zigmini 1.0.0-beta.3 → 1.1.0-beta.2

package/src/store.ts

@@ -1,4 +1,9 @@
 import { Database } from "bun:sqlite";
+import { AttachmentStore } from "./attachments/store.ts";
+import { AgentToolPermissionError, AgentToolPermissionStore, permissionOutcome, type AgentToolGrantAnswer, type AgentToolRequestInput, type AgentToolRequestRecord, type AnswerResult, type GrantEditInput, type GrantEditResult, type OwnerPrincipal } from "./agent/tool-permissions.ts";
+import type { AgentToolMigrationCard } from "./agent/tool-permissions.ts";
+import { SqliteAsideDecisions } from "./agent/aside-target-routes.ts";
+import type { LegacyScopeItem } from "./agent/definition.ts";
 import { say, type Text } from "./server-text.ts";
 import { OMO_CHECK_BASELINE, omoCheckActionable, omoCheckDaytime } from "./omo-check-policy.ts";
 import { chmodSync, existsSync, mkdirSync } from "node:fs";
@@ -6,8 +11,10 @@ import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import type { ConversationInfo, DecisionAnswerRequest, NotificationMode, ReplyNotification } from "./protocol.ts";
 import type { NativeTurnStats } from "./turn-stats.ts";
-import { SecurityRuntimeError, securityDecision, type AllowedValue, type HeldState, type SecurityApprover, type SecurityHoldRecord, type SecurityIntent, type SecurityReceipt } from "./security-allow.ts";
+import { SecurityRuntimeError, securityDecision, type AllowedValue, type HeldState, type SecurityApprover, type MessageSecurityHoldRecord as SecurityHoldRecord, type SecurityIntent, type SecurityReceipt, type ArtifactSecurityHold, type ArtifactReviewReceipt, type ArtifactReleaseReceipt, type ArtifactReadBinding, type ArtifactReviewSummary } from "./security-allow.ts";
+import { CollaborationStoreError, collaborationDigest, agentRequestTerminal, agentRequestRetryable, AGENT_REQUEST_FINAL_SQL, collaborationNever, collaborationStageDecision, type CollaborationBinding, type AgentCancelReceipt, type CollaborationGate, type CollaborationTarget, type AgentRequestInput, type AgentRequest, type AgentActivation, type AgentReceipt, type AgentDelivery, type AgentResultInput, type AgentResult, type AgentArtifact, type AgentArtifactStage, type AgentStageInput, type ArtifactGrant, type CollaborationPermissionOutcome, type CollaborationIntent } from "./agent/collaboration-types.ts";
 import { findPrivate, normalizeTerm, PUBLIC_ACCOUNT } from "./security/terms.ts";
+import { testCrashPoint } from "./test-crash.ts";
 
 export interface SecurityBaselineTerm {
 	readonly id: string;
@@ -35,7 +42,24 @@ export interface StoredEvent {
 
 export type MainInputSource =
 	| { origin: "user"; input_ref: { message_seq: number } }
-	| { origin: "work_update"; input_ref: { update_ids: string[]; notification_id: string } };
+	| { origin: "work_update"; input_ref: { update_ids: string[]; notification_id: string } }
+	| { readonly origin: "agent_collaboration"; readonly input_ref: {
+		readonly request_id: string; readonly activation_id: string; readonly direction: AgentActivation["direction"]; readonly message_seq: number } }
+	| { readonly origin: "agent_tool_permission"; readonly input_ref: CollaborationPermissionOutcome & { readonly activation_id: string } }
+	| { readonly origin: "collaboration_artifact_read"; readonly input_ref: {
+		readonly holdId: string; readonly readOperationId: string; readonly continuationId: string; readonly reviewedScopeDigest: string } };
+
+/** Preserve the discriminant when projecting a persisted input to a turn source. */
+export function mainInputSource(input: MainInputSource): MainInputSource {
+	switch (input.origin) {
+		case "user": return { origin: input.origin, input_ref: input.input_ref };
+		case "work_update": return { origin: input.origin, input_ref: input.input_ref };
+		case "agent_collaboration": return { origin: input.origin, input_ref: input.input_ref };
+		case "agent_tool_permission": return { origin: input.origin, input_ref: input.input_ref };
+		case "collaboration_artifact_read": return { origin: input.origin, input_ref: input.input_ref };
+		default: return collaborationNever(input);
+	}
+}
 
 export type MainInput = MainInputSource & {
 	session_path: string;
@@ -44,6 +68,7 @@ export type MainInput = MainInputSource & {
 	input_id?: string;
 	wire_message?: string;
 	native_identity?: boolean;
+	readonly authored_binding?: CollaborationBinding;
 };
 
 export interface MainTurn {
@@ -263,7 +288,7 @@ function terminalWork(status: WorkStatus): boolean {
 export type DecisionMethod = "select" | "confirm" | "input" | "editor" | "question" | "unknown";
 export type DecisionBinding = "live" | "expired" | "closed" | "unknown";
 export type DecisionStatus = "pending" | "submitted" | "delivered" | "needs_review" | "closed";
-export type DecisionRoute = "live_response" | "follow_up_command";
+export type DecisionRoute = "live_response" | "follow_up_command" | "collaboration_stage";
 
 export interface Decision {
 	readonly id: string;
@@ -353,13 +378,26 @@ export interface DecisionClaim {
 /**
  * A required question (no idle deadline) that its owner's turn, main's or a work's, is blocked on. Input queued behind
  * that turn (main chat, or a work instruction sent as a steer) cannot reach the owner before the answer, so it does not
- * change the question's context, and a recheck must not be queued there either.
+ * change the question's context, and a recheck must not be queued there either. Bug 236: a queued work instruction ends
+ * the wait instead (releasedWorkQuestion).
  */
 export function blockedQuestion(decision: Pick<Decision, "method" | "permission" | "bindingState" | "deadlineAt">): boolean {
 	return decision.method === "question" && !decision.permission &&
 		decision.bindingState === "live" && decision.deadlineAt === null;
 }
 
+/**
+ * Bug 236 (operator decision 2026-11-05): a work's required question whose native wait the gateway ended because a newer
+ * instruction was queued behind it. The question stays open in the inbox, takes its answer as a follow-up command, and a
+ * newer instruction does not change its context: the step that depends on the answer still waits for it.
+ */
+export const INSTRUCTION_RELEASED = "instruction_released";
+
+export function releasedWorkQuestion(decision: Pick<Decision, "workId" | "method" | "permission" | "bindingState" | "reason">): boolean {
+	return decision.workId !== null && decision.method === "question" && !decision.permission &&
+		decision.bindingState === "closed" && decision.reason === INSTRUCTION_RELEASED;
+}
+
 /** blockedQuestion owned by main. */
 export function blockedMainQuestion(decision: Pick<Decision, "workId" | "method" | "permission" | "bindingState" | "deadlineAt">): boolean {
 	return decision.workId === null && blockedQuestion(decision);
@@ -377,7 +415,7 @@ export interface DecisionDismissal {
 }
 
 export class DecisionStoreError extends Error {
-	constructor(readonly code: "security_endpoint_required" | "decision_not_found" | "decision_conflict" | "submission_conflict" | "source_conflict" | "invalid_decision" | "invalid_decision_answer" | "invalid_decision_cursor" | "invalid_decision_transition", readonly decision: Decision | null = null) {
+	constructor(readonly code: "security_endpoint_required" | "decision_not_found" | "decision_conflict" | "submission_conflict" | "source_conflict" | "invalid_decision" | "invalid_decision_answer" | "invalid_decision_cursor" | "invalid_decision_transition" | "tool_grant_response_required" | "tool_grant_principal_required", readonly decision: Decision | null = null) {
 		super(code);
 	}
 }
@@ -445,7 +483,7 @@ export function replacementQuestionPayload(payload: Record<string, unknown>): Re
  * async_wait_closed (a waitForAnswer false question whose native wait ended) and recheck_incomplete (a recheck turn
  * ended without a replacement; the question stands as asked). A permission is never resumed (submitDecision, info).
  */
-export const RESUMABLE_CLOSED: ReadonlySet<string> = new Set(["report_only", "main_released", "async_wait_closed", "recheck_incomplete"]);
+export const RESUMABLE_CLOSED: ReadonlySet<string> = new Set(["report_only", "main_released", INSTRUCTION_RELEASED, "async_wait_closed", "recheck_incomplete"]);
 
 /** Checks structural completeness, not the semantic appropriateness of a historical answer. */
 function completeDecisionAnswer(method: DecisionMethod, payload: unknown, response: unknown): boolean {
@@ -478,19 +516,24 @@ function completeDecisionAnswer(method: DecisionMethod, payload: unknown, respon
 	}
 }
 
+// allow: SIZE_OK - this existing Store owns the shared SQLite writer; T2 explicitly owns only its scoped transaction hunks.
 export class Store {
 	private readonly db: Database;
+	readonly attachments: AttachmentStore;
 	private readonly securityReceiptListeners = new Set<() => void>();
 
 	constructor(dataDir: string) {
 		mkdirSync(dataDir, { recursive: true, mode: 0o700 });
 		chmodSync(dataDir, 0o700);
 		this.db = new Database(join(dataDir, "gateway.sqlite"), { create: true });
+		// Independent writers serialize admission instead of failing immediately during another short transaction.
+		this.db.exec("PRAGMA busy_timeout = 5000;");
 		this.db.exec("PRAGMA journal_mode = WAL;");
 		// Linux builds of bun:sqlite default to synchronous=FULL, which fsyncs every appended event (~80x slower,
 		// and a stalled disk stalls the gateway). WAL + NORMAL cannot corrupt the database; a power cut may drop
 		// only the last few commits. This also matches the macOS default.
 		this.db.exec("PRAGMA synchronous = NORMAL;");
+		this.db.exec("PRAGMA busy_timeout = 5000;");
 		this.db.exec(`
 			CREATE TABLE IF NOT EXISTS conversations (
 				id TEXT PRIMARY KEY,
@@ -675,6 +718,14 @@ export class Store {
 			this.db.close();
 			throw error;
 		}
+		this.toolPermissions = new AgentToolPermissionStore(this.db);
+		this.asideTargets = new SqliteAsideDecisions(this.db, (id) => this.getDecision(id));
+		try {
+			this.toolPermissions.migrate();
+		} catch (error) {
+			this.db.close();
+			throw error;
+		}
 		this.db.exec(`
 			CREATE TABLE IF NOT EXISTS security_baseline_terms (
 				id TEXT PRIMARY KEY, value TEXT COLLATE BINARY NOT NULL UNIQUE, data TEXT NOT NULL
@@ -690,12 +741,1628 @@ export class Store {
 				id TEXT PRIMARY KEY, source_key TEXT UNIQUE, intent_submission TEXT UNIQUE, data TEXT NOT NULL
 			);
 		`);
+		this.attachments = new AttachmentStore(this.db, (conv, data, receipt) => this.acceptMainUser(conv, data, receipt));
+		try {
+			this.db.transaction(() => {
+				const schema = this.db.query<{ sql: string }, []>("SELECT sql FROM sqlite_master WHERE type='table' AND name='decisions'").get();
+				if (schema && !schema.sql.includes("'collaboration_stage'")) {
+					const indexes = this.db.query<{ sql: string }, []>("SELECT sql FROM sqlite_master WHERE type='index' AND tbl_name='decisions' AND sql IS NOT NULL").all();
+					this.db.exec("ALTER TABLE decisions RENAME TO collaboration_legacy_decisions");
+					this.db.exec(schema.sql.replace("'live_response','follow_up_command'", "'live_response','follow_up_command','collaboration_stage'"));
+					this.db.exec("INSERT INTO decisions SELECT * FROM collaboration_legacy_decisions; DROP TABLE collaboration_legacy_decisions");
+					for (const index of indexes) this.db.exec(index.sql);
+				}
+				// JSON is the typed record; generated columns cannot drift from its relational keys or revisions.
+				this.db.exec(`
+					CREATE TABLE IF NOT EXISTS agent_lifecycle (agent_id TEXT PRIMARY KEY, epoch INTEGER NOT NULL CHECK(epoch > 0));
+					CREATE TABLE IF NOT EXISTS agent_requests (
+						id TEXT PRIMARY KEY, data TEXT NOT NULL CHECK(json_valid(data)),
+						root_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.rootId')) STORED NOT NULL REFERENCES agent_requests(id),
+						parent_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.parentId')) STORED REFERENCES agent_requests(id),
+						requester_conv TEXT GENERATED ALWAYS AS (json_extract(data,'$.requesterConv')) STORED NOT NULL,
+						requester_agent TEXT GENERATED ALWAYS AS (json_extract(data,'$.requesterAgent')) STORED,
+						target_conv TEXT GENERATED ALWAYS AS (json_extract(data,'$.targetConv')) STORED NOT NULL,
+						target_agent TEXT GENERATED ALWAYS AS (json_extract(data,'$.targetAgent')) STORED NOT NULL,
+						kind TEXT GENERATED ALWAYS AS (json_extract(data,'$.kind')) STORED CHECK(kind IN ('task','question')),
+						payload_json TEXT GENERATED ALWAYS AS (json_extract(data,'$.payload')) STORED NOT NULL,
+						payload_sha TEXT GENERATED ALWAYS AS (json_extract(data,'$.payloadSha')) STORED NOT NULL,
+						submission_key TEXT GENERATED ALWAYS AS (json_extract(data,'$.submissionKey')) STORED NOT NULL UNIQUE,
+						fingerprint TEXT GENERATED ALWAYS AS (json_extract(data,'$.fingerprint')) STORED NOT NULL,
+						state TEXT GENERATED ALWAYS AS (json_extract(data,'$.state')) STORED NOT NULL CHECK(state IN ('queued','running','waiting_peer','waiting_owner','result_preparing','completed','failed','interrupted','cancel_requested','cancelled','unresolved_delivery','version_conflict')),
+						revision INTEGER GENERATED ALWAYS AS (json_extract(data,'$.revision')) STORED NOT NULL CHECK(revision > 0),
+						created_at TEXT GENERATED ALWAYS AS (json_extract(data,'$.createdAt')) STORED NOT NULL,
+						result_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.resultId')) STORED,
+						cancel_reason TEXT GENERATED ALWAYS AS (json_extract(data,'$.cancelReason')) STORED,
+						CHECK(id = json_extract(data,'$.id'))
+					);
+					CREATE INDEX IF NOT EXISTS agent_requests_target ON agent_requests(target_conv,state,created_at);
+					CREATE INDEX IF NOT EXISTS agent_requests_tree ON agent_requests(root_id,parent_id);
+					CREATE UNIQUE INDEX IF NOT EXISTS agent_requests_child ON agent_requests(parent_id) WHERE parent_id IS NOT NULL AND state NOT IN ${AGENT_REQUEST_FINAL_SQL};
+					CREATE TABLE IF NOT EXISTS agent_activations (
+						id TEXT PRIMARY KEY, data TEXT NOT NULL CHECK(json_valid(data)),
+						request_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.requestId')) STORED NOT NULL REFERENCES agent_requests(id),
+						direction TEXT GENERATED ALWAYS AS (json_extract(data,'$.direction')) STORED NOT NULL CHECK(direction IN ('request','reply','owner_answer')),
+						ordinal INTEGER GENERATED ALWAYS AS (json_extract(data,'$.ordinal')) STORED NOT NULL,
+						input_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.inputId')) STORED NOT NULL UNIQUE,
+						input_seq INTEGER GENERATED ALWAYS AS (json_extract(data,'$.inputSeq')) STORED REFERENCES events(seq),
+						target_conv TEXT GENERATED ALWAYS AS (json_extract(data,'$.targetConv')) STORED NOT NULL,
+						session_path TEXT GENERATED ALWAYS AS (json_extract(data,'$.binding.sessionPath')) STORED,
+						durable_session_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.binding.durableSessionId')) STORED,
+						gateway_generation TEXT GENERATED ALWAYS AS (json_extract(data,'$.binding.gatewayGeneration')) STORED,
+						definition_sha TEXT GENERATED ALWAYS AS (json_extract(data,'$.binding.definitionSha')) STORED,
+						state TEXT GENERATED ALWAYS AS (json_extract(data,'$.state')) STORED NOT NULL CHECK(state IN ('queued','attempted','acknowledged','consumed','rejected','unknown')),
+						revision INTEGER GENERATED ALWAYS AS (json_extract(data,'$.revision')) STORED NOT NULL CHECK(revision > 0),
+						consumed_entry TEXT GENERATED ALWAYS AS (json_extract(data,'$.consumedEntry')) STORED,
+						quiesced INTEGER GENERATED ALWAYS AS (json_extract(data,'$.quiesced')) STORED NOT NULL,
+						UNIQUE(request_id,direction,ordinal), CHECK(id = json_extract(data,'$.id'))
+					);
+					CREATE TABLE IF NOT EXISTS agent_results (
+						id TEXT PRIMARY KEY, data TEXT NOT NULL CHECK(json_valid(data)),
+						request_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.requestId')) STORED NOT NULL UNIQUE REFERENCES agent_requests(id),
+						activation_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.activationId')) STORED NOT NULL REFERENCES agent_activations(id),
+						submission_key TEXT GENERATED ALWAYS AS (json_extract(data,'$.submissionKey')) STORED NOT NULL UNIQUE,
+						payload_sha TEXT GENERATED ALWAYS AS (json_extract(data,'$.payloadSha')) STORED NOT NULL,
+						text TEXT GENERATED ALWAYS AS (json_extract(data,'$.text')) STORED NOT NULL,
+						outcome TEXT GENERATED ALWAYS AS (json_extract(data,'$.outcome')) STORED CHECK(outcome IN ('completed','failed')),
+						manifest_json TEXT GENERATED ALWAYS AS (json_extract(data,'$.manifest')) STORED NOT NULL,
+						committed_at TEXT GENERATED ALWAYS AS (json_extract(data,'$.committedAt')) STORED NOT NULL
+					);
+					CREATE TABLE IF NOT EXISTS agent_artifacts (
+						id TEXT PRIMARY KEY, data TEXT NOT NULL CHECK(json_valid(data)),
+						producer_conv TEXT GENERATED ALWAYS AS (json_extract(data,'$.producerConv')) STORED NOT NULL,
+						request_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.requestId')) STORED REFERENCES agent_requests(id),
+						sha256 TEXT GENERATED ALWAYS AS (json_extract(data,'$.sha256')) STORED NOT NULL,
+						bytes INTEGER GENERATED ALWAYS AS (json_extract(data,'$.bytes')) STORED NOT NULL CHECK(bytes BETWEEN 0 AND 10485760),
+						media_type TEXT GENERATED ALWAYS AS (json_extract(data,'$.mediaType')) STORED NOT NULL,
+						original_name TEXT GENERATED ALWAYS AS (json_extract(data,'$.originalName')) STORED NOT NULL,
+						sealed_name TEXT GENERATED ALWAYS AS (json_extract(data,'$.sealedName')) STORED NOT NULL,
+						state TEXT GENERATED ALWAYS AS (json_extract(data,'$.state')) STORED CHECK(state IN ('staged','committed','trashed')),
+						lifecycle_epoch INTEGER GENERATED ALWAYS AS (json_extract(data,'$.lifecycleEpoch')) STORED NOT NULL,
+						storage_class TEXT GENERATED ALWAYS AS (json_extract(data,'$.storageClass')) STORED CHECK(storage_class IN ('source_copy','scoped_document')),
+						stage_operation_key TEXT GENERATED ALWAYS AS (json_extract(data,'$.stageOperationKey')) STORED NOT NULL UNIQUE,
+						stage_payload_sha TEXT GENERATED ALWAYS AS (json_extract(data,'$.stagePayloadSha')) STORED NOT NULL,
+						provenance_json TEXT GENERATED ALWAYS AS (json_extract(data,'$.provenance')) STORED NOT NULL
+					);
+					CREATE TABLE IF NOT EXISTS agent_artifact_grants (
+						grant_id TEXT PRIMARY KEY, data TEXT NOT NULL CHECK(json_valid(data)),
+						artifact_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.artifactId')) STORED NOT NULL REFERENCES agent_artifacts(id),
+						grantee_conv TEXT GENERATED ALWAYS AS (json_extract(data,'$.granteeConv')) STORED NOT NULL,
+						request_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.requestId')) STORED NOT NULL REFERENCES agent_requests(id),
+						permission TEXT GENERATED ALWAYS AS (json_extract(data,'$.permission')) STORED CHECK(permission IN ('read','transfer')),
+						revoked INTEGER GENERATED ALWAYS AS (json_extract(data,'$.revoked')) STORED NOT NULL CHECK(revoked IN (0,1)),
+						revision INTEGER GENERATED ALWAYS AS (json_extract(data,'$.revision')) STORED NOT NULL CHECK(revision > 0),
+						grantee_lifecycle_epoch INTEGER GENERATED ALWAYS AS (json_extract(data,'$.granteeLifecycleEpoch')) STORED NOT NULL,
+						recipient_authority_epoch INTEGER GENERATED ALWAYS AS (json_extract(data,'$.recipientAuthorityEpoch')) STORED,
+						UNIQUE(artifact_id,grantee_conv,request_id,permission)
+					);
+					CREATE TABLE IF NOT EXISTS agent_artifact_stages (
+						transfer_id TEXT PRIMARY KEY, data TEXT NOT NULL CHECK(json_valid(data)),
+						operation_key TEXT GENERATED ALWAYS AS (json_extract(data,'$.operationKey')) STORED NOT NULL UNIQUE,
+						payload_sha TEXT GENERATED ALWAYS AS (json_extract(data,'$.payloadSha')) STORED NOT NULL,
+						source_ref_json TEXT GENERATED ALWAYS AS (json_extract(data,'$.source')) STORED NOT NULL,
+						target_ref_json TEXT GENERATED ALWAYS AS (json_extract(data,'$.target')) STORED NOT NULL,
+						scope_digest TEXT GENERATED ALWAYS AS (json_extract(data,'$.scopeDigest')) STORED NOT NULL,
+						owner_principal_ref TEXT GENERATED ALWAYS AS (json_extract(data,'$.ownerPrincipalRef')) STORED NOT NULL,
+						source_input_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.sourceBinding.inputId')) STORED NOT NULL,
+						source_activation_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.sourceBinding.activationId')) STORED,
+						origin_request_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.originRequestId')) STORED REFERENCES agent_requests(id),
+						decision_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.decisionId')) STORED UNIQUE REFERENCES decisions(id),
+						decision_revision INTEGER GENERATED ALWAYS AS (json_extract(data,'$.decisionRevision')) STORED,
+						continuation_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.continuationId')) STORED NOT NULL UNIQUE,
+						state TEXT GENERATED ALWAYS AS (json_extract(data,'$.state')) STORED CHECK(state IN ('awaiting_transfer_authority','ready','staging','staged','denied','cancelled','invalidated','unknown')),
+						revision INTEGER GENERATED ALWAYS AS (json_extract(data,'$.revision')) STORED NOT NULL CHECK(revision > 0),
+						artifact_id TEXT GENERATED ALWAYS AS (json_extract(data,'$.artifactId')) STORED UNIQUE REFERENCES agent_artifacts(id),
+						authority_ref TEXT GENERATED ALWAYS AS (json_extract(data,'$.authority')) STORED,
+						export_receipt TEXT GENERATED ALWAYS AS (json_extract(data,'$.exportReceipt')) STORED,
+						error_code TEXT GENERATED ALWAYS AS (json_extract(data,'$.errorCode')) STORED
+					);
+					CREATE TABLE IF NOT EXISTS agent_question_links (
+						decision_id TEXT PRIMARY KEY REFERENCES decisions(id), request_id TEXT REFERENCES agent_requests(id),
+						activation_id TEXT REFERENCES agent_activations(id), transfer_id TEXT REFERENCES agent_artifact_stages(transfer_id),
+						read_operation_id TEXT, origin_input_seq INTEGER REFERENCES events(seq)
+					);
+					CREATE UNIQUE INDEX IF NOT EXISTS agent_collaboration_operation ON events(json_extract(data,'$.key')) WHERE type='agent.collaboration.operation';
+				`);
+				// An index built with an older final-state list is rebuilt; the current list only frees more rows, so it cannot fail.
+				const child = this.db.query<{ sql: string }, []>("SELECT sql FROM sqlite_master WHERE type='index' AND name='agent_requests_child'").get();
+				if (child && !child.sql.includes(`state NOT IN ${AGENT_REQUEST_FINAL_SQL}`)) {
+					this.db.exec(`DROP INDEX agent_requests_child; CREATE UNIQUE INDEX agent_requests_child ON agent_requests(parent_id) WHERE parent_id IS NOT NULL AND state NOT IN ${AGENT_REQUEST_FINAL_SQL}`);
+				}
+			}).immediate();
+			this.attachments.migrate();
+		} catch (error) {
+			this.db.close();
+			throw error;
+		}
+		this.db.exec("PRAGMA foreign_keys = ON;");
 		for (const suffix of ["", "-wal", "-shm"]) {
 			const path = join(dataDir, `gateway.sqlite${suffix}`);
 			if (existsSync(path)) chmodSync(path, 0o600);
 		}
 	}
 
+	ensureAgentLifecycle(agentId: string): number {
+		this.db.query("INSERT OR IGNORE INTO agent_lifecycle VALUES (?, 1)").run(agentId);
+		const row = this.db.query<{ epoch: number }, [string]>("SELECT epoch FROM agent_lifecycle WHERE agent_id=?").get(agentId);
+		if (!row) throw new CollaborationStoreError("agent_not_found", 404);
+		return row.epoch;
+	}
+
+	/** A cancelled request's undispatched inputs are definitely unsent: they close as rejected and never dispatch. */
+	private closeQueuedAgentInputs(requestId: string): void {
+		for (const row of this.db.query<{ data: string }, [string]>("SELECT data FROM agent_activations WHERE request_id=? AND state='queued'").all(requestId)) {
+			const activation: AgentActivation = JSON.parse(row.data);
+			if (activation.direction === "reply") continue;
+			this.writeAgentActivation({ ...activation, state: "rejected", quiesced: true, revision: activation.revision + 1 }, activation.revision);
+		}
+	}
+
+	/**
+	 * cancel_requested becomes cancelled only when its own executions are quiescent and every child is terminal; the
+	 * check then repeats for the parent that waited on it. Anything still uncertain stays cancel_requested.
+	 */
+	private settleCancelledAgentRequest(requestId: string): void {
+		let current = this.getAgentRequest(requestId);
+		while (current && current.state === "cancel_requested") {
+			const id = current.id;
+			const running = this.db.query<{ data: string }, []>("SELECT data FROM agent_activations WHERE state NOT IN ('queued','rejected') AND quiesced=0").all()
+				.some(row => this.agentExecutionRequest(JSON.parse(row.data) as AgentActivation)?.id === id);
+			if (running || this.db.query(`SELECT id FROM agent_requests WHERE parent_id=? AND state NOT IN ${AGENT_REQUEST_FINAL_SQL}`).get(id)) return;
+			this.replyWithoutResult(this.writeAgentRequest({ ...current, state: "cancelled", revision: current.revision + 1 }, current.revision), current.cancelReason ?? "cancelled");
+			current = current.parentId ? this.getAgentRequest(current.parentId) : null;
+		}
+	}
+
+	/** Executions to interrupt cooperatively for requests left in cancel_requested: conversation and activation of each. */
+	cancelRequestedExecutions(): readonly { readonly conv: string; readonly activationId: string }[] {
+		return this.db.query<{ data: string }, []>("SELECT data FROM agent_activations WHERE state IN ('attempted','acknowledged','consumed') AND quiesced=0").all()
+			.map(row => JSON.parse(row.data) as AgentActivation)
+			.filter(activation => this.agentExecutionRequest(activation)?.state === "cancel_requested")
+			.map(activation => ({ conv: activation.targetConv, activationId: activation.id }));
+	}
+
+	/** Delete waits while the conversation owes or holds collaboration work: open requests, undelivered inputs or uncertain runs. */
+	agentCollaborationBusy(convId: string): boolean {
+		return this.db.query(`SELECT 1 FROM agent_requests WHERE (requester_conv=?1 OR target_conv=?1)
+			AND state NOT IN ${AGENT_REQUEST_FINAL_SQL}
+			UNION ALL SELECT 1 FROM agent_activations WHERE target_conv=?1 AND quiesced=0 AND state IN ('queued','attempted','acknowledged','consumed','unknown') LIMIT 1`).get(convId) !== null;
+	}
+
+	/**
+	 * After the native connection was lost, an input that crossed the RPC boundary without consumption evidence is
+	 * uncertain. It is never replayed: the activation becomes unknown and its request unresolved_delivery, which only an
+	 * evidence recheck may resolve.
+	 */
+	markUncertainAgentDeliveries(): number {
+		return this.db.transaction(() => {
+			let marked = 0;
+			for (const row of this.db.query<{ data: string }, []>("SELECT data FROM agent_activations WHERE state IN ('attempted','acknowledged') AND quiesced=0").all()) {
+				const activation: AgentActivation = JSON.parse(row.data);
+				this.writeAgentActivation({ ...activation, state: "unknown", revision: activation.revision + 1 }, activation.revision);
+				const request = this.agentExecutionRequest(activation) ?? this.getAgentRequest(activation.requestId);
+				if (request && !agentRequestTerminal(request.state) && request.state !== "cancel_requested") {
+					this.writeAgentRequest({ ...request, state: "unresolved_delivery", revision: request.revision + 1 }, request.revision);
+				}
+				this.appendEvent(activation.targetConv, "agent.collaboration.delivery_unknown", { activationId: activation.id, requestId: request?.id ?? null });
+				marked += 1;
+			}
+			return marked;
+		}).immediate();
+	}
+
+	advanceAgentLifecycle(agentId: string, expectedEpoch: number): number {
+		if (this.db.query("UPDATE agent_lifecycle SET epoch=epoch+1 WHERE agent_id=? AND epoch=?").run(agentId, expectedEpoch).changes !== 1) {
+			throw new CollaborationStoreError("lifecycle_conflict");
+		}
+		return expectedEpoch + 1;
+	}
+
+	/** The Hub records its current binding, not a model-supplied identity. No session is opened here. */
+	recordAgentBinding(binding: CollaborationBinding): void {
+		this.db.transaction(() => {
+			const current = this.agentBinding(binding.convId);
+			const conv = this.getConversation(binding.convId);
+			if (!conv || conv.threadId !== binding.sessionPath || (conv.agentId ?? null) !== binding.agentId ||
+				(current && current.ownerInputRevision > binding.ownerInputRevision)) throw new CollaborationStoreError("binding_conflict");
+			if (binding.agentId !== null && this.ensureAgentLifecycle(binding.agentId) !== binding.lifecycleEpoch) throw new CollaborationStoreError("lifecycle_conflict");
+			if (current && isDeepStrictEqual(current, binding)) return;
+			if (current) {
+				if (current.activationId !== null && binding.activationId === null && binding.ownerInputRevision > current.ownerInputRevision) {
+					const activation = this.getAgentActivation(current.activationId);
+					const request = activation && this.agentExecutionRequest(activation);
+					if (request && !agentRequestTerminal(request.state) && request.state !== "cancel_requested") {
+						this.replyWithoutResult(this.writeAgentRequest({ ...request, state: "interrupted", revision: request.revision + 1 }, request.revision), "owner_input");
+					}
+				}
+				for (const row of this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE json_extract(data,'$.source')='collaboration_artifact' AND json_extract(data,'$.readScope.granteeConv')=?").all(binding.convId)) {
+					const hold: ArtifactSecurityHold = JSON.parse(row.data);
+					const intendedRead = binding.readContinuationId === hold.continuation.id && hold.continuation.state === "queued" &&
+						binding.ownerInputRevision === hold.continuation.originOwnerInputRevision;
+					if (!intendedRead && hold.continuation.releaseReceiptId === null && hold.state !== "invalidated") {
+						this.writeArtifactHold({ ...hold, revision: hold.revision + 1, state: "invalidated", invalidationReason: "binding_changed",
+							continuation: { ...hold.continuation, state: "invalidated" } });
+					}
+				}
+				for (const row of this.db.query<{ data: string }, [string]>("SELECT data FROM agent_artifact_stages WHERE json_extract(data,'$.sourceBinding.convId')=? AND state IN ('awaiting_transfer_authority','ready','staging','staged')").all(binding.convId)) {
+					const stage: AgentArtifactStage = JSON.parse(row.data);
+					if (stage.artifactId && this.agentArtifact(stage.artifactId)?.requestId !== null) continue;
+					this.db.query("UPDATE agent_artifact_stages SET data=? WHERE transfer_id=?").run(JSON.stringify({ ...stage,
+						state: stage.state === "staging" ? "unknown" : "invalidated", revision: stage.revision + 1, errorCode: "binding_changed" }), stage.transferId);
+				}
+			}
+			this.appendEvent(binding.convId, "agent.collaboration.binding", binding);
+		}).immediate();
+	}
+
+	agentBinding(conv: string): CollaborationBinding | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM events WHERE conv=? AND type='agent.collaboration.binding' ORDER BY seq DESC LIMIT 1").get(conv);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	private assertAgentBinding(binding: CollaborationBinding): void {
+		if (!isDeepStrictEqual(this.agentBinding(binding.convId), binding) || this.getConversation(binding.convId)?.threadId !== binding.sessionPath) throw new CollaborationStoreError("binding_conflict");
+		if (binding.agentId !== null && this.ensureAgentLifecycle(binding.agentId) !== binding.lifecycleEpoch) throw new CollaborationStoreError("lifecycle_conflict");
+	}
+
+	private agentTarget(agentId: string): CollaborationTarget {
+		const conv = this.db.query<{ id: string }, [string]>("SELECT id FROM conversations WHERE agent_id=? AND hidden=0").get(agentId);
+		if (!conv) throw new CollaborationStoreError("agent_not_found", 404);
+		return { agentId, convId: conv.id, lifecycleEpoch: this.ensureAgentLifecycle(agentId) };
+	}
+
+	private checkAgentAccess(gate: CollaborationGate, binding: CollaborationBinding, target: CollaborationTarget): number | undefined {
+		this.assertAgentBinding(binding);
+		if (!isDeepStrictEqual(this.agentTarget(target.agentId), target)) throw new CollaborationStoreError("lifecycle_conflict");
+		gate.assertAccess(this.db, binding, target);
+		switch (gate.mode) {
+			case "standalone": return undefined;
+			case "authority": {
+				for (const actor of [target, ...(binding.agentId === null ? [] : [{ ...binding, agentId: binding.agentId }])]) {
+					const access = gate.access(this.db, actor.agentId);
+					if (access.accessState !== "open") throw new CollaborationStoreError("agent_access_blocked", 403);
+					if (access.lifecycleEpoch !== actor.lifecycleEpoch) throw new CollaborationStoreError("lifecycle_conflict");
+				}
+				return gate.access(this.db, target.agentId).authorityEpoch;
+			}
+			default: return collaborationNever(gate);
+		}
+	}
+
+	getAgentRequest(id: string): AgentRequest | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM agent_requests WHERE id=?").get(id);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	getAgentActivation(id: string): AgentActivation | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM agent_activations WHERE id=?").get(id);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	agentActivations(requestId: string): AgentActivation[] {
+		return this.db.query<{ data: string }, [string]>("SELECT data FROM agent_activations WHERE request_id=? ORDER BY ordinal").all(requestId).map(row => JSON.parse(row.data));
+	}
+
+	/** Durable FIFO, excluding only requests whose own dependency is blocked. */
+	nextAgentInput(conv: string): { readonly activation: AgentActivation; readonly request: AgentRequest } | null {
+		const rows = this.db.query<{ data: string }, [string]>(
+			"SELECT data FROM agent_activations WHERE target_conv=? AND state='queued' ORDER BY json_extract(data,'$.inputSeq'),id").all(conv);
+		for (const row of rows) {
+			const activation: AgentActivation = JSON.parse(row.data);
+			const request = this.getAgentRequest(activation.requestId);
+			const execution = this.agentExecutionRequest(activation);
+			// A reply reports its child's final state, cancelled included; only its execution (the parent) can stop it.
+			if (!request || (activation.direction !== "reply" && (request.state === "cancel_requested" || request.state === "cancelled")) ||
+				this.agentRequestBlocked(request.id) || (activation.direction === "request" && request.state !== "queued") ||
+				(execution && (agentRequestTerminal(execution.state) || execution.state === "cancel_requested" || this.agentRequestBlocked(execution.id)))) continue;
+			return { activation, request };
+		}
+		return null;
+	}
+
+	/** A definite pre-dispatch denial is not unknown delivery and must not block independent FIFO work. */
+	rejectQueuedAgentInput(activationId: string, code: string): void {
+		this.db.transaction(() => {
+			const activation = this.getAgentActivation(activationId);
+			if (!activation || activation.state !== "queued") return;
+			this.writeAgentActivation({ ...activation, state: "rejected", quiesced: true, revision: activation.revision + 1 }, activation.revision);
+			const request = this.agentExecutionRequest(activation);
+			if (request && !agentRequestTerminal(request.state) && request.state !== "cancel_requested") {
+				this.replyWithoutResult(this.writeAgentRequest({ ...request, state: code === "version_conflict" ? "version_conflict" : "interrupted", revision: request.revision + 1 }, request.revision), code);
+			}
+			this.appendEvent(activation.targetConv, "agent.collaboration.rejected", { activationId, code });
+		}).immediate();
+	}
+
+	/** The binding, claim and common input journal cross one writer boundary before the RPC write. */
+	admitAgentInput(input: { readonly activationId: string; readonly activationRevision: number; readonly requestRevision: number;
+		readonly previousBinding: CollaborationBinding | null; readonly wireMessage: string; readonly nativeIdentity: boolean }, binding: CollaborationBinding, gate: CollaborationGate): StoredEvent {
+		return this.db.transaction(() => {
+			const next = this.nextAgentInput(binding.convId);
+			if (!next || next.activation.id !== input.activationId || next.activation.revision !== input.activationRevision ||
+				next.request.revision !== input.requestRevision) throw new CollaborationStoreError("activation_revision_conflict");
+			if (!isDeepStrictEqual(this.agentBinding(binding.convId), input.previousBinding)) throw new CollaborationStoreError("binding_conflict");
+			if (this.lastSeq(binding.convId, "message.user") !== binding.ownerInputRevision ||
+				this.pendingMainUsers(binding.convId).length > 0 || this.mainTurn(binding.convId)) throw new CollaborationStoreError("conversation_busy");
+			const queued = this.getEvent(next.activation.inputSeq);
+			if (!queued) throw new CollaborationStoreError("input_source_missing");
+			const intent: CollaborationIntent = JSON.parse(JSON.stringify(queued.data));
+			if (intent.origin === "agent_tool_permission") {
+				const original = this.getAgentActivation(intent.outcome.blockedActivationId)?.binding;
+				if (!original || original.ownerInputRevision !== binding.ownerInputRevision) throw new CollaborationStoreError("permission_outcome_conflict");
+				this.assertCollaborationPermission(intent.outcome, original, gate);
+			}
+			this.recordAgentBinding(binding);
+			const activation = this.claimAgentActivation({ activationId: next.activation.id, expectedRevision: input.activationRevision,
+				requestRevision: input.requestRevision }, binding, gate);
+			let source: MainInputSource;
+			switch (intent.origin) {
+				case "agent_collaboration": source = { origin: intent.origin, input_ref: { request_id: intent.requestId,
+					activation_id: activation.id, direction: intent.direction, message_seq: intent.messageSeq } }; break;
+				case "agent_tool_permission": source = { origin: intent.origin, input_ref: { ...intent.outcome, activation_id: activation.id } }; break;
+				case "collaboration_artifact_read": case "collaboration_stage": throw new CollaborationStoreError("input_source_mismatch");
+				default: return collaborationNever(intent);
+			}
+			const journal = this.appendEvent(binding.convId, "main.input", { ...source, session_path: binding.sessionPath,
+				handoff: null, input_id: activation.inputId, wire_message: input.wireMessage, native_identity: input.nativeIdentity });
+			this.appendEvent(binding.convId, "agent.collaboration.admitted", { activationId: activation.id, intentSeq: activation.inputSeq, inputSeq: journal.seq });
+			this.writeAgentActivation({ ...activation, inputSeq: journal.seq, revision: activation.revision + 1 }, activation.revision);
+			return journal;
+		}).immediate();
+	}
+
+	/** Delivery correlation stays on the child; a reply executes only its parent, never that completed child. */
+	private agentExecutionRequest(activation: AgentActivation): AgentRequest | null {
+		const correlated = this.getAgentRequest(activation.requestId);
+		if (!correlated) throw new CollaborationStoreError("request_not_found", 404);
+		switch (activation.direction) {
+			case "request": case "owner_answer": return correlated;
+			case "reply": return correlated.parentId === null ? null : this.getAgentRequest(correlated.parentId);
+			default: return collaborationNever(activation.direction);
+		}
+	}
+
+	private agentOperation<T>(key: string, payload: unknown): T | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM events WHERE type='agent.collaboration.operation' AND json_extract(data,'$.key')=?").get(key);
+		if (!row) return null;
+		const operation: { payloadSha: string; receipt: T } = JSON.parse(row.data);
+		if (operation.payloadSha !== collaborationDigest(payload)) throw new CollaborationStoreError("submission_conflict");
+		return operation.receipt;
+	}
+
+	private saveAgentOperation<T>(conv: string, operation: { readonly key: string; readonly payload: unknown; readonly receipt: T }): T {
+		this.appendEvent(conv, "agent.collaboration.operation", { key: operation.key, payloadSha: collaborationDigest(operation.payload), receipt: operation.receipt });
+		return operation.receipt;
+	}
+
+	private writeAgentRequest(request: AgentRequest, expectedRevision: number): AgentRequest {
+		if (this.db.query("UPDATE agent_requests SET data=? WHERE id=? AND revision=?").run(JSON.stringify(request), request.id, expectedRevision).changes !== 1) throw new CollaborationStoreError("request_revision_conflict");
+		this.queueCollaborationEvent(this.appendEvent(request.requesterConv, "agent.collaboration.status", { requestId: request.id, state: request.state, revision: request.revision }));
+		return request;
+	}
+
+	/**
+	 * F3 D1: the stored collaboration events an open page must see as they happen - every request state change (the
+	 * requester's `agent.collaboration.status`) and the two reply messages of a committed result - wait here for the Hub's
+	 * publication. The Hub takes them at its own points (admission, result finalization, the reply wake) and, through
+	 * onCollaborationEvents, one microtask after any other transaction, so no caller has to know which Store write moved a
+	 * request. The microtask runs after the transaction ended: a rolled-back write leaves no event to publish.
+	 */
+	private readonly collaborationOutbox = new Set<number>();
+	private collaborationFlushPending = false;
+	/** Set by the Hub; called once per tick after transactions queued collaboration events. close() clears it. */
+	onCollaborationEvents: (() => void) | null = null;
+
+	private queueCollaborationEvent(event: StoredEvent): void {
+		this.collaborationOutbox.add(event.seq);
+		if (this.collaborationFlushPending) return;
+		this.collaborationFlushPending = true;
+		queueMicrotask(() => {
+			this.collaborationFlushPending = false;
+			this.onCollaborationEvents?.();
+		});
+	}
+
+	/** The queued status and reply events, oldest first, each once; one whose transaction rolled back is gone. close() empties the queue. */
+	takeCollaborationEvents(): StoredEvent[] {
+		const seqs = [...this.collaborationOutbox].sort((a, b) => a - b);
+		this.collaborationOutbox.clear();
+		return seqs.flatMap(seq => {
+			const event = this.getEvent(seq);
+			return event && (event.type === "agent.collaboration.status" || event.type === "message.collaboration") ? [event] : [];
+		});
+	}
+
+	/**
+	 * A request that became final without a result still reaches its requester once, on the same reply path as a result:
+	 * its final state and reason, never text or files. A parent that is itself final or being cancelled gets nothing.
+	 */
+	private replyWithoutResult(request: AgentRequest, reason: string): void {
+		const parent = request.parentId === null ? null : this.getAgentRequest(request.parentId);
+		if (parent && (agentRequestTerminal(parent.state) || parent.state === "cancel_requested")) return;
+		const message = this.appendEvent(request.requesterConv, "agent.collaboration.final_reply", { requestId: request.id, rootId: request.rootId,
+			direction: "reply", trust: "delegated", state: request.state, reason, resultId: null, manifest: [] });
+		this.newAgentActivation(request, "reply", message.seq);
+		this.finalReplyOutbox.add(message.seq);
+	}
+
+	private finalReplyOutbox = new Set<number>();
+
+	/**
+	 * F4-2 (C-4): the result-less final replies appended since the last call, oldest first, each once; every path that appends
+	 * one then wakes the replies, where the Hub sends their fallback notices. A reply whose transaction rolled back is gone.
+	 */
+	takeFinalReplies(): StoredEvent[] {
+		const seqs = [...this.finalReplyOutbox].sort((a, b) => a - b);
+		this.finalReplyOutbox.clear();
+		return seqs.flatMap(seq => {
+			const event = this.getEvent(seq);
+			return event?.type === "agent.collaboration.final_reply" ? [event] : [];
+		});
+	}
+
+	/** Conversations owed a queued reply; dispatch itself keeps the owner's turns first. */
+	queuedAgentReplyConvs(): string[] {
+		return this.db.query<{ conv: string }, []>("SELECT DISTINCT target_conv conv FROM agent_activations WHERE state='queued' AND direction='reply'").all().map(row => row.conv);
+	}
+
+	private writeAgentActivation(activation: AgentActivation, expectedRevision: number): AgentActivation {
+		if (this.db.query("UPDATE agent_activations SET data=? WHERE id=? AND revision=?").run(JSON.stringify(activation), activation.id, expectedRevision).changes !== 1) throw new CollaborationStoreError("activation_revision_conflict");
+		return activation;
+	}
+
+	private newAgentActivation(request: AgentRequest, direction: AgentActivation["direction"], source: number | { readonly seq: number }): AgentActivation {
+		const id = crypto.randomUUID();
+		const targetConv = direction === "reply" ? request.requesterConv : request.targetConv;
+		const ordinal = this.db.query<{ n: number }, [string, string]>("SELECT COALESCE(max(ordinal),0)+1 n FROM agent_activations WHERE request_id=? AND direction=?").get(request.id, direction)?.n ?? 1;
+		const input = typeof source === "number" ? this.appendEvent(targetConv, "agent.collaboration.input", {
+			origin: "agent_collaboration", requestId: request.id, activationId: id, direction, messageSeq: source } satisfies CollaborationIntent) : source;
+		const activation: AgentActivation = { id, requestId: request.id, direction, ordinal, inputId: crypto.randomUUID(), inputSeq: input.seq, targetConv, binding: null, state: "queued", revision: 1, consumedEntry: null, quiesced: false };
+		this.db.query("INSERT INTO agent_activations(id,data) VALUES (?,?)").run(id, JSON.stringify(activation));
+		return activation;
+	}
+
+	acceptAgentRequest(input: AgentRequestInput, binding: CollaborationBinding, gate: CollaborationGate): AgentReceipt {
+		return this.db.transaction(() => {
+			if (binding.readContinuationId !== undefined) throw new CollaborationStoreError("read_only_continuation", 403);
+			if (!input.toolCallId || !input.text.trim() || !["task", "question"].includes(input.kind) ||
+				new Set(input.files).size !== input.files.length) throw new CollaborationStoreError("invalid_request", 400);
+			if (Buffer.byteLength(input.text) > 65536 || input.files.length > 10) throw new CollaborationStoreError("request_too_large", 413);
+			const key = JSON.stringify([binding.durableSessionId, input.toolCallId, "request"]);
+			const payload = { ...input, text: input.text.trim(), files: [...input.files].sort() };
+			const operationPayload = { payload, source: binding.convId, activationId: binding.activationId };
+			const prior = this.agentOperation<AgentReceipt>(key, operationPayload);
+			if (prior) return prior;
+			const target = this.agentTarget(input.targetAgentId);
+			const authorityEpoch = this.checkAgentAccess(gate, binding, target);
+			if (binding.agentId !== null && input.kind !== "question") throw new CollaborationStoreError("agent_question_only", 403);
+			if (binding.agentId === target.agentId) throw new CollaborationStoreError("cycle_detected");
+			let parent: AgentRequest | null = null;
+			if (binding.activationId !== null) {
+				const active = this.getAgentActivation(binding.activationId);
+				if (!active || active.state !== "consumed" || !isDeepStrictEqual(active.binding, binding)) throw new CollaborationStoreError("parent_conflict");
+				parent = this.agentExecutionRequest(active);
+				if (!parent || parent.targetConv !== binding.convId || binding.lifecycleEpoch !== parent.targetLifecycleEpoch ||
+					!["running", "waiting_peer"].includes(parent.state) || this.agentRequestBlocked(parent.id)) throw new CollaborationStoreError("parent_conflict");
+				const ancestors = this.db.query<{ requester_agent: string | null; target_agent: string }, [string]>(`
+					WITH RECURSIVE ancestry AS (SELECT * FROM agent_requests WHERE id=? UNION ALL SELECT p.* FROM agent_requests p JOIN ancestry c ON c.parent_id=p.id)
+					SELECT requester_agent,target_agent FROM ancestry`).all(parent.id);
+				if (ancestors.some(row => row.requester_agent === target.agentId || row.target_agent === target.agentId)) throw new CollaborationStoreError("cycle_detected");
+			}
+			const id = crypto.randomUUID();
+			const rootId = parent?.rootId ?? id;
+			const artifacts = input.files.map(artifactId => this.agentArtifact(artifactId));
+			if (artifacts.some(artifact => artifact === null)) throw new CollaborationStoreError("artifact_not_found", 404);
+			const digests = artifacts.map(artifact => artifact?.sha256).sort();
+			const fingerprint = collaborationDigest([rootId, target.agentId, input.kind, input.text.normalize("NFC").replace(/\r\n/g, "\n").trim(), digests]);
+			const duplicateRow = this.db.query<{ data: string }, [string]>("SELECT data FROM agent_requests WHERE fingerprint=? ORDER BY created_at DESC LIMIT 1").get(fingerprint);
+			if (duplicateRow) {
+				const duplicate: AgentRequest = JSON.parse(duplicateRow.data);
+				if (!agentRequestRetryable(duplicate.state)) return this.saveAgentOperation(binding.convId, { key, payload: operationPayload, receipt: { requestId: duplicate.id, state: duplicate.state, revision: duplicate.revision } });
+				if (binding.agentId !== null || input.retryOf !== duplicate.id) throw new CollaborationStoreError("semantic_retry_required");
+			}
+			if (input.retryOf) {
+				const original = this.getAgentRequest(input.retryOf);
+				if (binding.agentId !== null || !original || !agentRequestRetryable(original.state) || original.requesterConv !== binding.convId) throw new CollaborationStoreError("invalid_retry");
+			}
+			if (parent && this.db.query(`SELECT id FROM agent_requests WHERE parent_id=? AND state NOT IN ${AGENT_REQUEST_FINAL_SQL}`).get(parent.id)) throw new CollaborationStoreError("unfinished_child");
+			const request: AgentRequest = { id, rootId, parentId: parent?.id ?? null, requesterConv: binding.convId, requesterAgent: binding.agentId, targetConv: target.convId, targetAgent: target.agentId,
+				requesterLifecycleEpoch: binding.lifecycleEpoch, targetLifecycleEpoch: target.lifecycleEpoch,
+				...(authorityEpoch === undefined ? {} : { recipientAuthorityEpoch: authorityEpoch }),
+				...(gate.mode === "authority" && binding.agentId !== null ? { requesterAuthorityEpoch: gate.access(this.db, binding.agentId).authorityEpoch } : {}),
+				kind: input.kind, payload, payloadSha: collaborationDigest({ payload, parentId: parent?.id ?? null, rootId, digests }), submissionKey: key, fingerprint, state: "queued", revision: 1, createdAt: new Date().toISOString(), resultId: null, cancelReason: null };
+			for (const artifact of artifacts) {
+				if (!artifact || artifact.state !== "staged" || artifact.requestId !== null || artifact.producerConv !== binding.convId) throw new CollaborationStoreError("artifact_already_bound");
+				const stage = this.agentStageByOperation(artifact.stageOperationKey);
+				if (!stage || stage.state !== "staged" || stage.artifactId !== artifact.id || stage.target.convId !== target.convId || artifact.sha256 !== this.stageDigest(stage)) throw new CollaborationStoreError("transfer_scope_changed");
+				this.assertAgentStage(stage, gate);
+			}
+			this.db.query("INSERT INTO agent_requests(id,data) VALUES (?,?)").run(id, JSON.stringify(request));
+			for (const artifact of artifacts) {
+				if (!artifact) throw new CollaborationStoreError("artifact_not_found", 404);
+				const committed: AgentArtifact = { ...artifact, requestId: id, state: "committed", provenance: { ...artifact.provenance, requestId: id, rootId } };
+				this.db.query("UPDATE agent_artifacts SET data=? WHERE id=? AND request_id IS NULL").run(JSON.stringify(committed), artifact.id);
+				this.createAgentGrant(committed, { convId: target.convId, lifecycleEpoch: target.lifecycleEpoch, authorityEpoch });
+			}
+			const data = { requestId: id, rootId, direction: "request", text: payload.text, files: input.files, trust: "delegated",
+				src: { channel: "gateway", adapter: "agent-collaboration" }, actor: { kind: binding.agentId === null ? "main" : "agent", id: binding.agentId } };
+			this.appendEvent(binding.convId, "message.collaboration", { ...data, outgoing: true });
+			const message = this.appendEvent(target.convId, "message.collaboration", { ...data, outgoing: false });
+			this.newAgentActivation(request, "request", message.seq);
+			if (parent) this.writeAgentRequest({ ...parent, state: "waiting_peer", revision: parent.revision + 1 }, parent.revision);
+			const receipt = this.saveAgentOperation(binding.convId, { key, payload: operationPayload, receipt: { requestId: id, state: request.state, revision: request.revision } });
+			testCrashPoint("collaboration.admission.before-commit");
+			return receipt;
+		}).immediate();
+	}
+
+	agentArtifact(id: string): AgentArtifact | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM agent_artifacts WHERE id=?").get(id);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	agentGrant(id: string): ArtifactGrant | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM agent_artifact_grants WHERE grant_id=?").get(id);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	agentStage(transferId: string): AgentArtifactStage | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM agent_artifact_stages WHERE transfer_id=?").get(transferId);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	private agentStageByOperation(operationKey: string): AgentArtifactStage | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM agent_artifact_stages WHERE operation_key=?").get(operationKey);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	private stageDigest(stage: AgentArtifactStage): string {
+		switch (stage.source.kind) {
+			case "agent_path": case "artifact": return stage.source.sha256;
+			case "attachment": return stage.source.origin.originalSha256;
+			default: return collaborationNever(stage.source);
+		}
+	}
+
+	private assertAgentStage(stage: AgentArtifactStage, gate: CollaborationGate): void {
+		const targetEpoch = this.checkAgentAccess(gate, stage.sourceBinding, stage.target);
+		if (stage.targetAuthorityEpoch !== targetEpoch || (gate.mode === "authority" && stage.sourceBinding.agentId !== null &&
+			stage.sourceAuthorityEpoch !== gate.access(this.db, stage.sourceBinding.agentId).authorityEpoch)) throw new CollaborationStoreError("authority_epoch_mismatch");
+		if (stage.originRequestId !== null) {
+			const request = this.getAgentRequest(stage.originRequestId);
+			if (!request || agentRequestTerminal(request.state) || request.state === "cancel_requested" ||
+				this.agentRequestBlocked(request.id, stage.decisionId ?? "")) throw new CollaborationStoreError("transfer_scope_changed");
+		}
+		if (stage.sourceBinding.activationId !== null) {
+			const activation = this.getAgentActivation(stage.sourceBinding.activationId);
+			if (!activation || activation.state !== "consumed" || !isDeepStrictEqual(activation.binding, stage.sourceBinding) ||
+				this.agentExecutionRequest(activation)?.id !== (stage.originRequestId ?? undefined)) throw new CollaborationStoreError("transfer_scope_changed");
+		}
+		switch (stage.source.kind) {
+			case "agent_path":
+				if (stage.originRequestId !== null && stage.source.path.split(/[\\/]/)[0] === "outputs" &&
+					this.deriveOutputLineage(stage.originRequestId).storageClass === "scoped_document") throw new CollaborationStoreError("scoped_path_requires_artifact", 403);
+				return;
+			case "attachment":
+				if (!gate.assertSelectedExportEligible) throw new CollaborationStoreError("attachment_eligibility_unavailable", 503);
+				gate.assertSelectedExportEligible(this.db, stage.source.origin);
+				break;
+			case "artifact": {
+				const grant = this.agentGrant(stage.source.grantId);
+				const artifact = this.agentArtifact(stage.source.artifactId);
+				if (!grant || grant.revoked || !artifact || artifact.state === "trashed") throw new CollaborationStoreError("source_revoked", 410);
+				if (grant.requestId !== stage.source.requestId || grant.artifactId !== artifact.id || grant.revision !== stage.source.grantRevision ||
+					grant.granteeConv !== stage.sourceBinding.convId || grant.granteeLifecycleEpoch !== stage.sourceBinding.lifecycleEpoch ||
+					artifact.sha256 !== stage.source.sha256) throw new CollaborationStoreError("transfer_scope_changed");
+				if (gate.mode === "authority" && stage.sourceBinding.agentId !== null &&
+					grant.recipientAuthorityEpoch !== gate.access(this.db, stage.sourceBinding.agentId).authorityEpoch) throw new CollaborationStoreError("authority_epoch_mismatch");
+				break;
+			}
+			default: return collaborationNever(stage.source);
+		}
+		if (stage.state === "awaiting_transfer_authority") return;
+		if (!stage.authority || stage.authority.scopeDigest !== stage.scopeDigest) throw new CollaborationStoreError("transfer_authority_required", 403);
+		switch (stage.authority.kind) {
+			case "owner_decision": {
+				const decision = this.getDecision(stage.authority.decisionId);
+				if (!decision || decision.revision !== stage.authority.decisionRevision || decision.submissionId !== stage.authority.submissionId ||
+					stage.authority.transferId !== stage.transferId || decision.status !== "delivered") throw new CollaborationStoreError("transfer_scope_changed");
+				break;
+			}
+			case "tool_policy":
+				if (gate.mode !== "authority" || !gate.assertTransferAuthority) throw new CollaborationStoreError("transfer_authority_unavailable", 503);
+				gate.assertTransferAuthority(this.db, stage);
+				break;
+			default: return collaborationNever(stage.authority);
+		}
+	}
+
+	beginAgentStage(input: AgentStageInput, binding: CollaborationBinding, gate: CollaborationGate): AgentArtifactStage {
+		return this.db.transaction(() => {
+			if (binding.readContinuationId !== undefined) throw new CollaborationStoreError("read_only_continuation", 403);
+			const payloadSha = collaborationDigest({ input, binding });
+			const existing = this.agentStageByOperation(input.operationKey);
+			if (existing) {
+				if (existing.payloadSha !== payloadSha) throw new CollaborationStoreError("submission_conflict");
+				return existing;
+			}
+			const targetAuthorityEpoch = this.checkAgentAccess(gate, binding, input.target);
+			const transferId = input.transferId ?? crypto.randomUUID();
+			const scopeDigest = collaborationDigest({ source: input.source, target: input.target, binding, operationKey: input.operationKey, transferId, purpose: "collaboration_attachment_transfer" });
+			const needsAuthority = input.source.kind !== "agent_path" && input.authority === null;
+			const decision = needsAuthority ? this.createDecision({
+				ownerConv: binding.convId, scope: `conv:${binding.convId}`, sourceSessionPath: null, sourceRequestId: transferId,
+				method: "confirm", required: true, bindingState: "closed",
+				payload: { kind: "collaboration-transfer", purpose: "collaboration_attachment_transfer", transferId, scopeDigest },
+			}) : null;
+			const origin = binding.activationId === null ? null : this.getAgentActivation(binding.activationId);
+			const originRequest = origin === null ? null : this.agentExecutionRequest(origin);
+			const stage: AgentArtifactStage = { ...input, transferId, payloadSha, scopeDigest, sourceBinding: binding, originRequestId: originRequest?.id ?? null,
+				...(targetAuthorityEpoch === undefined ? {} : { targetAuthorityEpoch }),
+				...(gate.mode === "authority" && binding.agentId !== null ? { sourceAuthorityEpoch: gate.access(this.db, binding.agentId).authorityEpoch } : {}),
+				decisionId: decision?.id ?? null, decisionRevision: decision?.revision ?? null, continuationId: crypto.randomUUID(),
+				state: needsAuthority ? "awaiting_transfer_authority" : "ready", revision: 1, artifactId: null, exportReceipt: null, errorCode: null };
+			this.assertAgentStage(stage, gate);
+			this.db.query("INSERT INTO agent_artifact_stages(transfer_id,data) VALUES (?,?)").run(transferId, JSON.stringify(stage));
+			if (decision) this.db.query("INSERT INTO agent_question_links(decision_id,request_id,activation_id,transfer_id) VALUES (?,?,?,?)").run(decision.id, stage.originRequestId, binding.activationId, transferId);
+			return stage;
+		}).immediate();
+	}
+
+	answerAgentStage(input: { readonly transferId: string; readonly expectedRevision: number; readonly submissionId: string; readonly scopeDigest: string; readonly choice: "allow" | "deny" | "cancel"; readonly ownerPrincipalRef: string }, gate: CollaborationGate): AgentArtifactStage {
+		return this.db.transaction(() => {
+			const stage = this.agentStage(input.transferId);
+			if (!stage || !stage.decisionId) throw new CollaborationStoreError("stage_not_found", 404);
+			if (stage.ownerPrincipalRef !== input.ownerPrincipalRef) throw new CollaborationStoreError("owner_mismatch", 403);
+			const key = JSON.stringify(["stage-answer", input.ownerPrincipalRef, input.submissionId]);
+			const prior = this.agentOperation<AgentArtifactStage>(key, input);
+			if (prior) return prior;
+			const decision = this.getDecision(stage.decisionId);
+			if (!decision || decision.revision !== input.expectedRevision || decision.submissionId !== null ||
+				stage.state !== "awaiting_transfer_authority" || stage.scopeDigest !== input.scopeDigest) throw new CollaborationStoreError("transfer_scope_changed");
+			this.checkAgentAccess(gate, stage.sourceBinding, stage.target);
+			let state: AgentArtifactStage["state"];
+			switch (input.choice) {
+				case "allow": state = "ready"; break;
+				case "deny": state = "denied"; break;
+				case "cancel": state = "cancelled"; break;
+				default: return collaborationNever(input.choice);
+			}
+			const decisionRevision = decision.revision + 1;
+			const next: AgentArtifactStage = { ...stage, state, revision: stage.revision + 1, decisionRevision,
+				authority: input.choice === "allow" ? { kind: "owner_decision", decisionId: decision.id, decisionRevision, submissionId: input.submissionId, scopeDigest: stage.scopeDigest, transferId: stage.transferId } : null,
+				errorCode: input.choice === "allow" ? null : input.choice === "deny" ? "transfer_denied" : "transfer_cancelled" };
+			this.db.query("UPDATE decisions SET revision=?,submission_id=?,submission_revision=?,submission_mode='answer',answer=?,answer_route='collaboration_stage',status=?,updated_at=? WHERE id=?")
+				.run(decisionRevision, input.submissionId, input.expectedRevision, JSON.stringify({ collaborationTransfer: { choice: input.choice, transferId: stage.transferId, scopeDigest: stage.scopeDigest } }), input.choice === "allow" ? "delivered" : "closed", new Date().toISOString(), decision.id);
+			if (input.choice === "allow") {
+				this.assertAgentStage(next, gate);
+				const intent: CollaborationIntent = { origin: "collaboration_stage", transferId: stage.transferId, continuationId: stage.continuationId };
+				this.appendEvent(stage.sourceBinding.convId, "agent.collaboration.input", intent);
+			}
+			this.db.query("UPDATE agent_artifact_stages SET data=? WHERE transfer_id=? AND revision=?").run(JSON.stringify(next), stage.transferId, stage.revision);
+			this.appendEvent(stage.sourceBinding.convId, "decision.operation", { decisionId: decision.id, request: { expectedRevision: input.expectedRevision, submissionId: input.submissionId, mode: "answer", response: { collaborationTransfer: { choice: input.choice, transferId: stage.transferId, scopeDigest: stage.scopeDigest } } }, targetScope: decision.scope, commandId: null, mainInputSeq: null });
+			return this.saveAgentOperation(stage.sourceBinding.convId, { key, payload: input, receipt: next });
+		}).immediate();
+	}
+
+	claimAgentStage(transferId: string, expectedRevision: number, gate: CollaborationGate): AgentArtifactStage {
+		return this.db.transaction(() => {
+			const stage = this.agentStage(transferId);
+			if (!stage || stage.revision !== expectedRevision || stage.state !== "ready") throw new CollaborationStoreError("stage_conflict");
+			this.assertAgentStage(stage, gate);
+			const next: AgentArtifactStage = { ...stage, revision: stage.revision + 1, state: "staging" };
+			this.db.query("UPDATE agent_artifact_stages SET data=? WHERE transfer_id=? AND revision=?").run(JSON.stringify(next), transferId, expectedRevision);
+			return next;
+		}).immediate();
+	}
+
+	sealAgentStage(input: { readonly transferId: string; readonly expectedRevision: number; readonly sha256: string; readonly bytes: number; readonly mediaType: string; readonly name: string; readonly sealedName: string }, gate: CollaborationGate): AgentArtifact {
+		return this.db.transaction(() => {
+			const stage = this.agentStage(input.transferId);
+			if (!stage || stage.state !== "staging" || stage.revision !== input.expectedRevision) throw new CollaborationStoreError("stage_conflict");
+			this.assertAgentStage(stage, gate);
+			if (!/^[a-f0-9]{64}$/.test(input.sha256) || input.sha256 !== this.stageDigest(stage) ||
+				!Number.isSafeInteger(input.bytes) || input.bytes < 0 || input.bytes > 10485760) throw new CollaborationStoreError("artifact_digest_conflict");
+			const sourceArtifact = stage.source.kind === "artifact" ? this.agentArtifact(stage.source.artifactId) : null;
+			const artifact: AgentArtifact = { id: crypto.randomUUID(), producerConv: stage.sourceBinding.convId, requestId: null, sha256: input.sha256, bytes: input.bytes,
+				mediaType: input.mediaType, originalName: input.name, sealedName: input.sealedName, state: "staged", lifecycleEpoch: stage.sourceBinding.lifecycleEpoch,
+				storageClass: stage.source.kind === "agent_path" ? "source_copy" : "scoped_document", stageOperationKey: stage.operationKey, stagePayloadSha: stage.payloadSha,
+				provenance: { transferId: stage.transferId, transferAuthorityRef: stage.authority, targetAgentId: stage.target.agentId, targetConvId: stage.target.convId, targetLifecycleEpoch: stage.target.lifecycleEpoch,
+					sourceInputId: stage.sourceBinding.inputId, sourceActivationId: stage.sourceBinding.activationId, requestId: null, rootId: null,
+					...(stage.source.kind === "attachment" ? { originAttachment: stage.source.origin } : {}),
+					...(sourceArtifact && stage.source.kind === "artifact" ? { ...sourceArtifact.provenance.originAttachment ? { originAttachment: sourceArtifact.provenance.originAttachment } : {},
+						sourceArtifactId: sourceArtifact.id, sourceArtifactGrantRevision: stage.source.grantRevision,
+						...(sourceArtifact.provenance.transferId ? { parentTransferId: sourceArtifact.provenance.transferId } : {}) } : {}),
+				} };
+			this.db.query("INSERT INTO agent_artifacts(id,data) VALUES (?,?)").run(artifact.id, JSON.stringify(artifact));
+			const next: AgentArtifactStage = { ...stage, state: "staged", revision: stage.revision + 1, artifactId: artifact.id, exportReceipt: stage.source.kind === "attachment" ? stage.source.origin : null };
+			this.db.query("UPDATE agent_artifact_stages SET data=? WHERE transfer_id=? AND revision=?").run(JSON.stringify(next), stage.transferId, stage.revision);
+			return artifact;
+		}).immediate();
+	}
+
+	private createAgentGrant(artifact: AgentArtifact, recipient: { readonly convId: string; readonly lifecycleEpoch: number; readonly authorityEpoch: number | undefined }): ArtifactGrant {
+		if (artifact.requestId === null) throw new CollaborationStoreError("artifact_unbound");
+		const grant: ArtifactGrant = { grantId: crypto.randomUUID(), artifactId: artifact.id, requestId: artifact.requestId, granteeConv: recipient.convId,
+			permission: "read", revoked: false, revision: 1, granteeLifecycleEpoch: recipient.lifecycleEpoch,
+			...(recipient.authorityEpoch === undefined ? {} : { recipientAuthorityEpoch: recipient.authorityEpoch }) };
+		this.db.query("INSERT INTO agent_artifact_grants(grant_id,data) VALUES (?,?)").run(grant.grantId, JSON.stringify(grant));
+		return grant;
+	}
+
+	claimAgentActivation(input: { readonly activationId: string; readonly expectedRevision: number; readonly requestRevision: number }, binding: CollaborationBinding, gate: CollaborationGate): AgentActivation {
+		return this.db.transaction(() => {
+			const activation = this.getAgentActivation(input.activationId);
+			const request = activation ? this.getAgentRequest(activation.requestId) : null;
+			if (!activation || !request || activation.state !== "queued" || activation.revision !== input.expectedRevision || request.revision !== input.requestRevision) throw new CollaborationStoreError("activation_revision_conflict");
+			this.assertAgentBinding(binding);
+			if (binding.convId !== activation.targetConv || binding.activationId !== activation.id || binding.inputId !== activation.inputId) throw new CollaborationStoreError("binding_conflict");
+			const expectedEpoch = activation.direction === "reply" ? request.requesterLifecycleEpoch : request.targetLifecycleEpoch;
+			if (binding.lifecycleEpoch !== expectedEpoch) throw new CollaborationStoreError("lifecycle_conflict");
+			if (gate.mode === "authority" && binding.agentId !== null) {
+				const epoch = activation.direction === "reply" ? request.requesterAuthorityEpoch : request.recipientAuthorityEpoch;
+				if (gate.access(this.db, binding.agentId).authorityEpoch !== epoch) throw new CollaborationStoreError("authority_epoch_mismatch");
+			}
+			if ((activation.direction !== "reply" && (request.state === "cancel_requested" || request.state === "cancelled")) || this.agentRequestBlocked(request.id)) throw new CollaborationStoreError("request_blocked");
+			if (activation.direction === "request" && request.state !== "queued") throw new CollaborationStoreError("request_blocked");
+			const execution = this.agentExecutionRequest(activation);
+			if (execution && (agentRequestTerminal(execution.state) || execution.state === "cancel_requested" ||
+				this.agentRequestBlocked(execution.id))) throw new CollaborationStoreError("request_blocked");
+			// A started execution continues only on the definition it started with; a re-applied one is never reinterpreted.
+			const origin = execution && activation.direction !== "request" ?
+				this.agentActivations(execution.id).find(row => row.direction === "request")?.binding : undefined;
+			if (origin && origin.definitionSha !== binding.definitionSha) throw new CollaborationStoreError("version_conflict", 409);
+			const target = this.agentTarget(request.targetAgent);
+			this.checkAgentAccess(gate, binding, target);
+			if (activation.direction === "request") for (const artifactId of request.payload.files) {
+				const grant = this.agentArtifactGrant(artifactId, binding.convId, request.id);
+				if (!grant) throw new CollaborationStoreError("artifact_forbidden", 403);
+				this.assertArtifactGrant(grant, binding, gate);
+			}
+			if (this.db.query("SELECT id FROM agent_activations WHERE target_conv=? AND id<>? AND state IN ('attempted','acknowledged','consumed','unknown') AND quiesced=0").get(binding.convId, activation.id)) throw new CollaborationStoreError("conversation_busy");
+			const next = this.writeAgentActivation({ ...activation, binding, state: "attempted", revision: activation.revision + 1 }, activation.revision);
+			if (activation.direction === "request" || (activation.direction === "owner_answer" && request.state === "waiting_owner")) {
+				this.writeAgentRequest({ ...request, state: "running", revision: request.revision + 1 }, request.revision);
+			}
+			return next;
+		}).immediate();
+	}
+
+	recordAgentActivationEvidence(input: { readonly activationId: string; readonly expectedRevision: number; readonly state: Exclude<AgentDelivery, "queued" | "attempted">; readonly consumedEntry?: string }, binding: CollaborationBinding): AgentActivation {
+		return this.db.transaction(() => {
+			const activation = this.getAgentActivation(input.activationId);
+			if (!activation || !isDeepStrictEqual(activation.binding, binding)) throw new CollaborationStoreError("binding_conflict");
+			if (activation.state === "consumed") return activation;
+			if (activation.revision !== input.expectedRevision || activation.state === "queued" || activation.state === "rejected") throw new CollaborationStoreError("activation_revision_conflict");
+			if (input.state === "consumed" && !input.consumedEntry) throw new CollaborationStoreError("consumption_evidence_required", 400);
+			if (input.state === "unknown" && activation.state === "acknowledged") return activation;
+			const next = this.writeAgentActivation({ ...activation, state: input.state, consumedEntry: input.consumedEntry ?? activation.consumedEntry, revision: activation.revision + 1 }, activation.revision);
+			const execution = this.agentExecutionRequest(activation);
+			const current = isDeepStrictEqual(this.agentBinding(binding.convId), binding) &&
+				this.getConversation(binding.convId)?.threadId === binding.sessionPath &&
+				(binding.agentId === null || this.ensureAgentLifecycle(binding.agentId) === binding.lifecycleEpoch);
+			if (input.state === "consumed") {
+				const resumed = execution;
+				if (resumed && ["unresolved_delivery", "waiting_peer", "waiting_owner"].includes(resumed.state) &&
+					!this.agentRequestBlocked(resumed.id) && current) {
+					this.writeAgentRequest({ ...resumed, state: "running", revision: resumed.revision + 1 }, resumed.revision);
+				}
+			}
+			if (input.state === "unknown") {
+				const request = execution;
+				if (request && current && !agentRequestTerminal(request.state) && request.state !== "cancel_requested") this.writeAgentRequest({ ...request, state: "unresolved_delivery", revision: request.revision + 1 }, request.revision);
+			}
+			return next;
+		}).immediate();
+	}
+
+	settleAgentActivation(input: { readonly activationId: string; readonly expectedRevision: number; readonly settlementId: string; readonly ownedInFlight: number; readonly reconciled: boolean }, binding: CollaborationBinding): AgentActivation {
+		return this.db.transaction(() => {
+			const activation = this.getAgentActivation(input.activationId);
+			if (!activation || !isDeepStrictEqual(activation.binding, binding) || activation.revision !== input.expectedRevision ||
+				!input.settlementId || !input.reconciled || input.ownedInFlight !== 0) throw new CollaborationStoreError("settlement_conflict");
+			if (activation.quiesced) return activation;
+			this.appendEvent(binding.convId, "agent.collaboration.settled", { ...input, binding });
+			return this.writeAgentActivation({ ...activation, quiesced: true, revision: activation.revision + 1 }, activation.revision);
+		}).immediate();
+	}
+
+	/** Conversations holding queued collaboration input in the request tree that a resolved decision may have unblocked. */
+	agentDecisionDependents(decisionId: string): string[] {
+		return this.db.query<{ conv: string }, [string]>(`SELECT DISTINCT a.target_conv conv FROM agent_question_links l
+			JOIN agent_requests linked ON linked.id=l.request_id JOIN agent_requests r ON r.root_id=linked.root_id
+			JOIN agent_activations a ON a.request_id=r.id WHERE l.decision_id=? AND a.state='queued'`).all(decisionId).map(row => row.conv);
+	}
+
+	private agentRequestBlocked(requestId: string, exceptDecisionId = ""): boolean {
+		return this.db.query(`WITH RECURSIVE ancestry AS (SELECT id,parent_id FROM agent_requests WHERE id=? UNION ALL SELECT p.id,p.parent_id FROM agent_requests p JOIN ancestry c ON p.id=c.parent_id)
+			SELECT d.id FROM agent_question_links l JOIN decisions d ON d.id=l.decision_id JOIN ancestry a ON a.id=l.request_id
+			WHERE d.id<>? AND (d.status IN ('pending','needs_review') OR (d.status='submitted' AND COALESCE(d.command_id,'') NOT LIKE 'collaboration:%') OR EXISTS (
+				SELECT 1 FROM security_holds h WHERE h.id=d.id AND json_extract(h.data,'$.source')='collaboration_artifact'
+				AND json_extract(h.data,'$.state') IN ('pending','allowed') AND json_extract(h.data,'$.continuation.state')<>'released')) LIMIT 1`).get(requestId, exceptDecisionId) !== null;
+	}
+
+	/**
+	 * Links a question observed during a collaboration execution to that request once. An owner turn (no activation) is
+	 * the owner's own context and is never linked; a replayed observation of the same decision is a no-op.
+	 */
+	linkCurrentAgentDecision(conv: string, decisionId: string): boolean {
+		const activationId = this.agentBinding(conv)?.activationId;
+		if (!activationId) return false;
+		if (this.db.query("SELECT 1 FROM agent_question_links WHERE decision_id=?").get(decisionId)) return false;
+		this.linkAgentDecision(decisionId, activationId);
+		return true;
+	}
+
+	/** The native consumption of the owner's answer in its request continuation is the decision's delivery receipt. */
+	private deliverCollaborationAnswer(activationId: string): void {
+		const decision = this.db.query<{ id: string }, [string]>("SELECT id FROM decisions WHERE command_id=? AND status='submitted'").get(`collaboration:${activationId}`);
+		const current = decision ? this.getDecision(decision.id) : null;
+		if (current) this.transitionDecision(current.id, current.revision, { status: "delivered", reason: "collaboration_answer_consumed" });
+	}
+
+	linkAgentDecision(decisionId: string, activationId: string): void {
+		this.db.transaction(() => {
+			const activation = this.getAgentActivation(activationId);
+			const decision = this.getDecision(decisionId);
+			const request = activation ? this.agentExecutionRequest(activation) : null;
+			// The executing input may still await its consumption evidence (recorded at settle); the exact current binding proves it runs.
+			if (!activation || !activation.binding || !decision || decision.ownerConv !== activation.targetConv ||
+				!["attempted", "acknowledged", "consumed"].includes(activation.state) || activation.quiesced ||
+				!isDeepStrictEqual(this.agentBinding(activation.targetConv), activation.binding) ||
+				this.getConversation(activation.targetConv)?.threadId !== activation.binding.sessionPath ||
+				(activation.binding.agentId !== null && this.ensureAgentLifecycle(activation.binding.agentId) !== activation.binding.lifecycleEpoch) ||
+				(request && (request.targetConv !== activation.targetConv || agentRequestTerminal(request.state) || request.state === "cancel_requested"))) throw new CollaborationStoreError("decision_link_conflict");
+			this.db.query("INSERT INTO agent_question_links(decision_id,request_id,activation_id,origin_input_seq) VALUES (?,?,?,?)").run(decisionId, request?.id ?? null, activation.id, activation.inputSeq);
+			if (request) this.writeAgentRequest({ ...request, state: "waiting_owner", revision: request.revision + 1 }, request.revision);
+		}).immediate();
+	}
+
+	agentResult(id: string): AgentResult | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM agent_results WHERE id=?").get(id);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	/** The explicit result the executing activation submitted, committed only after that activation settles. */
+	agentResultIntent(activationId: string): AgentResultInput | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM events WHERE type='agent.collaboration.result_intent' AND json_extract(data,'$.activationId')=? ORDER BY seq DESC LIMIT 1").get(activationId);
+		return row ? (JSON.parse(row.data) as { input: AgentResultInput }).input : null;
+	}
+
+	/** One explicit result per activation: the same submission returns its receipt, a different one is a conflict. */
+	recordAgentResultIntent(input: AgentResultInput, binding: CollaborationBinding): AgentReceipt {
+		return this.db.transaction(() => {
+			if (binding.readContinuationId !== undefined) throw new CollaborationStoreError("read_only_continuation", 403);
+			this.assertAgentBinding(binding);
+			const activation = binding.activationId === null ? null : this.getAgentActivation(binding.activationId);
+			const request = this.getAgentRequest(input.requestId);
+			if (!activation || !request || this.agentExecutionRequest(activation)?.id !== request.id || request.targetConv !== binding.convId ||
+				!isDeepStrictEqual(activation.binding, binding) || activation.state !== "consumed") throw new CollaborationStoreError("result_binding_conflict");
+			const prior = this.agentResultIntent(activation.id);
+			if (prior) {
+				if (prior.toolCallId !== input.toolCallId || collaborationDigest({ ...prior, expectedRevision: 0 }) !== collaborationDigest({ ...input, expectedRevision: 0 })) {
+					throw new CollaborationStoreError("result_conflict");
+				}
+				return { requestId: request.id, state: request.state, revision: request.revision };
+			}
+			if (request.state !== "result_preparing" || request.revision !== input.expectedRevision || request.resultId !== null ||
+				activation.quiesced) throw new CollaborationStoreError("result_conflict");
+			if (Buffer.byteLength(input.text) > 65536 || input.artifacts.length > 10) throw new CollaborationStoreError("result_too_large", 413);
+			for (const id of input.artifacts) {
+				const artifact = this.agentArtifact(id);
+				if (!artifact || artifact.requestId !== request.id || artifact.provenance.producedBy?.activationId !== activation.id || artifact.state !== "staged") {
+					throw new CollaborationStoreError("result_artifact_conflict");
+				}
+			}
+			this.appendEvent(binding.convId, "agent.collaboration.result_intent", { activationId: activation.id, input });
+			return { requestId: request.id, state: request.state, revision: request.revision };
+		}).immediate();
+	}
+
+	/**
+	 * After the executing activation settled: commit its submitted result (and the reply outbox) once, or mark a running
+	 * request that ended without a result as interrupted/result_missing. Waiting requests keep waiting; nothing reruns.
+	 */
+	finalizeAgentActivation(activationId: string, gateFor: (request: AgentRequest) => CollaborationGate): { readonly result: AgentResult | null; readonly missing: boolean } {
+		return this.db.transaction(() => {
+			const none = { result: null, missing: false };
+			const activation = this.getAgentActivation(activationId);
+			if (!activation?.binding || !activation.quiesced || activation.state !== "consumed") return none;
+			const request = this.agentExecutionRequest(activation);
+			if (!request || request.targetConv !== activation.targetConv) return none;
+			if (request.state === "cancel_requested") {
+				// The cancel won before any result commit: a late result stays an audited intent and wakes nobody.
+				this.settleCancelledAgentRequest(request.id);
+				return none;
+			}
+			const intent = this.agentResultIntent(activation.id);
+			if (intent) {
+				if (request.state !== "result_preparing" || request.resultId !== null) return none;
+				return { result: this.commitAgentResult({ ...intent, expectedRevision: request.revision }, activation.binding, gateFor(request)), missing: false };
+			}
+			if ((request.state !== "running" && request.state !== "result_preparing") || this.agentRequestBlocked(request.id) ||
+				this.db.query(`SELECT id FROM agent_requests WHERE parent_id=? AND state NOT IN ${AGENT_REQUEST_FINAL_SQL}`).get(request.id)) return none;
+			this.replyWithoutResult(this.writeAgentRequest({ ...request, state: "interrupted", revision: request.revision + 1, cancelReason: "result_missing" }, request.revision), "result_missing");
+			this.appendEvent(request.targetConv, "agent.collaboration.result_missing", { requestId: request.id, activationId: activation.id });
+			return { result: null, missing: true };
+		}).immediate();
+	}
+
+	commitAgentResult(input: AgentResultInput, binding: CollaborationBinding, gate: CollaborationGate): AgentResult {
+		return this.db.transaction(() => {
+			if (binding.readContinuationId !== undefined) throw new CollaborationStoreError("read_only_continuation", 403);
+			const key = JSON.stringify([binding.durableSessionId, input.toolCallId, "result"]);
+			const prior = this.agentOperation<AgentResult>(key, { input, binding });
+			if (prior) return prior;
+			const request = this.getAgentRequest(input.requestId);
+			const activation = binding.activationId === null ? null : this.getAgentActivation(binding.activationId);
+			if (!request || !activation || this.agentExecutionRequest(activation)?.id !== request.id || request.targetConv !== binding.convId ||
+				!isDeepStrictEqual(activation.binding, binding)) throw new CollaborationStoreError("result_binding_conflict");
+			this.checkAgentAccess(gate, binding, this.agentTarget(request.targetAgent));
+			if (binding.lifecycleEpoch !== request.targetLifecycleEpoch) throw new CollaborationStoreError("lifecycle_conflict");
+			if (request.revision !== input.expectedRevision || request.resultId !== null || !["running", "result_preparing"].includes(request.state) ||
+				activation.state !== "consumed" || !activation.quiesced || this.agentRequestBlocked(request.id) ||
+				this.db.query(`SELECT id FROM agent_requests WHERE parent_id=? AND state NOT IN ${AGENT_REQUEST_FINAL_SQL}`).get(request.id)) throw new CollaborationStoreError("result_conflict");
+			if (Buffer.byteLength(input.text) > 65536 || input.artifacts.length > 10) throw new CollaborationStoreError("result_too_large", 413);
+			const resultId = crypto.randomUUID();
+			const manifest = input.artifacts.map(id => {
+				const artifact = this.agentArtifact(id);
+				if (!artifact || artifact.producerConv !== binding.convId || artifact.requestId !== request.id || artifact.provenance.producedBy?.activationId !== activation.id || artifact.state !== "staged") throw new CollaborationStoreError("result_artifact_conflict");
+				const committed: AgentArtifact = { ...artifact, state: "committed", resultId };
+				this.db.query("UPDATE agent_artifacts SET data=? WHERE id=?").run(JSON.stringify(committed), artifact.id);
+				const recipient = this.getConversation(request.requesterConv);
+				if (!recipient) throw new CollaborationStoreError("requester_not_found", 404);
+				this.createAgentGrant(committed, { convId: request.requesterConv, lifecycleEpoch: recipient.agentId ? this.ensureAgentLifecycle(recipient.agentId) : 1,
+					authorityEpoch: gate.mode === "authority" && recipient.agentId ? gate.access(this.db, recipient.agentId).authorityEpoch : undefined });
+				return committed;
+			});
+			const result: AgentResult = { id: resultId, requestId: request.id, activationId: activation.id, submissionKey: key, payloadSha: collaborationDigest(input), text: input.text, outcome: input.outcome, manifest, committedAt: new Date().toISOString() };
+			this.db.query("INSERT INTO agent_results(id,data) VALUES (?,?)").run(result.id, JSON.stringify(result));
+			const completed = this.writeAgentRequest({ ...request, state: input.outcome, revision: request.revision + 1, resultId: result.id }, request.revision);
+			const message = this.appendEvent(request.requesterConv, "message.collaboration", { requestId: request.id, rootId: request.rootId, resultId: result.id, direction: "reply", trust: "delegated", text: input.text, manifest });
+			this.queueCollaborationEvent(message);
+			this.queueCollaborationEvent(this.appendEvent(request.targetConv, "message.collaboration", { requestId: request.id, resultId: result.id, direction: "reply", outgoing: true, trust: "delegated" }));
+			const parent = request.parentId === null ? null : this.getAgentRequest(request.parentId);
+			if (!parent || (!agentRequestTerminal(parent.state) && parent.state !== "cancel_requested")) this.newAgentActivation(completed, "reply", message.seq);
+			return this.saveAgentOperation(binding.convId, { key, payload: { input, binding }, receipt: result });
+		}).immediate();
+	}
+
+	cancelAgentRequest(input: { readonly requestId: string; readonly expectedRevision: number; readonly reason: string }, binding: CollaborationBinding): AgentCancelReceipt {
+		return this.db.transaction(() => {
+			this.assertAgentBinding(binding);
+			const request = this.getAgentRequest(input.requestId);
+			if (!request) throw new CollaborationStoreError("request_not_found", 404);
+			if (request.requesterConv !== binding.convId) throw new CollaborationStoreError("cancel_forbidden", 403);
+			return this.cancelAgentRequestTree(request, input);
+		}).immediate();
+	}
+
+	/** The owner (authenticated at the caller boundary) may cancel any request tree; the same CAS rules apply. */
+	cancelAgentRequestAsOwner(input: { readonly requestId: string; readonly expectedRevision: number; readonly reason: string }): AgentCancelReceipt {
+		return this.db.transaction(() => {
+			const request = this.getAgentRequest(input.requestId);
+			if (!request) throw new CollaborationStoreError("request_not_found", 404);
+			return this.cancelAgentRequestTree(request, input);
+		}).immediate();
+	}
+
+	/**
+	 * The owner pressed stop on the conversation's current run, which executes this activation's request: the same owner
+	 * cancel as the cancel route, from the request's current revision. Null when that run executes no open request.
+	 */
+	cancelStoppedAgentExecution(convId: string, activationId: string, reason: string): AgentCancelReceipt | null {
+		return this.db.transaction(() => {
+			const activation = this.getAgentActivation(activationId);
+			if (!activation || activation.targetConv !== convId || this.agentBinding(convId)?.activationId !== activationId || activation.quiesced ||
+				!["attempted", "acknowledged", "consumed"].includes(activation.state)) return null;
+			const request = this.agentExecutionRequest(activation);
+			if (!request || agentRequestTerminal(request.state) || request.state === "cancel_requested") return null;
+			return this.cancelAgentRequestTree(request, { expectedRevision: request.revision, reason });
+		}).immediate();
+	}
+
+	/** A reply delivered to a root requester executes no request: once its run ends, nothing else waits to settle it. */
+	agentReplyWithoutExecution(activationId: string): boolean {
+		const activation = this.getAgentActivation(activationId);
+		return activation?.direction === "reply" && this.agentExecutionRequest(activation) === null;
+	}
+
+	/** A final request (interrupted and version_conflict included) is never rewritten; the receipt reports each descendant's state. */
+	private cancelAgentRequestTree(request: AgentRequest, input: { readonly expectedRevision: number; readonly reason: string }): AgentCancelReceipt {
+		return this.db.transaction(() => {
+			if (request.revision !== input.expectedRevision || agentRequestTerminal(request.state)) throw new CollaborationStoreError("request_revision_conflict");
+			const rows = this.db.query<{ data: string }, [string]>(`WITH RECURSIVE tree AS (SELECT * FROM agent_requests WHERE id=? UNION ALL SELECT c.* FROM agent_requests c JOIN tree p ON c.parent_id=p.id) SELECT data FROM tree`).all(request.id);
+			const descendants = rows.map(row => (JSON.parse(row.data) as AgentRequest).id)
+				.filter(id => id !== request.id);
+			let receipt: AgentReceipt = { requestId: request.id, state: request.state, revision: request.revision };
+			const cancelled: AgentRequest[] = [];
+			for (const row of rows.reverse()) {
+				const child: AgentRequest = JSON.parse(row.data);
+				if (agentRequestTerminal(child.state)) continue;
+				const active = this.db.query<{ data: string }, [string, string]>(`SELECT a.data FROM agent_activations a JOIN agent_requests r ON r.id=a.request_id
+					WHERE a.state NOT IN ('queued','rejected') AND a.quiesced=0 AND (a.request_id=? OR r.parent_id=?)`).all(child.id, child.id)
+					.some(row => { const activation: AgentActivation = JSON.parse(row.data); return this.agentExecutionRequest(activation)?.id === child.id; }) ||
+					this.db.query<{ data: string }, []>(`SELECT r.data FROM events r WHERE r.type='agent.collaboration.reader'
+						AND NOT EXISTS (SELECT 1 FROM events s WHERE s.type='agent.collaboration.reader.settled' AND json_extract(s.data,'$.readId')=json_extract(r.data,'$.readId'))`).all()
+						.some(row => {
+							const reader: { grant: ArtifactGrant; binding: CollaborationBinding } = JSON.parse(row.data);
+							const activation = reader.binding.activationId === null ? null : this.getAgentActivation(reader.binding.activationId);
+							return (activation === null ? reader.grant.requestId : this.agentExecutionRequest(activation)?.id) === child.id;
+						}) ||
+					this.db.query(`SELECT h.id FROM security_holds h JOIN agent_question_links l ON l.decision_id=h.id WHERE l.request_id=?
+						AND json_extract(h.data,'$.source')='collaboration_artifact' AND json_extract(h.data,'$.continuation.dispatchReceiptId') IS NOT NULL
+						AND NOT EXISTS (SELECT 1 FROM events e WHERE e.type='agent.collaboration.read.settled' AND json_extract(e.data,'$.holdId')=h.id)`).get(child.id) !== null ||
+					this.db.query("SELECT transfer_id FROM agent_artifact_stages WHERE origin_request_id=? AND state IN ('staging','unknown')").get(child.id) !== null;
+				const unsettledChild = this.db.query(`SELECT id FROM agent_requests WHERE parent_id=? AND state NOT IN ${AGENT_REQUEST_FINAL_SQL}`).get(child.id);
+				const next = this.writeAgentRequest({ ...child, state: active || unsettledChild ? "cancel_requested" : "cancelled", revision: child.revision + 1, cancelReason: input.reason }, child.revision);
+				this.closeQueuedAgentInputs(child.id);
+				if (next.state === "cancelled") cancelled.push(next);
+				if (child.id === request.id) receipt = { requestId: child.id, state: next.state, revision: next.revision };
+			}
+			// After the whole tree changed, so a child inside it never replies to a parent cancelled with it.
+			for (const next of cancelled) this.replyWithoutResult(next, input.reason);
+			return { ...receipt, children: descendants.map(id => {
+				const child = this.getAgentRequest(id);
+				if (!child) throw new CollaborationStoreError("request_not_found", 404);
+				return { requestId: child.id,
+					state: child.state, revision: child.revision };
+			}) };
+		}).immediate();
+	}
+
+	listAgentRequests(conv: string, cursor?: string): { readonly requests: readonly AgentRequest[]; readonly nextCursor: string | null } {
+		let after: { createdAt: string; id: string } | null = null;
+		if (cursor !== undefined) {
+			let value: unknown;
+			try { value = JSON.parse(Buffer.from(cursor, "base64url").toString()); }
+			catch (error) {
+				if (error instanceof SyntaxError) throw new CollaborationStoreError("invalid_request_cursor", 400);
+				throw error;
+			}
+			if (!object(value) || typeof value.createdAt !== "string" || typeof value.id !== "string") throw new CollaborationStoreError("invalid_request_cursor", 400);
+			after = { createdAt: value.createdAt, id: value.id };
+		}
+		const rows = this.db.query<{ data: string; id: string; created_at: string }, [string, string, string, string, string, string]>("SELECT data,id,created_at FROM agent_requests WHERE (requester_conv=? OR target_conv=?) AND (?='' OR created_at<? OR (created_at=? AND id<?)) ORDER BY created_at DESC,id DESC LIMIT 51").all(conv, conv, after?.createdAt ?? "", after?.createdAt ?? "", after?.createdAt ?? "", after?.id ?? "");
+		const page = rows.slice(0, 50);
+		const last = page.at(-1);
+		return { requests: page.map(row => JSON.parse(row.data)), nextCursor: rows.length > 50 && last ? Buffer.from(JSON.stringify({ createdAt: last.created_at, id: last.id })).toString("base64url") : null };
+	}
+
+	/** Writer-transaction lineage: admitted inputs, actual release claims, and consumed child replies only. */
+	private deriveOutputLineage(requestId: string): { readonly storageClass: AgentArtifact["storageClass"]; readonly inputArtifactIds: readonly string[] } {
+		const inputs = new Set<string>();
+		const pending = new Set([requestId]);
+		for (const id of pending) {
+			const request = this.getAgentRequest(id);
+			if (!request) throw new CollaborationStoreError("request_not_found", 404);
+			for (const artifactId of request.payload.files) inputs.add(artifactId);
+			const activations = this.db.query<{ data: string }, [string, string, string]>(`SELECT a.data FROM agent_activations a
+				JOIN agent_requests r ON r.id=a.request_id WHERE a.target_conv=? AND a.state='consumed' AND (a.request_id=? OR r.parent_id=?)`)
+				.all(request.targetConv, id, id).map(row => {
+					const activation: AgentActivation = JSON.parse(row.data);
+					return activation;
+				});
+			// Both raw and held release use the original reader operation. A fresh held binding does not change its owner.
+			const readers = this.db.query<{ data: string }, [string]>(`SELECT r.data FROM events r JOIN events e
+				ON json_extract(e.data,'$.readOperationId')=json_extract(r.data,'$.readId')
+				LEFT JOIN security_holds h ON h.id=json_extract(e.data,'$.holdId')
+				WHERE r.type='agent.collaboration.reader' AND r.conv=? AND e.type='agent.collaboration.release'
+				AND (json_extract(e.data,'$.holdId') IS NULL OR json_extract(h.data,'$.continuation.releaseReceiptId')=CAST(e.seq AS TEXT))`)
+				.all(request.targetConv).map(row => {
+					const reader: { readonly grant: ArtifactGrant; readonly binding: CollaborationBinding } = JSON.parse(row.data);
+					return reader;
+				});
+			for (const activation of activations) {
+				if (this.agentExecutionRequest(activation)?.id !== id) continue;
+				for (const reader of readers) {
+					if (isDeepStrictEqual(reader.binding, activation.binding)) inputs.add(reader.grant.artifactId);
+				}
+				switch (activation.direction) {
+					case "request": case "owner_answer": break;
+					case "reply": {
+						// A reply to a child that ended without a result carries no files.
+						if (this.getAgentRequest(activation.requestId)?.resultId != null) {
+							const row = this.db.query<{ data: string }, [string]>("SELECT data FROM agent_results WHERE request_id=?").get(activation.requestId);
+							if (!row) throw new CollaborationStoreError("result_not_found", 404);
+							const result: AgentResult = JSON.parse(row.data);
+							for (const artifact of result.manifest) inputs.add(artifact.id);
+						}
+						// The child's inputs remain relevant even if its committed result has no files.
+						pending.add(activation.requestId);
+						break;
+					}
+					default: collaborationNever(activation.direction);
+				}
+			}
+		}
+		const inputArtifactIds = [...inputs].sort();
+		return { inputArtifactIds, storageClass: inputArtifactIds.some(id => this.agentArtifact(id)?.storageClass === "scoped_document") ? "scoped_document" : "source_copy" };
+	}
+
+	prepareAgentResult(input: { readonly requestId: string; readonly expectedRevision: number; readonly files: readonly { readonly sha256: string; readonly bytes: number; readonly mediaType: string; readonly name: string; readonly sealedName: string }[] }, binding: CollaborationBinding): AgentArtifact[] {
+		return this.db.transaction(() => {
+			if (binding.readContinuationId !== undefined) throw new CollaborationStoreError("read_only_continuation", 403);
+			this.assertAgentBinding(binding);
+			const request = this.getAgentRequest(input.requestId);
+			const activation = binding.activationId === null ? null : this.getAgentActivation(binding.activationId);
+			if (!request || !activation || request.targetConv !== binding.convId || this.agentExecutionRequest(activation)?.id !== request.id ||
+				!isDeepStrictEqual(activation.binding, binding) || binding.lifecycleEpoch !== request.targetLifecycleEpoch ||
+				activation.state !== "consumed" || request.state !== "running" || request.revision !== input.expectedRevision || this.agentRequestBlocked(request.id)) throw new CollaborationStoreError("result_conflict");
+			if (input.files.length > 10) throw new CollaborationStoreError("result_too_large", 413);
+			const lineage = this.deriveOutputLineage(request.id);
+			const artifacts = input.files.map((file, ordinal): AgentArtifact => {
+				if (!/^[a-f0-9]{64}$/.test(file.sha256) || !Number.isSafeInteger(file.bytes) || file.bytes < 0 || file.bytes > 10485760 || !file.sealedName) throw new CollaborationStoreError("invalid_artifact", 400);
+				const artifact: AgentArtifact = { id: crypto.randomUUID(), producerConv: binding.convId, requestId: request.id, sha256: file.sha256, bytes: file.bytes, mediaType: file.mediaType,
+					originalName: file.name, sealedName: file.sealedName, state: "staged", lifecycleEpoch: binding.lifecycleEpoch, storageClass: lineage.storageClass,
+					stageOperationKey: JSON.stringify(["result", activation.id, ordinal]), stagePayloadSha: collaborationDigest(file),
+					provenance: { transferId: null, transferAuthorityRef: null, targetAgentId: request.requesterAgent ?? "main", targetConvId: request.requesterConv,
+						targetLifecycleEpoch: request.requesterAgent ? this.ensureAgentLifecycle(request.requesterAgent) : 1,
+						sourceInputId: binding.inputId, sourceActivationId: activation.id, requestId: request.id, rootId: request.rootId,
+						producedBy: { requestId: request.id, activationId: activation.id, producerConv: binding.convId }, inputArtifactIds: lineage.inputArtifactIds } };
+				this.db.query("INSERT INTO agent_artifacts(id,data) VALUES (?,?)").run(artifact.id, JSON.stringify(artifact));
+				return artifact;
+			});
+			this.writeAgentRequest({ ...request, state: "result_preparing", revision: request.revision + 1 }, request.revision);
+			return artifacts;
+		}).immediate();
+	}
+
+	agentArtifactGrant(artifactId: string, conv: string, requestId: string): ArtifactGrant | null {
+		const row = this.db.query<{ data: string }, [string, string, string]>("SELECT data FROM agent_artifact_grants WHERE artifact_id=? AND grantee_conv=? AND request_id=? AND permission='read'").get(artifactId, conv, requestId);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	private assertArtifactGrant(grant: ArtifactGrant, binding: CollaborationBinding, gate: CollaborationGate): AgentArtifact {
+		this.assertAgentBinding(binding);
+		const artifact = this.agentArtifact(grant.artifactId);
+		const current = this.agentGrant(grant.grantId);
+		if (!artifact || artifact.state === "trashed" || !current || current.revoked) throw new CollaborationStoreError("artifact_revoked", 410);
+		if (!isDeepStrictEqual(current, grant) || grant.granteeConv !== binding.convId || grant.granteeLifecycleEpoch !== binding.lifecycleEpoch || artifact.requestId !== grant.requestId) throw new CollaborationStoreError("artifact_review_stale");
+		const request = this.getAgentRequest(grant.requestId);
+		if (!request || request.state === "cancel_requested" || request.state === "cancelled") throw new CollaborationStoreError("read_cancelled");
+		if (gate.mode === "authority" && binding.agentId !== null) {
+			const access = gate.access(this.db, binding.agentId);
+			if (access.accessState === "blocked") throw new CollaborationStoreError("agent_access_blocked", 403);
+			if (access.authorityEpoch !== grant.recipientAuthorityEpoch || access.lifecycleEpoch !== binding.lifecycleEpoch) throw new CollaborationStoreError("authority_epoch_mismatch");
+		}
+		return artifact;
+	}
+
+	private assertAgentReadExecution(binding: CollaborationBinding, hold?: ArtifactSecurityHold): AgentRequest | null {
+		const activationId = hold ? hold.readScope.activationId : binding.activationId;
+		if (activationId === null) return null;
+		const activation = this.getAgentActivation(activationId);
+		if (!activation || activation.state !== "consumed" ||
+			(!hold?.continuation.targetBinding && !isDeepStrictEqual(activation.binding, binding))) throw new CollaborationStoreError("binding_conflict");
+		const execution = this.agentExecutionRequest(activation);
+		if (execution && (execution.state === "cancel_requested" || execution.state === "cancelled")) throw new CollaborationStoreError("read_cancelled");
+		if (execution && (execution.targetConv !== binding.convId || execution.targetLifecycleEpoch !== binding.lifecycleEpoch)) throw new CollaborationStoreError("binding_conflict");
+		if (execution && (execution.state === "result_preparing" || agentRequestTerminal(execution.state) || this.agentRequestBlocked(execution.id, hold?.decisionId ?? ""))) throw new CollaborationStoreError("request_blocked");
+		return execution;
+	}
+
+	beginAgentArtifactRead(input: { readonly requestId: string; readonly artifactId: string; readonly readOperationId: string }, binding: CollaborationBinding, gate: CollaborationGate): { readonly readId: string; readonly grant: ArtifactGrant } {
+		return this.db.transaction(() => {
+			if (binding.readContinuationId !== undefined) throw new CollaborationStoreError("read_only_continuation", 403);
+			const key = JSON.stringify(["artifact-read", input.readOperationId]);
+			const prior = this.agentOperation<{ readId: string; grant: ArtifactGrant }>(key, { input, binding });
+			if (prior) throw new CollaborationStoreError("read_already_started");
+			const grant = this.agentArtifactGrant(input.artifactId, binding.convId, input.requestId);
+			if (!grant) throw new CollaborationStoreError("artifact_forbidden", 403);
+			this.assertArtifactGrant(grant, binding, gate);
+			this.assertAgentReadExecution(binding);
+			const receipt = { readId: input.readOperationId, grant };
+			this.appendEvent(binding.convId, "agent.collaboration.reader", { readId: input.readOperationId, grant, binding });
+			return this.saveAgentOperation(binding.convId, { key, payload: { input, binding }, receipt });
+		}).immediate();
+	}
+
+	settleAgentArtifactReader(readId: string, evidence: { readonly helperStopped: boolean; readonly leaseReleased: boolean }): void {
+		this.db.transaction(() => {
+			if (!evidence.helperStopped || !evidence.leaseReleased) throw new CollaborationStoreError("reader_not_settled");
+			const row = this.db.query<{ conv: string }, [string]>("SELECT conv FROM events WHERE type='agent.collaboration.reader' AND json_extract(data,'$.readId')=?").get(readId);
+			if (!row) throw new CollaborationStoreError("read_not_found", 404);
+			if (this.db.query("SELECT seq FROM events WHERE type='agent.collaboration.reader.settled' AND json_extract(data,'$.readId')=?").get(readId)) return;
+			this.appendEvent(row.conv, "agent.collaboration.reader.settled", { readId, ...evidence });
+		}).immediate();
+	}
+
+	claimAgentArtifactReadRelease(readId: string, binding: CollaborationBinding, gate: CollaborationGate): { readonly readId: string; readonly grantRevision: number; readonly artifactId: string; readonly sha256: string; readonly releaseSeq: number } {
+		return this.db.transaction(() => {
+			const row = this.db.query<{ data: string }, [string]>("SELECT data FROM events WHERE type='agent.collaboration.reader' AND json_extract(data,'$.readId')=?").get(readId);
+			if (!row) throw new CollaborationStoreError("read_not_found", 404);
+			const reader: { grant: ArtifactGrant; binding: CollaborationBinding } = JSON.parse(row.data);
+			if (!isDeepStrictEqual(reader.binding, binding)) throw new CollaborationStoreError("binding_conflict");
+			if (this.db.query("SELECT id FROM security_holds WHERE json_extract(data,'$.readOperationId')=?").get(readId)) throw new CollaborationStoreError("artifact_review_required", 403);
+			if (this.db.query("SELECT seq FROM events WHERE type='agent.collaboration.release' AND json_extract(data,'$.readOperationId')=?").get(readId)) throw new CollaborationStoreError("read_already_released");
+			const artifact = this.assertArtifactGrant(reader.grant, binding, gate);
+			this.assertAgentReadExecution(binding);
+			const event = this.appendEvent(binding.convId, "agent.collaboration.release", { kind: "collaboration_artifact", readOperationId: readId, artifactId: artifact.id,
+				requestId: reader.grant.requestId, grantRevision: reader.grant.revision, sha256: artifact.sha256, releaseState: "claimed" });
+			return { readId, grantRevision: reader.grant.revision, artifactId: artifact.id, sha256: artifact.sha256, releaseSeq: event.seq };
+		}).immediate();
+	}
+
+	private agentReaders(grantId: string): { readId: string; state: "stop_requested" | "release_preceded_revoke" | "unknown" }[] {
+		return this.db.query<{ readId: string }, [string]>(`SELECT json_extract(r.data,'$.readId') readId FROM events r WHERE r.type='agent.collaboration.reader' AND json_extract(r.data,'$.grant.grantId')=?
+			AND NOT EXISTS (SELECT 1 FROM events s WHERE s.type='agent.collaboration.reader.settled' AND json_extract(s.data,'$.readId')=json_extract(r.data,'$.readId'))`).all(grantId).map(row => {
+			const release = this.db.query("SELECT seq FROM events WHERE type='agent.collaboration.release' AND json_extract(data,'$.readOperationId')=?").get(row.readId);
+			return { readId: row.readId, state: release ? "release_preceded_revoke" : "stop_requested" };
+		});
+	}
+
+	revokeAgentArtifactGrant(input: { readonly requestId: string; readonly artifactId: string; readonly grantId: string; readonly expectedRevision: number; readonly operationId: string; readonly ownerPrincipalRef: string; readonly granteeConv: string }) {
+		return this.db.transaction(() => {
+			const key = JSON.stringify(["grant-revoke", input.ownerPrincipalRef, input.operationId]);
+			type Receipt = { operationId: string; requestId: string; artifactId: string; grantId: string; previousRevision: number; revision: number; state: "revoked"; changed: boolean; requestState: string; activeReaders: ReturnType<Store["agentReaders"]>; affectedTransfers: { transferId: string; state: string }[] };
+			const prior = this.agentOperation<Receipt>(key, input);
+			if (prior) return prior;
+			const grant = this.agentGrant(input.grantId);
+			const artifact = this.agentArtifact(input.artifactId);
+			const request = this.getAgentRequest(input.requestId);
+			if (!grant || !artifact || !request || grant.artifactId !== artifact.id || grant.requestId !== request.id || artifact.requestId !== request.id) throw new CollaborationStoreError("grant_not_found", 404);
+			if (grant.granteeConv !== input.granteeConv || !input.ownerPrincipalRef) throw new CollaborationStoreError("grant_owner_mismatch", 403);
+			if (artifact.state === "trashed") throw new CollaborationStoreError("artifact_revoked", 410);
+			if (grant.revision !== input.expectedRevision) throw new CollaborationStoreError("grant_revision_conflict");
+			const next = grant.revoked ? grant : { ...grant, revoked: true, revision: grant.revision + 1 };
+			this.db.query("UPDATE agent_artifact_grants SET data=? WHERE grant_id=? AND revision=?").run(JSON.stringify(next), grant.grantId, grant.revision);
+			const affectedTransfers: Receipt["affectedTransfers"] = [];
+			for (const row of this.db.query<{ data: string }, [string]>("SELECT data FROM agent_artifact_stages WHERE json_extract(data,'$.source.grantId')=? AND state IN ('awaiting_transfer_authority','ready','staging','staged','unknown')").all(grant.grantId)) {
+				const stage: AgentArtifactStage = JSON.parse(row.data);
+				if (stage.artifactId && this.agentArtifact(stage.artifactId)?.requestId !== null) continue;
+				const stopped: AgentArtifactStage = { ...stage, state: stage.state === "staging" || stage.state === "unknown" ? "unknown" : "invalidated", revision: stage.revision + 1, errorCode: "source_revoked" };
+				this.db.query("UPDATE agent_artifact_stages SET data=? WHERE transfer_id=?").run(JSON.stringify(stopped), stage.transferId);
+				affectedTransfers.push({ transferId: stage.transferId, state: stopped.state });
+			}
+			for (const row of this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE json_extract(data,'$.source')='collaboration_artifact' AND json_extract(data,'$.readScope.artifactGrantId')=?").all(grant.grantId)) {
+				const hold: ArtifactSecurityHold = JSON.parse(row.data);
+				if (hold.continuation.releaseReceiptId === null) this.writeArtifactHold({ ...hold, state: "invalidated", revision: hold.revision + 1, invalidationReason: "grant_revoked",
+					continuation: { ...hold.continuation, state: "invalidated" } });
+			}
+			return this.saveAgentOperation(input.granteeConv, { key, payload: input, receipt: { operationId: input.operationId, requestId: request.id, artifactId: artifact.id, grantId: grant.grantId,
+				previousRevision: grant.revision, revision: next.revision, state: "revoked" as const, changed: !grant.revoked, requestState: request.state, activeReaders: this.agentReaders(grant.grantId), affectedTransfers } });
+		}).immediate();
+	}
+
+	artifactSecurityHold(id: string): ArtifactSecurityHold | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE id=? AND json_extract(data,'$.source')='collaboration_artifact'").get(id);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	artifactHoldByContinuation(continuationId: string): ArtifactSecurityHold | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE json_extract(data,'$.source')='collaboration_artifact' AND json_extract(data,'$.continuation.id')=?").get(continuationId);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	/** The exact binding that began this read; owner review and resume are checked against it, never a later binding. */
+	artifactReaderBinding(readOperationId: string): CollaborationBinding {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM events WHERE type='agent.collaboration.reader' AND json_extract(data,'$.readId')=?").get(readOperationId);
+		if (!row) throw new CollaborationStoreError("read_not_found", 404);
+		const reader: { binding: CollaborationBinding } = JSON.parse(row.data);
+		return reader.binding;
+	}
+
+	unsettledArtifactHolds(activationId: string): readonly ArtifactSecurityHold[] {
+		return this.db.query<{ data: string }, [string]>(`SELECT data FROM security_holds WHERE json_extract(data,'$.source')='collaboration_artifact'
+			AND json_extract(data,'$.readScope.activationId')=? AND json_extract(data,'$.continuation.settledReceipt') IS NULL
+			AND json_extract(data,'$.continuation.targetBinding') IS NULL ORDER BY rowid`).all(activationId).map(row => JSON.parse(row.data));
+	}
+
+	private writeArtifactHold(hold: ArtifactSecurityHold): ArtifactSecurityHold {
+		this.db.query("UPDATE security_holds SET data=?,intent_submission=? WHERE id=?").run(JSON.stringify(hold), hold.answerSubmissionId, hold.id);
+		this.db.query("UPDATE decisions SET revision=?,status=?,updated_at=? WHERE id=?").run(hold.revision,
+			hold.state === "pending" ? "pending" : hold.state === "allowed" ? "delivered" : "closed", new Date().toISOString(), hold.decisionId);
+		return hold;
+	}
+
+	createArtifactSecurityHold(input: { readonly readOperationId: string; readonly representation: ArtifactSecurityHold["representation"]; readonly originInputSeq: number; readonly ownerPrincipalRef: string; readonly readArguments: ArtifactSecurityHold["readArguments"]; readonly summary?: ArtifactReviewSummary }, binding: CollaborationBinding, gate: CollaborationGate): ArtifactSecurityHold {
+		return this.db.transaction(() => {
+			const readerRow = this.db.query<{ data: string }, [string]>("SELECT data FROM events WHERE type='agent.collaboration.reader' AND json_extract(data,'$.readId')=?").get(input.readOperationId);
+			if (!readerRow) throw new CollaborationStoreError("read_not_found", 404);
+			const reader: { grant: ArtifactGrant; binding: CollaborationBinding } = JSON.parse(readerRow.data);
+			if (!isDeepStrictEqual(reader.binding, binding)) throw new CollaborationStoreError("binding_conflict");
+			const artifact = this.assertArtifactGrant(reader.grant, binding, gate);
+			const request = artifact.requestId === null ? null : this.getAgentRequest(artifact.requestId);
+			if (!request?.resultId || artifact.resultId !== request.resultId || this.getEvent(input.originInputSeq)?.conv !== binding.convId ||
+				input.readArguments.requestId !== request.id || input.readArguments.artifactId !== artifact.id) throw new CollaborationStoreError("artifact_review_stale");
+			const resourceRef = { kind: "collaboration_artifact" as const, requestId: request.id, artifactId: artifact.id, resultId: request.resultId, originalSha256: artifact.sha256 };
+			const readScope: ArtifactSecurityHold["readScope"] = { artifactGrantId: reader.grant.grantId, grantRevision: reader.grant.revision, granteeConv: binding.convId, lifecycleEpoch: binding.lifecycleEpoch,
+				inputId: binding.inputId, activationId: binding.activationId, managedBindingDigest: collaborationDigest(binding),
+				...(reader.grant.recipientAuthorityEpoch === undefined ? {} : { recipientAuthorityEpoch: reader.grant.recipientAuthorityEpoch }) };
+			const scopeDigest = collaborationDigest([resourceRef, input.representation, readScope, "collaboration_artifact_review"]);
+			const prior = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE source_key=?").get(`artifact:${scopeDigest}`);
+			if (prior) return JSON.parse(prior.data);
+			const dependent = this.assertAgentReadExecution(binding);
+			const id = crypto.randomUUID();
+			const hold: ArtifactSecurityHold = { id, decisionId: id, revision: 1, source: "collaboration_artifact", purpose: "collaboration_artifact_review", state: "pending", resourceRef, ...(input.summary ? { summary: input.summary } : {}),
+				representation: input.representation, readScope, scopeDigest, readOperationId: input.readOperationId, ownerPrincipalRef: input.ownerPrincipalRef,
+				answerSubmissionId: null, reviewReceipt: null, readArguments: input.readArguments, invalidationReason: null,
+				continuation: { id: crypto.randomUUID(), originInputSeq: input.originInputSeq, originOwnerInputRevision: binding.ownerInputRevision, settledReceipt: null, state: "unrequested",
+					resumeSubmissionId: null, reviewedScopeDigest: null, targetBinding: null, boundScopeDigest: null, dispatchReceiptId: null, releaseReceiptId: null } };
+			this.db.query("INSERT INTO security_holds(id,source_key,data) VALUES (?,?,?)").run(id, `artifact:${scopeDigest}`, JSON.stringify(hold));
+			const now = new Date().toISOString();
+			this.insertDecision({ id, revision: 1, ownerConv: binding.convId, scope: `security:${binding.convId}`, workId: null, sourceSessionPath: null, sourceRequestId: id, sourceCommandSeq: null, legacyActionId: null,
+				method: "confirm", permission: false, required: false, payload: { kind: "security-check", purpose: "collaboration_artifact_review", holdId: id, scopeDigest }, bindingState: "closed", deadlineAt: null,
+				status: "pending", submissionId: null, submissionRevision: null, submissionMode: null, answer: null, commandId: null, answerRoute: null, supersededBy: null, reason: null, createdAt: now, updatedAt: now });
+			if (binding.activationId !== null) {
+				const activation = this.getAgentActivation(binding.activationId);
+				if (!activation) throw new CollaborationStoreError("binding_conflict");
+				this.db.query("INSERT INTO agent_question_links(decision_id,request_id,activation_id,read_operation_id,origin_input_seq) VALUES (?,?,?,?,?)").run(id, dependent?.id ?? null, activation.id, input.readOperationId, input.originInputSeq);
+				if (dependent && !agentRequestTerminal(dependent.state)) this.writeAgentRequest({ ...dependent, state: "waiting_owner", revision: dependent.revision + 1 }, dependent.revision);
+			}
+			return hold;
+		}).immediate();
+	}
+
+	private assertArtifactHold(hold: ArtifactSecurityHold, binding: CollaborationBinding, gate: CollaborationGate): void {
+		const grant = this.agentGrant(hold.readScope.artifactGrantId);
+		if (!grant || grant.revoked) throw new CollaborationStoreError("artifact_revoked", 410);
+		const artifact = this.assertArtifactGrant(grant, binding, gate);
+		if (grant.revision !== hold.readScope.grantRevision || artifact.sha256 !== hold.resourceRef.originalSha256 ||
+			binding.ownerInputRevision !== hold.continuation.originOwnerInputRevision || hold.state === "invalidated" ||
+			hold.continuation.state === "invalidated" || hold.continuation.state === "cancelled") throw new CollaborationStoreError("artifact_review_stale");
+		const actual: ArtifactReadBinding = { inputId: binding.inputId, activationId: binding.activationId, managedBindingDigest: collaborationDigest(binding) };
+		const expected = hold.continuation.targetBinding ?? { inputId: hold.readScope.inputId, activationId: hold.readScope.activationId, managedBindingDigest: hold.readScope.managedBindingDigest };
+		if (!isDeepStrictEqual(actual, expected)) throw new CollaborationStoreError("artifact_review_stale");
+	}
+
+	reviewArtifactHold(input: { readonly holdId: string; readonly expectedRevision: number; readonly submissionId: string; readonly scopeDigest: string; readonly choice: "allow" | "deny" | "cancel"; readonly ownerPrincipalRef: string }, binding: CollaborationBinding, gate: CollaborationGate): ArtifactReviewReceipt {
+		return this.db.transaction(() => {
+			const hold = this.artifactSecurityHold(input.holdId);
+			if (!hold) throw new CollaborationStoreError("hold_not_found", 404);
+			if (hold.ownerPrincipalRef !== input.ownerPrincipalRef) throw new CollaborationStoreError("owner_mismatch", 403);
+			const key = JSON.stringify(["artifact-review", input.submissionId]);
+			const prior = this.agentOperation<ArtifactReviewReceipt>(key, input);
+			if (prior) return prior;
+			if (hold.revision !== input.expectedRevision || hold.state !== "pending" || hold.scopeDigest !== input.scopeDigest) throw new CollaborationStoreError("artifact_review_conflict");
+			this.assertArtifactHold(hold, binding, gate);
+			let state: ArtifactReviewReceipt["reviewState"];
+			switch (input.choice) {
+				case "allow": state = "allowed"; break;
+				case "deny": state = "denied"; break;
+				case "cancel": state = "cancelled"; break;
+				default: return collaborationNever(input.choice);
+			}
+			const revision = hold.revision + 1;
+			this.writeArtifactHold({ ...hold, state, revision, answerSubmissionId: input.submissionId, reviewReceipt: { decisionRevision: revision, choice: input.choice } });
+			const receipt: ArtifactReviewReceipt = { kind: "collaboration_artifact_review", holdId: hold.id, decisionId: hold.decisionId, revision, submissionId: input.submissionId,
+				scopeDigest: hold.scopeDigest, reviewState: state, resource: { requestId: hold.resourceRef.requestId, artifactId: hold.resourceRef.artifactId, resultId: hold.resourceRef.resultId }, effect: "review_recorded", contentReleased: false };
+			return this.saveAgentOperation(binding.convId, { key, payload: input, receipt });
+		}).immediate();
+	}
+
+	settleArtifactRead(holdId: string, evidence: { readonly settlementId: string; readonly ownedInFlight: number; readonly reconciled: boolean }, binding: CollaborationBinding): ArtifactSecurityHold {
+		return this.db.transaction(() => {
+			const hold = this.artifactSecurityHold(holdId);
+			if (hold && hold.continuation.targetBinding !== null) {
+				const actual: ArtifactReadBinding = { inputId: binding.inputId, activationId: binding.activationId, managedBindingDigest: collaborationDigest(binding) };
+				if (!evidence.settlementId || evidence.ownedInFlight !== 0 || !evidence.reconciled || binding.readContinuationId !== hold.continuation.id ||
+					!isDeepStrictEqual(actual, hold.continuation.targetBinding)) throw new CollaborationStoreError("artifact_read_not_settled");
+				// Settlement reconciles this exact dispatched input even after owner steer; it grants no release.
+				if (!this.db.query("SELECT seq FROM events WHERE type='agent.collaboration.read.settled' AND json_extract(data,'$.holdId')=?").get(holdId)) {
+					this.appendEvent(binding.convId, "agent.collaboration.read.settled", { holdId, ...evidence, binding: actual });
+				}
+				return hold;
+			}
+			if (!hold || !evidence.settlementId || evidence.ownedInFlight !== 0 || !evidence.reconciled ||
+				hold.readScope.inputId !== binding.inputId || hold.readScope.activationId !== binding.activationId || hold.readScope.managedBindingDigest !== collaborationDigest(binding)) throw new CollaborationStoreError("artifact_read_not_settled");
+			this.assertAgentBinding(binding);
+			if (hold.continuation.settledReceipt !== null) return hold;
+			return this.writeArtifactHold({ ...hold, revision: hold.revision + 1, continuation: { ...hold.continuation, settledReceipt: { inputId: binding.inputId, activationId: binding.activationId, managedBindingDigest: collaborationDigest(binding), settlementId: evidence.settlementId } } });
+		}).immediate();
+	}
+
+	resumeArtifactRead(input: { readonly holdId: string; readonly expectedRevision: number; readonly resumeSubmissionId: string; readonly readOperationId: string; readonly scopeDigest: string; readonly ownerPrincipalRef: string }, binding: CollaborationBinding, gate: CollaborationGate) {
+		return this.db.transaction(() => {
+			const hold = this.artifactSecurityHold(input.holdId);
+			if (!hold) throw new CollaborationStoreError("hold_not_found", 404);
+			if (hold.ownerPrincipalRef !== input.ownerPrincipalRef || binding.convId !== hold.readScope.granteeConv) throw new CollaborationStoreError("owner_mismatch", 403);
+			type Receipt = { holdId: string; readOperationId: string; continuationId: string; revision: number; resumeSubmissionId: string; scopeDigest: string; resumeState: ArtifactSecurityHold["continuation"]["state"]; contentReleased: false };
+			const key = JSON.stringify(["artifact-resume", input.resumeSubmissionId]);
+			const prior = this.agentOperation<Receipt>(key, input);
+			if (prior) return { ...prior, resumeState: hold.continuation.state };
+			if (hold.revision !== input.expectedRevision || hold.scopeDigest !== input.scopeDigest || hold.readOperationId !== input.readOperationId || hold.continuation.resumeSubmissionId !== null) throw new CollaborationStoreError("artifact_resume_conflict");
+			switch (hold.state) {
+				case "pending": throw new CollaborationStoreError("document_review_pending");
+				case "denied": throw new CollaborationStoreError("document_review_denied", 403);
+				case "cancelled": throw new CollaborationStoreError("document_review_cancelled");
+				case "invalidated": throw new CollaborationStoreError("artifact_review_stale");
+				case "allowed": break;
+				default: return collaborationNever(hold.state);
+			}
+			this.assertArtifactHold(hold, binding, gate);
+			if (!hold.continuation.settledReceipt) throw new CollaborationStoreError("artifact_read_not_settled");
+			this.assertAgentReadExecution(binding, hold);
+			const released = hold.continuation.releaseReceiptId !== null;
+			if (!released && hold.continuation.state !== "unrequested") throw new CollaborationStoreError("artifact_resume_conflict");
+			const next = this.writeArtifactHold({ ...hold, revision: hold.revision + 1, continuation: { ...hold.continuation,
+				state: released ? hold.continuation.state : "queued", resumeSubmissionId: input.resumeSubmissionId, reviewedScopeDigest: hold.scopeDigest } });
+			if (!released) {
+				const intent: CollaborationIntent = { origin: "collaboration_artifact_read", holdId: hold.id, readOperationId: hold.readOperationId, continuationId: hold.continuation.id, reviewedScopeDigest: hold.scopeDigest };
+				this.appendEvent(binding.convId, "agent.collaboration.input", intent);
+			}
+			const receipt: Receipt = { holdId: hold.id, readOperationId: hold.readOperationId, continuationId: hold.continuation.id, revision: next.revision, resumeSubmissionId: input.resumeSubmissionId, scopeDigest: hold.scopeDigest, resumeState: next.continuation.state, contentReleased: false };
+			return this.saveAgentOperation(binding.convId, { key, payload: input, receipt });
+		}).immediate();
+	}
+
+	nextArtifactReadInput(conv: string): { readonly hold: ArtifactSecurityHold; readonly seq: number } | null {
+		const row = this.db.query<{ data: string; seq: number }, [string]>(`
+			SELECT h.data,e.seq FROM events e JOIN security_holds h ON h.id=json_extract(e.data,'$.holdId')
+			WHERE e.conv=? AND e.type='agent.collaboration.input' AND json_extract(e.data,'$.origin')='collaboration_artifact_read'
+			AND json_extract(h.data,'$.state')='allowed' AND json_extract(h.data,'$.continuation.state')='queued'
+			ORDER BY e.seq LIMIT 1`).get(conv);
+		return row ? { hold: JSON.parse(row.data), seq: row.seq } : null;
+	}
+
+	admitArtifactRead(input: { readonly holdId: string; readonly expectedRevision: number; readonly previousBinding: CollaborationBinding;
+		readonly wireMessage: string }, fresh: CollaborationBinding, gate: CollaborationGate): StoredEvent {
+		return this.db.transaction(() => {
+			const next = this.nextArtifactReadInput(fresh.convId);
+			if (!next || next.hold.id !== input.holdId || next.hold.revision !== input.expectedRevision ||
+				!isDeepStrictEqual(this.agentBinding(fresh.convId), input.previousBinding)) throw new CollaborationStoreError("artifact_resume_conflict");
+			if (this.lastSeq(fresh.convId, "message.user") !== fresh.ownerInputRevision ||
+				this.pendingMainUsers(fresh.convId).length || this.mainTurn(fresh.convId)) throw new CollaborationStoreError("conversation_busy");
+			const hold = this.dispatchArtifactRead({ holdId: input.holdId, fresh }, input.previousBinding, gate);
+			const source: MainInputSource = { origin: "collaboration_artifact_read", input_ref: { holdId: hold.id, readOperationId: hold.readOperationId,
+				continuationId: hold.continuation.id, reviewedScopeDigest: hold.scopeDigest } };
+			return this.appendEvent(fresh.convId, "main.input", { ...source, session_path: fresh.sessionPath, handoff: null,
+				input_id: fresh.inputId, wire_message: input.wireMessage, native_identity: true, authored_binding: fresh });
+		}).immediate();
+	}
+
+	dispatchArtifactRead(input: string | { readonly holdId: string; readonly fresh: CollaborationBinding }, binding: CollaborationBinding, gate: CollaborationGate): ArtifactSecurityHold {
+		return this.db.transaction(() => {
+			const holdId = typeof input === "string" ? input : input.holdId;
+			const hold = this.artifactSecurityHold(holdId);
+			if (!hold || hold.state !== "allowed" || hold.continuation.state !== "queued" || !hold.continuation.settledReceipt || hold.continuation.targetBinding !== null) throw new CollaborationStoreError("artifact_resume_conflict");
+			this.assertArtifactHold(hold, binding, gate);
+			this.assertAgentReadExecution(binding, hold);
+			if (binding.activationId !== null) {
+				const active = this.getAgentActivation(binding.activationId);
+				if (!active?.quiesced) throw new CollaborationStoreError("request_blocked");
+			}
+			const fresh: CollaborationBinding = { ...binding, inputId: typeof input === "string" ? crypto.randomUUID() : input.fresh.inputId,
+				activationId: null, readContinuationId: hold.continuation.id };
+			if (typeof input !== "string" && (!isDeepStrictEqual(fresh, input.fresh) || fresh.inputId === binding.inputId)) throw new CollaborationStoreError("artifact_review_stale");
+			const targetBinding: ArtifactReadBinding = { inputId: fresh.inputId, activationId: fresh.activationId, managedBindingDigest: collaborationDigest(fresh) };
+			const dispatch = this.appendEvent(binding.convId, "agent.collaboration.read.dispatch", { holdId, readOperationId: hold.readOperationId, continuationId: hold.continuation.id, targetBinding });
+			this.recordAgentBinding(fresh);
+			return this.writeArtifactHold({ ...hold, revision: hold.revision + 1, continuation: { ...hold.continuation, state: "dispatched", targetBinding,
+				boundScopeDigest: collaborationDigest([hold.scopeDigest, hold.continuation.id, targetBinding]), dispatchReceiptId: String(dispatch.seq) } });
+		}).immediate();
+	}
+
+	claimArtifactRelease(input: { readonly holdId: string; readonly expectedRevision: number; readonly representation: ArtifactSecurityHold["representation"] }, binding: CollaborationBinding, gate: CollaborationGate): ArtifactReleaseReceipt {
+		return this.db.transaction(() => {
+			const hold = this.artifactSecurityHold(input.holdId);
+			if (!hold || hold.revision !== input.expectedRevision || hold.state !== "allowed" || hold.continuation.releaseReceiptId !== null ||
+				!isDeepStrictEqual(input.representation, hold.representation) || !["unrequested", "dispatched"].includes(hold.continuation.state)) throw new CollaborationStoreError("artifact_review_stale");
+			if (this.db.query("SELECT seq FROM events WHERE type='agent.collaboration.read.settled' AND json_extract(data,'$.holdId')=?").get(hold.id)) throw new CollaborationStoreError("artifact_read_not_settled");
+			this.assertArtifactHold(hold, binding, gate);
+			this.assertAgentReadExecution(binding, hold);
+			if (hold.continuation.targetBinding === null && hold.continuation.settledReceipt !== null) throw new CollaborationStoreError("artifact_resume_required");
+			const receipt: ArtifactReleaseReceipt = { kind: "collaboration_artifact", readOperationId: hold.readOperationId, holdId: hold.id, requestId: hold.resourceRef.requestId, artifactId: hold.resourceRef.artifactId,
+				grantRevision: hold.readScope.grantRevision, representationSha256: hold.representation.sha256, scopeDigest: hold.scopeDigest,
+				continuationId: hold.continuation.targetBinding === null ? null : hold.continuation.id, boundScopeDigest: hold.continuation.boundScopeDigest, releaseState: "claimed" };
+			const event = this.appendEvent(binding.convId, "agent.collaboration.release", receipt);
+			this.writeArtifactHold({ ...hold, revision: hold.revision + 1, continuation: { ...hold.continuation, releaseReceiptId: String(event.seq) } });
+			return receipt;
+		}).immediate();
+	}
+
+	recordArtifactDelivery(input: { readonly holdId: string; readonly dispatchReceiptId: string | null; readonly releaseReceiptId: string | null; readonly state: "released" | "unknown" }, binding: ArtifactReadBinding): ArtifactSecurityHold {
+		return this.db.transaction(() => {
+			const hold = this.artifactSecurityHold(input.holdId);
+			if (!hold || hold.continuation.dispatchReceiptId !== input.dispatchReceiptId || hold.continuation.releaseReceiptId !== input.releaseReceiptId ||
+				!isDeepStrictEqual(hold.continuation.targetBinding ?? { inputId: hold.readScope.inputId, activationId: hold.readScope.activationId, managedBindingDigest: hold.readScope.managedBindingDigest }, binding)) throw new CollaborationStoreError("artifact_delivery_conflict");
+			if (hold.continuation.state === "released" || hold.continuation.state === "invalidated" || hold.continuation.state === "cancelled") return hold;
+			if (input.state === "released" && input.releaseReceiptId === null) throw new CollaborationStoreError("artifact_delivery_conflict");
+			if (input.dispatchReceiptId === null && input.releaseReceiptId === null) throw new CollaborationStoreError("artifact_delivery_conflict");
+			this.appendEvent(hold.readScope.granteeConv, "agent.collaboration.release.evidence", { ...input, binding });
+			return this.writeArtifactHold({ ...hold, revision: hold.revision + 1, continuation: { ...hold.continuation, state: input.state } });
+		}).immediate();
+	}
+
+	markAgentStageUnknown(transferId: string, expectedRevision: number): AgentArtifactStage {
+		return this.db.transaction(() => {
+			const stage = this.agentStage(transferId);
+			if (!stage || stage.state !== "staging" || stage.revision !== expectedRevision) throw new CollaborationStoreError("stage_conflict");
+			const next: AgentArtifactStage = { ...stage, state: "unknown", revision: stage.revision + 1, errorCode: "export_unknown" };
+			this.db.query("UPDATE agent_artifact_stages SET data=? WHERE transfer_id=? AND revision=?").run(JSON.stringify(next), transferId, expectedRevision);
+			return next;
+		}).immediate();
+	}
+
+	/**
+	 * Housekeeping candidates: sealed collaboration files of finished requests that no live grant keeps. Listing changes
+	 * nothing; trashAgentArtifact repeats every reference check at the operator's selection.
+	 */
+	agentArtifactCleanupRows(): readonly { readonly artifactId: string; readonly sealedName: string; readonly bytes: number; readonly state: string }[] {
+		return this.db.query<{ data: string }, []>(`SELECT a.data FROM agent_artifacts a JOIN agent_requests r ON r.id=a.request_id
+			WHERE a.state<>'trashed' AND r.state IN ${AGENT_REQUEST_FINAL_SQL}
+			AND NOT EXISTS (SELECT 1 FROM agent_artifact_grants g WHERE g.artifact_id=a.id AND g.revoked=0) ORDER BY a.id`).all()
+			.map(row => JSON.parse(row.data) as AgentArtifact)
+			.map(artifact => ({ artifactId: artifact.id, sealedName: artifact.sealedName, bytes: artifact.bytes, state: artifact.state }));
+	}
+
+	trashAgentArtifact(artifactId: string): AgentArtifact {
+		return this.db.transaction(() => {
+			const artifact = this.agentArtifact(artifactId);
+			if (!artifact) throw new CollaborationStoreError("artifact_not_found", 404);
+			if (artifact.state === "trashed") return artifact;
+			const request = artifact.requestId === null ? null : this.getAgentRequest(artifact.requestId);
+			const ended = request !== null && agentRequestTerminal(request.state);
+			if (request && (!ended || this.agentActivations(request.id).some(a => a.state === "unknown" ||
+				(a.state !== "queued" && a.state !== "rejected" && !a.quiesced)))) throw new CollaborationStoreError("artifact_busy");
+			for (const row of this.db.query<{ data: string }, [string]>("SELECT data FROM agent_artifact_grants WHERE artifact_id=?").all(artifactId)) {
+				const grant: ArtifactGrant = JSON.parse(row.data);
+				if (!grant.revoked || this.agentReaders(grant.grantId).length > 0) throw new CollaborationStoreError("artifact_busy");
+			}
+			if (this.db.query("SELECT transfer_id FROM agent_artifact_stages WHERE (artifact_id=? OR json_extract(data,'$.source.artifactId')=?) AND state IN ('awaiting_transfer_authority','ready','staging','unknown')").get(artifactId, artifactId)) throw new CollaborationStoreError("artifact_busy");
+			if (this.db.query("SELECT id FROM security_holds WHERE json_extract(data,'$.resourceRef.artifactId')=? AND json_extract(data,'$.continuation.state') IN ('queued','dispatched','unknown')").get(artifactId)) throw new CollaborationStoreError("artifact_busy");
+			const tombstone: AgentArtifact = { ...artifact, state: "trashed" };
+			this.db.query("UPDATE agent_artifacts SET data=? WHERE id=?").run(JSON.stringify(tombstone), artifactId);
+			return tombstone;
+		}).immediate();
+	}
+
+	acceptCollaborationPermissionOutcome(outcome: CollaborationPermissionOutcome, binding: CollaborationBinding, gate: CollaborationGate) {
+		return this.db.transaction(() => {
+			const key = JSON.stringify(["permission", outcome.decisionId, outcome.decisionRevision, outcome.continuationId]);
+			type Receipt = { readonly decisionId: string; readonly continuationId: string; readonly inputSeq: number };
+			const prior = this.agentOperation<Receipt>(key, outcome);
+			if (prior) return prior;
+			this.assertCollaborationPermission(outcome, binding, gate);
+			const intent: CollaborationIntent = { origin: "agent_tool_permission", outcome };
+			const input = this.appendEvent(binding.convId, "agent.collaboration.input", intent);
+			return this.saveAgentOperation(binding.convId, { key, payload: outcome, receipt: { decisionId: outcome.decisionId, continuationId: outcome.continuationId, inputSeq: input.seq } });
+		}).immediate();
+	}
+
+	/** Only the shared dispatcher allocates the continuation, once per exact stored outcome. */
+	dispatchCollaborationPermission(outcome: CollaborationPermissionOutcome, binding: CollaborationBinding, gate: CollaborationGate): AgentActivation {
+		return this.db.transaction(() => {
+			const key = JSON.stringify(["permission-dispatch", outcome.decisionId, outcome.decisionRevision, outcome.continuationId]);
+			const prior = this.agentOperation<{ readonly activationId: string }>(key, outcome);
+			if (prior) {
+				const activation = this.getAgentActivation(prior.activationId);
+				if (!activation) throw new CollaborationStoreError("activation_not_found");
+				return activation;
+			}
+			this.assertCollaborationPermission(outcome, binding, gate);
+			const blocked = this.getAgentActivation(outcome.blockedActivationId), request = this.getAgentRequest(outcome.collaborationRequestId);
+			if (!blocked?.quiesced || !request) throw new CollaborationStoreError("request_blocked");
+			const accepted = this.acceptCollaborationPermissionOutcome(outcome, binding, gate);
+			const activation = this.newAgentActivation(request, "owner_answer", { seq: accepted.inputSeq });
+			this.saveAgentOperation(binding.convId, { key, payload: outcome, receipt: { activationId: activation.id } });
+			return activation;
+		}).immediate();
+	}
+
+	private assertCollaborationPermission(outcome: CollaborationPermissionOutcome, binding: CollaborationBinding, gate: CollaborationGate): void {
+			if (gate.mode !== "authority" || binding.agentId === null) throw new CollaborationStoreError("authority_adapter_required", 503);
+			if (!gate.permissionOutcome || !isDeepStrictEqual(gate.permissionOutcome(this.db, outcome.decisionId), outcome)) throw new CollaborationStoreError("permission_outcome_conflict");
+			this.assertAgentBinding(binding);
+			const decision = this.getDecision(outcome.decisionId);
+			const activation = this.getAgentActivation(outcome.blockedActivationId);
+			const request = this.getAgentRequest(outcome.collaborationRequestId);
+			const link = this.db.query<{ request_id: string; activation_id: string; origin_input_seq: number }, [string]>("SELECT request_id,activation_id,origin_input_seq FROM agent_question_links WHERE decision_id=?").get(outcome.decisionId);
+			const access = gate.access(this.db, binding.agentId);
+			// Q-07 (294 card values): the decision is a 294 grant card (permission:false, purpose agent_tool_grant); the link names
+			// the asking execution's input; the outcome's origin input is that same execution input.
+			const purpose = this.db.query<{ purpose: string }, [string]>("SELECT purpose FROM decision_purposes WHERE decision_id=?").get(outcome.decisionId)?.purpose;
+			if (!decision || decision.revision !== outcome.decisionRevision || decision.submissionId === null ||
+				!["delivered", "closed"].includes(decision.status) || decision.permission || purpose !== "agent_tool_grant" ||
+				!activation || !request || !link || this.agentExecutionRequest(activation)?.id !== request.id || link.request_id !== request.id || link.activation_id !== activation.id ||
+				link.origin_input_seq !== activation.inputSeq || activation.inputSeq !== outcome.originInputSeq ||
+				!isDeepStrictEqual(activation.binding, binding) || activation.state !== "consumed" ||
+				binding.lifecycleEpoch !== outcome.lifecycleEpoch || access.lifecycleEpoch !== outcome.lifecycleEpoch ||
+				access.authorityEpoch !== outcome.authorityEpoch || access.policyRevision !== outcome.policyRevision) throw new CollaborationStoreError("permission_outcome_conflict");
+			if (access.accessState !== "open") throw new CollaborationStoreError("agent_access_blocked", 403);
+			if (agentRequestTerminal(request.state) || request.state === "cancel_requested" || this.agentRequestBlocked(request.id)) throw new CollaborationStoreError("request_blocked");
+	}
+
 	securityAllowedValues(): { revision: number; values: AllowedValue[] } {
 		return this.db.transaction(() => ({
 			revision: this.db.query<{ revision: number }, []>("SELECT revision FROM security_allow_revision WHERE id = 1").get()!.revision,
@@ -765,16 +2432,16 @@ export class Store {
 	}
 
 	securityHolds(): SecurityHoldRecord[] {
-		return this.db.query<{ data: string }, []>("SELECT data FROM security_holds ORDER BY rowid").all().map((row) => JSON.parse(row.data));
+		return this.db.query<{ data: string }, []>("SELECT data FROM security_holds WHERE json_extract(data, '$.state.source') IN ('message','answer') ORDER BY rowid").all().map((row) => JSON.parse(row.data));
 	}
 
 	securityHold(id: string): SecurityHoldRecord | null {
-		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE id = ?").get(id);
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE id = ? AND json_extract(data, '$.state.source') IN ('message','answer')").get(id);
 		return row ? JSON.parse(row.data) : null;
 	}
 
 	securityHoldByKey(key: string): SecurityHoldRecord | null {
-		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE source_key = ?").get(key);
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE source_key = ? AND json_extract(data, '$.state.source') IN ('message','answer')").get(key);
 		return row ? JSON.parse(row.data) : null;
 	}
 
@@ -871,6 +2538,7 @@ export class Store {
 	}
 
 	securityReceipt(ref: SecurityReceipt): "sent" | "unconfirmed" | null {
+		if (ref.kind === "collaboration_artifact" || ref.kind === "collaboration_artifact_review") return null;
 		if (ref.kind === "answer") {
 			const decision = this.getDecision(ref.decisionId);
 			if (decision?.submissionId !== ref.submissionId) return null;
@@ -1127,14 +2795,25 @@ export class Store {
 		const sources = (inputs.length ? inputs : events.filter((event) => event.type === "turn.started"))
 			.map((event) => event.data as Partial<MainInputSource>);
 		const explicit = [...sources].reverse().find((source) => source.origin === "user")
-			?? sources.find((source) => source.origin === "work_update");
-		const source: MainInputSource = explicit?.origin === "work_update" && explicit.input_ref
-			? { origin: "work_update", input_ref: explicit.input_ref }
-			: {
-				origin: "user",
-				input_ref: explicit?.origin === "user" && explicit.input_ref
-					? explicit.input_ref : { message_seq: this.lastSeq(conv, "message.user") },
-			};
+			?? sources.find((source) => source.origin !== undefined);
+		let source: MainInputSource;
+		switch (explicit?.origin) {
+			case "user": source = { origin: explicit.origin, input_ref: explicit.input_ref ?? { message_seq: this.lastSeq(conv, "message.user") } }; break;
+			case "work_update":
+				if (!explicit.input_ref) throw new CollaborationStoreError("input_source_missing");
+				source = { origin: explicit.origin, input_ref: explicit.input_ref }; break;
+			case "agent_collaboration":
+				if (!explicit.input_ref) throw new CollaborationStoreError("input_source_missing");
+				source = { origin: explicit.origin, input_ref: explicit.input_ref }; break;
+			case "agent_tool_permission":
+				if (!explicit.input_ref) throw new CollaborationStoreError("input_source_missing");
+				source = { origin: explicit.origin, input_ref: explicit.input_ref }; break;
+			case "collaboration_artifact_read":
+				if (!explicit.input_ref) throw new CollaborationStoreError("input_source_missing");
+				source = { origin: explicit.origin, input_ref: explicit.input_ref }; break;
+			case undefined: source = { origin: "user", input_ref: { message_seq: this.lastSeq(conv, "message.user") } }; break;
+			default: return collaborationNever(explicit);
+		}
 		const report = events.filter((event) => event.type === "message.final"
 			&& Array.isArray((event.data as { work_update_ids?: unknown }).work_update_ids)).at(-1);
 		return { seq: first.seq, source, inputs, reportEventSeq: report?.seq ?? null };
@@ -1146,11 +2825,48 @@ export class Store {
 	}
 
 	/** Exact native message/history proves consumption; a queue ACK alone does not. */
-	consumeMainInput(input: StoredEvent): StoredEvent | null {
+	consumeMainInput(input: StoredEvent, native?: { readonly entry: LedgerEntry; readonly durableId: string }): StoredEvent | null {
 		return this.db.transaction(() => {
+			const source: MainInput = JSON.parse(JSON.stringify(input.data));
+			switch (source.origin) {
+				case "user": case "work_update": break;
+				case "agent_collaboration": case "agent_tool_permission": {
+					const activation = this.getAgentActivation(source.input_ref.activation_id);
+					const ledger = this.getLedger(input.conv);
+					const stored = source.input_id ? this.ledgerUser(source.session_path, { clientInputId: source.input_id }) : null;
+					if (!activation?.binding || !native || native.entry.sessionPath !== source.session_path ||
+						native.durableId !== activation.binding.durableSessionId || native.entry.role !== "user" ||
+						ledger?.durableId !== native.durableId || ledger.sessionPath !== source.session_path ||
+						(source.native_identity && stored?.entryId !== native.entry.entryId) ||
+						(source.native_identity ? native.entry.clientInputId !== source.input_id : native.entry.text !== source.wire_message)) {
+						throw new CollaborationStoreError("consumption_evidence_required");
+					}
+					this.recordAgentActivationEvidence({ activationId: activation.id, expectedRevision: activation.revision,
+						state: "consumed", consumedEntry: native.entry.entryId }, activation.binding);
+					if (activation.direction === "owner_answer") this.deliverCollaborationAnswer(activation.id);
+					break;
+				}
+				case "collaboration_artifact_read": {
+					const hold = this.artifactSecurityHold(source.input_ref.holdId), binding = source.authored_binding;
+					const ledger = this.getLedger(input.conv);
+					if (!native || !binding || !hold || hold.readOperationId !== source.input_ref.readOperationId ||
+						hold.continuation.id !== source.input_ref.continuationId || hold.scopeDigest !== source.input_ref.reviewedScopeDigest ||
+						hold.continuation.targetBinding?.managedBindingDigest !== collaborationDigest(binding) ||
+						hold.continuation.targetBinding.inputId !== source.input_id || native.durableId !== binding.durableSessionId ||
+						ledger?.durableId !== native.durableId || native.entry.sessionPath !== source.session_path ||
+						native.entry.clientInputId !== source.input_id || native.entry.role !== "user" ||
+						this.ledgerUser(source.session_path, { clientInputId: binding.inputId })?.entryId !== native.entry.entryId) {
+						throw new CollaborationStoreError("consumption_evidence_required");
+					}
+					break;
+				}
+				default: return collaborationNever(source);
+			}
 			this.ackMainInput(input);
 			if (this.mainInputConsumed(input)) return null;
-			return this.appendEvent(input.conv, "main.input.consumed", { input_seq: input.seq });
+			return this.appendEvent(input.conv, "main.input.consumed", { input_seq: input.seq,
+				...(native ? { input_id: source.input_id, entry_id: native.entry.entryId, session_path: native.entry.sessionPath,
+					durable_session_id: native.durableId, source: mainInputSource(source) } : {}) });
 		}).immediate();
 	}
 
@@ -1158,7 +2874,7 @@ export class Store {
 	mainUserInput(conv: string, sessionPath: string, text: string, clientInputId?: string): StoredEvent | null {
 		return this.mainTurn(conv)?.inputs.find((input) => {
 			const data = input.data as MainInput;
-			return data.origin === "user" && data.session_path === sessionPath &&
+			return data.origin !== "work_update" && data.session_path === sessionPath &&
 				typeof data.input_id === "string" && (data.native_identity
 					? data.input_id === clientInputId : data.wire_message === text);
 		}) ?? null;
@@ -1169,8 +2885,7 @@ export class Store {
 		if (!turn) return null;
 		const inputs = turn.inputs.filter((input) => this.mainInputConsumed(input));
 		const data = ([...inputs].reverse().find((input) => (input.data as MainInput).origin === "user") ?? inputs[0])?.data as MainInput | undefined;
-		if (data?.origin === "user") return { origin: "user", input_ref: data.input_ref };
-		if (data?.origin === "work_update") return { origin: "work_update", input_ref: data.input_ref };
+		if (data) return mainInputSource(data);
 		// Older persisted turn.started events predate the durable input ledger.
 		return turn.inputs.length === 0 ? turn.source : null;
 	}
@@ -1244,6 +2959,11 @@ export class Store {
 		this.db.query("UPDATE conversations SET hidden = ? WHERE id = ?").run(Number(hidden), id);
 	}
 
+	/** Binds a conversation to another agent id: an archived agent restored under a new id keeps its history. */
+	setConversationAgent(id: string, agentId: string): void {
+		this.db.query("UPDATE conversations SET agent_id = ? WHERE id = ?").run(agentId, id);
+	}
+
 	setThread(convId: string, threadId: string): void {
 		this.db.query("UPDATE conversations SET thread_id = ? WHERE id = ?").run(threadId, convId);
 	}
@@ -1549,6 +3269,35 @@ export class Store {
 		}).immediate();
 	}
 
+	/**
+	 * Bug 282: housekeeping reconcile closes an unfinished work from recorded evidence (`reconcile_*` reason). Nothing changes
+	 * unless `expectedSeq` is still the latest command and the work is unfinished, not waiting_input and has no unresolved
+	 * decision. In the same transaction every pending/sending/unknown command becomes rejected with the reason as its error,
+	 * so it is never re-sent and a later instruct is not refused. The change is an observation, not a terminal report:
+	 * it does not wake main, and a report on a newer command still sets the final state.
+	 */
+	closeByReconcile(workId: string, expectedSeq: number, status: "failed" | "cancelled", reason: string, evidence: Record<string, unknown>): WorkItem | null {
+		return this.db.transaction(() => {
+			const work = this.getWork(workId);
+			if (!work || terminalWork(work.status) || work.status === "waiting_input") return null;
+			const commands = this.listWorkCommands(workId);
+			const latest = commands.at(-1);
+			if (latest?.seq !== expectedSeq || this.unresolvedWorkDecisions(workId) > 0) return null;
+			const settled = commands.filter((c) => c.delivery === "pending" || c.delivery === "sending" || c.delivery === "unknown").map((c) => c.id);
+			for (const id of settled) this.setWorkCommandDelivery(id, "rejected", { error: reason });
+			const observation = this.recordWorkUpdate(workId, {
+				sourceKey: `reconcile:${reason}:${latest.id}`,
+				kind: "observation",
+				commandSeq: expectedSeq,
+				summary: reason,
+				details: { status, previousStatus: work.status, previousReason: work.statusReason, evidence, settledCommandIds: settled },
+			});
+			this.db.query("UPDATE work_items SET status = ?, status_reason = ?, updated_at = ? WHERE id = ?")
+				.run(status, reason, observation.receivedAt, workId);
+			return this.getWork(workId);
+		}).immediate();
+	}
+
 	/** Unresolved decisions (questions, permissions) of one work. */
 	unresolvedWorkDecisions(workId: string): number {
 		return this.db.query<{ n: number }, [string]>(`SELECT COUNT(*) AS n FROM decisions WHERE work_id = ? AND ${unresolvedDecisions}`).get(workId)?.n ?? 0;
@@ -1834,6 +3583,159 @@ export class Store {
 		}).immediate();
 	}
 
+	/** 294 permission ledger on this connection (src/agent/tool-permissions.ts). */
+	readonly toolPermissions: AgentToolPermissionStore;
+
+	/** 294 D4: the Aside tab picker's card rebind and bound-call reads on this connection (no second connection). */
+	readonly asideTargets: SqliteAsideDecisions;
+
+	/** Records the tool request and its gateway-owned inbox card (purpose agent_tool_grant) in one transaction. */
+	createAgentToolRequest(input: AgentToolRequestInput): AgentToolRequestRecord {
+		return this.db.transaction(() => {
+			const existing = this.toolPermissions.existingRequest(input);
+			if (existing) return existing;
+			const proposal = this.toolPermissions.proposal(input);
+			const decision = this.createDecision({
+				ownerConv: input.convId, scope: `conv:${input.convId}`, sourceSessionPath: null,
+				sourceRequestId: `agent-tool:${proposal.requestId}`, method: "confirm", permission: false, required: true,
+				payload: proposal.payload, bindingState: "closed",
+			});
+			return this.toolPermissions.insertRequest(input, proposal, decision.id);
+		}).immediate();
+	}
+
+	/**
+	 * Q-07: the 294 grant card of a call made inside a collaboration execution. The signed activation must be the
+	 * conversation's current binding and the named request the one it executes. Its original input is that execution's
+	 * input (a target the owner never messaged has no owner message to name); the card is linked to that execution in
+	 * the same transaction, so the request and every request below it wait for the owner while independent ones run.
+	 */
+	createCollaborationToolRequest(input: Omit<AgentToolRequestInput, "originInputSeq">): AgentToolRequestRecord {
+		return this.db.transaction(() => {
+			const binding = this.agentBinding(input.convId);
+			const activation = binding?.activationId ? this.getAgentActivation(binding.activationId) : null;
+			if (!activation || activation.id !== input.activationId || this.agentExecutionRequest(activation)?.id !== input.collaborationRequestId) {
+				throw new AgentToolPermissionError("tool_request_invalid");
+			}
+			const request = this.createAgentToolRequest({ ...input, originInputSeq: activation.inputSeq });
+			if (!this.db.query("SELECT 1 FROM agent_question_links WHERE decision_id=?").get(request.decisionId)) this.linkAgentDecision(request.decisionId, activation.id);
+			return request;
+		}).immediate();
+	}
+
+	/** Q-07: the owner's stored outcome of a collaboration 294 card (null for any other decision or before the answer). */
+	collaborationPermissionOutcome(decisionId: string): CollaborationPermissionOutcome | null {
+		return permissionOutcome(this.db, decisionId);
+	}
+
+	/** Q-07: the answered collaboration 294 cards an execution asked, oldest first. */
+	collaborationPermissionDecisions(activationId: string): string[] {
+		return this.db.query<{ decision_id: string }, [string]>(`SELECT l.decision_id FROM agent_question_links l JOIN agent_tool_outcomes o ON o.decision_id=l.decision_id
+			WHERE l.activation_id=? AND json_extract(o.data,'$.collaborationRequestId') IS NOT NULL ORDER BY l.rowid`).all(activationId).map(row => row.decision_id);
+	}
+
+	/**
+	 * 294 C8: the one-shot confirmation card (purpose agent_tool_action) of a click/fill on a granted target, with the request
+	 * row, in one transaction. The same logical call returns the same card. Without an active grant naming the operation
+	 * nothing is recorded (grant_conflict): an action card never stands in for the tool grant itself.
+	 */
+	createAgentToolAction(input: AgentToolRequestInput): AgentToolRequestRecord {
+		return this.db.transaction(() => {
+			const existing = this.toolPermissions.existingRequest(input);
+			if (existing) return existing;
+			if (!this.toolPermissions.actionGrant(input.agentId, input.toolKey, input.operation)) throw new AgentToolPermissionError("grant_conflict");
+			const proposal = this.toolPermissions.proposal(input, "agent_tool_action");
+			const decision = this.createDecision({
+				ownerConv: input.convId, scope: `conv:${input.convId}`, sourceSessionPath: null,
+				sourceRequestId: `agent-tool-action:${proposal.requestId}`, method: "confirm", permission: false, required: true,
+				payload: proposal.payload, bindingState: "closed",
+			});
+			return this.toolPermissions.insertRequest(input, proposal, decision.id, "agent_tool_action");
+		}).immediate();
+	}
+
+	/**
+	 * 294 C5: an execution whose outcome cannot be proven (started without a stored result, a lost execute answer, an engine
+	 * that reported unknown) is marked outcome_unknown and shown once on the existing needs_review surface with the original
+	 * operation and its state. Nothing is re-run; the owner decides what to do next. The same execution keeps one card.
+	 */
+	reviewAgentToolOutcome(invocationId: string, reason: string): Decision | null {
+		return this.db.transaction(() => {
+			const target = this.toolPermissions.deliveryTarget(invocationId);
+			if (!target) return null;
+			this.toolPermissions.markOutcomeUnknown(invocationId);
+			const source = { scope: `conv:${target.convId}`, sourceSessionPath: null, sourceRequestId: `agent-tool-outcome:${invocationId}` };
+			const existing = this.getDecisionBySource(source);
+			if (existing) return existing;
+			const request = this.db.query<{ tool_key_json: string; operation: string }, [string]>(
+				"SELECT r.tool_key_json, r.operation FROM agent_tool_invocations i JOIN agent_tool_requests r ON r.id = i.request_id WHERE i.id = ?").get(invocationId)!;
+			const toolKey = JSON.parse(request.tool_key_json) as { originalName?: unknown };
+			const tool = typeof toolKey.originalName === "string" ? toolKey.originalName : "tool";
+			return this.createDecision({
+				ownerConv: target.convId, ...source, method: "confirm", permission: false, required: true, bindingState: "unknown",
+				payload: {
+					kind: "agent_tool_outcome_unknown", title: `Tool result unknown: ${tool} ${request.operation}`,
+					message: "The tool may have run, but its result was not recorded. It will not run again by itself. Check the target before asking again.",
+					agentId: target.agentId, invocationId, operationId: target.operationId, toolKey, operation: request.operation,
+					state: "outcome_unknown", reason,
+				},
+			});
+		}).immediate();
+	}
+
+	/**
+	 * 294 item 11: the migration card of a legacy agent (purpose agent_tool_migration) in one transaction. The open card is
+	 * returned again (one card per agent and lifecycle); a managed agent gets none. Creating it grants nothing.
+	 */
+	createAgentToolMigration(agentId: string, convId: string, items: readonly LegacyScopeItem[]): AgentToolMigrationCard | null {
+		return this.db.transaction(() => {
+			const current = this.toolPermissions.currentMigration(agentId);
+			if (current && current.state !== "applied") return current;
+			if (this.toolPermissions.mode(agentId) === "managed") return null;
+			const proposal = this.toolPermissions.migrationProposal(agentId, items);
+			const decision = this.createDecision({
+				ownerConv: convId, scope: `conv:${convId}`, sourceSessionPath: null,
+				sourceRequestId: `agent-tool-migration:${agentId}:${crypto.randomUUID()}`, method: "confirm", permission: false, required: true,
+				payload: proposal.payload, bindingState: "closed",
+			});
+			return this.toolPermissions.insertMigration(agentId, convId, items, proposal, decision.id);
+		}).immediate();
+	}
+
+	/** 294 grant scope edit: a narrowing applies at once; a widening opens its agent_tool_grant inbox card. One transaction. */
+	editAgentToolGrant(agentId: string, grantId: string, input: GrantEditInput, principal: OwnerPrincipal): GrantEditResult {
+		return this.db.transaction(() => this.toolPermissions.editGrant(agentId, grantId, input, principal, (ownerConv, sourceRequestId, payload) => this.createDecision({
+			ownerConv, scope: `conv:${ownerConv}`, sourceSessionPath: null, sourceRequestId, method: "confirm", permission: false, required: true,
+			payload, bindingState: "closed",
+		}).id)).immediate();
+	}
+
+	/**
+	 * The owner answer to a tool purpose decision: answer, grant, policy revision and execution intent commit together.
+	 * The same submission with the same body returns the stored result; another body is submission_conflict.
+	 */
+	answerAgentToolDecision(id: string, request: AgentToolGrantAnswer, principal: OwnerPrincipal): { decision: Decision; fresh: boolean; result: AnswerResult | null } {
+		return this.db.transaction(() => {
+			const decision = this.getDecision(id);
+			if (!decision) throw new DecisionStoreError("decision_not_found");
+			if (!this.toolPermissions.isToolPurpose(id)) throw new DecisionStoreError("invalid_decision_answer", decision);
+			const previous = this.decisionOperation(request.submissionId);
+			if (previous) {
+				if (previous.data.decisionId !== id || !isDeepStrictEqual(previous.data.request, request)) throw new DecisionStoreError("submission_conflict", decision);
+				return { decision, fresh: false, result: null };
+			}
+			if (decision.revision !== request.expectedRevision || decision.status !== "pending" || decision.submissionId !== null) {
+				throw new DecisionStoreError("decision_conflict", decision);
+			}
+			const result = this.toolPermissions.answerToolDecision(id, decision.revision + 1, request, principal);
+			this.db.query(`UPDATE decisions SET status = 'closed', reason = ?, revision = revision + 1, submission_id = ?, submission_revision = ?,
+				submission_mode = 'answer', answer = ?, updated_at = ? WHERE id = ?`)
+				.run(`tool_grant_${result.outcome}`, request.submissionId, request.expectedRevision, JSON.stringify(request.response), new Date().toISOString(), id);
+			this.appendEvent(decision.ownerConv, "decision.operation", { decisionId: id, request, targetScope: decision.scope, commandId: null, mainInputSeq: null });
+			return { decision: this.getDecision(id)!, fresh: true, result };
+		}).immediate();
+	}
+
 	getDecision(id: string): Decision | null {
 		const row = this.db.query<DecisionRow, [string]>(`SELECT ${decisionColumns} FROM decisions WHERE id = ?`).get(id);
 		return row ? toDecision(row) : null;
@@ -1882,7 +3784,7 @@ export class Store {
 			if (!work) return "owner_unknown";
 			if (terminalWork(work.status)) return `work_${work.status}`;
 			if (decision.sourceSessionPath !== work.sessionPath || decision.sourceCommandSeq === null) return "owner_unknown";
-			if (blockedQuestion(decision)) return null;
+			if (blockedQuestion(decision) || releasedWorkQuestion(decision)) return null;
 			const newer = this.listWorkCommands(work.id).some((command) =>
 				command.kind === "instruct" && command.seq > decision.sourceCommandSeq! &&
 				(!object(command.payload) || !Object.hasOwn(command.payload, "decision_operation")));
@@ -1909,6 +3811,7 @@ export class Store {
 		const result = this.db.transaction((): DecisionClaim | DecisionStoreError => {
 			let decision = this.getDecision(id);
 			if (!decision) throw new DecisionStoreError("decision_not_found");
+			if (collaborationStageDecision(decision)) throw new CollaborationStoreError("collaboration_stage_endpoint_required", 403);
 			if (securityDecision(decision)) throw new DecisionStoreError("security_endpoint_required");
 			if (!Number.isSafeInteger(request.expectedRevision) || request.expectedRevision < 1 ||
 				!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(request.submissionId)) {
@@ -1932,6 +3835,7 @@ export class Store {
 				decision = this.submitDecision(id, { ...request, liveBinding });
 				return { decision, operation: null, fresh: false };
 			}
+			if (this.toolPermissions.isToolPurpose(id)) throw new DecisionStoreError("tool_grant_response_required", decision);
 			if (decision.revision !== request.expectedRevision || decision.status === "closed" || decision.status === "delivered") {
 				throw new DecisionStoreError("decision_conflict", decision);
 			}
@@ -1965,6 +3869,9 @@ export class Store {
 			let mainInputSeq: number | null = null;
 			const work = decision.workId === null ? null : this.getWork(decision.workId);
 			const knownWork = work !== null && decision.sourceSessionPath === work.sessionPath && decision.sourceCommandSeq !== null;
+			const linkedId = decision.permission ? null : this.db.query<{ request_id: string | null }, [string]>(
+				"SELECT request_id FROM agent_question_links WHERE decision_id=? AND transfer_id IS NULL AND read_operation_id IS NULL").get(decision.id)?.request_id ?? null;
+			const linked = linkedId ? this.getAgentRequest(linkedId) : null;
 			const targetScope = knownWork ? decision.scope : `conv:${decision.ownerConv}`;
 			if (control || decision.answerRoute === "follow_up_command") {
 				const operation = request.mode === "resume" ? "answer" : request.mode;
@@ -1984,6 +3891,15 @@ export class Store {
 						kind: "instruct", requestKey: `decision:${request.submissionId}`,
 						sourceSessionPath: work.sessionPath, payload,
 					}).id;
+				} else if (!control && linked) {
+					// The owner's answer resumes the request that asked, through its own continuation, never a plain owner turn.
+					// A request that already ended keeps the answer in history only and wakes no model.
+					const message = this.appendEvent(decision.ownerConv, "message.collaboration.answer", {
+						text: `ZGW_DECISION_COMMAND ${JSON.stringify(payload)}`, src: { channel: "web", adapter: "decision-inbox" }, trust: "owner",
+						decision_id: decision.id, decision_operation: operation, requestId: linked.id,
+					});
+					const open = !agentRequestTerminal(linked.state) && linked.state !== "cancel_requested";
+					commandId = open ? `collaboration:${this.newAgentActivation(linked, "owner_answer", message.seq).id}` : "collaboration:ended";
 				} else {
 					const input = this.acceptMainUser(decision.ownerConv, {
 						text: `ZGW_DECISION_COMMAND ${JSON.stringify(payload)}`,
@@ -2000,6 +3916,7 @@ export class Store {
 					decision = this.getDecision(id)!;
 				}
 			}
+			if (commandId === "collaboration:ended") decision = this.transitionDecision(id, decision.revision, { status: "closed", reason: "collaboration_request_ended" });
 			const data: DecisionOperation = { decisionId: id, request, targetScope, commandId, mainInputSeq };
 			const operation = this.appendEvent(decision.ownerConv, "decision.operation", data) as DecisionOperationEvent;
 			return { decision, operation, fresh: true };
@@ -2378,6 +4295,7 @@ export class Store {
 	private decisionAtRevision(id: string, revision: number): Decision {
 		const decision = this.getDecision(id);
 		if (!decision) throw new DecisionStoreError("decision_not_found");
+		if (collaborationStageDecision(decision)) throw new CollaborationStoreError("collaboration_stage_endpoint_required", 403);
 		if (decision.revision !== revision) throw new DecisionStoreError("decision_conflict", decision);
 		return decision;
 	}
@@ -2487,6 +4405,7 @@ export class Store {
 		return this.db.transaction(() => {
 			const d = this.getDecision(id);
 			if (!d) throw new DecisionStoreError("decision_not_found");
+			if (collaborationStageDecision(d) || securityDecision(d)) throw new CollaborationStoreError("purpose_endpoint_required", 403);
 			const prior = this.db.query<{ id: string }, [string]>("SELECT id FROM decisions WHERE submission_id = ?").get(request.submissionId);
 			if (prior) {
 				if (prior.id !== id || d.submissionRevision !== request.expectedRevision || d.submissionMode !== request.mode || !isDeepStrictEqual(d.answer, request.response)) {
@@ -2560,6 +4479,7 @@ export class Store {
 		return this.db.transaction((): DecisionDismissal => {
 			const d = this.getDecision(id);
 			if (!d) throw new DecisionStoreError("decision_not_found");
+			if (collaborationStageDecision(d)) throw new CollaborationStoreError("collaboration_stage_endpoint_required", 403);
 			if (securityDecision(d)) throw new DecisionStoreError("security_endpoint_required");
 			if (d.revision !== expectedRevision || d.status === "delivered" || d.status === "closed" || d.status === "submitted") {
 				throw new DecisionStoreError("decision_conflict", d);
@@ -2721,6 +4641,9 @@ export class Store {
 	}
 
 	close(): void {
+		// A late reply wake or flush after close must not read this database: nothing is left to publish and nobody is called.
+		this.collaborationOutbox.clear();
+		this.onCollaborationEvents = null;
 		this.db.close();
 	}
 }