@inetafrica/open-claudia 2.10.0 → 2.11.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## v2.11.0
+- **Unified multi-channel identity is now LIVE by default (Phases 0 + 1).** v2.10.0 shipped the split-brain fix inert behind `OC_UNIFIED_IDENTITY` (default off). This release flips the default **on** and lands the Phase 1 queue-routing fix that made it safe to do so. The owner's Telegram, Kazee and voice channels now resolve to one canonical person out of the box — one state, one session, one transcript, one run-lock — so the bot stops fracturing into a separate assistant per channel. The flag stays as an operator **kill-switch** (`OC_UNIFIED_IDENTITY=0` + restart) for reversibility (risk R14); it is no longer a hold-back gate.
+- **Person-scoped queue routing (Phase 1, 1.2) — the blocker that kept the flag off.** Under unified identity the owner's channels share one run-lock and message queue, so a message sent from one channel while a run is in flight on another used to drain in the *finishing* turn's async scope — a Kazee follow-up could be answered in the Telegram chat. Each queued message now **captures its origin channel** at enqueue time, and `drainQueuedMessages` peels off one same-origin run at a time (requeuing the rest so the natural close→drain tail-recursion handles the next group), scoping each drained reply to `chatContext.run(origin, …)`. Replies always route back to the channel the message came from; same-origin batches behave exactly as before. Grouping logic extracted to a pure, unit-tested `core/queue-drain.js`.
+- **Cross-channel dedup (0.3).** `router.isDuplicate` is re-keyed from `adapter:channel:msg` to `canonical:adapter:msg` — a message redelivered against a different channel that resolves to the same person is now caught once the owner's channels are unified (adapter stays in the key, so distinct messages that merely share a numeric id across transports are never collapsed).
+- **First-contact migration (0.2 / 1.1) fires automatically.** With the flag on, the first inbound message from a previously-siloed owner channel folds its pre-existing state + sessions into the owner bucket — non-destructive, idempotent, and backed up to `~/.open-claudia/backups/` first (unchanged from v2.10.0, now actually reached). Pre-migration per-channel transcripts remain as separate files and stay reachable via `transcript-search --all`; new history accretes under the unified person id (1.3).
+- **Tests.** `test-unified-identity.js` gains a `default` (unset ⇒ on) child to lock the new default and proves an explicit `0` still reverts to strict per-channel resolution; new `test-queue-routing.js` covers origin keying, same-origin batching, mixed-origin split/requeue, and legacy (pre-capture) fallback. Full suite green.
+- **Agent-space / OpenClaw:** no new deps or required env; Docker image builds identically. Existing single-owner deployments see unified behaviour for the owner's own channels only — strangers still resolve to their own isolated bucket (the per-person guardrail arrives in Phase 3).
+
 ## v2.10.0
 - **Unified multi-channel identity — foundation, gated OFF by default (Phase 0).** An owned bot is meant to be one mind across every channel its owner reaches it on; today it split-brains because conversation state (session, transcript, run-lock, queue) is keyed per `transport:channelId`, so an unlinked channel (voice bridge, a stray Kazee DM) becomes a separate assistant with its own history. This release lands the identity-resolution foundation behind a single flag, `OC_UNIFIED_IDENTITY` (default **off**). **With the flag off nothing changes** — every new code path is gated, so publishing this version is behaviourally identical to v2.9.3 until an operator sets `OC_UNIFIED_IDENTITY=1` and restarts. Boot log now prints `Unified identity: on|off` for visibility.
 - **Resolution seam (0.1).** `identity.canonicalForChannel` — the single chokepoint every adapter (Telegram/Kazee/voice) routes through — gains a flag-gated branch: a *configured owner channel* (one whose `transport:channelId` matches an operator-declared owner id — a `TELEGRAM_CHAT_ID`, `KAZEE_OWNER_USER_ID`, or `VOICE_OWNER_USER_ID`) with no explicit `/link` now resolves to the single owner canonical (the owner's first-linked handle, matching `people.linkHandle`'s primary convention). Because it's the one seam, state/transcript/scheduler all unify downstream for free. Owner detection uses only trusted, operator-set signals — never a guess — so a stranger's channel can never be merged by mistake (verified: a non-owner channel still resolves to its own default bucket).

package/core/config.js

@@ -94,11 +94,12 @@ const DEFAULT_CLAUDE_MODEL = config.CLAUDE_MODEL || process.env.CLAUDE_MODEL ||
 const AUTO_COMPACT_TOKENS = parseInt(config.AUTO_COMPACT_TOKENS || process.env.AUTO_COMPACT_TOKENS || "380000", 10);
 const MIN_COMPACT_INTERVAL_MS = parseInt(config.MIN_COMPACT_INTERVAL_MS || process.env.MIN_COMPACT_INTERVAL_MS || "1800000", 10);
 const PROJECT_TRANSCRIPTS = configTruthy(config.PROJECT_TRANSCRIPTS || process.env.PROJECT_TRANSCRIPTS, true);
-// Unified multi-channel identity (Phase 0). Default OFF: when unset the bot
-// behaves exactly as before — every code path added for unification is gated
-// on this flag, so publishing is behaviourally inert until an operator flips
-// OC_UNIFIED_IDENTITY=1 in .env and restarts.
-const UNIFIED_IDENTITY = configTruthy(config.OC_UNIFIED_IDENTITY || process.env.OC_UNIFIED_IDENTITY, false);
+// Unified multi-channel identity. Default ON: the owner's Telegram, Kazee and
+// voice channels resolve to one canonical person, sharing one state, session,
+// transcript and run-lock (the split-brain fix). The flag remains as an
+// operator kill-switch for reversibility (R14) — set OC_UNIFIED_IDENTITY=0 in
+// .env and restart to fall back to strict per-channel behaviour.
+const UNIFIED_IDENTITY = configTruthy(config.OC_UNIFIED_IDENTITY || process.env.OC_UNIFIED_IDENTITY, true);
 const TRANSCRIPT_MAX_ENTRY_CHARS = parseInt(config.TRANSCRIPT_MAX_ENTRY_CHARS || process.env.TRANSCRIPT_MAX_ENTRY_CHARS || "12000", 10);
 const TRANSCRIPTS_DIR = config.TRANSCRIPTS_DIR || process.env.TRANSCRIPTS_DIR || path.join(CONFIG_DIR, "transcripts");
 const WHISPER_CLI = config.WHISPER_CLI || "";

package/core/queue-drain.js

@@ -0,0 +1,25 @@
+// Pure helpers for origin-aware queue draining. Kept separate from the runner
+// so the grouping logic — which decides where a drained reply is routed under
+// unified identity — is unit-testable without spawning a run.
+
+// A queued message's origin channel, or a sentinel for legacy items that were
+// queued before origin capture existed (those fall back to the finishing turn's
+// context, exactly as before).
+function originKey(item) {
+  return item && item.origin ? `${item.origin.transport}:${item.origin.channelId}` : "__current__";
+}
+
+// Split the leading run of same-origin messages off the front of the queue.
+// Returns { group, rest }: `group` is the contiguous same-origin prefix (to run
+// now, scoped to that origin), `rest` is everything after it (to be requeued so
+// the natural close→drain tail-recursion handles the next origin group). For a
+// non-empty queue, `group` always has at least one item.
+function splitLeadingOriginGroup(queue) {
+  if (!Array.isArray(queue) || queue.length === 0) return { group: [], rest: [] };
+  const firstKey = originKey(queue[0]);
+  let i = 0;
+  while (i < queue.length && originKey(queue[i]) === firstKey) i++;
+  return { group: queue.slice(0, i), rest: queue.slice(i) };
+}
+
+module.exports = { originKey, splitLeadingOriginGroup };

package/core/router.js

@@ -26,11 +26,14 @@ const { MAX_FILE_SIZE, MAX_VOICE_SIZE, FILES_DIR } = require("./config");
 const channelWizard = require("./channel-wizard");
 require("./handlers"); // side-effect: register slash commands
 
-// Per-adapter dedup. Telegram message_ids are unique per chat, not
-// globally; same goes for Kazee. Namespace by adapter:channel:msg.
+// Cross-channel dedup. Message ids are unique per adapter, not globally, so
+// the adapter stays in the key. Keying by canonical (not raw channelId) means
+// a message redelivered against a different channel that resolves to the same
+// person is still caught once the owner's channels are unified.
 const processedMessages = new Set();
 function isDuplicate(envelope) {
-  const key = `${envelope.adapter?.id || envelope.adapter?.type}:${envelope.channelId}:${envelope.messageId}`;
+  const canonical = envelope.canonicalUserId || envelope.channelId;
+  const key = `${canonical}:${envelope.adapter?.id || envelope.adapter?.type}:${envelope.messageId}`;
   if (processedMessages.has(key)) return true;
   processedMessages.add(key);
   if (processedMessages.size > 400) {

package/core/runner.js

@@ -13,6 +13,7 @@ const {
 } = require("./config");
 const { currentState, saveState, recordSession, userOwnsClaudeSession, resetSessionUsage } = require("./state");
 const { chatContext, currentChannelId, currentAdapter } = require("./context");
+const { splitLeadingOriginGroup } = require("./queue-drain");
 const { buildSystemPrompt, promptWithDynamicContext } = require("./system-prompt");
 const { redactSensitive } = require("./redact");
 const { send, editMessage, sendVoice, sendVoiceEnd, splitMessage } = require("./io");
@@ -782,7 +783,11 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   cwd = resolveRunCwd(cwd);
 
   if (state.runningProcess) {
-    state.messageQueue.push({ prompt, replyToMsgId, opts, queuedAt: Date.now() });
+    // Capture the origin channel so the drained reply routes back to where the
+    // message came from. Under unified identity the owner's channels share one
+    // run-lock and queue, so a Kazee message queued during a Telegram run must
+    // still be answered on Kazee — not wherever the finishing turn happens to be.
+    state.messageQueue.push({ prompt, replyToMsgId, opts, queuedAt: Date.now(), origin: store ? { ...store } : null });
     await send(state.isCompacting ? "Compacting context, will pick this up next…" : "Queued.", { replyTo: replyToMsgId });
     return;
   }
@@ -1132,10 +1137,19 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   };
 
   const drainQueuedMessages = async () => {
-    if (state.messageQueue.length > 0 && state.currentSession) {
-      const drained = state.messageQueue.splice(0);
-      if (drained.length === 1) {
-        const only = drained[0];
+    if (state.messageQueue.length === 0 || !state.currentSession) return;
+    const drained = state.messageQueue.splice(0);
+    // Handle one same-origin run at a time; requeue the remainder so the
+    // finishing turn's close→drain tail-recursion picks up the next origin
+    // group. Each group's reply is scoped to the channel it came from, so a
+    // message queued from one of the owner's channels during a run on another
+    // is still answered on its own channel (unified identity, one run-lock).
+    const { group, rest } = splitLeadingOriginGroup(drained);
+    if (rest.length) state.messageQueue.unshift(...rest);
+
+    const runGroup = async () => {
+      if (group.length === 1) {
+        const only = group[0];
         await runClaude(only.prompt, state.currentSession.dir, only.replyToMsgId, only.opts);
       } else {
         const fmtTime = (ts) => {
@@ -1145,16 +1159,20 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
           const ss = String(d.getSeconds()).padStart(2, "0");
           return `${hh}:${mm}:${ss}`;
         };
-        const numbered = drained.map((m, i) => `[${i + 1}] (${fmtTime(m.queuedAt || Date.now())}) ${m.prompt}`).join("\n\n");
+        const numbered = group.map((m, idx) => `[${idx + 1}] (${fmtTime(m.queuedAt || Date.now())}) ${m.prompt}`).join("\n\n");
         const batched =
-          `While you were working the user sent these ${drained.length} follow-up messages (oldest first):\n\n` +
+          `While you were working the user sent these ${group.length} follow-up messages (oldest first):\n\n` +
           `${numbered}\n\n` +
           `Treat each as a distinct follow-up request. Add them to your plan and handle them; ` +
           `if any contradicts an earlier one, prefer the newer one and call out the conflict.`;
-        const last = drained[drained.length - 1];
+        const last = group[group.length - 1];
         await runClaude(batched, state.currentSession.dir, last.replyToMsgId, last.opts);
       }
-    }
+    };
+
+    const origin = group[0].origin;
+    if (origin) await chatContext.run(origin, runGroup);
+    else await runGroup();
   };
 
   const updateProgress = async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-unified-identity.js"
+    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-queue-routing.js"
   },
   "files": [
     "bot.js",
@@ -50,7 +50,10 @@
     "test-tool-guard.js",
     "test-tooling-mode.js",
     "test-tool-manifest.js",
-    "test-approval-async.js"
+    "test-approval-async.js",
+    "test-recall-evolution.js",
+    "test-unified-identity.js",
+    "test-queue-routing.js"
   ],
   "keywords": [
     "claude",

package/test-queue-routing.js

@@ -0,0 +1,52 @@
+// Origin-aware queue draining. Under unified identity the owner's channels
+// share one run-lock and message queue, so a message queued from one channel
+// during a run on another must still be answered on its own channel. These
+// tests lock in the grouping that guarantees that routing.
+
+const assert = require("assert");
+const { originKey, splitLeadingOriginGroup } = require("./core/queue-drain");
+
+const tg = (id) => ({ prompt: `m${id}`, origin: { transport: "telegram", channelId: "6251055967" } });
+const kz = (id) => ({ prompt: `m${id}`, origin: { transport: "kazee", channelId: "abc" } });
+const legacy = (id) => ({ prompt: `m${id}` }); // queued before origin capture
+
+// originKey
+assert.strictEqual(originKey(tg(1)), "telegram:6251055967", "telegram key");
+assert.strictEqual(originKey(kz(1)), "kazee:abc", "kazee key");
+assert.strictEqual(originKey(legacy(1)), "__current__", "legacy → sentinel");
+
+// Empty queue
+assert.deepStrictEqual(splitLeadingOriginGroup([]), { group: [], rest: [] }, "empty");
+
+// All one origin → single group, no remainder (the common case: preserves the
+// prior single-batch behaviour, now scoped to that origin).
+{
+  const q = [tg(1), tg(2), tg(3)];
+  const { group, rest } = splitLeadingOriginGroup(q);
+  assert.strictEqual(group.length, 3, "same-origin: all grouped");
+  assert.strictEqual(rest.length, 0, "same-origin: nothing requeued");
+}
+
+// Mixed origins → only the leading same-origin run comes out; the rest is
+// requeued so the next drain routes it to its own channel.
+{
+  const q = [tg(1), tg(2), kz(3), tg(4)];
+  const { group, rest } = splitLeadingOriginGroup(q);
+  assert.deepStrictEqual(group.map((m) => m.prompt), ["m1", "m2"], "leading telegram group");
+  assert.deepStrictEqual(rest.map((m) => m.prompt), ["m3", "m4"], "kazee + later telegram requeued");
+  // Draining the remainder next peels off the kazee message on its own.
+  const next = splitLeadingOriginGroup(rest);
+  assert.deepStrictEqual(next.group.map((m) => m.prompt), ["m3"], "next drain: kazee alone");
+  assert.deepStrictEqual(next.rest.map((m) => m.prompt), ["m4"], "next drain: trailing telegram requeued");
+}
+
+// Legacy items (no origin) group together under the sentinel and fall back to
+// the finishing turn's context — matching pre-change behaviour.
+{
+  const q = [legacy(1), legacy(2), tg(3)];
+  const { group, rest } = splitLeadingOriginGroup(q);
+  assert.deepStrictEqual(group.map((m) => m.prompt), ["m1", "m2"], "legacy grouped");
+  assert.deepStrictEqual(rest.map((m) => m.prompt), ["m3"], "origin item requeued");
+}
+
+console.log("queue-routing OK");

package/test-recall-evolution.js

@@ -0,0 +1,214 @@
+// v2.6.59 evolution: dream-tunable knobs (bounded, env-pinned, revertible),
+// walker cascade verdicts, per-node evidence, windowed health deltas, delta
+// dreaming (dump selection + merge clusters), reviewer skip-gate, journal
+// backfill dedupe, and version-stamped KPI aggregation.
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+// Redirect EVERYTHING before any require: CONFIG_DIR derives from HOME, and
+// metrics._resetForTest() deletes files — must never touch live telemetry.
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "recall-evolution-"));
+process.env.HOME = tmp;
+process.env.PACKS_DIR = path.join(tmp, "packs");
+process.env.RECALL_GRAPH_DB = path.join(tmp, "graph.db");
+delete process.env.RECALL_WALKER_MAX_CANDIDATES;
+
+const tuning = require("./core/recall/tuning");
+const metrics = require("./core/recall/metrics");
+const disc = require("./core/recall/discoverer");
+const review = require("./core/pack-review");
+const dream = require("./core/dream");
+const kpi = require("./core/recall/kpi");
+const packs = require("./core/packs");
+
+// ── tuning: bounds, precedence, revert ──
+tuning._resetForTest();
+assert.strictEqual(tuning.get("walkerMaxCandidates"), 14, "default value");
+assert.strictEqual(tuning.get("cascade"), "on", "enum default");
+assert.strictEqual(tuning.get("nope"), undefined, "unknown knob → undefined");
+
+const ch = tuning.set("walkerMaxCandidates", 18, { reason: "test", evidence: "unit" });
+assert.deepStrictEqual({ knob: ch.knob, from: ch.from, to: ch.to }, { knob: "walkerMaxCandidates", from: 14, to: 18 });
+assert.strictEqual(tuning.get("walkerMaxCandidates"), 18, "set applies");
+assert.strictEqual(tuning.set("walkerMaxCandidates", 18), null, "no-op set rejected");
+assert.strictEqual(tuning.set("walkerMaxCandidates", 99).to, 20, "clamped to max");
+assert.strictEqual(tuning.set("bogusKnob", 5), null, "unknown knob rejected");
+assert.strictEqual(tuning.set("cascade", "sideways"), null, "illegal enum clamps to default → no-op");
+assert.strictEqual(tuning.get("cascade") === "on" || tuning.get("cascade") === "off", true);
+
+process.env.RECALL_WALKER_MAX_CANDIDATES = "10";
+assert.strictEqual(tuning.get("walkerMaxCandidates"), 10, "env pin wins over tuning file");
+assert.strictEqual(tuning.set("walkerMaxCandidates", 16), null, "env-pinned knob refuses dream writes");
+delete process.env.RECALL_WALKER_MAX_CANDIDATES;
+
+const rv = tuning.revert("walkerMaxCandidates", { reason: "test rollback" });
+assert.strictEqual(rv.to, 18, "revert restores the value before the last change");
+assert.ok(tuning.history().some((h) => /^rollback:/.test(h.reason)), "rollback recorded in history");
+assert.ok(tuning.lastChange() && !/^rollback:/.test(tuning.lastChange().reason), "lastChange skips rollbacks");
+
+// ── cascade verdicts: conservative, evidence-only ──
+assert.strictEqual(disc.cascadeVerdict(null), null, "no history → judge");
+assert.strictEqual(disc.cascadeVerdict({ seen: 6, kept: 0, open: 0, rev: 0 }), "drop", "seen≥6 never kept never used → drop");
+assert.strictEqual(disc.cascadeVerdict({ seen: 5, kept: 4, open: 1 }), "keep", "keep-rate ≥0.8 with real use → keep");
+assert.strictEqual(disc.cascadeVerdict({ seen: 5, kept: 4, open: 0, rev: 0 }), null, "high keep but never used → judge");
+assert.strictEqual(disc.cascadeVerdict({ seen: 3, kept: 0, open: 0 }), null, "too little history → judge");
+assert.strictEqual(disc.cascadeVerdict({ seen: 6, kept: 1, open: 0 }), null, "ambiguous middle → judge");
+
+// ── metrics: node stats, rescues, co-rescue pairs, evidence ──
+metrics._resetForTest();
+for (let i = 0; i < 7; i++) {
+  metrics.logTurn({
+    query: "q", tier: "full",
+    seeds: [{ id: "pack:seeded", score: 3 }],
+    activated: [{ id: "pack:noisy", activation: 0.5, hop: 1 }],
+    cand: [{ id: "pack:seeded", act: false }, { id: "pack:noisy", act: true }],
+    kept: i < 3 ? [{ id: "pack:seeded", why: "w" }, { id: "pack:resc-a", why: "w" }, { id: "pack:resc-b", why: "w" }]
+                : [{ id: "pack:seeded", why: "w" }],
+    latencyMs: 1000, costUsd: 0.001,
+  });
+}
+metrics.logUse(["pack:seeded"]);
+metrics.logUse(["pack:seeded"], "reviewer");
+const ns = metrics.nodeStats().nodes;
+assert.strictEqual(ns["pack:noisy"].seen, 7, "candidate seen count accumulates");
+assert.strictEqual(ns["pack:noisy"].kept, 0, "never-kept stays zero");
+assert.strictEqual(ns["pack:noisy"].act, 7, "graph-arrival count tracked");
+assert.strictEqual(ns["pack:resc-a"].resc, 3, "kept-without-seed counts as rescue");
+assert.strictEqual(ns["pack:seeded"].open, 1, "📖 open tracked per node");
+assert.strictEqual(ns["pack:seeded"].rev, 1, "reviewer credit tracked per node");
+
+const ev = metrics.evidence({ minSeen: 6, coRescueMin: 3 });
+assert.ok(ev.neverKept.some((n) => n.id === "pack:noisy"), "noisy node lands in neverKept");
+assert.ok(!ev.neverKept.some((n) => n.id === "pack:seeded"), "used node never in neverKept");
+assert.ok(ev.coRescuePairs.some((p) => p.a === "pack:resc-a" && p.b === "pack:resc-b" && p.n === 3), "co-rescue pair counted");
+assert.ok(ev.summary.turns === 7, "evidence carries the raw summary");
+
+// cascadeVerdict against the accumulated stats: noisy is a drop, seeded needs more
+assert.strictEqual(disc.cascadeVerdict(ns["pack:noisy"]), "drop", "real accumulated stats produce a drop verdict");
+
+// ── dream: windowed deltas + health ──
+const delta = dream.summaryDelta(
+  { turns: 10, opens: 5, keptTotal: 12, rescueTurns: 3, latencyMsTotal: 30000, shadowChecks: 4, shadowAgree: 4, byTier: { full: { n: 4, ms: 40000 }, seeds: { n: 6, ms: 600 } } },
+  { turns: 6, opens: 2, keptTotal: 6, rescueTurns: 1, latencyMsTotal: 10000, byTier: { full: { n: 2, ms: 10000 } } }
+);
+assert.strictEqual(delta.turns, 4);
+assert.strictEqual(delta.opens, 3);
+assert.deepStrictEqual(delta.byTier.full, { n: 2, ms: 30000 });
+assert.deepStrictEqual(delta.byTier.seeds, { n: 6, ms: 600 });
+const health = dream.healthOf({ turns: 10, rescueTurns: 3, keptTotal: 10, opens: 2, reviewerUses: 1, latencyMsTotal: 20000 });
+assert.strictEqual(health.rescueRate, 0.3);
+assert.strictEqual(health.noiseRate, 0.7);
+assert.strictEqual(health.avgLatencyMs, 2000);
+
+// ── dream: merge clusters (similarity + ability boundary) ──
+const mkPack = (dir, name, description, kind) => ({ dir, name, description, tags: ["kazee", "mobile"], kind });
+const clusters = dream.mergeClusters([
+  mkPack("kazee-mobile-deploy", "Kazee Mobile Deployment", "APK versionCode updater pipeline GitLab CI"),
+  mkPack("kazee-mobile-deployment", "Kazee Mobile Deployment", "APK versionCode updater pipeline GitLab"),
+  mkPack("villa-heatmap", "Villa WiFi Heatmap", "LAN hosted survey renders access points"),
+]);
+assert.strictEqual(clusters.length, 1, "one similar pair clusters");
+assert.deepStrictEqual([...clusters[0]].sort(), ["kazee-mobile-deploy", "kazee-mobile-deployment"]);
+const abilitySplit = dream.mergeClusters([
+  mkPack("deploy-a", "Kazee Mobile Deployment", "APK versionCode updater pipeline", "ability"),
+  mkPack("deploy-b", "Kazee Mobile Deployment", "APK versionCode updater pipeline"),
+]);
+assert.strictEqual(abilitySplit.length, 0, "ability/context never cluster together");
+
+// ── dream: delta dump selection ──
+const now = Date.now();
+const iso = (d) => new Date(d).toISOString();
+const corpus = [
+  { dir: "touched", updated: iso(now - 3600e3), tags: [] },
+  { dir: "stale", updated: iso(now - 40 * 86400e3), tags: [] },
+  { dir: "concernpack", updated: iso(now - 40 * 86400e3), tags: ["concern"] },
+  { dir: "clustered", updated: iso(now - 40 * 86400e3), tags: [] },
+];
+const since = iso(now - 86400e3);
+const dump = dream.selectDumpDirs(corpus, { sinceTs: since, fullSweep: false, clusters: [["clustered", "touched"]] });
+assert.ok(dump.has("touched"), "touched pack dumped in full");
+assert.ok(dump.has("concernpack"), "shared concern always dumped");
+assert.ok(dump.has("clustered"), "merge-cluster member dumped");
+assert.ok(!dump.has("stale"), "untouched pack stays an index row");
+const sweep = dream.selectDumpDirs(corpus, { sinceTs: since, fullSweep: true, clusters: [] });
+assert.strictEqual(sweep.size, 4, "full sweep dumps everything");
+
+// ── reviewer skip-gate: only provably-empty turns skip ──
+const pad = "The deployment pipeline completed and artifacts were archived. ".repeat(8); // ~500 chars, no preference words
+assert.strictEqual(review.shouldSkipReview({ userText: "ok", assistantText: "", signals: {} }), "short");
+assert.strictEqual(review.shouldSkipReview({ userText: "thanks!", assistantText: pad, signals: { tier: "skip" } }), "trivial");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad, signals: { tier: "seeds", wrote: false } }), "lookup");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad, signals: { tier: "seeds", wrote: true } }), null, "a write means review");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad, signals: { tier: "seeds" } }), null, "unknown wrote-state means review");
+assert.strictEqual(review.shouldSkipReview({ userText: "remember the fup rule", assistantText: pad, signals: { tier: "seeds", wrote: false } }), null, "preference language escapes the skip");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad, signals: { tier: "full", wrote: false } }), null, "full tier always reviews");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad + pad + pad, signals: { tier: "seeds", wrote: false } }), null, "long turns always review");
+
+// ── dream: journal backfill dedupe ──
+packs.createPack({ dir: "backfill-me", name: "Backfill", description: "test" });
+const p = packs.readPack("backfill-me");
+p.sections.Journal = [
+  "- [2026-06-01] Tuned the FUP enforcer thresholds and reran the dry-run",
+  "- [2026-06-02] Tuned the FUP enforcer thresholds and reran the dry-run",
+  "- [2026-06-03] Tuned FUP enforcer thresholds and reran the dry-run again",
+  "- [2026-06-04] Shipped the tiered recall gate with the candidate cap",
+].join("\n");
+packs.writePack(p);
+const backupRoot = path.join(tmp, "backup");
+const jd = dream.journalBackfillDedupe(backupRoot);
+assert.ok(jd.removed >= 2, `near-dup journal lines collapsed (removed ${jd.removed})`);
+const after = packs.readPack("backfill-me").sections.Journal.split("\n").filter((l) => l.trim());
+assert.ok(after.some((l) => /tiered recall gate/.test(l)), "distinct line survives");
+assert.ok(after.some((l) => /FUP enforcer/.test(l)), "one representative of the dup family survives");
+assert.ok(fs.existsSync(path.join(backupRoot, "packs", "backfill-me")), "deduped pack backed up first");
+
+// ── KPI: version-stamped aggregation + snapshots + report ──
+metrics._resetForTest();
+const L = (o) => JSON.stringify(o) + "\n";
+fs.writeFileSync(metrics.LOG_FILE, [
+  L({ ts: "2026-06-01T00:00:00Z", v: "2.6.50", model: "haiku", tier: "full", seeds: [{ id: "pack:a" }], kept: [{ id: "pack:a" }, { id: "pack:b" }], latencyMs: 10000, costUsd: 0.01 }),
+  L({ ts: "2026-06-01T00:01:00Z", v: "2.6.50", use: ["pack:a"] }),
+  L({ ts: "2026-06-02T00:00:00Z", v: "2.6.50", model: "haiku", tier: "full", gated: true, latencyMs: 5 }),
+  L({ ts: "2026-07-01T00:00:00Z", v: "2.6.59", model: "haiku", tier: "seeds", seeds: [{ id: "pack:a" }], kept: [{ id: "pack:a" }], latencyMs: 2000, costUsd: 0, auto: { kept: ["pack:a"], dropped: ["pack:z"] } }),
+  L({ ts: "2026-05-01T00:00:00Z", tier: "full", seeds: [], kept: [], latencyMs: 3000, walker: "failed" }),
+].join(""));
+const rows = kpi.aggregate();
+assert.strictEqual(rows.length, 3, "three version buckets (two stamped + legacy)");
+assert.strictEqual(rows[0].v, kpi.LEGACY_VERSION, "unstamped records fall into the legacy bucket, ordered first");
+const v50 = rows.find((r) => r.v === "2.6.50");
+assert.strictEqual(v50.turns, 2);
+assert.strictEqual(v50.gatedPct, 50);
+assert.strictEqual(v50.rescuePct, 100, "kept-without-seed counts as a rescue turn");
+assert.strictEqual(v50.noisePct, 50, "one of two kept nodes was used");
+assert.deepStrictEqual(v50.models, ["haiku"]);
+const v59 = rows.find((r) => r.v === "2.6.59");
+assert.strictEqual(v59.rescuePct, 0);
+assert.strictEqual(v59.autoKept, 1);
+assert.strictEqual(v59.autoDropped, 1);
+assert.strictEqual(rows.find((r) => r.v === kpi.LEGACY_VERSION).walkerFailPct, 100);
+
+metrics.appendKpi({ trigger: "test", health: { rescueRate: 0.25, noiseRate: 0.5, avgLatencyMs: 8000 }, window: { turns: 40 } });
+metrics.appendKpi({ trigger: "test", health: { rescueRate: 0.30, noiseRate: 0.4, avgLatencyMs: 7000 }, window: { turns: 55 } });
+const snaps = metrics.readKpi();
+assert.strictEqual(snaps.length, 2, "nightly snapshots append");
+assert.ok(snaps[0].v && snaps[0].ts, "snapshots are version-stamped");
+
+const table = kpi.renderTable(rows);
+assert.ok(/2\.6\.50/.test(table) && /rescue/.test(table), "table renders versions and metrics");
+const html = kpi.htmlReport();
+assert.ok(/<svg/.test(html) && /2\.6\.59/.test(html) && /rescue/i.test(html), "HTML report has charts and versions");
+const outPath = kpi.writeHtmlReport(path.join(tmp, "kpi.html"));
+assert.ok(fs.existsSync(outPath), "report file written");
+
+// ── dream: prompt carries evidence + knob table; parseDream accepts tuning ──
+const prompt = dream.buildDreamPrompt({ sinceTs: since, fullSweep: false, clusters: [], evidence: ev, windowDelta: { turns: 4, rescueTurns: 1, keptTotal: 4, opens: 1, latencyMsTotal: 8000, byTier: {} } });
+assert.ok(/RECALL EVIDENCE/.test(prompt), "evidence section present");
+assert.ok(/walkerMaxCandidates/.test(prompt), "knob table present");
+assert.ok(/delta night/.test(prompt), "delta framing present");
+const parsed = dream.parseDream(JSON.stringify({ report: "hi", tuning: { knob: "episodeLimit", to: 4, reason: "r" } }));
+assert.deepStrictEqual(parsed.tuning, { knob: "episodeLimit", to: 4, reason: "r" }, "tuning proposal parses");
+assert.strictEqual(dream.parseDream(JSON.stringify({ report: "hi", tuning: "bogus" })).tuning, null, "non-object tuning ignored");
+
+console.log("recall evolution OK");

package/test-unified-identity.js

@@ -0,0 +1,106 @@
+// Unified multi-channel identity. Verifies, in hermetic child processes (fresh
+// require cache per flag state), that:
+//   flag OFF (=0) → resolution is byte-identical to before; auto-link is inert.
+//   flag ON  (=1) → configured owner channels resolve to one owner canonical,
+//               strangers stay isolated, and the first owner-channel contact
+//               folds its siloed state into the owner bucket (merge, idempotent,
+//               backed up, nothing lost).
+//   default (unset) → ON: the flag now defaults on, so an unset env resolves
+//               owner channels to the owner canonical. Only an explicit 0/off
+//               (the operator kill-switch) reverts to per-channel behaviour.
+// Isolation: each child sets its own temp HOME so config-dir points at a
+// throwaway .open-claudia — the real vault/state is never touched.
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const assert = require("assert");
+const { execFileSync } = require("child_process");
+
+const REPO = __dirname;
+
+function seedHome() {
+  const HOME = fs.mkdtempSync(path.join(os.tmpdir(), "oc-idtest-"));
+  const CFG = path.join(HOME, ".open-claudia");
+  fs.mkdirSync(CFG, { recursive: true });
+  // .env deliberately omits OC_UNIFIED_IDENTITY so the parent controls it via
+  // process.env per child.
+  fs.writeFileSync(path.join(CFG, ".env"), [
+    `WORKSPACE=${path.join(HOME, "ws")}`,
+    `CLAUDE_PATH=${process.execPath}`,
+    `TELEGRAM_BOT_TOKEN=dummy`,
+    `TELEGRAM_CHAT_ID=6251055967`,
+    `VOICE_OWNER_USER_ID=voice-owner`,
+    ``,
+  ].join("\n"));
+  fs.writeFileSync(path.join(CFG, "people.json"), JSON.stringify([{
+    id: "person_owner", name: "Owner", isOwner: true,
+    handles: [{ adapter: "telegram", channelId: "6251055967", canonicalUserId: "telegram:6251055967" }],
+    primaryChannel: { adapter: "telegram", channelId: "6251055967" }, notes: [],
+  }]));
+  fs.writeFileSync(path.join(CFG, "identities.json"), JSON.stringify({ channels: {}, preferred: {} }));
+  fs.writeFileSync(path.join(CFG, "state.json"), JSON.stringify({ users: {
+    "telegram:6251055967": { currentSession: { name: "tickets", dir: "/ws/tickets" }, lastSessionId: "t-sess",
+      settings: { model: "claude-opus-4-8" }, sessionUsage: { turns: 10, costUsd: 5 } },
+    "voice:voice-owner": { currentSession: { name: "hr", dir: "/ws/hr" }, lastSessionId: "v-sess",
+      settings: {}, sessionUsage: { turns: 3, costUsd: 1 } },
+  } }));
+  fs.writeFileSync(path.join(CFG, "sessions.json"), JSON.stringify({
+    "voice:voice-owner": { hr: [{ id: "v-sess", title: "HR", created: "x", lastUsed: "x" }] },
+  }));
+  return { HOME, CFG };
+}
+
+function runChild(mode) {
+  const { HOME, CFG } = seedHome();
+  process.env.HOME = HOME;
+  const id = require(path.join(REPO, "core/identity"));
+  const state = require(path.join(REPO, "core/state"));
+
+  if (mode === "off") {
+    assert.strictEqual(id.canonicalForChannel("voice", "voice-owner"), "voice:voice-owner", "off: voice stays siloed");
+    assert.strictEqual(id.canonicalForChannel("telegram", "6251055967"), "telegram:6251055967", "off: owner telegram unchanged");
+    assert.strictEqual(state.autoLinkOwnerChannel("voice", "voice-owner"), null, "off: auto-link inert");
+    const after = JSON.parse(fs.readFileSync(path.join(CFG, "state.json"), "utf-8"));
+    assert.ok("voice:voice-owner" in after.users, "off: voice bucket untouched");
+  } else if (mode === "default") {
+    // No OC_UNIFIED_IDENTITY in env or .env → the new default (ON) must apply.
+    assert.strictEqual(id.canonicalForChannel("voice", "voice-owner"), "telegram:6251055967", "default: unset resolves to owner (default ON)");
+    assert.strictEqual(id.canonicalForChannel("telegram", "9999999999"), "telegram:9999999999", "default: stranger stays isolated");
+  } else {
+    assert.strictEqual(id.ownerCanonical(), "telegram:6251055967", "on: ownerCanonical");
+    assert.strictEqual(id.canonicalForChannel("voice", "voice-owner"), "telegram:6251055967", "on: voice unified to owner");
+    assert.strictEqual(id.canonicalForChannel("telegram", "9999999999"), "telegram:9999999999", "on: stranger stays isolated");
+    const r1 = state.autoLinkOwnerChannel("voice", "voice-owner");
+    assert.deepStrictEqual(r1, { from: "voice:voice-owner", to: "telegram:6251055967" }, "on: migrate result");
+    assert.strictEqual(state.autoLinkOwnerChannel("voice", "voice-owner"), null, "on: idempotent second call");
+    const after = JSON.parse(fs.readFileSync(path.join(CFG, "state.json"), "utf-8"));
+    assert.ok(!("voice:voice-owner" in after.users), "on: voice bucket folded away");
+    assert.ok("telegram:6251055967" in after.users, "on: owner bucket present");
+    const sess = JSON.parse(fs.readFileSync(path.join(CFG, "sessions.json"), "utf-8"));
+    assert.ok(sess["telegram:6251055967"] && sess["telegram:6251055967"].hr, "on: hr session folded into owner");
+    const backups = fs.existsSync(path.join(CFG, "backups")) ? fs.readdirSync(path.join(CFG, "backups")) : [];
+    assert.ok(backups.length >= 3, "on: state/sessions/identities backed up before merge");
+  }
+
+  fs.rmSync(HOME, { recursive: true, force: true });
+  console.log(`unified-identity child(${mode}) OK`);
+}
+
+if (process.argv[2] === "--child") {
+  runChild(process.argv[3]);
+} else {
+  for (const mode of ["off", "on", "default"]) {
+    const childEnv = { ...process.env };
+    if (mode === "on") childEnv.OC_UNIFIED_IDENTITY = "1";
+    else if (mode === "off") childEnv.OC_UNIFIED_IDENTITY = "0";
+    else delete childEnv.OC_UNIFIED_IDENTITY; // default: prove unset ⇒ ON
+    try {
+      execFileSync(process.execPath, [__filename, "--child", mode], { env: childEnv, stdio: "pipe" });
+    } catch (e) {
+      console.error(`unified-identity ${mode} FAILED:\n${e.stdout || ""}${e.stderr || ""}`);
+      process.exit(1);
+    }
+  }
+  console.log("unified-identity OK");
+}