@@ -0,0 +1,18 @@
+---
+'@objectstack/runtime': patch
+---
+
+fix(runtime): the webhook redeliver button works on a kernel with no raw HTTP app — the dispatcher serves `POST /webhooks/redeliver`
+
+Clause-②: no
+
+On a self-hosted server, `@objectstack/plugin-webhooks` serves the operator's redeliver button by mounting `POST /api/v1/webhooks/redeliver` on the raw Hono app. A hosted tenant kernel has no raw app, so on that shape the path answered `404 ROUTE_NOT_FOUND`, even though the plugin had registered the `webhooks` service that can serve it.
+
+**The door that changes: `HttpDispatcher`, for a kernel with no raw app.** It now serves exactly `POST /webhooks/redeliver` (no sub-paths, no other method). It forwards the request, body unread, to the request kernel's `webhooks` service (`IWebhookService.handleRedeliver`), read on every request, and returns that `Response` as it is. So the hosted door answers what the self-hosted mount answers: `200` with the replayed row, and the same `401`, `400`, `404` and `409` refusals with the same bodies. An anonymous call is refused `401 UNAUTHENTICATED` there exactly as on the mount.
+
+- No `webhooks` service registered (plugin-webhooks absent, or present without its redelivery veto), or one without `handleRedeliver`: `501 NOT_IMPLEMENTED`, naming which. Never `ROUTE_NOT_FOUND`.
+- A member that throws: a sanitised `500 INTERNAL_ERROR`, with the original error in the server log. The same answer, logged, when a transport hands over a request whose body was already read, instead of a "not JSON" refusal for a well-formed request.
+- Any method other than `POST` is not claimed: it answers the dispatcher's ordinary `404 ROUTE_NOT_FOUND` and never reaches the service.
+- The dispatcher's two gates apply to this path unchanged: a session that still owes an authentication step, or a signed-in caller who is not a member of the request's environment, is refused `403` before the service runs. This door is therefore stricter than the self-hosted mount, never looser.
+
+Nothing changes on a self-hosted server: the plugin's raw-app mount still serves the path there and never reaches the dispatcher.
@@ -25,7 +25,7 @@
 // dispatcher domain files.
 //
 // The population comes from `packages/rest/src/rest-route-ledger.ts` (81 rows
-// / 18 families) and `packages/runtime/src/route-ledger.ts` (85 rows / 22
+// / 18 families) and `packages/runtime/src/route-ledger.ts` (86 rows / 23
 // domains) because those two are enumerated from a RUNNING server and guarded
 // in both directions by their own conformance tests — so a new family or
 // domain cannot be silently absent from them, and therefore cannot be silently
@@ -67,9 +67,10 @@
 // The ledgers supply the POPULATION; the classification stays a reviewed row
 // here.
 //
-// Of the 40 ledger keys, 10 are classified by rows below (re-derived when the
-// `/approvals/act` domain arrived classified, #22576, after `/i18n` left the
-// baseline, #22432); the other 30 are enumerated one by one,
+// Of the 41 ledger keys, 11 are classified by rows below (re-derived when the
+// `/webhooks/redeliver` domain arrived classified, #22755, after
+// `/approvals/act` did, #22576, and `/i18n` left the baseline, #22432); the
+// other 30 are enumerated one by one,
 // dated, and pinned SHRINK-ONLY in `authz-ledger-population.baseline.ts`,
 // whose MAX note dates every step down from the 34 of 40 it held on the
 // 2026-08-31 adoption day. That list can only get shorter: growth, staleness,
@@ -99,12 +100,12 @@
 // [commit 2ce1eb41b] That completeness is over ROUTES, not over primitives: a primitive
 // enforced by a predicate inside an existing resolver adds no entry point, so
 // it can be neither UNCLASSIFIED nor STALE. Measured against the rows below:
-// 44 of 55 carry no `covers` key at all (11 rows, 21 keys, every one an
-// HTTP/transport pin), and 38 of the file's 48 `enforced` rows are exactly
+// 44 of 56 carry no `covers` key at all (12 rows, 22 keys, every one an
+// HTTP/transport pin), and 38 of the file's 49 `enforced` rows are exactly
 // that in-resolver shape — the ADR-0049/#8613 `active` rows and the ADR-0091
 // grant-validity-window row among them (see their own blocks further down)
 // are the normal case, not an exception. Of the
-// 21 `covers` keys that DO exist, 7 are GATE pins tied to the enforcement call
+// 22 `covers` keys that DO exist, 7 are GATE pins tied to the enforcement call
 // itself, not merely a function name — delete `shouldDenyAnonymous` from
 // `/actions`, `/automation`, `/packages`, `/analytics` or `/i18n`, or drop the MCP
 // context-threading / stdio principal binding, and the pinned key vanishes from source, its row
@@ -330,6 +331,25 @@ export const AUTHZ_CONFORMANCE: AuthzPrimitive[] = [
     covers: ['dispatcher-domain:route-ledger.ts:/approvals/act'],
     note: 'The DISPATCHER domain only: on a self-hosted kernel the same path is served from the raw Hono app and never reaches the dispatcher, which is why the route-ledger rows are pinned unobservable on the showcase boot. Unit- and wire-proven, not dogfood-proven: plugin-approvals action-page-member.integration.test.ts drives the member on a real kernel and store (GET never decides; POST decides as the bound approver, audited as that approver; unknown, expired and consumed tokens told on the page with 200; no cookie or Authorization read); runtime domains/approvals-act.test.ts pins the domain on the real HttpDispatcher (the request forwarded unread, HEAD answered as a bodiless GET, 501 for an absent slot or member, a SIGNED-IN non-member reaching the member exactly as an anonymous caller does while /approvals/act/x, /approvals/actx, /approvals, /approvals/requests and /data/task stay membership-checked); core/security/auth-gate.test.ts pins the exact allow-list entry; http-conformance hono-approvals-act.conformance.test.ts drives the real plugin through createHonoApp and the self-hosted mount, where a form POST redeems a live token and HEAD answers identically at both doors.' },
 
+  // #22755 — the `/webhooks/redeliver` dispatcher domain (segment 2 of #22564's
+  // stage 2; ruling A on #22438). Unlike `approval-action-token` above, the
+  // credential here IS the session: the member judges the caller from the
+  // request's own credentials through the `auth` service, so the honest class
+  // is "a signed-in caller, scoped to their active organization", and the
+  // dispatcher's two preamble gates apply to the path unexempted. ⛔ Ids stay
+  // in this comment, out of the row's strings.
+  //
+  // Not HIGH_RISK, for the list's own reason: it marks a primitive guarding
+  // object DATA through a sibling HTTP entry point, and this door serves no
+  // record read or query — it replays one outbox row the caller's organization
+  // owns. Its proofs are the plugin's member suite and the two-door wire suite,
+  // neither of which lives in this directory; a dogfood proof driving the route
+  // at its literal wire path is the honest upgrade, and would claim this row.
+  { id: 'webhook-redeliver-session', summary: 'Webhook redeliver door (`POST /webhooks/redeliver`, the operator button that replays a finished delivery) — any signed-in caller may press it, and only for a delivery row of their own active organization; an anonymous caller is refused by the member itself, exactly as the self-hosted mount refuses it', state: 'enforced',
+    enforcement: 'plugin-webhooks/webhook-outbox-plugin.ts serveRedeliver — the ONE body both faces run: the caller resolved from the request\'s own credentials through the auth service (no signed-in user: 401 UNAUTHENTICATED), the caller\'s active organization threaded into messaging.redeliverHttp as the tenant (a row outside it: 404 RESOURCE_NOT_FOUND), and the redelivery veto installed with messaging before the slot is registered (a row whose subscription or signing secret is gone: 409 DELIVERY_NOT_ELIGIBLE); reached through IWebhookService.handleRedeliver by runtime/domains/webhooks.ts, which forwards the transport\'s request UNREAD, resolves the slot per request and adds no credential of its own (an absent slot or member is a typed 501, never a route miss). The two dispatcher preamble gates apply to the exact path with NO exemption: core/security/auth-gate.ts ALLOW_ROUTES does not list it (a session owing an authentication step is refused 403 first) and runtime/http-dispatcher.ts enforceProjectMembership does not skip it (a signed-in non-member of the environment is refused 403 PROJECT_MEMBERSHIP_REQUIRED first). The self-hosted raw-app mount (plugin-webhooks registerAdminRoutes) runs the same body on the same outbox',
+    covers: ['dispatcher-domain:route-ledger.ts:/webhooks/redeliver'],
+    note: 'The DISPATCHER domain only: on a self-hosted kernel the same path is served from the raw Hono app and never reaches the dispatcher, which is why the route-ledger row is pinned unobservable on the showcase boot. Unit- and wire-proven, not dogfood-proven: plugin-webhooks webhook-redeliver-member.test.ts drives the member on a real kernel, messaging service and outbox (every refusal the contract declares, the tenant scope, the veto, byte parity with the mount); runtime domains/webhooks-redeliver.test.ts pins the domain on the real HttpDispatcher (the request forwarded unread, POST alone claimed, 501 for an absent slot or member, the slot read per request, a signed-in non-member and a gated session stopped before the member while a member of the environment and an anonymous caller reach it); http-conformance hono-webhooks-redeliver.conformance.test.ts drives the real plugin through createHonoApp and the self-hosted mount, where a replay lands in the outbox and every refusal, anonymous first, answers the same bytes at both doors.' },
+
   // ── #2992 / ADR-0096 D4 — latent execution surfaces (pre-wiring identity
   // admission). Neither surface is reachable by a client today; these rows
   // register their identity posture NOW so the ratchet (see the probes +
 
@@ -990,6 +990,8 @@ describe('the ledger-sourced population and its baseline bite', () => {
       'dispatcher-domain:route-ledger.ts:/mcp',
       'dispatcher-domain:route-ledger.ts:/meta',
       'dispatcher-domain:route-ledger.ts:/packages',
+      // [#22755] classified by `webhook-redeliver-session`.
+      'dispatcher-domain:route-ledger.ts:/webhooks/redeliver',
       'rest-family:rest-route-ledger.ts:metadata',
       // [#22430] classified by `anonymous-deny-api-description`.
       'rest-family:rest-route-ledger.ts:openapi',
 
@@ -106,11 +106,11 @@
 //     `RestServer.getRoutes()` on a booted server and guarded per route by
 //     `rest-route-ledger.conformance.test.ts`. It reaches all 17 registrars;
 //     this table reaches 1.
-//   `packages/runtime/src/route-ledger.ts`: 85 rows over 22 domains. Its
+//   `packages/runtime/src/route-ledger.ts`: 86 rows over 23 domains. Its
 //     machine contract is DOMAIN-level, by live registry introspection
 //     (`domainRegistry.list()`), the per-route rows being documentation. It
 //     covers all 15 `async handle*(` methods in `http-dispatcher.ts` and all
-//     17 `DomainRoute` prefixes declared by the 16 domain files.
+//     18 `DomainRoute` prefixes declared by the 17 domain files.
 //   Nine more ledgers exist repo-wide (290 rows in total).
 //
 // ⭐ On FILE SELECTION the ledgers are simply the right answer, and that is
@@ -298,7 +298,11 @@ export interface ProbeTableReading {
 // `approval-action-token` row covers one more key, the `/approvals/act`
 // dispatcher-domain key, which arrived classified rather than through the
 // baseline (the baseline still holds 30 and its ceiling did not move).
-export const PROBE_TABLE: ProbeTableReading = { entries: 20, files: 15, keys: 21 };
+// [#22755] 20 / 15 / 21 -> 20 / 15 / 22: no probe and no file joined; the
+// `webhook-redeliver-session` row covers one more key, the
+// `/webhooks/redeliver` dispatcher-domain key, which arrived classified rather
+// than through the baseline (the baseline still holds 30, its ceiling unmoved).
+export const PROBE_TABLE: ProbeTableReading = { entries: 20, files: 15, keys: 22 };
 
 /**
  * The probe count `authz-conformance.matrix.ts`'s header states.
@@ -387,7 +391,7 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     file: 'packages/runtime/src/route-ledger.ts',
     kinds: ['ROUTE_ENUMERATION'],
     probes: 1,
-    keys: 22,
+    keys: 23,
     // [#13953] 80 -> 82: the two operator run-lifecycle rows
     // (`POST /automation/:name/runs/:runId/cancel` and `.../restore-suspension`).
     // Both carry `domain: '/automation'`, an EXISTING key, so `reachable` moves
@@ -418,11 +422,19 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     // `/security` domain dispatches to it — so the domain-file counts in the
     // note below are unchanged. Controls moved with the row ("route: '" and
     // "domain: '" 84 -> 85, RouteLedgerEntry unchanged at 2).
-    population: 85,
-    reachable: 85,
+    // [#22755] 85 -> 86: the `POST /webhooks/redeliver` row arrived with the
+    // dispatcher's `/webhooks/redeliver` domain (the webhook redeliver door for
+    // a kernel with no raw app). It carries `domain: '/webhooks/redeliver'`, so
+    // it is REACHABLE — `reachable` moves with `population`, `blindSpot` stays
+    // 0 — and it carries a NEW distinct domain: `keys` 22 -> 23, one new key,
+    // classified by `webhook-redeliver-session` rather than added to the
+    // baseline. Controls moved with the row ("route: '" and "domain: '"
+    // 85 -> 86, RouteLedgerEntry unchanged at 2).
+    population: 86,
+    reachable: 86,
     blindSpot: 0,
     populationRule: 'ledger rows inside ROUTE_LEDGER; reachable = rows carrying a `domain` (each distinct value mints a key)',
-    controls: { "route: '": 85, "domain: '": 85, RouteLedgerEntry: 2 },
+    controls: { "route: '": 86, "domain: '": 86, RouteLedgerEntry: 2 },
     // [#22432] Re-derived on the merged ref: the note's two counts had stood at
     // 11 files / 5 classified / 16 baselined since before the `/analytics`
     // domain was classified (#21061), which named one more file and moved one
@@ -433,15 +445,18 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     // [#22576] `domains/approvals.ts` is a sixteenth domain file with a
     // seventeenth plain prefix, named by no probe, and its key is the eighth
     // classified: 22 domains, 14 still in the baseline.
+    // [#22755] `domains/webhooks.ts` is a seventeenth domain file with an
+    // eighteenth plain prefix, named by no probe, and its key is the ninth
+    // classified: 23 domains, 14 still in the baseline.
     note:
       'The dispatcher half. Its machine contract is DOMAIN-level by live registry introspection ' +
       '(domainRegistry.list()), guarded in BOTH directions by route-ledger.conformance.test.ts: every ' +
       'registered domain needs a row, and every ledger domain must be a live prefix or a pinned legacy / ' +
       'non-dispatch branch. That two-way guard is what settles the FILE-SELECTION layer by ' +
-      'construction — all 17 DomainRoute prefixes declared across the 16 domain files that declare one are ' +
-      'ledger domains today, including the 10 files no probe names. 22 domains; 8 classified ' +
-      '(/meta, /actions, /automation, /packages, /mcp, /analytics, /i18n, /approvals/act), 14 in the ' +
-      'shrink-only baseline.',
+      'construction — all 18 DomainRoute prefixes declared across the 17 domain files that declare one are ' +
+      'ledger domains today, including the 11 files no probe names. 23 domains; 9 classified ' +
+      '(/meta, /actions, /automation, /packages, /mcp, /analytics, /i18n, /approvals/act, ' +
+      '/webhooks/redeliver), 14 in the shrink-only baseline.',
   },
   {
     file: 'packages/rest/src/rest-server.ts',
 
@@ -43,22 +43,24 @@ describe('authz probe blind-spot census (#13260)', () => {
     expect(derived.table).toEqual(PROBE_TABLE);
   });
 
-  it('every classified key is accounted for — 21 `covers` keys, no more', () => {
-    // The matrix's `covers` keys number 21 today: the 9 probe-minted keys this
+  it('every classified key is accounted for — 22 `covers` keys, no more', () => {
+    // The matrix's `covers` keys number 22 today: the 9 probe-minted keys this
     // census was first measured against, plus the 6 ledger family/domain keys
     // classified when the population moved (2026-08-31), plus the `/analytics`
     // domain's gate-pin key and its dispatcher-domain key (#21061), plus the
     // `openapi` REST family key (#22430), plus the `/i18n` domain's gate-pin
     // key and its dispatcher-domain key (#22432), plus the `/approvals/act`
-    // dispatcher-domain key, classified by `approval-action-token` (#22576). If a probe
+    // dispatcher-domain key, classified by `approval-action-token` (#22576),
+    // plus the `/webhooks/redeliver` dispatcher-domain key, classified by
+    // `webhook-redeliver-session` (#22755). If a probe
     // starts minting a key no row covers, the ratchet itself goes red as
     // UNCLASSIFIED — that is its job, and this pin does not duplicate it. What
     // this asserts is only that the census's key count is current.
     //
-    // ⚠️ This is NOT the size of the population. The ledgers mint 40 keys; 10
+    // ⚠️ This is NOT the size of the population. The ledgers mint 41 keys; 11
     // are classified here and 30 are enumerated in the shrink-only baseline,
     // which `authz-conformance.test.ts` holds to its own four rules.
-    expect(PROBE_TABLE.keys).toBe(21);
+    expect(PROBE_TABLE.keys).toBe(22);
   });
 
   it.each(PROBE_FILE_CENSUS.map((r) => [r.file, r] as const))(
 
@@ -149,6 +149,13 @@ const UNEXERCISED_BY_THIS_BOOT: Record<string, string> = {
     'self-hosted, plugin-approvals mounts the ADR-0043 action page with rawApp.get() directly on Hono, so it never passes through the IHttpServer port; the dispatcher domain this row ledgers serves only a kernel with no raw app. Both doors are driven, on the real plugin, by packages/qa/http-conformance/src/hono-approvals-act.conformance.test.ts',
   'POST /api/v1/approvals/act':
     'self-hosted, plugin-approvals mounts the ADR-0043 redemption with rawApp.post() directly on Hono, so it never passes through the IHttpServer port; the dispatcher domain this row ledgers serves only a kernel with no raw app. Both doors are driven, on the real plugin, by packages/qa/http-conformance/src/hono-approvals-act.conformance.test.ts',
+  // [#22755] Two doors, one path, again. This row ledgers the DISPATCHER's
+  // `/webhooks/redeliver` domain, the door for a kernel with NO raw app. The
+  // showcase `requires` the `webhooks` capability, so this self-hosted boot
+  // composes plugin-webhooks, which serves the same path itself from
+  // `rawApp.post()` on the Hono app — never through the port.
+  'POST /api/v1/webhooks/redeliver':
+    'self-hosted, plugin-webhooks mounts the redeliver door with rawApp.post() directly on Hono, so it never passes through the IHttpServer port; the dispatcher domain this row ledgers serves only a kernel with no raw app. Both doors are driven, on the real plugin, by packages/qa/http-conformance/src/hono-webhooks-redeliver.conformance.test.ts',
 };
 
 /** Segments a probe path uses for `:params` — must match no literal segment. */
 
@@ -20,7 +20,9 @@
     "@objectstack/objectql": "workspace:*",
     "@objectstack/plugin-approvals": "workspace:*",
     "@objectstack/plugin-hono-server": "workspace:*",
+    "@objectstack/plugin-webhooks": "workspace:*",
     "@objectstack/runtime": "workspace:*",
+    "@objectstack/service-messaging": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@types/node": "^26.6.3",
     "typescript": "^6.0.3",