive: true, mode: 0o700 });
+		chmodSync(dataDir, 0o700);
 		this.db = new Database(join(dataDir, "gateway.sqlite"), { create: true });
 		this.db.exec("PRAGMA journal_mode = WAL;");
 		// Linux builds of bun:sqlite default to synchronous=FULL, which fsyncs every appended event (~80x slower,
@@ -638,6 +641,158 @@ export class Store {
 			this.db.close();
 			throw error;
 		}
+		this.db.exec(`
+			CREATE TABLE IF NOT EXISTS security_allowed_values (
+				id TEXT PRIMARY KEY, value TEXT COLLATE BINARY NOT NULL UNIQUE, data TEXT NOT NULL
+			);
+			CREATE TABLE IF NOT EXISTS security_allow_revision (
+				id INTEGER PRIMARY KEY CHECK(id = 1), revision INTEGER NOT NULL
+			);
+			INSERT OR IGNORE INTO security_allow_revision VALUES (1, 0);
+			CREATE TABLE IF NOT EXISTS security_holds (
+				id TEXT PRIMARY KEY, source_key TEXT UNIQUE, intent_submission TEXT UNIQUE, data TEXT NOT NULL
+			);
+		`);
+		for (const suffix of ["", "-wal", "-shm"]) {
+			const path = join(dataDir, `gateway.sqlite${suffix}`);
+			if (existsSync(path)) chmodSync(path, 0o600);
+		}
+	}
+
+	securityAllowedValues(): { revision: number; values: AllowedValue[] } {
+		return this.db.transaction(() => ({
+			revision: this.db.query<{ revision: number }, []>("SELECT revision FROM security_allow_revision WHERE id = 1").get()!.revision,
+			values: this.db.query<{ data: string }, []>("SELECT data FROM security_allowed_values ORDER BY json_extract(data, '$.approvedAt'), id").all()
+				.map((row): AllowedValue => JSON.parse(row.data)),
+		})).immediate();
+	}
+
+	securityHolds(): SecurityHoldRecord[] {
+		return this.db.query<{ data: string }, []>("SELECT data FROM security_holds ORDER BY rowid").all().map((row) => JSON.parse(row.data));
+	}
+
+	securityHold(id: string): SecurityHoldRecord | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE id = ?").get(id);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	securityHoldByKey(key: string): SecurityHoldRecord | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE source_key = ?").get(key);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	createSecurityHold(record: SecurityHoldRecord): void {
+		this.db.transaction(() => {
+			const s = record.state;
+			this.db.query("INSERT INTO security_holds (id, source_key, data) VALUES (?, ?, ?)").run(s.id, record.key, JSON.stringify(record));
+			this.insertDecision({
+				id: s.id, revision: s.revision, ownerConv: s.conv, scope: `security:${s.conv}`, workId: null,
+				sourceSessionPath: null, sourceRequestId: s.id, sourceCommandSeq: null, legacyActionId: null,
+				method: "confirm", permission: false, required: false, payload: { kind: "security-check", heldId: s.id },
+				bindingState: "closed", deadlineAt: null, status: "pending",
+				submissionId: null, submissionRevision: null, submissionMode: null, answer: null, commandId: null,
+				answerRoute: null, supersededBy: null, reason: null, createdAt: s.createdAt, updatedAt: s.createdAt,
+			});
+		}).immediate();
+	}
+
+	private writeSecurityHold(record: SecurityHoldRecord): SecurityHoldRecord {
+		const s = record.state;
+		this.db.query("UPDATE security_holds SET data = ?, intent_submission = ? WHERE id = ?")
+			.run(JSON.stringify(record), record.intent?.submissionId ?? null, s.id);
+		const statuses = { pending: "pending", processing: "submitted", sent: "delivered", cancelled: "closed", failed: "needs_review", unconfirmed: "needs_review" } as const;
+		this.db.query("UPDATE decisions SET revision = ?, status = ?, reason = ?, updated_at = ? WHERE id = ?")
+			.run(s.revision, statuses[s.status], s.errorCode, new Date().toISOString(), s.id);
+		return record;
+	}
+
+	claimSecurityHold(id: string, intent: SecurityIntent): { record: SecurityHoldRecord; fresh: boolean } {
+		return this.db.transaction(() => {
+			const record = this.securityHold(id);
+			if (!record) throw new SecurityRuntimeError("held_conflict");
+			if (record.intent !== null) {
+				if (!isDeepStrictEqual(record.intent, intent)) throw new SecurityRuntimeError("held_conflict", record.state);
+				return { record, fresh: false };
+			}
+			const reused = intent.submissionId === null ? null : this.db.query<{ id: string }, [string]>("SELECT id FROM security_holds WHERE intent_submission = ?").get(intent.submissionId);
+			if (reused || record.state.status !== "pending" ||
+				(intent.expectedRevision !== null && record.state.revision !== intent.expectedRevision)) throw new SecurityRuntimeError("held_conflict", record.state);
+			const claimed = this.writeSecurityHold({ ...record, intent, state: {
+				...record.state, revision: record.state.revision + 1,
+				status: intent.send ? "processing" : "cancelled",
+			} });
+			return { record: claimed, fresh: true };
+		}).immediate();
+	}
+
+	reserveSecurityDispatch(id: string, occurrences: readonly { canonicalValue?: string; value: string; kind: string; label: string }[], approver: SecurityApprover): SecurityHoldRecord {
+		return this.db.transaction(() => {
+			const record = this.securityHold(id);
+			if (!record || record.state.status !== "processing" || record.dispatchReserved) throw new SecurityRuntimeError("held_conflict", record?.state);
+			const remember = record.intent?.remember === true;
+			let revision = this.securityAllowedValues().revision;
+			if (remember) {
+				let added = 0;
+				for (const occurrence of occurrences) {
+					const value = occurrence.canonicalValue ?? occurrence.value;
+					const entry: AllowedValue = { id: crypto.randomUUID(), value, kind: occurrence.kind, label: occurrence.label,
+						approvedAt: new Date().toISOString(), approvedBy: approver, heldId: id };
+					added += this.db.query("INSERT OR IGNORE INTO security_allowed_values VALUES (?, ?, ?)").run(entry.id, value, JSON.stringify(entry)).changes;
+				}
+				if (added > 0) {
+					this.db.query("UPDATE security_allow_revision SET revision = revision + 1 WHERE id = 1").run();
+					revision++;
+				}
+			}
+			return this.writeSecurityHold({ ...record, dispatchReserved: true, state: {
+				...record.state, revision: record.state.revision + 1, remembered: remember, allowlistRevision: revision,
+			} });
+		}).immediate();
+	}
+
+	updateSecurityHold(id: string, change: Partial<Pick<HeldState, "status" | "errorCode">>, receipt?: SecurityReceipt, intent?: SecurityIntent): SecurityHoldRecord {
+		return this.db.transaction(() => {
+			const record = this.securityHold(id);
+			if (!record) throw new SecurityRuntimeError("held_conflict");
+			return this.writeSecurityHold({ ...record, intent: record.intent ?? intent ?? null, ...(receipt ? { receipt } : {}),
+				state: { ...record.state, ...change, revision: record.state.revision + 1 } });
+		}).immediate();
+	}
+
+	deleteSecurityAllowedValues(expectedRevision: number, id?: string): { revision: number; removed: number } {
+		return this.db.transaction(() => {
+			let revision = this.securityAllowedValues().revision;
+			if (revision !== expectedRevision) throw new SecurityRuntimeError("allowlist_conflict", undefined, revision);
+			const removed = id === undefined ? this.db.query("DELETE FROM security_allowed_values").run().changes
+				: this.db.query("DELETE FROM security_allowed_values WHERE id = ?").run(id).changes;
+			if (removed > 0) {
+				this.db.query("UPDATE security_allow_revision SET revision = revision + 1 WHERE id = 1").run();
+				revision++;
+			}
+			return { revision, removed };
+		}).immediate();
+	}
+
+	securityReceipt(ref: SecurityReceipt): "sent" | "unconfirmed" | null {
+		if (ref.kind === "answer") {
+			const decision = this.getDecision(ref.decisionId);
+			if (decision?.submissionId !== ref.submissionId) return null;
+			return decision?.status === "delivered" ? "sent" : decision?.reason === "receipt_unknown" ? "unconfirmed" : null;
+		}
+		const after = this.eventsAfter(ref.conv, ref.messageSeq);
+		const inputs = after.filter((event) => event.type === "main.input" && object(event.data) && object(event.data.input_ref) &&
+			event.data.input_ref.message_seq === ref.messageSeq);
+		return inputs.some((input) => after.some((event) => event.type === "main.input.ack" && object(event.data) &&
+			event.data.input_seq === input.seq)) ? "sent" : null;
+	}
+
+	onSecurityReceipt(listener: () => void): () => void {
+		this.securityReceiptListeners.add(listener);
+		return () => this.securityReceiptListeners.delete(listener);
+	}
+
+	notifySecurityReceipts(): void {
+		for (const listener of this.securityReceiptListeners) listener();
 	}
 
 	/**
@@ -939,6 +1094,7 @@ export class Store {
 					.run(input.conv, data.session_path, data.handoff);
 			}
 		}).immediate();
+		this.notifySecurityReceipts();
 	}
 
 	eventsAfter(conv: string, seq: number, limit = -1): StoredEvent[] {
@@ -1015,11 +1171,12 @@ export class Store {
 		}).immediate();
 	}
 
-	/** Acceptance and definitely-unsent intent precede every session-admission await. */
-	acceptMainUser(conv: string, data: unknown): StoredEvent {
+	/** Acceptance, unsent intent and the optional receipt link commit together before session admission. */
+	acceptMainUser(conv: string, data: unknown, receipt?: (ref: SecurityReceipt) => void): StoredEvent {
 		return this.db.transaction(() => {
 			const message = this.appendEvent(conv, "message.user", data);
 			this.appendEvent(conv, "main.user.pending", { message_seq: message.seq });
+			receipt?.({ kind: "message", conv, messageSeq: message.seq });
 			return message;
 		}).immediate();
 	}
@@ -1593,6 +1750,7 @@ export class Store {
 	 * for sibling A cannot invalidate sibling B's options.
 	 */
 	decisionContextReason(decision: Decision): string | null {
+		if (securityDecision(decision)) return null;
 		if (decision.workId !== null) {
 			const work = this.getWork(decision.workId);
 			if (!work) return "owner_unknown";
@@ -1625,6 +1783,7 @@ export class Store {
 		const result = this.db.transaction((): DecisionClaim | DecisionStoreError => {
 			let decision = this.getDecision(id);
 			if (!decision) throw new DecisionStoreError("decision_not_found");
+			if (securityDecision(decision)) throw new DecisionStoreError("security_endpoint_required");
 			if (!Number.isSafeInteger(request.expectedRevision) || request.expectedRevision < 1 ||
 				!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(request.submissionId)) {
 				throw new DecisionStoreError("invalid_decision_answer", decision);
@@ -2275,6 +2434,7 @@ export class Store {
 		return this.db.transaction((): DecisionDismissal => {
 			const d = this.getDecision(id);
 			if (!d) throw new DecisionStoreError("decision_not_found");
+			if (securityDecision(d)) throw new DecisionStoreError("security_endpoint_required");
 			if (d.revision !== expectedRevision || d.status === "delivered" || d.status === "closed" || d.status === "submitted") {
 				throw new DecisionStoreError("decision_conflict", d);
 			}

package/src/update/handoff-system.ts

@@ -10,6 +10,9 @@ import { type BridgeGeneration, type HandoffDeps, type OverlapControl, runHandof
 import { installedVersion } from "./helper.ts";
 import { initialOverlap, observe, type OverlapState } from "../runtime/overlap-policy.ts";
 import { sampleResources } from "../runtime/resource-sample.ts";
+import { agentDir } from "../model-accounts.ts";
+import { attemptRefusal, readGuardState, readStoreSchema, storeIncompatibility } from "../engine/schema-guard.ts";
+import { supportedSchema } from "../engine/thread-schema.ts";
 
 const OVERLAP_REASONS: Readonly<Record<string, string>> = {
 	critical_pressure: "메모리 압박 단계가 위험입니다",
@@ -110,6 +113,25 @@ export function systemHandoffDeps(launchd: LaunchdDeps, ctx: LaunchdContext, opt
 		writeRegistry: (registry: SlotRegistry | null) => registry === null ? rmSync(paths.slotsFile, { force: true }) : writeRegistry(paths.slotsFile, registry),
 		snapshot: () => createSnapshot(ctx.packageRoot, paths.generations, version),
 		engineFolder: () => existsSync(paths.omoCurrent) ? basename(realpathSync(paths.omoCurrent)) : null,
+		// Same agent folder rule as the bridge's own guard (process env overlaid with config.env) and its pinned engine folder.
+		preflight: (record) => {
+			let supported: number | null = null;
+			try {
+				supported = supportedSchema(record.engine === null ? paths.omoCurrent : join(paths.omo, record.engine));
+			} catch {
+				supported = null;
+			}
+			let config: Record<string, string>;
+			try {
+				config = readConfig(launchd, ctx);
+			} catch {
+				// A broken config.env is reported by startBridge, which reads it next and fails the attempt untouched.
+				return null;
+			}
+			const found = storeIncompatibility(readStoreSchema(agentDir({ ...ctx.env, ...config })), supported);
+			return found === null ? null : `저장소 스키마 ${found.store} > 엔진 지원 ${found.supported}`;
+		},
+		startRefusal: (record) => attemptRefusal(readGuardState(paths.run), { slot: record.slot, engine: record.engine, since: record.since }),
 		startBridge: async (record) => {
 			let config: Record<string, string>;
 			try {

package/src/update/handoff.ts

@@ -34,6 +34,10 @@ export interface HandoffDeps {
 	readonly writeRegistry: (registry: SlotRegistry | null) => void;
 	readonly snapshot: () => { readonly name: string; readonly dir: string };
 	readonly engineFolder: () => string | null;
+	/** Findings 214-217: why the new slot's engine cannot use the shared store, checked before it starts; null when it can. */
+	readonly preflight: (record: SlotRecord) => string | null;
+	/** The startup refusal of this attempt (this slot, engine and start time) only; a stale shared record is null. */
+	readonly startRefusal: (record: SlotRecord) => string | null;
 	readonly startBridge: (record: SlotRecord) => Promise<string | null>;
 	readonly stopBridge: (slot: RuntimeSlot) => Promise<void>;
 	readonly generation: (record: SlotRecord, action: "status" | "drain" | "terminate") => Promise<BridgeGeneration | null>;
@@ -111,14 +115,18 @@ export async function runHandoff(deps: HandoffDeps): Promise<HandoffResult> {
 		await deps.stopBridge(slot);
 		deps.writeRegistry(stored);
 	};
+	const blocked = deps.preflight(fresh);
+	if (blocked !== null) return fail(true, `새 세대(슬롯 ${slot}, 엔진 ${fresh.engine ?? "current"})를 시작하지 않았습니다: ${blocked}`);
 	deps.writeRegistry({ schema: 1, slots: [old, fresh] });
 	const started = await deps.startBridge(fresh);
 	if (started !== null) {
 		await undo();
 		return fail(true, `새 세대(슬롯 ${slot})를 시작하지 못했습니다: ${started}`);
 	}
-	const up = await until(deps, BRIDGE_START_WAIT_MS, async () => (await deps.generation(fresh, "status"))?.omo === "running");
-	const unhealthy = up ? await deps.healthCheck(fresh) : NOT_UP;
+	let refused: string | null = null;
+	const up = await until(deps, BRIDGE_START_WAIT_MS, async () => (refused = deps.startRefusal(fresh)) !== null ||
+		(await deps.generation(fresh, "status"))?.omo === "running");
+	const unhealthy = refused ?? (up ? await deps.healthCheck(fresh) : NOT_UP);
 	if (unhealthy !== null) {
 		await undo();
 		return fail(true, `새 세대(슬롯 ${slot}) 확인 실패: ${unhealthy}`);

package/src/update/helper.ts

@@ -19,6 +19,9 @@ export const STOP_WAIT_MS = 15_000;
 export const LOST_RECORDS = "업데이트 전 백업 뒤에 생긴 기록(대화 등)은 없어졌을 수 있습니다.";
 export const UPDATE_AGAIN = "옛 엔진이 공유 폴더 스키마를 읽지 못해 브리지가 멈췄습니다. 다시 업데이트하세요(새 엔진 필요).";
 
+/** The installer's refusal code (src/engine/install.ts ENGINE_SCHEMA_INCOMPATIBLE) as printed by `setup --engine-only`. */
+export const ENGINE_SCHEMA_REFUSAL = "engine_schema_incompatible";
+
 export interface CommandOutput { readonly code: number; readonly stdout: string; readonly stderr: string }
 
 export interface Probe { readonly status: number; readonly omo: string | null; readonly version: string | null }
@@ -143,7 +146,14 @@ export async function runHelper(request: UpdateRequest, deps: HelperDeps): Promi
 		}
 		if (request.engineChanged) {
 			phase("engine");
-			await bun([join(deps.packageRoot, "src/cli/main.ts"), "setup", "--non-interactive", "--engine-only"], "새 엔진 설치");
+			try {
+				await bun([join(deps.packageRoot, "src/cli/main.ts"), "setup", "--non-interactive", "--engine-only"], "새 엔진 설치");
+			} catch (error) {
+				// Findings 214-217: the installer refused before selecting the engine and nothing running was restarted.
+				if (!(error instanceof StepError) || !error.message.includes(ENGINE_SCHEMA_REFUSAL)) throw error;
+				log(`실패(실행 중인 것은 그대로): ${error.message}`);
+				return await untouchedRollback(request, deps, { failure: { untouched: true, message: error.message }, prevTgz, log, phase, bun, finish });
+			}
 		}
 		phase("restart");
 		const restarted = await deps.strategy.run({ restart: deps.restart, log, request });

package/src/update/request.ts

@@ -1,7 +1,7 @@
 import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { CONSENT_WORD, type ConsentRecord, noticeSha256, type PermissionNotice, writePending } from "../consent/consent.ts";
-import { type StoreReading, updateSchemaNotice } from "../engine/schema-guard.ts";
+import { SCHEMA_INCOMPATIBLE, storeIncompatibility, type StoreReading, updateSchemaNotice } from "../engine/schema-guard.ts";
 import type { InstallKind } from "../runtime/install-kind.ts";
 import { type Origin, REQUEST_FILE, type UpdateRequest, readState, updateDir, updateRunning, writeJson, writeState } from "./state.ts";
 import { TargetError, type TargetInfo } from "./target.ts";
@@ -21,7 +21,7 @@ export const CHECKOUT_MESSAGE = "이 설치(checkout)는 저장소에서 배포
 
 export const DRAINING_MESSAGE = "이전 업데이트가 아직 이전 세대를 정리하고 있습니다. 정리가 끝난 뒤 다시 하세요";
 
-export type RefusalCode = "not_updatable" | "in_progress" | "same_version" | "busy" | "consent_on_mac" | "consent_required" | "schema_confirm" | "pending_questions";
+export type RefusalCode = "not_updatable" | "in_progress" | "same_version" | "busy" | "consent_on_mac" | "consent_required" | "schema_confirm" | "pending_questions" | typeof SCHEMA_INCOMPATIBLE;
 
 export interface Refusal {
 	readonly ok: false;
@@ -78,10 +78,23 @@ export function schemaLines(target: TargetInfo, store: StoreReading, globalEngin
 	return notice.confirm ? [...notice.lines, ROLLBACK_SCHEMA_WARNING] : null;
 }
 
+/**
+ * Findings 214-217: the target's engine cannot read the shared store, so the update is refused before any package
+ * install or engine-link change. Neither `force` nor `confirmSchema` overrides it; null when not known to be incompatible.
+ */
+export function schemaRefusal(target: TargetInfo, store: StoreReading): Refusal | null {
+	const found = storeIncompatibility(store, target.engine?.threadSchema ?? null);
+	if (found === null) return null;
+	return refuse(SCHEMA_INCOMPATIBLE, `공유 폴더 스키마 ${found.store}를 ${target.version}의 엔진 ${target.engine?.omo ?? ""}(지원 ${found.supported})이 읽지 못해 업데이트하지 않았습니다. 스키마 ${found.store}를 지원하는 버전이 필요합니다`,
+		{ lines: [`저장소 스키마 ${found.store}`, `대상 엔진 지원 ${found.supported}`] });
+}
+
 export function precheck(input: PrecheckInput): Precheck {
 	if (input.kind !== "npm") return refuse("not_updatable", CHECKOUT_MESSAGE);
 	if (input.running) return refuse("in_progress", "업데이트가 이미 진행 중입니다");
 	if (input.target.version === input.current.version) return refuse("same_version", `이미 ${input.current.version}입니다`);
+	const incompatible = schemaRefusal(input.target, input.store);
+	if (incompatible !== null) return incompatible;
 	if (input.busy && !input.force && input.target.handoff !== true) return refuse("busy", BUSY_MESSAGE);
 	const notice = input.target.notice;
 	const noticeChanged = input.consent?.noticeVersion !== notice.version;

package/src/work.ts

@@ -4,6 +4,7 @@ import { isDeepStrictEqual } from "node:util";
 import { OmoCommandError, type OmoClient, type OmoEvent, type OmoStatus } from "./omo/client.ts";
 import { DecisionStoreError, Store, WorkStoreError, type LedgerState, type MainInput, type StoredEvent, type WorkCommand, type WorkItem, type WorkReport, type WorkUpdateKind } from "./store.ts";
 import { nativeReplyEntry, type NativeReplyEntry, type NativeReplyObserver } from "./reply-notifications.ts";
+import { notificationHistory } from "./notification-history.ts";
 
 const ACK_TIMEOUT_MS = 30_000;
 const PREFIX = "ZGW_WORK_COMMAND ";
@@ -126,11 +127,15 @@ export class WorkRouter {
 	/** Includes finished, normally lazy sources so enabling never backfills their old replies. */
 	async notificationBaseline(): Promise<void> {
 		for (const work of this.allWorks()) {
-			const binding = await this.ensure(work);
+			const generation = this.generation;
 			const revision = this.options.replies?.revision();
-			const entries = await this.wholeSession(binding.sessionId, () => this.current(work.id, binding));
-			if (!entries || !this.current(work.id, binding)) throw new Error("reply_baseline_discarded");
-			if (revision !== undefined) this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId: work.id, title: work.title }, entries, revision);
+			const current = () => !this.stopped && generation === this.generation &&
+				this.store.getWork(work.id)?.sessionPath === work.sessionPath;
+			await notificationHistory(work.sessionPath, (entry) => {
+				if (!current()) throw new Error("reply_baseline_discarded");
+				if (revision !== undefined) this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId: work.id, title: work.title }, [entry], revision);
+			}, true);
+			if (!current()) throw new Error("reply_baseline_discarded");
 		}
 	}
 	private allWorks(): WorkItem[] { return this.store.listConversations().flatMap((conv) => this.store.listWorks(conv.id)); }
@@ -750,10 +755,19 @@ export class WorkRouter {
 			if (!this.ready || generation !== this.generation) return;
 			// A completed report may precede the final assistant reply. Enabled notifications
 			// must recover that tail even when command delivery already reached its terminal state.
-			if (["completed", "failed", "cancelled"].includes(work.status) &&
-				this.options.replies?.settings().mode !== "all-replies" &&
-				!this.store.listWorkCommands(work.id).some((command) => ["pending", "sending", "unknown"].includes(command.delivery))) continue;
 			try {
+				if (["completed", "failed", "cancelled"].includes(work.status) &&
+					!this.store.listWorkCommands(work.id).some((command) => ["pending", "sending", "unknown"].includes(command.delivery))) {
+					if (this.options.replies?.settings().mode === "all-replies") {
+						const revision = this.options.replies.revision();
+						await notificationHistory(work.sessionPath, (entry) => {
+							if (!this.ready || generation !== this.generation ||
+								this.store.getWork(work.id)?.sessionPath !== work.sessionPath) throw new Error("reply_history_discarded");
+							this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId: work.id, title: work.title }, [entry], revision);
+						});
+					}
+					continue;
+				}
 				await this.reconcile(work.id);
 				this.schedule(work.id);
 			} catch (error) { this.fail(error); }

package/web/DESIGN.md

@@ -14,6 +14,10 @@ The chat retains its bounded scroll area. The memo remains an anchored,
 resizable panel inside `messages-wrap`, constrained to the available width
 and height. Text owns the remaining panel height; image controls do not
 overlap the composer or resize handle.
+The message viewport reserves a 64px right gutter outside its scroll area.
+The existing 34px navigation buttons and their 20px right offset occupy this
+gutter, with 10px clearance. All message kinds share this boundary, including
+system notices. The message list remains the only vertical scroll owner.
 
 ## 4. Typography and spacing
 Keep existing 12px panel labels, 14px memo text, 8/12px control spacing,
@@ -105,6 +109,16 @@ image-specific remove labels. Keyboard focus remains visible. Closing or
 reopening the memo must not lose saved text or image references.
 
 ## 8. Verification and retained debt
+Security confirmation reuses the same inbox item, text buttons and inline delete
+confirmation. Chat and inbox share the held identity. Pending, processing, sent,
+cancelled, failed and unconfirmed states have text labels; only confirmed sent
+uses `--ok`. Canonical values preserve whitespace and wrap at narrow widths.
+Allowed values remain inside the existing security settings section. The list
+uses 12px metadata, 8px spacing, 4px radii and existing border/muted tokens.
+Loading, offline, empty, error, retry and busy states use live status regions.
+Delete confirmation focuses the keep action and explains future-check effects.
+Real desktop/mobile and light/dark QA is assigned to the integration lead.
+
 Exercise empty/one/two/full/uploading/error/remove/reopen/remote-update states
 at narrow and wide sizes. Preserve the existing theme and unrelated controls.
 Existing broad application-script size is outside this feature; extract only
@@ -139,3 +153,28 @@ A sent message shows the references it carried above its text as quotes: the 1px
 as the title; reference text is set as DOM text only, never HTML. No new tokens or motion; autocomplete, IME, autocopy,
 마지막 보냄 includes the reference count, including a reference-only send. ArrowUp still recalls typed text only,
 as it already does for image-only messages.
+
+## 10. Inline chat diagrams (180)
+Only complete top-level, unindented triple-backtick `zigmini-diagram` fences
+become diagrams. Invalid and unfinished fences retain the existing source view.
+The figure uses `--bg-card`, `--bg-input`, `--border`, `--text` and `--muted`.
+Native node text inherits the message font and stays selectable. Nodes use
+8px/12px padding, a 4px radius and a 1px border; the figure uses an 8px radius.
+Top-to-bottom levels use intrinsic max-content columns, 24px column gaps and
+48px row gaps. A 24px right gutter carries edges that skip a level; their
+horizontal segments stay in the row gaps, never through intermediate labels.
+Labels never scale down or truncate, including at enlarged text.
+The diagram viewport alone owns horizontal and vertical diagram scrolling,
+bounded to the message width and 24rem height. The transcript retains normal
+scroll chaining. At phone widths up to 640px, the figure leaves 48px on its right
+for the existing transcript navigation buttons, keeping its source and scroll
+controls clear without changing those buttons or other message layouts.
+The viewport is a named keyboard-focusable region with a visible
+text-colour focus outline. A native details/summary source foldout follows it,
+with a 44px minimum summary target and selectable complete fence source.
+The title and a native text list describe every directed edge for assistive
+technology; SVG connectors are inert and hidden from it. Disconnected nodes
+remain visible. No animation, network, remote fonts, new settings or exports.
+Source foldouts retain their local open state across streaming updates.
+Desktop/phone light/dark, enlarged text, source/copy and reference QA belong
+to the parent integration lane; local unit checks do not claim visual approval.