@addozhang/dsh-discord 0.1.0

package/lib/features/reconcile-events.js

@@ -0,0 +1,50 @@
+/**
+ * History replay after reconnect (design.md §11 steps 4–7, tasks 15.3/15.4).
+ * Because DSH 0.1.1-rc.2 ignores `events.mux.since`, durable history reads —
+ * not the live stream — are the recovery source. Per active session the
+ * replay walks bounded history pages, folds events past the committed
+ * watermark oldest-first, skips events whose live delivery is already known,
+ * and advances the watermark strictly after the delivery bookkeeping for that
+ * event resolves. The page budget bounds recovery work; hitting it yields an
+ * explicitly incomplete result rather than an unbounded fetch loop.
+ */
+const DEFAULT_MAX_PAGES = 3;
+export async function replayHistory(deps, input) {
+    const maxPages = input.maxPages ?? DEFAULT_MAX_PAGES;
+    const watermark = deps.watermarkStore.watermark(input.sessionId);
+    const delivered = [];
+    let committedThrough = undefined;
+    // Newest page first; each older page continues below the lowest seq seen.
+    let beforeSeq = undefined;
+    let pending = [];
+    let incomplete = false;
+    for (let pageIndex = 0; pageIndex < maxPages; pageIndex += 1) {
+        const page = await deps.historyPort.history(input.sessionId, beforeSeq);
+        const fresh = page.events.filter(event => event.seq > (watermark ?? Number.NEGATIVE_INFINITY));
+        pending = [...fresh, ...pending];
+        beforeSeq = page.events.length > 0 ? page.events[0]?.seq : beforeSeq;
+        if (!page.hasMore) {
+            pending = pending.filter(event => event.seq > (watermark ?? Number.NEGATIVE_INFINITY));
+            break;
+        }
+        if (pageIndex === maxPages - 1)
+            incomplete = true;
+    }
+    // Fold oldest-first, committing only after the bookkeeping resolves.
+    // Events already delivered live across the gap (their id is in liveSeen)
+    // skip the deliver call entirely but still advance the watermark: the
+    // live path owns their bookkeeping.
+    for (const event of pending) {
+        if (input.liveSeen?.has(event.id) === true) {
+            await deps.watermarkStore.commit(input.sessionId, event.seq);
+            committedThrough = event.seq;
+            continue;
+        }
+        const bookkeeping = await deps.deliver.deliver(event);
+        if (bookkeeping === 'recorded')
+            delivered.push(event.id);
+        await deps.watermarkStore.commit(input.sessionId, event.seq);
+        committedThrough = event.seq;
+    }
+    return { delivered, committedThrough, incomplete };
+}

package/lib/features/reconcile-intents.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Uncertain prompt admission reconciliation (design.md §11 step 6, task
+ * 15.5). An intent parked in `unknown` is resolved by evidence, never by
+ * resubmission: a durable history entry whose `user/message.source.rpcId`
+ * equals the submitted request ID proves DSH accepted the prompt, and the
+ * live queue snapshot still holding the pending item proves it too. Without
+ * evidence — or with probes that could not complete — the intent stays
+ * unknown and the user's explicit retry mints a NEW intent, exactly as the
+ * submission flow promises.
+ */
+export interface IntentEvidenceInput {
+    messageId: string;
+    sessionId: string;
+    requestId: string;
+}
+export type EvidenceProbe = (sessionId: string, requestId: string) => Promise<'present' | 'absent' | 'unknown'>;
+export interface IntentReconcileDeps {
+    resolve(messageId: string, outcome: 'succeeded' | 'failed' | 'unknown', atMs: number): Promise<void>;
+    historyEvidence: EvidenceProbe;
+    queueEvidence: EvidenceProbe;
+    nowMs: () => number;
+}
+export interface IntentReconcileInput {
+    intents: readonly IntentEvidenceInput[];
+    /** Bound per sweep; leftovers wait for the next one. */
+    maxIntents: number;
+}
+export interface IntentReconcileResult {
+    proven: string[];
+    unresolved: string[];
+}
+export declare function reconcileIntents(deps: IntentReconcileDeps, input: IntentReconcileInput): Promise<IntentReconcileResult>;

package/lib/features/reconcile-intents.js

@@ -0,0 +1,32 @@
+/**
+ * Uncertain prompt admission reconciliation (design.md §11 step 6, task
+ * 15.5). An intent parked in `unknown` is resolved by evidence, never by
+ * resubmission: a durable history entry whose `user/message.source.rpcId`
+ * equals the submitted request ID proves DSH accepted the prompt, and the
+ * live queue snapshot still holding the pending item proves it too. Without
+ * evidence — or with probes that could not complete — the intent stays
+ * unknown and the user's explicit retry mints a NEW intent, exactly as the
+ * submission flow promises.
+ */
+export async function reconcileIntents(deps, input) {
+    const proven = [];
+    const unresolved = [];
+    for (const intent of input.intents.slice(0, input.maxIntents)) {
+        const inHistory = await deps.historyEvidence(intent.sessionId, intent.requestId);
+        if (inHistory === 'present') {
+            await deps.resolve(intent.messageId, 'succeeded', deps.nowMs());
+            proven.push(intent.messageId);
+            continue;
+        }
+        const inQueue = await deps.queueEvidence(intent.sessionId, intent.requestId);
+        if (inQueue === 'present') {
+            await deps.resolve(intent.messageId, 'succeeded', deps.nowMs());
+            proven.push(intent.messageId);
+            continue;
+        }
+        // Absent or unverifiable: leave the intent exactly as it is. No
+        // resubmission — the user's explicit retry mints a new intent.
+        unresolved.push(intent.messageId);
+    }
+    return { proven, unresolved };
+}

package/lib/features/reconcile-interactions.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Pending interaction reconciliation (design.md §9/§11 steps 3 and 10, task
+ * 15.7). At startup each pending interaction is judged against the Host's
+ * replayed pending baseline and generation. A replayed request keeps its
+ * controls; a resolution observed from another client retires them; a Host
+ * generation change with the interaction missing from the new baseline
+ * expires them fail-closed — the adapter never claims an answer was applied.
+ * The sweep accepts a disposal probe and stops touching anything the moment
+ * it turns false.
+ */
+export interface InteractionRecord {
+    rpcId: string;
+    kind: 'approval' | 'question';
+    state: 'pending' | 'submitting' | 'resolved' | 'unresolved' | 'expired';
+    /** The Host generation the interaction was created under. */
+    seenGeneration: number;
+    /** Outcome observed from a `resolved` frame, if any. */
+    remoteOutcome?: 'allowed-once' | 'rejected' | 'answered' | 'cancelled' | undefined;
+}
+export interface InteractionFacts {
+    hostGeneration: number;
+    /** rpcIds the Host still reports pending (the mux replay baseline). */
+    pendingBaseline: ReadonlySet<string>;
+}
+export type InteractionAction = {
+    rpcId: string;
+    action: 'keep';
+} | {
+    rpcId: string;
+    action: 'retire';
+    reason: 'resolved-elsewhere';
+    outcome: InteractionRecord['remoteOutcome'];
+} | {
+    rpcId: string;
+    action: 'expire';
+    reason: 'host-generation-change';
+};
+export interface InteractionPlan {
+    actions: InteractionAction[];
+}
+/** Pure planning: given records and facts, decide each interaction's fate. */
+export declare function planInteractionReconciliation(records: readonly InteractionRecord[], facts: InteractionFacts): InteractionPlan;
+export interface InteractionReconcileDeps {
+    /** Retires the rendered controls for one interaction. */
+    disable(rpcId: string): Promise<void>;
+    /** Disposal probe: false stops the sweep between records. */
+    shouldContinue?: () => boolean | undefined;
+}
+export interface InteractionSweepResult {
+    kept: string[];
+    retired: string[];
+    expired: string[];
+    aborted: boolean;
+}
+/**
+ * Apply the plan: retire and expire disable the controls; keep leaves them
+ * alone. The sweep stops between records the moment disposal wins.
+ */
+export declare function sweepInteractionReconciliation(deps: InteractionReconcileDeps, records: readonly InteractionRecord[], facts: InteractionFacts): Promise<InteractionSweepResult>;

package/lib/features/reconcile-interactions.js

@@ -0,0 +1,54 @@
+/**
+ * Pending interaction reconciliation (design.md §9/§11 steps 3 and 10, task
+ * 15.7). At startup each pending interaction is judged against the Host's
+ * replayed pending baseline and generation. A replayed request keeps its
+ * controls; a resolution observed from another client retires them; a Host
+ * generation change with the interaction missing from the new baseline
+ * expires them fail-closed — the adapter never claims an answer was applied.
+ * The sweep accepts a disposal probe and stops touching anything the moment
+ * it turns false.
+ */
+/** Pure planning: given records and facts, decide each interaction's fate. */
+export function planInteractionReconciliation(records, facts) {
+    const actions = records.map((record) => {
+        if (record.remoteOutcome !== undefined) {
+            return { rpcId: record.rpcId, action: 'retire', reason: 'resolved-elsewhere', outcome: record.remoteOutcome };
+        }
+        const replayed = facts.pendingBaseline.has(record.rpcId);
+        if (replayed && facts.hostGeneration === record.seenGeneration) {
+            return { rpcId: record.rpcId, action: 'keep' };
+        }
+        if (facts.hostGeneration !== record.seenGeneration && !replayed) {
+            return { rpcId: record.rpcId, action: 'expire', reason: 'host-generation-change' };
+        }
+        return { rpcId: record.rpcId, action: 'retire', reason: 'resolved-elsewhere', outcome: undefined };
+    });
+    return { actions };
+}
+/**
+ * Apply the plan: retire and expire disable the controls; keep leaves them
+ * alone. The sweep stops between records the moment disposal wins.
+ */
+export async function sweepInteractionReconciliation(deps, records, facts) {
+    const plan = planInteractionReconciliation(records, facts);
+    const result = { kept: [], retired: [], expired: [], aborted: false };
+    for (let index = 0; index < plan.actions.length; index += 1) {
+        if (deps.shouldContinue?.() === false) {
+            result.aborted = true;
+            return result;
+        }
+        const action = plan.actions[index];
+        if (action === undefined)
+            continue;
+        if (action.action === 'keep') {
+            result.kept.push(action.rpcId);
+            continue;
+        }
+        await deps.disable(action.rpcId);
+        if (action.action === 'expire')
+            result.expired.push(action.rpcId);
+        else
+            result.retired.push(action.rpcId);
+    }
+    return result;
+}

package/lib/features/session-adopt.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Cold session adoption (design.md §13, task 9.2). Resuming a
+ * not-currently-bound session adopts it into ONE new writable Discord
+ * thread: ownership is claimed, thread→session is bound durably, and a
+ * bounded slice of recent history is shown — the model is never prompted by
+ * adoption itself. Subagent sessions are not adoptable; a session that
+ * cannot be inspected refuses before anything is created.
+ */
+import type { BindingStore } from '../state/bindings.js';
+import type { ThreadBinding } from '../state/records.js';
+import type { SessionOwnerStore } from '../state/session-owners.js';
+export interface InspectedSession {
+    sessionId: string;
+    workspaceId: string;
+    archived: boolean;
+    isSubagent: boolean;
+    history: ReadonlyArray<{
+        index: number;
+        role: string;
+    }>;
+}
+export interface DshSessionInspectPort {
+    inspect(request: {
+        sessionId: string;
+    }): Promise<{
+        outcome: 'found';
+        session: InspectedSession;
+    } | {
+        outcome: 'not-found';
+    } | {
+        outcome: 'failed';
+    } | {
+        outcome: 'unknown';
+    }>;
+}
+export interface DiscordThreadPort {
+    createThread(request: {
+        parentChannelId: string;
+        name: string;
+    }): Promise<{
+        outcome: 'completed';
+        threadId: string;
+    } | {
+        outcome: 'failed';
+    } | {
+        outcome: 'unknown';
+    }>;
+    findThreadBySource(sourceMessageId: string): Promise<{
+        outcome: 'found';
+        threadId: string;
+    } | {
+        outcome: 'not-found';
+    }>;
+}
+/** Bounded recent history shown on adoption (design.md §13: bounded display). */
+export declare const ADOPTION_HISTORY_LIMIT = 10;
+export interface SessionAdoptionDeps {
+    sessions: DshSessionInspectPort;
+    discord: DiscordThreadPort;
+    threadBindings: BindingStore<ThreadBinding>;
+    owners: SessionOwnerStore;
+    nowMs: () => number;
+}
+export type SessionAdoptionResult = {
+    outcome: 'adopted';
+    threadId: string;
+    sessionId: string;
+    workspaceId: string;
+    /** Recent history, oldest → newest, capped at the display limit. */
+    history: InspectedSession['history'];
+} | {
+    outcome: 'refused';
+    reason: 'subagent-not-adoptable' | 'session-disappeared';
+} | {
+    outcome: 'conflict';
+    ownedByThreadId: string;
+} | {
+    outcome: 'failed';
+} | {
+    outcome: 'unknown';
+};
+export declare function createSessionAdoptionFlow(deps: SessionAdoptionDeps): {
+    adopt(request: {
+        sessionId: string;
+        guildId: string;
+        parentChannelId: string;
+        createdBy: string;
+    }): Promise<SessionAdoptionResult>;
+};

package/lib/features/session-adopt.js

@@ -0,0 +1,77 @@
+/**
+ * Cold session adoption (design.md §13, task 9.2). Resuming a
+ * not-currently-bound session adopts it into ONE new writable Discord
+ * thread: ownership is claimed, thread→session is bound durably, and a
+ * bounded slice of recent history is shown — the model is never prompted by
+ * adoption itself. Subagent sessions are not adoptable; a session that
+ * cannot be inspected refuses before anything is created.
+ */
+import { threadBindingKey } from '../state/domain.js';
+/** Bounded recent history shown on adoption (design.md §13: bounded display). */
+export const ADOPTION_HISTORY_LIMIT = 10;
+export function createSessionAdoptionFlow(deps) {
+    return {
+        async adopt(request) {
+            const inspected = await deps.sessions.inspect({ sessionId: request.sessionId });
+            if (inspected.outcome === 'not-found') {
+                return { outcome: 'refused', reason: 'session-disappeared' };
+            }
+            if (inspected.outcome === 'failed')
+                return { outcome: 'failed' };
+            if (inspected.outcome === 'unknown')
+                return { outcome: 'unknown' };
+            if (inspected.session.isSubagent) {
+                return { outcome: 'refused', reason: 'subagent-not-adoptable' };
+            }
+            // Claim ownership BEFORE creating the thread: a session already owned
+            // by another thread conflicts explicitly — never an implicit takeover.
+            const ownership = await deps.owners.claim({
+                sessionId: request.sessionId,
+                threadId: `pending:${request.sessionId}`,
+                guildId: request.guildId,
+                claimedAtMs: deps.nowMs(),
+            });
+            if (ownership.outcome === 'conflict') {
+                return { outcome: 'conflict', ownedByThreadId: ownership.record.threadId };
+            }
+            const owningThread = ownership.outcome === 'claimed'
+                ? ownership.record.threadId
+                : ownership.record.threadId;
+            const created = await deps.discord.createThread({
+                parentChannelId: request.parentChannelId,
+                name: `Resume: ${request.sessionId}`,
+            });
+            if (created.outcome !== 'completed') {
+                // Release the pending ownership so a retry can claim cleanly.
+                await deps.owners.release({ sessionId: request.sessionId, threadId: owningThread });
+                return created.outcome === 'failed' ? { outcome: 'failed' } : { outcome: 'unknown' };
+            }
+            // Re-key ownership from the pending marker to the real thread id.
+            await deps.owners.release({ sessionId: request.sessionId, threadId: owningThread });
+            const owned = await deps.owners.claim({
+                sessionId: request.sessionId,
+                threadId: created.threadId,
+                guildId: request.guildId,
+                claimedAtMs: deps.nowMs(),
+            });
+            if (owned.outcome === 'conflict') {
+                return { outcome: 'failed' };
+            }
+            const bound = await deps.threadBindings.bind(threadBindingKey({ applicationId: 'app', guildId: request.guildId, threadId: created.threadId }), {
+                sessionId: request.sessionId,
+                workspaceId: inspected.session.workspaceId,
+                createdBy: request.createdBy,
+                createdAtMs: deps.nowMs(),
+            });
+            if (!bound.ok)
+                return { outcome: 'failed' };
+            return {
+                outcome: 'adopted',
+                threadId: created.threadId,
+                sessionId: request.sessionId,
+                workspaceId: inspected.session.workspaceId,
+                history: inspected.session.history.slice(-ADOPTION_HISTORY_LIMIT),
+            };
+        },
+    };
+}

package/lib/features/session-creation.d.ts

@@ -0,0 +1,49 @@
+/**
+ * DSH session creation for a new thread (design.md §10, task 8.3). The
+ * adapter preallocates the session id and hands it to `session.create`, so
+ * DSH can adopt the same id idempotently after an uncertain response. Success
+ * binds the thread durably (single writable owner); a bound thread replays
+ * its existing session without any DSH call; rejection and unknown outcomes
+ * leave the thread unbound — reconciliation, never blind retry, decides what
+ * actually happened.
+ */
+import { type ThreadBindingScope } from '../state/domain.js';
+import type { BindingStore } from '../state/bindings.js';
+import type { ThreadBinding } from '../state/records.js';
+/** The DSH session-creation surface the flow needs. */
+export interface DshSessionPort {
+    createSession(request: {
+        sessionId: string;
+        workspaceId: string;
+    }): Promise<{
+        outcome: 'completed';
+        sessionId: string;
+    } | {
+        outcome: 'rejected';
+        reason: string;
+    } | {
+        outcome: 'unknown';
+    }>;
+}
+export interface SessionCreationDeps {
+    sessions: DshSessionPort;
+    threadBindings: BindingStore<ThreadBinding>;
+    /** Preallocation source for session ids (design.md §10). */
+    newSessionId: () => string;
+}
+export type SessionCreationResult = {
+    outcome: 'created';
+    sessionId: string;
+} | {
+    outcome: 'rejected';
+} | {
+    outcome: 'unknown';
+};
+export declare function createSessionCreationFlow(deps: SessionCreationDeps): {
+    ensureSession(request: {
+        scope: ThreadBindingScope;
+        workspaceId: string;
+        createdBy: string;
+        nowMs: number;
+    }): Promise<SessionCreationResult>;
+};

package/lib/features/session-creation.js

@@ -0,0 +1,43 @@
+/**
+ * DSH session creation for a new thread (design.md §10, task 8.3). The
+ * adapter preallocates the session id and hands it to `session.create`, so
+ * DSH can adopt the same id idempotently after an uncertain response. Success
+ * binds the thread durably (single writable owner); a bound thread replays
+ * its existing session without any DSH call; rejection and unknown outcomes
+ * leave the thread unbound — reconciliation, never blind retry, decides what
+ * actually happened.
+ */
+import { threadBindingKey } from '../state/domain.js';
+export function createSessionCreationFlow(deps) {
+    return {
+        async ensureSession(request) {
+            const key = threadBindingKey(request.scope);
+            // Replay or crash-recovery: an existing binding IS the answer.
+            const existing = deps.threadBindings.get(key);
+            if (existing !== undefined) {
+                return { outcome: 'created', sessionId: existing.sessionId };
+            }
+            const preallocatedId = deps.newSessionId();
+            const created = await deps.sessions.createSession({
+                sessionId: preallocatedId,
+                workspaceId: request.workspaceId,
+            });
+            if (created.outcome === 'completed') {
+                const bound = await deps.threadBindings.bind(key, {
+                    sessionId: created.sessionId,
+                    workspaceId: request.workspaceId,
+                    createdBy: request.createdBy,
+                    createdAtMs: request.nowMs,
+                });
+                if (!bound.ok) {
+                    // Lost a bind race to a concurrent creator: its session wins.
+                    const winner = deps.threadBindings.get(key);
+                    return { outcome: 'created', sessionId: winner?.sessionId ?? created.sessionId };
+                }
+                return { outcome: 'created', sessionId: created.sessionId };
+            }
+            // Rejection and unknown: stay unbound, report the outcome as a value.
+            return created.outcome === 'rejected' ? { outcome: 'rejected' } : { outcome: 'unknown' };
+        },
+    };
+}

package/lib/features/session-mainline.d.ts

@@ -0,0 +1,75 @@
+/**
+ * The session mainline (Phase 1 composition): the one orchestrator both
+ * Discord ingress paths share. `admitMention` walks a bound-channel mention
+ * through intent claim → thread creation → session creation → at-most-once
+ * prompt → adapter-owned turn registration; `continueInThread` queues every
+ * later Thread message through the same idempotent prompt flow. Each step's
+ * outcome surfaces as a value so the Discord layer can answer honestly —
+ * nothing here retries or invents a fourth state.
+ */
+import type { createThreadCreationFlow } from './thread-creation.js';
+import type { createSessionCreationFlow } from './session-creation.js';
+import type { createPromptSubmissionFlow } from './prompt-submission.js';
+import type { TurnTracker } from './turn-ownership.js';
+export interface SessionMainlineDeps {
+    threads: ReturnType<typeof createThreadCreationFlow>;
+    sessions: ReturnType<typeof createSessionCreationFlow>;
+    prompts: ReturnType<typeof createPromptSubmissionFlow>;
+    turns: TurnTracker;
+}
+export type MentionMainlineResult = {
+    outcome: 'admitted';
+    threadId: string;
+    sessionId: string;
+} | {
+    outcome: 'thread-conflict';
+} | {
+    outcome: 'thread-failed';
+} | {
+    outcome: 'session-rejected';
+} | {
+    outcome: 'session-unknown';
+} | {
+    outcome: 'prompt-rejected';
+} | {
+    outcome: 'prompt-unknown';
+};
+export interface MentionMainlineRequest {
+    applicationId: string;
+    guildId: string;
+    /** The bound project channel the mention arrived in. */
+    channelId: string;
+    messageId: string;
+    authorId: string;
+    workspaceId: string;
+    prompt: string;
+}
+export type ContinuationMainlineResult = {
+    outcome: 'queued';
+} | {
+    outcome: 'already-submitted';
+} | {
+    outcome: 'conflict';
+} | {
+    outcome: 'rejected';
+} | {
+    outcome: 'unknown';
+};
+export interface ContinuationMainlineRequest {
+    applicationId: string;
+    guildId: string;
+    threadId: string;
+    sessionId: string;
+    messageId: string;
+    prompt: string;
+}
+/**
+ * The stable, adapter-owned request id for a submitted prompt: derived from
+ * the Discord message id, recorded on the intent before the DSH call, and
+ * echoed by the Host onto the durable `user/message` (`source.rpcId`).
+ */
+export declare function requestIdFor(messageId: string): string;
+export declare function createSessionMainline(deps: SessionMainlineDeps): {
+    admitMention(request: MentionMainlineRequest): Promise<MentionMainlineResult>;
+    continueInThread(request: ContinuationMainlineRequest): Promise<ContinuationMainlineResult>;
+};

package/lib/features/session-mainline.js

@@ -0,0 +1,96 @@
+/**
+ * The session mainline (Phase 1 composition): the one orchestrator both
+ * Discord ingress paths share. `admitMention` walks a bound-channel mention
+ * through intent claim → thread creation → session creation → at-most-once
+ * prompt → adapter-owned turn registration; `continueInThread` queues every
+ * later Thread message through the same idempotent prompt flow. Each step's
+ * outcome surfaces as a value so the Discord layer can answer honestly —
+ * nothing here retries or invents a fourth state.
+ */
+import { hashPayload } from '../state/intents.js';
+import { safeTitle } from '../policy/disclosure.js';
+/**
+ * The stable, adapter-owned request id for a submitted prompt: derived from
+ * the Discord message id, recorded on the intent before the DSH call, and
+ * echoed by the Host onto the durable `user/message` (`source.rpcId`).
+ */
+export function requestIdFor(messageId) {
+    return `discord:${messageId}`;
+}
+/** Register the turn after an accepted submission; a second claim is a no-op. */
+function ownTurn(deps, turn) {
+    deps.turns.register(turn);
+}
+function mapSubmission(result) {
+    if (result.outcome === 'accepted')
+        return { outcome: 'queued' };
+    if (result.outcome === 'already-submitted')
+        return { outcome: 'already-submitted' };
+    if (result.outcome === 'conflict')
+        return { outcome: 'conflict' };
+    return result.outcome === 'rejected' ? { outcome: 'rejected' } : { outcome: 'unknown' };
+}
+export function createSessionMainline(deps) {
+    return {
+        async admitMention(request) {
+            // The source message id is the durable intent: one thread per message,
+            // deterministic recovery on redelivery (design.md §4, §10).
+            const thread = await deps.threads.ensureThread({
+                sourceMessageId: request.messageId,
+                contentHash: await hashPayload({ prompt: request.prompt }),
+                guildId: request.guildId,
+                parentChannelId: request.channelId,
+                threadName: safeTitle(request.prompt),
+                creatorUserId: request.authorId,
+            });
+            if (thread.outcome === 'conflict')
+                return { outcome: 'thread-conflict' };
+            if (thread.outcome !== 'created' && thread.outcome !== 'recovered') {
+                return { outcome: 'thread-failed' };
+            }
+            const threadId = thread.threadId;
+            const scope = { applicationId: request.applicationId, guildId: request.guildId, threadId };
+            const session = await deps.sessions.ensureSession({
+                scope,
+                workspaceId: request.workspaceId,
+                createdBy: request.authorId,
+                nowMs: Date.now(),
+            });
+            if (session.outcome === 'rejected')
+                return { outcome: 'session-rejected' };
+            if (session.outcome === 'unknown')
+                return { outcome: 'session-unknown' };
+            const sessionId = session.sessionId;
+            const requestId = requestIdFor(request.messageId);
+            const submitted = await deps.prompts.submitOnce({
+                requestId,
+                sessionId,
+                prompt: request.prompt,
+            });
+            if (submitted.outcome === 'accepted') {
+                ownTurn(deps, { sessionId, requestId, threadId });
+                return { outcome: 'admitted', threadId, sessionId };
+            }
+            // A replay lands here with `already-submitted`: the binding and thread
+            // still exist, so the visible state is identical to the first admit.
+            if (submitted.outcome === 'already-submitted') {
+                return { outcome: 'admitted', threadId, sessionId };
+            }
+            if (submitted.outcome === 'conflict')
+                return { outcome: 'thread-conflict' };
+            return submitted.outcome === 'rejected' ? { outcome: 'prompt-rejected' } : { outcome: 'prompt-unknown' };
+        },
+        async continueInThread(request) {
+            const requestId = requestIdFor(request.messageId);
+            const submitted = await deps.prompts.submitOnce({
+                requestId,
+                sessionId: request.sessionId,
+                prompt: request.prompt,
+            });
+            if (submitted.outcome === 'accepted') {
+                ownTurn(deps, { sessionId: request.sessionId, requestId, threadId: request.threadId });
+            }
+            return mapSubmission(submitted);
+        },
+    };
+}