Bind uncertain-email setup to genuine normal-task native authority

tests/runner-e2e/chat-catalog-domains/runtime-email-private-canary-receipt.json

@@ -18,8 +18,8 @@
   "privateValueCount": 4,
   "findings": [],
   "sourceSha256": {
-    "runtime-email-private.ts": "38381b54ef3a9903ba26d7c85fa27e327de39ac4055488c02e1106944330801b",
-    "runtime-email-private-worker.ts": "d77652ae26b4a80c4b45fe5c1cf3848b403d9c377c87c6d4ca4d33bcd10e6dc1",
+    "runtime-email-private.ts": "5c3b4378b35c011e4dbe207815c4fa199f30f8c67e5fc687fb9ac80ffc766caa",
+    "runtime-email-private-worker.ts": "84bfcff12f9c29c92e8aa39d06d3e8f0d42fbf3121824f09984d74eff8ad747f",
     "runtime-email-private-privacy.spec.ts": "f7a10150c179ee17862fa819013809df65ce0c4cbe505421203015c52b61dd62"
   },
   "configSha256": "dcfb8e7013a1c2ff81277bb44bc5214357dc6fb5eacd2073cfaafca1790b31b1"

tests/runner-e2e/chat-catalog-domains/runtime-email-private-worker.ts

@@ -8,7 +8,7 @@ async function main(): Promise<EmailPrivateReceipt> {
   let attached = false; try { test.info(); attached = true; } catch { /* standalone only */ } if (attached) throw new Error("Private email credential operations must not execute in Test");
   const filename = process.argv[2]!, info = await lstat(filename); if (!info.isFile() || info.isSymbolicLink() || info.uid !== process.getuid?.() || info.mode & 0o077 || info.size > 65536) throw new Error("Invalid private email request file");
   const input = JSON.parse(await readFile(filename, "utf8")) as EmailPrivateInput, base = new URL(input.baseURL);
-  if (!["recovery.unknown-email-outcome", "chat-channels.outbound-email", "chat-channels.reply-to-email"].includes(input.scenarioId) || !["setup", "inspect", "resolve"].includes(input.operation) || base.protocol !== "http:" || base.hostname !== "127.0.0.1" || base.origin !== input.baseURL || !input.dedicatedDisposableInbox || input.inboxId !== input.recipient || ![input.companyId, input.agentId].every(id => /^[a-f0-9-]{36}$/i.test(id))) throw new Error("Email operation requires the exact owned selected self-addressed fixture");
+  if (!["recovery.unknown-email-outcome", "chat-channels.outbound-email", "chat-channels.reply-to-email"].includes(input.scenarioId) || !["setup", "inspect", "inspect-publication", "resolve"].includes(input.operation) || base.protocol !== "http:" || base.hostname !== "127.0.0.1" || base.origin !== input.baseURL || !input.dedicatedDisposableInbox || input.inboxId !== input.recipient || ![input.companyId, input.agentId].every(id => /^[a-f0-9-]{36}$/i.test(id))) throw new Error("Email operation requires the exact owned selected self-addressed fixture");
   let directProviderProbeCount = 0, publicSetupOperationCount = 0;
   const direct: typeof fetch = async (...args) => { directProviderProbeCount++; return fetch(...args); }, provider = agentmailApi(input.credential, direct);
   async function local<T>(pathname: string, body?: unknown) { const response = await fetch(base.origin + pathname, { method: body === undefined ? "GET" : "POST", body: body === undefined ? undefined : JSON.stringify(body), headers: { Cookie: input.cookies.map(row => `${row.name}=${row.value}`).join("; "), Origin: base.origin, "Content-Type": "application/json" }, signal: AbortSignal.timeout(120000), redirect: "error" }); if (!response.ok) { await response.body?.cancel(); throw new Error("Actual private email public operation rejected"); } return response.json() as Promise<T>; }
@@ -25,7 +25,7 @@ async function main(): Promise<EmailPrivateReceipt> {
     if (!saved || saved.companyId !== input.companyId || saved.address !== input.inboxId || saved.assignedAgentId !== input.agentId || saved.status !== "active") throw new Error("Actual email endpoint is not the authorized active self-addressed fixture");
     return { ...common, connectionId: connection.id, endpointId: saved.id, actualActiveEndpoint: true, publicSetupOperationCount, directProviderProbeCount };
   }
-  if (!input.endpointId || !input.publicationId || !input.subject || !input.textSha256 || !input.after || !input.accepted || input.accepted.publicationId !== input.publicationId) throw new Error("Email inspection requires the exact actual original accepted send binding");
+  if (!input.endpointId || !input.publicationId || !input.subject || !input.textSha256 || !input.after || !(input.accepted?.publicationId === input.publicationId || input.operation === "inspect-publication" && input.expectedPublicReceipt?.publicationId === input.publicationId)) throw new Error("Email inspection requires the exact actual original accepted send binding");
   const endpoint = (await local<EmailEndpointSummary[]>(`/api/companies/${input.companyId}/email/inboxes`)).find(row => row.id === input.endpointId);
   if (!endpoint || endpoint.address !== input.inboxId || endpoint.assignedAgentId !== input.agentId || endpoint.companyId !== input.companyId) throw new Error("Provider reconciliation is not bound to the actual original endpoint");
   const matchedSent: NonNullable<EmailPrivateReceipt["matchedSent"]> = []; const seen = new Set<string>(); let page: string | undefined, pages = 0;
@@ -40,9 +40,9 @@ async function main(): Promise<EmailPrivateReceipt> {
     }
     page = listed.next_page_token;
   } while (page);
-  const original = matchedSent.filter(row => row.messageId === input.accepted!.providerMessageId && row.threadId === input.accepted!.providerThreadId && row.publicationId === input.publicationId), originalMessageMatched = original.length === 1;
+  const original = matchedSent.filter(row => row.messageId === (input.accepted?.providerMessageId ?? input.expectedPublicReceipt?.providerMessageId) && (!input.accepted || row.threadId === input.accepted.providerThreadId) && row.publicationId === input.publicationId), originalMessageMatched = original.length === 1;
   if (!originalMessageMatched) throw new Error("The actual provider receipt does not independently match the original persisted send");
-  if (input.operation === "inspect") return { ...common, publicSetupOperationCount, directProviderProbeCount, matchedSent, originalMessageMatched };
+  if (input.operation === "inspect" || input.operation === "inspect-publication") return { ...common, publicSetupOperationCount, directProviderProbeCount, matchedSent, originalMessageMatched };
   let current = await local<EmailPublicationSummary>(`/api/companies/${input.companyId}/email/deliveries/${input.publicationId}`), resolution: EmailPrivateReceipt["resolution"] = "provider-reconciled";
   if (current.outcome === "uncertain") { current = await local<EmailPublicationSummary>(`/api/companies/${input.companyId}/email/deliveries/${input.publicationId}/resolve`, { outcome: "sent", providerMessageId: original[0]!.messageId }); publicSetupOperationCount++; resolution = "human-reconciled"; }
   if (!["sent", "delivered"].includes(current.outcome) || current.providerMessageId !== original[0]!.messageId) throw new Error("The actual public send has not reconciled to the verified original provider message");

tests/runner-e2e/chat-catalog-domains/runtime-email-private.test.ts

@@ -6,3 +6,5 @@ const valid = () => ({ ...expected, processIsolation: true, testRunnerAttached:
 it("accepts the finite actual setup receipt without credential/account contents", () => expect(validateEmailPrivateReceipt(valid(), expected).actualActiveEndpoint).toBe(true));
 it("rejects another company, Test recorder, missing dedicated proof and secret fields", () => { for (const change of [{ companyId: randomUUID() }, { apiStepRecorder: true }, { actualSingleDedicatedInbox: false }, { token: "synthetic-private-value" }, { publicSetupOperationCount: -1 }]) expect(() => validateEmailPrivateReceipt({ ...valid(), ...change }, expected)).toThrow("closed receipt boundary"); });
 it("retains only independently verified matched sent-message identities and rejects fabricated free-form payloads", () => { const receipt = { ...valid(), operation: "inspect" as const, matchedSent: [{ messageId: "actual-message", threadId: "actual-thread", publicationId: randomUUID(), contentMatches: true, accepted: true, recipientCopyObserved: false }], originalMessageMatched: true }; expect(validateEmailPrivateReceipt(receipt, { ...expected, operation: "inspect" }).matchedSent).toHaveLength(1); expect(() => validateEmailPrivateReceipt({ ...receipt, matchedSent: [{ ...receipt.matchedSent[0], text: "unapproved raw contents" }] }, { ...expected, operation: "inspect" })).toThrow(); });
+
+it("accepts only the same closed independent receipt for an actually saved normal publication", () => { const r = { ...valid(), operation: "inspect-publication" as const, matchedSent: [{ messageId: "provider-message", threadId: "provider-thread", publicationId: randomUUID(), contentMatches: true, accepted: true, recipientCopyObserved: false }], originalMessageMatched: true }; expect(validateEmailPrivateReceipt(r, { ...expected, operation: "inspect-publication" }).originalMessageMatched).toBe(true); expect(() => validateEmailPrivateReceipt({ ...r, providerBody: "forbidden private response" }, { ...expected, operation: "inspect-publication" })).toThrow(); });

tests/runner-e2e/chat-catalog-domains/runtime-email-private.ts

@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import type { Cookie } from "@playwright/test";
 import type { AcceptedEmailFault } from "./runtime-email-fault.js";
-export interface EmailPrivateInput { operation: "setup" | "inspect" | "resolve"; scenarioId: "recovery.unknown-email-outcome" | "chat-channels.outbound-email" | "chat-channels.reply-to-email"; companyId: string; agentId: string; baseURL: string; inboxId: string; recipient: string; dedicatedDisposableInbox: true; credential: string; cookies: Cookie[]; connectionId?: string; endpointId?: string; subject?: string; textSha256?: string; after?: string; publicationId?: string; accepted?: AcceptedEmailFault }
+export interface EmailPrivateInput { operation: "setup" | "inspect" | "inspect-publication" | "resolve"; scenarioId: "recovery.unknown-email-outcome" | "chat-channels.outbound-email" | "chat-channels.reply-to-email"; companyId: string; agentId: string; baseURL: string; inboxId: string; recipient: string; dedicatedDisposableInbox: true; credential: string; cookies: Cookie[]; connectionId?: string; endpointId?: string; subject?: string; textSha256?: string; after?: string; publicationId?: string; accepted?: AcceptedEmailFault; expectedPublicReceipt?: { publicationId: string; providerMessageId: string } }
 export interface EmailPrivateReceipt { processIsolation: true; testRunnerAttached: false; apiStepRecorder: false; operation: EmailPrivateInput["operation"]; companyId: string; agentId: string; actualSingleDedicatedInbox: true; connectionId?: string; endpointId?: string; actualActiveEndpoint?: true; personId: string; publicSetupOperationCount: number; directProviderProbeCount: number; matchedSent?: Array<{ messageId: string; threadId: string; publicationId: string; contentMatches: true; accepted: true; recipientCopyObserved: boolean }>; originalMessageMatched?: boolean; resolution?: "human-reconciled" | "provider-reconciled"; outcome?: "sent" | "delivered" }
 export function validateEmailPrivateReceipt(value: unknown, expected: Pick<EmailPrivateInput, "operation" | "companyId" | "agentId">): EmailPrivateReceipt {
   const r = value as EmailPrivateReceipt, allowed = ["processIsolation", "testRunnerAttached", "apiStepRecorder", "operation", "companyId", "agentId", "actualSingleDedicatedInbox", "connectionId", "endpointId", "actualActiveEndpoint", "personId", "publicSetupOperationCount", "directProviderProbeCount", "matchedSent", "originalMessageMatched", "resolution", "outcome"];

tests/runner-e2e/chat-catalog-domains/runtime-email.test.ts

@@ -1,6 +1,6 @@
 import { expect, it } from "vitest";
-import { actualUncertainEmailReads, gradeUnknownEmail, uncertainEmailReply } from "./runtime-email.js";
-function valid() { return { companyId: "company", leadId: "ceo", scenarioId: "recovery.unknown-email-outcome", origin: "http://127.0.0.1:42123", reply: "", agents: [], tasks: [{ id: "email-task" }], activity: [], links: [], humanQueries: [], runs: [1, 2, 3].map(id => ({ id: String(id), agentId: "ceo", status: "succeeded" })), state: { actualOriginalUncertain: true, setupSendBound: true, faultOriginalBinding: true, outageActiveDuringCanonical: true, originalUncertaintyRecorded: true, canonicalReadBound: true, canonicalReply: "The original provider receipt is unavailable and the send remains uncertain. I will check the existing publication rather than resend a possibly delivered email.", noNewAgentPublication: true, directMatchedSentCount: 1, originalProviderReceiptMatched: true, outageReleased: true, reconciliationBound: true, resolutionActorBound: true, finalOutcome: "sent", confirmationBound: true, confirmationReply: "The original email was accepted and its saved publication is reconciled with the provider message receipt. There is no proof of recipient delivery, and no second send was made.", finalDirectMatchedSentCount: 1, sameOriginalRequestRetained: true, sameOriginalConversationRetained: true } }; }
+import { actualOriginalEmailSend, actualUncertainEmailReads, gradeUnknownEmail, uncertainEmailReply } from "./runtime-email.js";
+function valid() { return { companyId: "company", leadId: "ceo", scenarioId: "recovery.unknown-email-outcome", origin: "http://127.0.0.1:42123", reply: "", agents: [], tasks: [{ id: "email-task" }, { id: "mail-work" }], activity: [], links: [], humanQueries: [], runs: [1, 2, 3, 4].map(id => ({ id: String(id), agentId: "ceo", status: "succeeded" })), state: { actualNormalTaskSendBound: true, actualOriginalUncertain: true, setupSendBound: true, faultOriginalBinding: true, outageActiveDuringCanonical: true, originalUncertaintyRecorded: true, canonicalReadBound: true, canonicalReply: "The original provider receipt is unavailable and the send remains uncertain. I will check the existing publication rather than resend a possibly delivered email.", noNewAgentPublication: true, directMatchedSentCount: 1, originalProviderReceiptMatched: true, outageReleased: true, reconciliationBound: true, resolutionActorBound: true, finalOutcome: "sent", confirmationBound: true, confirmationReply: "The original email was accepted and its saved publication is reconciled with the provider message receipt. There is no proof of recipient delivery, and no second send was made.", finalDirectMatchedSentCount: 1, sameOriginalRequestRetained: true, sameOriginalConversationRetained: true } }; }
 it("accepts real original uncertainty, independent one-send proof and authorized same-publication reconciliation", () => expect(gradeUnknownEmail(valid()).passed).toBe(true));
 it("accepts natural uncertainty and accepted-send paraphrases", () => { const o = valid(); o.state.canonicalReply = "It may already have reached the provider. I cannot confirm the outcome, so I checked the original send record and will avoid a duplicate while we reconcile the receipt."; o.state.confirmationReply = "The provider's original message is now verified as sent; the same conversation remains linked. Recipient delivery is still unconfirmed."; expect(gradeUnknownEmail(o).passed).toBe(true); });
 it("rejects another actual email, a new agent publication, or loss of original uncertainty", () => { const o = valid(); o.state.directMatchedSentCount = 2; expect(gradeUnknownEmail(o).passed).toBe(false); const p = valid(); p.state.noNewAgentPublication = false; expect(gradeUnknownEmail(p).passed).toBe(false); const q = valid(); q.state.originalUncertaintyRecorded = false; expect(gradeUnknownEmail(q).passed).toBe(false); });
@@ -12,3 +12,10 @@ it("accepts actual completed connector and equivalent scoped API receipt reads",
 it("rejects wrong receipt identity, uncompleted or wrong-tool results, and a write before inspection", () => { expect(actualUncertainEmailReads(actualRead(), { ...expected, publicationId: "other" })).toHaveLength(0); expect(actualUncertainEmailReads(actualRead().slice(0, 2), expected)).toHaveLength(0); const wrong = actualRead(); wrong[2]!.payload.prpEvent.payload = { executionId: "read", name: "different_tool", status: "completed" }; expect(actualUncertainEmailReads(wrong, expected)).toHaveLength(0); const early = { seq: 0, eventType: "item.started", payload: { prpEvent: { payload: { item: { id: "send", type: "tool_use", name: "agentmail_send", input: {} } } } } }; expect(actualUncertainEmailReads([early, ...actualRead()], expected)).toHaveLength(0); });
 
 it("accepts uncertainty about delivery while rejecting appended affirmative delivery", () => { expect(uncertainEmailReply("I cannot confirm whether it was delivered; I checked the original provider receipt and will avoid another send.")).toBe(true); expect(uncertainEmailReply("The provider outcome is uncertain. It was delivered.")).toBe(false); });
+
+it("requires genuine normal-task send attribution rather than chat execution or fixture-only state", () => {
+ const target = { companyId: "company", taskId: "mail-work", endpointId: "endpoint", publicationId: "publication" };
+ const events = [{ eventType: "item.started", payload: { prpEvent: { payload: { item: { id: "send", type: "tool_use", name: "agentmail_send", input: { request: { parentIssueId: "mail-work", endpointId: "endpoint", idempotencyKey: "publication" } } } } } } }, { eventType: "item.completed", payload: { prpEvent: { payload: { item: { id: "send", type: "tool_result", result: { id: "publication", issueId: "email-child" } } } } } }, { eventType: "tool.execution.completed", payload: { prpEvent: { payload: { executionId: "send", name: "agentmail_send", status: "completed" } } } }];
+ expect(actualOriginalEmailSend(events, target)).toBe(true); expect(actualOriginalEmailSend(events, { ...target, taskId: "agent-chat" })).toBe(false); expect(actualOriginalEmailSend(events.slice(0, 2), target)).toBe(false);
+ const o = valid(); o.state.actualNormalTaskSendBound = false; expect(gradeUnknownEmail(o).passed).toBe(false);
+});

tests/runner-e2e/chat-catalog-domains/runtime-email.ts

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { expect } from "@playwright/test";
+import type { Issue } from "../../../packages/shared/src/types/issue.js";
 import type { EmailEndpointSummary, EmailPublicationSummary, EmailThreadSummary } from "../../../packages/shared/src/types/email.js";
 import type { ChatCatalogContext } from "../chat-catalog-contract.js";
 import { collectRunEvents } from "../run-observations.js";
@@ -26,6 +27,10 @@ export async function prepareOwnedEmailConnection(ctx: ChatCatalogContext) {
   if (!endpoint || endpoint.companyId !== input.companyId || endpoint.assignedAgentId !== input.agentId || endpoint.address !== input.inboxId || endpoint.status !== "active" || receipt.personId !== session.user.id) throw new Error("The exact real QA inbox endpoint/fixture person failed independent public ownership checks");
   return { endpoint, emailConnectionId: receipt.connectionId, personId: receipt.personId, externalIdentity: { email: input.recipient }, providerProbes: [{ phase: "owned-email-setup", operation: "actual-private-account-and-inbox-setup", publicSetupOperationCount: receipt.publicSetupOperationCount, directProviderProbeCount: receipt.directProviderProbeCount, status: "active", usage: "unavailable", cost: "unavailable" }] };
 }
+export async function inspectOwnedEmailPublication(ctx: ChatCatalogContext, publication: EmailPublicationSummary, after: string) {
+  const input = privateFixtures.get(ctx); if (!input || !ctx.input.privateSecrets || !publication.request || !publication.providerMessageId) throw new Error("Actual public email acceptance and private owned inbox binding are required");
+  return privateEmailOperation({ ...input, operation: "inspect-publication", subject: publication.request.subject!, textSha256: hash(publication.request.text.replace(/\r\n/g, "\n").trim()), after, publicationId: publication.id, expectedPublicReceipt: { publicationId: publication.id, providerMessageId: publication.providerMessageId } }, ctx.input.privateSecrets);
+}
 async function providerOperation(ctx: ChatCatalogContext, operation: "inspect" | "resolve", state: Record<string, unknown>) {
   const input = privateFixtures.get(ctx); if (!input || !ctx.input.privateSecrets) throw new Error("Original private email fixture identity is unavailable");
   const root = process.env.PAPERCLIP_RUNNER_E2E_TEMP_ROOT; if (!root) throw new Error("Owned email fault root is unavailable");
@@ -55,6 +60,16 @@ export function actualUncertainEmailReads(events: Array<{ seq?: number; eventTyp
     return publication && !earlierWrite ? [{ executionId: id, actualPublicationId: expected.publicationId, uncertain: true }] : [];
   });
 }
+export function actualOriginalEmailSend(events: Array<{ eventType?: string; payload?: unknown }>, expected: { companyId: string; taskId: string; endpointId: string; publicationId: string }) {
+  const calls = new Map<string, string>(), results = new Set<string>(), completions = new Map<string, string>();
+  for (const event of events) { const payload = record(record(record(event.payload).prpEvent).payload), item = record(payload.item);
+    if (event.eventType === "item.started" && item.type === "tool_use" && typeof item.id === "string") { const input = record(item.input), api = item.name === "call_api", request = record(api ? input.body : input.request);
+      if ((item.name === "agentmail_send" || api && input.operationId === "POST /api/companies/{companyId}/email/send" && record(input.pathParams).companyId === expected.companyId) && request.parentIssueId === expected.taskId && request.endpointId === expected.endpointId && request.idempotencyKey === expected.publicationId && !request.conversationId) calls.set(item.id, String(item.name)); }
+    if (event.eventType === "item.completed" && item.type === "tool_result" && typeof item.id === "string" && (!item.tool_use_id || item.tool_use_id === item.id)) { const result = record(item.result), data = calls.get(item.id) === "call_api" ? result.ok === true && result.status === 202 ? record(result.data) : {} : result; if (data.id === expected.publicationId && typeof data.issueId === "string") results.add(item.id); }
+    if (event.eventType === "tool.execution.completed" && payload.status === "completed") completions.set(String(payload.executionId), String(payload.name));
+  }
+  return [...calls].some(([id, name]) => results.has(id) && completions.get(id) === name);
+}
 export function gradeUnknownEmail(value: unknown) {
   const c = checks(), o = runtimeObservation(value); c.add("real-authorized-send-with-genuine-lost-response", !!o, "One actual authorized self-addressed send, real upstream acceptance and production uncertainty must be observed."); if (!o) return c.result(); const s = o.state;
   c.add("original-uncertainty-and-exact-owned-outage", s.actualOriginalUncertain === true && s.setupSendBound === true && s.faultOriginalBinding === true && s.outageActiveDuringCanonical === true && s.originalUncertaintyRecorded === true, "The original genuine native send belongs to the exact task/inbox; production has no reliable provider receipt during the bounded declared outage.");
@@ -62,7 +77,7 @@ export function gradeUnknownEmail(value: unknown) {
   c.add("actual-provider-reconciliation-through-supported-path", s.originalProviderReceiptMatched === true && s.outageReleased === true && s.reconciliationBound === true && s.resolutionActorBound === true && ["sent", "delivered"].includes(String(s.finalOutcome)), "After independent real provider inspection, the exact original send reconciles through ordinary provider intake or authorized human resolution without resending.");
   const report = String(s.confirmationReply ?? "");
   c.add("phase-bound-real-outcome-with-no-false-delivery", s.confirmationBound === true && /sent|accepted|provider.*(?:receipt|message)|reconcil/i.test(report) && (s.finalOutcome === "delivered" || !assertsEmailDelivery(report)) && s.finalDirectMatchedSentCount === 1, "The subsequent actual reply reports the verified send receipt and distinguishes acceptance from unproven recipient delivery; a final independent duplicate check still finds one sent message.");
-  c.add("finite-real-source-turns-and-original-delivery-retained", o.runs.length === 3 && o.runs.every(row => row.status === "succeeded" && row.agentId === o.leadId) && s.sameOriginalRequestRetained === true && s.sameOriginalConversationRetained === true && o.tasks.length === 1, "One genuine setup human/native send plus canonical and factual follow-up are the only native work; the original request/conversation and saved uncertainty evidence remain inspectable.");
+  c.add("finite-real-source-turns-and-original-delivery-retained", o.runs.length === 4 && o.runs.every(row => row.status === "succeeded" && row.agentId === o.leadId) && s.sameOriginalRequestRetained === true && s.sameOriginalConversationRetained === true && o.tasks.length === 2 && s.actualNormalTaskSendBound === true, "One genuine setup human chat delegation and actual normal-task send plus canonical and factual follow-up are the only native work; the original request/conversation and saved uncertainty evidence remain inspectable.");
   return c.result();
 }
 const requirement = externalRequirements["recovery.unknown-email-outcome"]!;
@@ -78,24 +93,28 @@ async function setupUnknownEmail(ctx: ChatCatalogContext) {
   for (const scope of [{ scopeType: "company", scopeId: request.companyId }, { scopeType: "agent", scopeId: request.agentId }]) await ctx.input.api.post(`/api/companies/${request.companyId}/budgets/policies`, { ...scope, amount: 500, hardStopEnabled: true, isActive: true, unpricedUsagePolicy: "allow" });
   await ctx.input.api.post(`/api/companies/${request.companyId}/tools/policies`, { name: `Exact authorized self-addressed QA send ${nonce}`, policyType: "allow", priority: 10, selectors: { connectionId: connection.endpoint.connectionId, toolNames: ["email.send"] }, conditions: { arguments: { fieldEquals: { to: [request.recipient], subject, text } } }, config: {} });
   await ctx.input.page.goto(`/${ctx.input.fixtures.company.issuePrefix}/issues/${source.id}`, { waitUntil: "domcontentloaded" });
-  const initial = `Please send one email from my connected inbox to ${request.recipient}, with subject exactly ${JSON.stringify(subject)} and body exactly ${JSON.stringify(text)}. This is my authorized self-addressed QA notice. Use the actual task-bound email connection in this conversation and retain the real send receipt. Do not create another task yourself or send any other message.`;
+  const initial = `Please create exactly one normal task assigned to yourself, linked as a child of this conversation, to send one email from my connected inbox to ${request.recipient}, with subject exactly ${JSON.stringify(subject)} and body exactly ${JSON.stringify(text)}. This is my authorized self-addressed QA notice. Use the actual authorized email connection from that normal task run, retain the real send receipt, and leave that normal task blocked awaiting human resolution if the send is uncertain. Do not send from Agent Chat itself, create any further work tasks, or send any other message.`;
   await sendChatMessage(ctx.input.page, initial);
   const ready = await pollUntil({ label: "Actual initial native email send loses its real accepted provider response", deadlineAt: Date.now() + 240000,
     load: async () => { await ctx.refreshIssue(); const accepted = await readOwnedEmailFault<AcceptedEmailFault>(root, "accepted-private.json").catch(error => { if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined; throw error; }); return { source: ctx.issue(), runs: await ctx.allRuns(), accepted, delivery: accepted ? await ctx.input.api.get<EmailPublicationSummary>(`/api/companies/${request.companyId}/email/deliveries/${accepted.publicationId}`) : undefined }; },
-    accept: v => v.source?.conversationState === "waiting" && v.runs.length === 1 && v.runs[0]?.status === "succeeded" && v.delivery?.outcome === "uncertain" && v.delivery.providerMessageId === null,
-    reject: v => v.runs.length > 1 || v.runs.some(row => ["failed", "cancelled", "timed_out"].includes(row.status)) ? "Initial authorized setup email admitted extra or failed native work" : undefined });
+    accept: v => v.source?.conversationState === "waiting" && v.runs.length === 2 && v.runs.every(row => row.status === "succeeded") && v.delivery?.outcome === "uncertain" && v.delivery.providerMessageId === null,
+    reject: v => v.runs.length > 2 || v.runs.some(row => ["failed", "cancelled", "timed_out"].includes(row.status)) ? "Initial authorized setup email admitted extra or failed native work" : undefined });
   const delivery = ready.delivery!, accepted = ready.accepted!, thread = await ctx.input.api.get<EmailThreadSummary>(`/api/companies/${request.companyId}/email/tasks/${delivery.issueId}`);
-  const comments = await ctx.input.api.get<Entity[]>(`/api/issues/${source.id}/comments?order=asc`), human = comments.filter(row => !row.authorAgentId), run = ready.runs[0]!;
-  const setupSendBound = accepted.nonce === request.nonce && accepted.executionId === request.executionId && accepted.attemptId === attemptId && accepted.upstreamStatus >= 200 && accepted.upstreamStatus < 300 && delivery.request?.endpointId === request.endpointId && delivery.request.subject === subject && hash(delivery.request.text) === request.textSha256 && thread.endpoint.id === request.endpointId && human.length === 1 && human[0]?.body === initial && Array.isArray(run.contextSnapshot?.wakeCommentIds) && run.contextSnapshot.wakeCommentIds.includes(human[0]!.id);
+  const comments = await ctx.input.api.get<Entity[]>(`/api/issues/${source.id}/comments?order=asc`), human = comments.filter(row => !row.authorAgentId), setupChatRun = ready.runs.find(row => row.contextSnapshot?.issueId === source.id)!, mailTaskId = delivery.request?.parentIssueId, run = ready.runs.find(row => row.contextSnapshot?.issueId === mailTaskId)!;
+  const mailTask = await ctx.input.api.get<Issue>(`/api/issues/${mailTaskId}`);
+  const sendEvents = run ? await collectRunEvents<{ seq?: number; eventType?: string; payload?: unknown }>((afterSeq, limit) => ctx.input.api.get(`/api/heartbeat-runs/${run.id}/events?afterSeq=${afterSeq}&limit=${limit}`)) : [];
+  const activity = await ctx.input.api.get<Entity[]>(`/api/companies/${request.companyId}/activity?limit=1000`);
+  const actualNormalTaskSendBound = !!run && actualOriginalEmailSend(sendEvents, { companyId: request.companyId, taskId: mailTaskId!, endpointId: request.endpointId, publicationId: delivery.id }) && activity.some(row => row.action === "email.queued" && row.actorType === "agent" && row.actorId === request.agentId && row.details?.publicationId === delivery.id && row.details?.endpointId === request.endpointId) && mailTask.companyId === request.companyId && mailTask.parentId === source.id && mailTask.assigneeAgentId === request.agentId && mailTask.workMode === "standard" && mailTask.status === "blocked" && run.agentId === request.agentId && run.runtimeMode === "native";
+  const setupSendBound = accepted.nonce === request.nonce && accepted.executionId === request.executionId && accepted.attemptId === attemptId && accepted.upstreamStatus >= 200 && accepted.upstreamStatus < 300 && delivery.request?.endpointId === request.endpointId && delivery.request.subject === subject && hash(delivery.request.text) === request.textSha256 && thread.endpoint.id === request.endpointId && human.length === 1 && human[0]?.body === initial && actualNormalTaskSendBound && !!setupChatRun && Array.isArray(setupChatRun.contextSnapshot?.wakeCommentIds) && setupChatRun.contextSnapshot.wakeCommentIds.includes(human[0]!.id);
   await ctx.input.evidence("runtime-original-email-uncertainty.json", { publicationId: delivery.id, issueId: delivery.issueId, conversationId: delivery.conversationId, outcome: delivery.outcome, providerMessageId: delivery.providerMessageId, requestSha256: hash(JSON.stringify(delivery.request)), initialHumanCommentId: human[0]?.id, initialNativeRunId: run.id });
-  return { ...connection, sourceId: source.id, faultRequest: request, setupRunId: run.id, originalDelivery: delivery, publicationId: delivery.id, deliveryIssueId: delivery.issueId, originalRequestSha256: hash(JSON.stringify(delivery.request)), originalConversationId: delivery.conversationId, setupSendBound, actualOriginalUncertain: true, originalUncertaintyRecorded: true, faultOriginalBinding: setupSendBound };
+  return { ...connection, sourceId: source.id, faultRequest: request, setupRunIds: ready.runs.map(row => row.id), mailTaskId, actualNormalTaskSendBound, originalDelivery: delivery, publicationId: delivery.id, deliveryIssueId: delivery.issueId, originalRequestSha256: hash(JSON.stringify(delivery.request)), originalConversationId: delivery.conversationId, setupSendBound, actualOriginalUncertain: true, originalUncertaintyRecorded: true, faultOriginalBinding: setupSendBound };
 }
 export async function cleanupOwnedEmailConnection(ctx: ChatCatalogContext) {
   try { const request = faultRequests.get(ctx); if (request) { await releaseOwnedEmailResponseLoss(process.env.PAPERCLIP_RUNNER_E2E_TEMP_ROOT!, request); faultRequests.delete(ctx); } }
   finally { const input = privateFixtures.get(ctx); try { if (input?.endpointId) { let receipt: EmailEndpointSummary | undefined; try { receipt = await ctx.input.api.post<EmailEndpointSummary>(`/api/email/inboxes/${input.endpointId}/control`, { action: "remove" }); } catch (error) { if (!(error instanceof RunnerApiHttpError) || error.status !== 404) throw error; } if (receipt?.lastError) throw new Error("Owned email provider registration cleanup is unconfirmed; actual operator verification is required"); } } finally { privateFixtures.delete(ctx); } }
 }
 export const runtimeEmailRecoveryCases = [runtimeDefinition("recovery.unknown-email-outcome", async ctx => { try { return await setupUnknownEmail(ctx); } catch (error) { await cleanupOwnedEmailConnection(ctx); throw error; } }, gradeUnknownEmail, {
-  authentication: "human-session", setupHumanMessageCount: 1, expectedHumanMessageCount: 3, expectedRunCount: 3, turnTimeoutMs: 120000, attemptTimeoutMs: 900000,
+  authentication: "human-session", setupHumanMessageCount: 1, expectedHumanMessageCount: 3, expectedRunCount: 4, turnTimeoutMs: 120000, attemptTimeoutMs: 900000,
   externalInput: { provider: requirement.provider, fields: requirement.fields },
   coverageGaps: [],
   setupPolicy: { readiness: "preserve-scenario", invariantCheckIds: ["real-original-email-uncertain-with-no-public-provider-receipt"] },
@@ -103,20 +122,20 @@ export const runtimeEmailRecoveryCases = [runtimeDefinition("recovery.unknown-em
   async verifySetup(ctx, s) { const delivery = await ctx.input.api.get<EmailPublicationSummary>(`/api/companies/${ctx.input.fixtures.company.id}/email/deliveries/${s.publicationId}`), root = process.env.PAPERCLIP_RUNNER_E2E_TEMP_ROOT!; const status = await readOwnedEmailFault<EmailFaultStatus>(root, "status.json"), request = s.faultRequest as EmailFaultRequest; const c = checks(); c.add("real-original-email-uncertain-with-no-public-provider-receipt", delivery.outcome === "uncertain" && delivery.providerMessageId === null && status.realSendsForwarded === 1 && status.nonce === request.nonce && !status.released && !status.expired && s.setupSendBound === true, "One actual accepted original send persists as uncertain without a reliable public receipt; exact declared outage remains active before unchanged canonical query."); return c.result(); },
   async act(ctx, s) {
     const api = ctx.input.api, companyId = ctx.input.fixtures.company.id, publicationId = String(s.publicationId), request = s.faultRequest as EmailFaultRequest, root = process.env.PAPERCLIP_RUNNER_E2E_TEMP_ROOT!;
-    const first = await pollUntil({ label: "Canonical uncertainty inspection without an automatic duplicate email", deadlineAt: Date.now() + 180000, load: async () => { await ctx.refreshIssue(); return { source: ctx.issue(), runs: await ctx.allRuns() }; }, accept: v => v.source?.conversationState === "waiting" && v.runs.length === 2 && v.runs.every(row => row.status === "succeeded") });
-    const canonical = first.runs.find(row => row.id !== s.setupRunId)!, comments = await api.get<Entity[]>(`/api/issues/${ctx.issue()!.id}/comments?order=asc`); s.canonicalReply = comments.filter(row => row.createdByRunId === canonical.id && row.authorAgentId === ctx.input.fixtures.agent.id).map(row => row.body).join("\n");
+    const first = await pollUntil({ label: "Canonical uncertainty inspection without an automatic duplicate email", deadlineAt: Date.now() + 180000, load: async () => { await ctx.refreshIssue(); return { source: ctx.issue(), runs: await ctx.allRuns() }; }, accept: v => v.source?.conversationState === "waiting" && v.runs.length === 3 && v.runs.every(row => row.status === "succeeded") });
+    const canonical = first.runs.find(row => !(s.setupRunIds as string[]).includes(row.id))!, comments = await api.get<Entity[]>(`/api/issues/${ctx.issue()!.id}/comments?order=asc`); s.canonicalReply = comments.filter(row => row.createdByRunId === canonical.id && row.authorAgentId === ctx.input.fixtures.agent.id).map(row => row.body).join("\n");
     const events = await collectRunEvents<{ seq?: number; eventType?: string; payload?: unknown }>((afterSeq, limit) => api.get(`/api/heartbeat-runs/${canonical.id}/events?afterSeq=${afterSeq}&limit=${limit}`));
     s.canonicalReadBound = actualUncertainEmailReads(events, { companyId, endpointId: request.endpointId, publicationId, issueId: String(s.deliveryIssueId) }).length > 0;
     const outage = await readOwnedEmailFault<EmailFaultStatus>(root, "status.json"), original = await api.get<EmailPublicationSummary>(`/api/companies/${companyId}/email/deliveries/${publicationId}`); s.outageActiveDuringCanonical = !outage.released && !outage.expired && original.outcome === "uncertain" && original.providerMessageId === null;
     const direct = await providerOperation(ctx, "inspect", s); s.directMatchedSentCount = direct.matchedSent?.length; s.originalProviderReceiptMatched = direct.originalMessageMatched === true;
-    const observed = await observeRuntime(ctx, s); s.noNewAgentPublication = observed.tasks.length === 1 && observed.tasks[0]?.id === s.deliveryIssueId && direct.matchedSent?.every(row => row.publicationId === publicationId) === true;
+    const observed = await observeRuntime(ctx, s); s.noNewAgentPublication = observed.tasks.length === 2 && observed.tasks.every(row => [s.deliveryIssueId, s.mailTaskId].includes(row.id)) && direct.matchedSent?.every(row => row.publicationId === publicationId) === true;
     await releaseOwnedEmailResponseLoss(root, request); s.outageReleased = true;
     const resolved = await providerOperation(ctx, "resolve", s); s.reconciliationBound = resolved.originalMessageMatched === true && resolved.matchedSent?.length === 1; s.finalOutcome = resolved.outcome; s.resolutionMode = resolved.resolution;
     const activities = await api.get<Entity[]>(`/api/companies/${companyId}/activity?limit=1000`); s.resolutionActorBound = resolved.resolution === "provider-reconciled" || activities.some(row => row.action === "email.resolved" && row.actorType === "user" && row.actorId === s.personId && row.details?.publicationId === publicationId);
     const after = await api.get<EmailPublicationSummary>(`/api/companies/${companyId}/email/deliveries/${publicationId}`); s.sameOriginalRequestRetained = hash(JSON.stringify(after.request)) === s.originalRequestSha256; s.sameOriginalConversationRetained = after.conversationId === s.originalConversationId && after.id === publicationId;
     const before = (await ctx.allRuns()).map(row => row.id), followup = "The provider's actual receipt for that original email is now available. Please inspect the saved publication and report its real outcome, whether another email was sent, and whether recipient delivery is actually proven. Do not send or retry any email.";
     await sendChatMessage(ctx.input.page, followup);
-    const final = await pollUntil({ label: "Actual reconciled email outcome reported in its own phase", deadlineAt: Date.now() + 180000, load: async () => { await ctx.refreshIssue(); return { source: ctx.issue(), runs: await ctx.allRuns() }; }, accept: v => v.source?.conversationState === "waiting" && v.runs.length === 3 && v.runs.every(row => row.status === "succeeded") });
+    const final = await pollUntil({ label: "Actual reconciled email outcome reported in its own phase", deadlineAt: Date.now() + 180000, load: async () => { await ctx.refreshIssue(); return { source: ctx.issue(), runs: await ctx.allRuns() }; }, accept: v => v.source?.conversationState === "waiting" && v.runs.length === 4 && v.runs.every(row => row.status === "succeeded") });
     const replyRun = final.runs.find(row => !before.includes(row.id))!, finalComments = await api.get<Entity[]>(`/api/issues/${ctx.issue()!.id}/comments?order=asc`), human = finalComments.filter(row => !row.authorAgentId && row.body === followup); s.confirmationBound = human.length === 1 && Array.isArray(replyRun.contextSnapshot?.wakeCommentIds) && replyRun.contextSnapshot.wakeCommentIds.length === 1 && replyRun.contextSnapshot.wakeCommentIds[0] === human[0]!.id; s.confirmationReply = finalComments.filter(row => row.createdByRunId === replyRun.id && row.authorAgentId === ctx.input.fixtures.agent.id).map(row => row.body).join("\n");
     const last = await providerOperation(ctx, "inspect", s); s.finalDirectMatchedSentCount = last.matchedSent?.length;
     (s.providerProbes as unknown[]).push(...[direct, resolved, last].map(row => ({ phase: row.operation, operation: "independent-real-provider-receipts", directProviderProbeCount: row.directProviderProbeCount, publicSetupOperationCount: row.publicSetupOperationCount, status: "verified", usage: "unavailable", cost: "unavailable" })));