[trissim]

Summary

2 queue commits, 7 files, +65/-28. Head 5714102f20ac918af1af50dd0fe46088d95edc9f, based on freshly fetched main 7b36ed6be51993471150eb475fc378c640d96fdb. Remote equals HEAD; tracked source is clean.

This PR is now only the source-bound queue repair. The previous 26-commit/140-file overhaul is preserved at archive/p1090-before-queue-split-4bb783cc (4bb783ccc04f59614c7816277531c68baa3f8c2b). ACP runner, retirement, session binding, configuration, plan, shell, submission-lifetime and other unrelated work are not in this diff. ACP work follows separately after this queue fix lands.

What changes

Original recipients, not replacement names

Before, notification queue evidence kept recipient name strings, then queue actions resolved whatever incarnation currently held that name.

After, CheckedNotifications.queued_recipients and QueueEvidence.queued_recipients retain their existing FrozenRecipient values. The BUS action resolves registry.snapshot().born(recipient.lookup) inside the existing worker-thread call and acts on that original incarnation. A replacement with the same name is not substituted. Presentation still draws canonical_thread; displayed spelling is not authority.

Original source, not the latest root after an await

Before, the queue's service lambda looked up the view's current observation when the action later ran.

After, the evidence constructor passes the existing original transcript and observation bound service methods into QueueSource.capture_queue_service; no concrete view import is needed. Observing.queue_service checks that observation's currentness before returning its original service; the absent owner raises its explicit refusal. MailboxSessionSources also captures the original transcript scope's service method, which checks its original root. The service is checked before each recipient action across awaits. Native queue scope checks and MailboxSessionSources(BusQueueSource, OperationalSessionSources) precedence are unchanged.

No broad collector

The BUS loop's except (..., OSError, ...) and accumulated string-failure list are deleted. A failed action stops the loop and propagates immediately, as directed; later recipients are no longer attempted after a failure. The modal displays the specific source/recipient refusals (RouteChangedError, UnregisteredThreadError, RelationViolationError) beside its existing queue/request refusals and stays open. Unexpected IO errors propagate rather than being hidden in a combined string. No new catch-all, fallback or compatibility alias replaces the collector.

Before / after structure

• NotificationStatus -> CheckedNotifications still owns notification evidence; its queued-recipient projection now returns original nominal identities instead of names.
• Observation -> Observing owns queue-service availability/currentness.
• TranscriptScope -> KnownTranscript owns transcript-root validity.
• QueueSource -> BusQueueSource owns the worker-thread action on original recipients; mailbox sources compose the transcript fence with the inherited observation fence.
• ConversationSubmissions supplies the captured service when constructing evidence; QueueInspection keeps its original source, evidence and scope.

Verification and limits

The seven changed modules compile; the complete bounded diff was inspected. No pytest, local NRA gate, new mock or repeated import run was launched. Previous ACP import results do not qualify this queue head. The first bounded head198 passed its production-debt comparison but failed on one new TYPE_CHECKING view import. The second commit removes that import by accepting the existing typed source-owned bound service methods; native policy returns the original observation method and mailbox policy binds the original transcript method around it. Native evidence also reads that ordinary transcript method now but does not invoke it. The exact571 head's hosted result and source review remain to be read; no green, merge, install or working-app claim is made here.

Actual acceptance still needs the original-recipient replacement refusal, captured observation/transcript retirement refusal and visible modal error behavior, then merge/install verification. Existing independent reader/native holds and original uncertain inputs are untouched.

Assumed: existing native queue/request APIs, ordinary frozen-recipient equality/hash and bound-method capture. Explicitly changed: fail-fast instead of accumulating per-recipient failures. Additional source-fence methods are ordinary synchronous checks; there is no new suspension before each worker-thread action.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[github-actions]

debt-src at 5714102 passes.