[qingyun-wu]

What

5b of the owner's execution order: the discord bridge's proactive leg migrates its private .sending claim machinery onto the outbox ClaimBackend seam. New src/proactive_claim_fence.py pairs every file move with a durable backend record — claim / confirm / release / fail / recover — constructed on the contract (Design A today; DesignCClaimBackend slots in with a one-line constructor change when #3104 lands).

What stays: the file renames. They are the inter-bridge visibility mechanism (a claimed file leaves every *.txt glob peers poll) — backend records can't provide that. Quarantine remains byte-preserving; presenter-mode and routing/destination gates run before claim exactly as before.

What the backend replaces (both real defects, not refactor gloss):

1. _transient_send_attempts — in-memory, so attempt counts were lost on every restart; a crash-looping bridge could retry a "capped" transient failure forever. Attempts are now durable (pinned: the cap parks across simulated restarts).
2. pid-scoped .sending orphan recovery → incarnation-based backend.recover() (strictly stronger post the feat(sparrow): DesignCClaimBackend — namespace-as-state claiming behind the ClaimBackend seam #3104 pid-reuse fix). The file sweep stays for crash-between-move-and-record gaps.

Decision/executor split preserved: decide_failed_send extracted as the single failure-decision owner in send_failure_policy; the legacy resolve_failed_send executor and the fence both consult it. Vendored ag2_sparrow copy synced verbatim (delegation test green).

Evidence

• New tests/proactive-claim-fence.test.py: 13 checks on a REAL backend — file semantics, durable attempts (cap enforced across fence restarts), partial-delivery parks (never re-sends confirmed chunks), permanent parks first-time, crash recovery, mtime-scoped fresh cycles.
• sending-suffix-is-proactive-only guard extended to see method claim sites (helper-function claims resolved via enclosing-function scan; loop and delegating-caller resolution untouched). Mutation-tested: removing the fence's family gate turns the guard red (5/6), restoring it green (6/6).
• Delegation pins followed one hop (send-failure-delegation, claim-release, foreign-target, dm-failure-preserves-file, progress-flag, recovery) — each updated pin's behavioral pairing named in-file.
• Full sweep: 119 suites (discord/telegram/slack/proactive/send-failure/marker/dm-result) all green at this head.
• scripts/review-checks.sh PASS on the staged diff.

Stacking

Parent: #3095 (feat/discord-delivery-provider) — merge order #3092 → #3094 → #3095 → this. Will rebase over #3113 when it lands (both touch poll_proactive; this PR's claim sites sit below #3113's destination gate, conflict expected trivial). Live round trip owed at the post-merge bridge restart, alongside the #3110/#3113 round trips already queued for that restart.

Signed: @sutando-qingyun-001:ag2.space

🤖 Generated with Claude Code

[qingyun-wu]

For the record: this was accidentally squash-merged into the PARENT branch (feat/discord-delivery-provider, #3095) before any review. Fixed by resetting that branch to its reviewed head d51d4088 (so #3095's scope matches what john's re-pass covers) and reopening the fence as #3124 for its own review pass. The squash commit 931a0e8c is superseded; content lives on unchanged at fc894dae.