@inetafrica/open-claudia 2.9.3 → 2.11.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## v2.11.0
+- **Unified multi-channel identity is now LIVE by default (Phases 0 + 1).** v2.10.0 shipped the split-brain fix inert behind `OC_UNIFIED_IDENTITY` (default off). This release flips the default **on** and lands the Phase 1 queue-routing fix that made it safe to do so. The owner's Telegram, Kazee and voice channels now resolve to one canonical person out of the box — one state, one session, one transcript, one run-lock — so the bot stops fracturing into a separate assistant per channel. The flag stays as an operator **kill-switch** (`OC_UNIFIED_IDENTITY=0` + restart) for reversibility (risk R14); it is no longer a hold-back gate.
+- **Person-scoped queue routing (Phase 1, 1.2) — the blocker that kept the flag off.** Under unified identity the owner's channels share one run-lock and message queue, so a message sent from one channel while a run is in flight on another used to drain in the *finishing* turn's async scope — a Kazee follow-up could be answered in the Telegram chat. Each queued message now **captures its origin channel** at enqueue time, and `drainQueuedMessages` peels off one same-origin run at a time (requeuing the rest so the natural close→drain tail-recursion handles the next group), scoping each drained reply to `chatContext.run(origin, …)`. Replies always route back to the channel the message came from; same-origin batches behave exactly as before. Grouping logic extracted to a pure, unit-tested `core/queue-drain.js`.
+- **Cross-channel dedup (0.3).** `router.isDuplicate` is re-keyed from `adapter:channel:msg` to `canonical:adapter:msg` — a message redelivered against a different channel that resolves to the same person is now caught once the owner's channels are unified (adapter stays in the key, so distinct messages that merely share a numeric id across transports are never collapsed).
+- **First-contact migration (0.2 / 1.1) fires automatically.** With the flag on, the first inbound message from a previously-siloed owner channel folds its pre-existing state + sessions into the owner bucket — non-destructive, idempotent, and backed up to `~/.open-claudia/backups/` first (unchanged from v2.10.0, now actually reached). Pre-migration per-channel transcripts remain as separate files and stay reachable via `transcript-search --all`; new history accretes under the unified person id (1.3).
+- **Tests.** `test-unified-identity.js` gains a `default` (unset ⇒ on) child to lock the new default and proves an explicit `0` still reverts to strict per-channel resolution; new `test-queue-routing.js` covers origin keying, same-origin batching, mixed-origin split/requeue, and legacy (pre-capture) fallback. Full suite green.
+- **Agent-space / OpenClaw:** no new deps or required env; Docker image builds identically. Existing single-owner deployments see unified behaviour for the owner's own channels only — strangers still resolve to their own isolated bucket (the per-person guardrail arrives in Phase 3).
+
+## v2.10.0
+- **Unified multi-channel identity — foundation, gated OFF by default (Phase 0).** An owned bot is meant to be one mind across every channel its owner reaches it on; today it split-brains because conversation state (session, transcript, run-lock, queue) is keyed per `transport:channelId`, so an unlinked channel (voice bridge, a stray Kazee DM) becomes a separate assistant with its own history. This release lands the identity-resolution foundation behind a single flag, `OC_UNIFIED_IDENTITY` (default **off**). **With the flag off nothing changes** — every new code path is gated, so publishing this version is behaviourally identical to v2.9.3 until an operator sets `OC_UNIFIED_IDENTITY=1` and restarts. Boot log now prints `Unified identity: on|off` for visibility.
+- **Resolution seam (0.1).** `identity.canonicalForChannel` — the single chokepoint every adapter (Telegram/Kazee/voice) routes through — gains a flag-gated branch: a *configured owner channel* (one whose `transport:channelId` matches an operator-declared owner id — a `TELEGRAM_CHAT_ID`, `KAZEE_OWNER_USER_ID`, or `VOICE_OWNER_USER_ID`) with no explicit `/link` now resolves to the single owner canonical (the owner's first-linked handle, matching `people.linkHandle`'s primary convention). Because it's the one seam, state/transcript/scheduler all unify downstream for free. Owner detection uses only trusted, operator-set signals — never a guess — so a stranger's channel can never be merged by mistake (verified: a non-owner channel still resolves to its own default bucket).
+- **One-time owner-state merge (0.2).** The first inbound message from a configured owner channel that was previously siloed folds that channel's pre-existing state + sessions into the owner's canonical bucket (`state.autoLinkOwnerChannel`, called from the router before any state is read). The merge is **non-destructive** (it folds, never overwrites), **idempotent** (in-memory guard plus a naturally-no-op re-migrate once the source is gone — safe across restarts), and **backs up** `state.json`/`sessions.json`/`identities.json` to `~/.open-claudia/backups/` before touching anything. It deliberately does **not** write into `identities.json`, so turning the flag back off cleanly reverts routing while the already-merged history stays with the owner.
+- **Agent-space / OpenClaw ready.** No new dependencies, no new native modules, and no new *required* env or files — the Docker `:latest` image and the npm package build and run exactly as before with the flag off, so existing single-user deployments are unaffected and the multi-user owned-agent rollout can flip the flag per-deployment when ready. New `test-unified-identity.js` (wired into `npm test`) proves both flag states in isolated child processes: flag-off byte-identical resolution + inert auto-link; flag-on unification, stranger isolation, and the merge (result, idempotence, buckets folded, sessions preserved, backups written).
+- **Explicitly deferred (not shipped hot):** the unified serialized-queue reply-routing fix (when the owner sends from two channels *simultaneously* under the flag, a queued message currently drains in the finishing turn's origin scope — Phase 1), per-person persona packs (Phase 2), and the independent external-speaker guardrail/enforcer (Phase 3). The flag stays off until at least the Phase 1 queue-scope fix lands, so none of these are live-exposed.
+
 ## v2.9.3
 - **Bot advertises a distinct "thinking" state before its first token (Kazee parity Phase 2).** The typing pipeline now carries an additive `state` discriminator (`'thinking' | 'typing'`) — no new socket event. The runner advertises `thinking` from the moment a turn starts until the first stream event (text delta, assistant content, tool call, or result), then flips to plain `typing`; Kazee clients render "<name> is thinking…" in the header/chat-list for that pre-token window and fall back to normal typing text otherwise. The Telegram adapter ignores `state` (its chat action has no such distinction), so the change is inert there. Pairs with the chat-central `message:interactiveUpdated` broadcast (server-authoritative button selection) landing in the same release across chat-central/web/mobile.
 - **Ships the v2.9.2 work that never published.** v2.9.2 (Kazee REST media fallback when a socket send lacks a media path, plus an explicit `typing:stop` on turn end) was committed to main but no tag was ever pushed, so CI never published it. This tag carries it to npm alongside the thinking-state change.

package/bot.js

@@ -203,6 +203,7 @@ setInterval(checkForUpdates, 5 * 60 * 1000);
   console.log(`Soul: ${SOUL_FILE}`);
   console.log(`Vault: ${VAULT_FILE} (${vault.exists() ? "exists" : "not created"})`);
   console.log(`Onboarded: ${isOnboarded()}`);
+  console.log(`Unified identity: ${require("./core/config").UNIFIED_IDENTITY ? "ON" : "off"}`);
 
   // Notify owner that bot is back online via every adapter that knows
   // an owner channel. Kazee skipped: ownerUserId is a user id, not a

package/core/config.js

@@ -94,6 +94,12 @@ const DEFAULT_CLAUDE_MODEL = config.CLAUDE_MODEL || process.env.CLAUDE_MODEL ||
 const AUTO_COMPACT_TOKENS = parseInt(config.AUTO_COMPACT_TOKENS || process.env.AUTO_COMPACT_TOKENS || "380000", 10);
 const MIN_COMPACT_INTERVAL_MS = parseInt(config.MIN_COMPACT_INTERVAL_MS || process.env.MIN_COMPACT_INTERVAL_MS || "1800000", 10);
 const PROJECT_TRANSCRIPTS = configTruthy(config.PROJECT_TRANSCRIPTS || process.env.PROJECT_TRANSCRIPTS, true);
+// Unified multi-channel identity. Default ON: the owner's Telegram, Kazee and
+// voice channels resolve to one canonical person, sharing one state, session,
+// transcript and run-lock (the split-brain fix). The flag remains as an
+// operator kill-switch for reversibility (R14) — set OC_UNIFIED_IDENTITY=0 in
+// .env and restart to fall back to strict per-channel behaviour.
+const UNIFIED_IDENTITY = configTruthy(config.OC_UNIFIED_IDENTITY || process.env.OC_UNIFIED_IDENTITY, true);
 const TRANSCRIPT_MAX_ENTRY_CHARS = parseInt(config.TRANSCRIPT_MAX_ENTRY_CHARS || process.env.TRANSCRIPT_MAX_ENTRY_CHARS || "12000", 10);
 const TRANSCRIPTS_DIR = config.TRANSCRIPTS_DIR || process.env.TRANSCRIPTS_DIR || path.join(CONFIG_DIR, "transcripts");
 const WHISPER_CLI = config.WHISPER_CLI || "";
@@ -245,6 +251,7 @@ module.exports = {
   AUTO_COMPACT_TOKENS,
   MIN_COMPACT_INTERVAL_MS,
   PROJECT_TRANSCRIPTS,
+  UNIFIED_IDENTITY,
   TRANSCRIPT_MAX_ENTRY_CHARS,
   TRANSCRIPTS_DIR,
   WHISPER_CLI, WHISPER_MODEL, FFMPEG,

package/core/identity.js

@@ -36,9 +36,55 @@ function saveIdentities() {
   try { fs.writeFileSync(IDENTITIES_FILE, JSON.stringify(identities, null, 2)); } catch (e) {}
 }
 
+// A channel is a "configured owner channel" when its (transport, channelId)
+// matches an owner identifier the operator set in .env — a telegram chat id,
+// the Kazee owner user id, or the voice-bridge owner id. These are trusted,
+// operator-declared signals (never guesses), so unifying them into the owner's
+// canonical bucket cannot merge a stranger's state by mistake.
+function isConfiguredOwnerChannel(transport, channelId) {
+  const t = String(transport || "").toLowerCase();
+  const c = String(channelId || "");
+  if (!c) return false;
+  let cfg;
+  try { cfg = require("./config"); } catch (e) { return false; }
+  if (t === "telegram") return (cfg.CHAT_IDS || []).map(String).includes(c);
+  if (t === "kazee") return !!cfg.config.KAZEE_OWNER_USER_ID && c === String(cfg.config.KAZEE_OWNER_USER_ID);
+  if (t === "voice") return c === String(cfg.config.VOICE_OWNER_USER_ID || "voice-owner");
+  return false;
+}
+
+// The owner's single stable canonical id = their first-linked handle's
+// canonical (matching people.linkHandle's primary convention), falling back to
+// the legacy telegram bootstrap id. Lazy + guarded so an early or partial
+// people-module load during boot degrades to the telegram fallback rather than
+// throwing on the identity-resolution hot path.
+function ownerCanonical() {
+  try {
+    const people = require("./people");
+    const owner = (people.owners() || [])[0];
+    const h = owner && Array.isArray(owner.handles) ? owner.handles[0] : null;
+    if (h) return normalizeCanonicalUserId(h.canonicalUserId || defaultCanonicalForChannel(h.adapter, h.channelId));
+  } catch (e) {}
+  try { const { CHAT_ID } = require("./config"); return defaultCanonicalForChannel("telegram", CHAT_ID || ""); } catch (e) {}
+  return "";
+}
+
 function canonicalForChannel(transport, channelId) {
   const key = channelKey(transport, channelId);
-  return normalizeCanonicalUserId(identities.channels[key]) || defaultCanonicalForChannel(transport, channelId);
+  const explicit = normalizeCanonicalUserId(identities.channels[key]);
+  if (explicit) return explicit;
+  // Flag-gated (Phase 0): a configured owner channel with no explicit /link
+  // still resolves to the single owner canonical, so all of the owner's
+  // channels share one brain without a manual link. Flag OFF ⇒ byte-identical
+  // to prior behaviour (returns the default `transport:channelId`).
+  try {
+    const { UNIFIED_IDENTITY } = require("./config");
+    if (UNIFIED_IDENTITY && isConfiguredOwnerChannel(transport, channelId)) {
+      const owner = ownerCanonical();
+      if (owner) return owner;
+    }
+  } catch (e) {}
+  return defaultCanonicalForChannel(transport, channelId);
 }
 
 function canonicalForTelegram(chatId) {
@@ -79,6 +125,8 @@ module.exports = {
   normalizeCanonicalUserId,
   channelKey,
   defaultCanonicalForChannel,
+  isConfiguredOwnerChannel,
+  ownerCanonical,
   canonicalForChannel,
   canonicalForTelegram,
   canonicalForStoredUserKey,

package/core/queue-drain.js

@@ -0,0 +1,25 @@
+// Pure helpers for origin-aware queue draining. Kept separate from the runner
+// so the grouping logic — which decides where a drained reply is routed under
+// unified identity — is unit-testable without spawning a run.
+
+// A queued message's origin channel, or a sentinel for legacy items that were
+// queued before origin capture existed (those fall back to the finishing turn's
+// context, exactly as before).
+function originKey(item) {
+  return item && item.origin ? `${item.origin.transport}:${item.origin.channelId}` : "__current__";
+}
+
+// Split the leading run of same-origin messages off the front of the queue.
+// Returns { group, rest }: `group` is the contiguous same-origin prefix (to run
+// now, scoped to that origin), `rest` is everything after it (to be requeued so
+// the natural close→drain tail-recursion handles the next origin group). For a
+// non-empty queue, `group` always has at least one item.
+function splitLeadingOriginGroup(queue) {
+  if (!Array.isArray(queue) || queue.length === 0) return { group: [], rest: [] };
+  const firstKey = originKey(queue[0]);
+  let i = 0;
+  while (i < queue.length && originKey(queue[i]) === firstKey) i++;
+  return { group: queue.slice(0, i), rest: queue.slice(i) };
+}
+
+module.exports = { originKey, splitLeadingOriginGroup };

package/core/router.js

@@ -10,7 +10,7 @@ const { handleAction } = require("./actions");
 const { isChatAuthorized } = require("./access");
 const introFlow = require("./intro-flow");
 const { send, deleteMessage } = require("./io");
-const { currentState } = require("./state");
+const { currentState, autoLinkOwnerChannel } = require("./state");
 const { runClaude } = require("./runner");
 const { transcribeAudio } = require("./media");
 const { vault } = require("./vault-store");
@@ -26,11 +26,14 @@ const { MAX_FILE_SIZE, MAX_VOICE_SIZE, FILES_DIR } = require("./config");
 const channelWizard = require("./channel-wizard");
 require("./handlers"); // side-effect: register slash commands
 
-// Per-adapter dedup. Telegram message_ids are unique per chat, not
-// globally; same goes for Kazee. Namespace by adapter:channel:msg.
+// Cross-channel dedup. Message ids are unique per adapter, not globally, so
+// the adapter stays in the key. Keying by canonical (not raw channelId) means
+// a message redelivered against a different channel that resolves to the same
+// person is still caught once the owner's channels are unified.
 const processedMessages = new Set();
 function isDuplicate(envelope) {
-  const key = `${envelope.adapter?.id || envelope.adapter?.type}:${envelope.channelId}:${envelope.messageId}`;
+  const canonical = envelope.canonicalUserId || envelope.channelId;
+  const key = `${canonical}:${envelope.adapter?.id || envelope.adapter?.type}:${envelope.messageId}`;
   if (processedMessages.has(key)) return true;
   processedMessages.add(key);
   if (processedMessages.size > 400) {
@@ -55,6 +58,11 @@ function scope(envelope, fn) {
 async function onMessage(envelope) {
   return scope(envelope, async () => {
     try {
+      // Phase 0 unified identity (flag-gated; a no-op when the flag is off):
+      // fold a configured owner channel's pre-existing siloed state into the
+      // owner's canonical bucket on first contact, before any state is read.
+      try { autoLinkOwnerChannel(envelope.adapter?.type, envelope.channelId); } catch (e) {}
+
       // While a channel wizard is open, capture text input before slash
       // dispatch — except for /cancel, which always bails out.
       if (channelWizard.isAwaiting(envelope.canonicalUserId)) {

package/core/runner.js

@@ -13,6 +13,7 @@ const {
 } = require("./config");
 const { currentState, saveState, recordSession, userOwnsClaudeSession, resetSessionUsage } = require("./state");
 const { chatContext, currentChannelId, currentAdapter } = require("./context");
+const { splitLeadingOriginGroup } = require("./queue-drain");
 const { buildSystemPrompt, promptWithDynamicContext } = require("./system-prompt");
 const { redactSensitive } = require("./redact");
 const { send, editMessage, sendVoice, sendVoiceEnd, splitMessage } = require("./io");
@@ -782,7 +783,11 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   cwd = resolveRunCwd(cwd);
 
   if (state.runningProcess) {
-    state.messageQueue.push({ prompt, replyToMsgId, opts, queuedAt: Date.now() });
+    // Capture the origin channel so the drained reply routes back to where the
+    // message came from. Under unified identity the owner's channels share one
+    // run-lock and queue, so a Kazee message queued during a Telegram run must
+    // still be answered on Kazee — not wherever the finishing turn happens to be.
+    state.messageQueue.push({ prompt, replyToMsgId, opts, queuedAt: Date.now(), origin: store ? { ...store } : null });
     await send(state.isCompacting ? "Compacting context, will pick this up next…" : "Queued.", { replyTo: replyToMsgId });
     return;
   }
@@ -1132,10 +1137,19 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   };
 
   const drainQueuedMessages = async () => {
-    if (state.messageQueue.length > 0 && state.currentSession) {
-      const drained = state.messageQueue.splice(0);
-      if (drained.length === 1) {
-        const only = drained[0];
+    if (state.messageQueue.length === 0 || !state.currentSession) return;
+    const drained = state.messageQueue.splice(0);
+    // Handle one same-origin run at a time; requeue the remainder so the
+    // finishing turn's close→drain tail-recursion picks up the next origin
+    // group. Each group's reply is scoped to the channel it came from, so a
+    // message queued from one of the owner's channels during a run on another
+    // is still answered on its own channel (unified identity, one run-lock).
+    const { group, rest } = splitLeadingOriginGroup(drained);
+    if (rest.length) state.messageQueue.unshift(...rest);
+
+    const runGroup = async () => {
+      if (group.length === 1) {
+        const only = group[0];
         await runClaude(only.prompt, state.currentSession.dir, only.replyToMsgId, only.opts);
       } else {
         const fmtTime = (ts) => {
@@ -1145,16 +1159,20 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
           const ss = String(d.getSeconds()).padStart(2, "0");
           return `${hh}:${mm}:${ss}`;
         };
-        const numbered = drained.map((m, i) => `[${i + 1}] (${fmtTime(m.queuedAt || Date.now())}) ${m.prompt}`).join("\n\n");
+        const numbered = group.map((m, idx) => `[${idx + 1}] (${fmtTime(m.queuedAt || Date.now())}) ${m.prompt}`).join("\n\n");
         const batched =
-          `While you were working the user sent these ${drained.length} follow-up messages (oldest first):\n\n` +
+          `While you were working the user sent these ${group.length} follow-up messages (oldest first):\n\n` +
           `${numbered}\n\n` +
           `Treat each as a distinct follow-up request. Add them to your plan and handle them; ` +
           `if any contradicts an earlier one, prefer the newer one and call out the conflict.`;
-        const last = drained[drained.length - 1];
+        const last = group[group.length - 1];
         await runClaude(batched, state.currentSession.dir, last.replyToMsgId, last.opts);
       }
-    }
+    };
+
+    const origin = group[0].origin;
+    if (origin) await chatContext.run(origin, runGroup);
+    else await runGroup();
   };
 
   const updateProgress = async () => {

package/core/state.js

@@ -3,12 +3,18 @@
 // linked channels share the same conversation, settings, and usage.
 
 const fs = require("fs");
-const { STATE_FILE, SESSIONS_FILE, CHAT_ID } = require("./config");
+const path = require("path");
+const { STATE_FILE, SESSIONS_FILE, IDENTITIES_FILE, CONFIG_DIR, CHAT_ID, UNIFIED_IDENTITY } = require("./config");
 const {
   normalizeCanonicalUserId,
   canonicalForTelegram,
   canonicalForStoredUserKey,
   setIdentityMapping,
+  isConfiguredOwnerChannel,
+  ownerCanonical,
+  defaultCanonicalForChannel,
+  channelKey,
+  identities,
 } = require("./identity");
 const { currentChannelId, currentCanonicalUserId } = require("./context");
 
@@ -245,6 +251,47 @@ function linkIdentity(transport, channelId, canonicalUserId) {
   return result;
 }
 
+// ── Phase 0 unified identity: one-time owner-channel merge ───────────
+// When the unified-identity flag is on, the first inbound message from a
+// configured owner channel that was never explicitly /linked folds its
+// pre-existing siloed state into the owner's canonical bucket. Idempotent
+// (in-memory guard + a naturally-no-op migrate once the source is moved),
+// non-destructive (merges, and backs up state/sessions/identities first), and
+// completely inert when the flag is off. Deliberately does NOT write into
+// identities.json — resolution comes from the flag+config path in
+// identity.canonicalForChannel, so turning the flag back off cleanly reverts
+// routing while the already-merged history stays with the owner.
+const autoLinkedOwnerChannels = new Set();
+
+function backupIdentityState() {
+  try {
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const dir = path.join(CONFIG_DIR, "backups");
+    fs.mkdirSync(dir, { recursive: true });
+    for (const f of [STATE_FILE, SESSIONS_FILE, IDENTITIES_FILE]) {
+      try { if (fs.existsSync(f)) fs.copyFileSync(f, path.join(dir, `${path.basename(f)}.${stamp}.bak`)); } catch (e) {}
+    }
+  } catch (e) {}
+}
+
+function autoLinkOwnerChannel(transport, channelId) {
+  if (!UNIFIED_IDENTITY) return null;
+  if (!isConfiguredOwnerChannel(transport, channelId)) return null;
+  const key = channelKey(transport, channelId);
+  if (autoLinkedOwnerChannels.has(key)) return null;
+  autoLinkedOwnerChannels.add(key);
+  // An explicit /link already unifies this channel — nothing to migrate.
+  if (Object.prototype.hasOwnProperty.call(identities.channels, key)) return null;
+  const to = ownerCanonical();
+  const from = defaultCanonicalForChannel(transport, channelId);
+  if (!to || from === to) return null;
+  const hasState = !!(savedState.users && savedState.users[from]) || !!loadSessions()[from];
+  if (!hasState) return null;
+  backupIdentityState();
+  migrateUserData(from, to);
+  return { from, to };
+}
+
 module.exports = {
   userStates,
   savedState,
@@ -264,4 +311,5 @@ module.exports = {
   userOwnsClaudeSession,
   migrateUserData,
   linkIdentity,
+  autoLinkOwnerChannel,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.9.3",
+  "version": "2.11.0",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js"
+    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-queue-routing.js"
   },
   "files": [
     "bot.js",
@@ -50,7 +50,10 @@
     "test-tool-guard.js",
     "test-tooling-mode.js",
     "test-tool-manifest.js",
-    "test-approval-async.js"
+    "test-approval-async.js",
+    "test-recall-evolution.js",
+    "test-unified-identity.js",
+    "test-queue-routing.js"
   ],
   "keywords": [
     "claude",

package/test-queue-routing.js

@@ -0,0 +1,52 @@
+// Origin-aware queue draining. Under unified identity the owner's channels
+// share one run-lock and message queue, so a message queued from one channel
+// during a run on another must still be answered on its own channel. These
+// tests lock in the grouping that guarantees that routing.
+
+const assert = require("assert");
+const { originKey, splitLeadingOriginGroup } = require("./core/queue-drain");
+
+const tg = (id) => ({ prompt: `m${id}`, origin: { transport: "telegram", channelId: "6251055967" } });
+const kz = (id) => ({ prompt: `m${id}`, origin: { transport: "kazee", channelId: "abc" } });
+const legacy = (id) => ({ prompt: `m${id}` }); // queued before origin capture
+
+// originKey
+assert.strictEqual(originKey(tg(1)), "telegram:6251055967", "telegram key");
+assert.strictEqual(originKey(kz(1)), "kazee:abc", "kazee key");
+assert.strictEqual(originKey(legacy(1)), "__current__", "legacy → sentinel");
+
+// Empty queue
+assert.deepStrictEqual(splitLeadingOriginGroup([]), { group: [], rest: [] }, "empty");
+
+// All one origin → single group, no remainder (the common case: preserves the
+// prior single-batch behaviour, now scoped to that origin).
+{
+  const q = [tg(1), tg(2), tg(3)];
+  const { group, rest } = splitLeadingOriginGroup(q);
+  assert.strictEqual(group.length, 3, "same-origin: all grouped");
+  assert.strictEqual(rest.length, 0, "same-origin: nothing requeued");
+}
+
+// Mixed origins → only the leading same-origin run comes out; the rest is
+// requeued so the next drain routes it to its own channel.
+{
+  const q = [tg(1), tg(2), kz(3), tg(4)];
+  const { group, rest } = splitLeadingOriginGroup(q);
+  assert.deepStrictEqual(group.map((m) => m.prompt), ["m1", "m2"], "leading telegram group");
+  assert.deepStrictEqual(rest.map((m) => m.prompt), ["m3", "m4"], "kazee + later telegram requeued");
+  // Draining the remainder next peels off the kazee message on its own.
+  const next = splitLeadingOriginGroup(rest);
+  assert.deepStrictEqual(next.group.map((m) => m.prompt), ["m3"], "next drain: kazee alone");
+  assert.deepStrictEqual(next.rest.map((m) => m.prompt), ["m4"], "next drain: trailing telegram requeued");
+}
+
+// Legacy items (no origin) group together under the sentinel and fall back to
+// the finishing turn's context — matching pre-change behaviour.
+{
+  const q = [legacy(1), legacy(2), tg(3)];
+  const { group, rest } = splitLeadingOriginGroup(q);
+  assert.deepStrictEqual(group.map((m) => m.prompt), ["m1", "m2"], "legacy grouped");
+  assert.deepStrictEqual(rest.map((m) => m.prompt), ["m3"], "origin item requeued");
+}
+
+console.log("queue-routing OK");

package/test-recall-evolution.js

@@ -0,0 +1,214 @@
+// v2.6.59 evolution: dream-tunable knobs (bounded, env-pinned, revertible),
+// walker cascade verdicts, per-node evidence, windowed health deltas, delta
+// dreaming (dump selection + merge clusters), reviewer skip-gate, journal
+// backfill dedupe, and version-stamped KPI aggregation.
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+// Redirect EVERYTHING before any require: CONFIG_DIR derives from HOME, and
+// metrics._resetForTest() deletes files — must never touch live telemetry.
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "recall-evolution-"));
+process.env.HOME = tmp;
+process.env.PACKS_DIR = path.join(tmp, "packs");
+process.env.RECALL_GRAPH_DB = path.join(tmp, "graph.db");
+delete process.env.RECALL_WALKER_MAX_CANDIDATES;
+
+const tuning = require("./core/recall/tuning");
+const metrics = require("./core/recall/metrics");
+const disc = require("./core/recall/discoverer");
+const review = require("./core/pack-review");
+const dream = require("./core/dream");
+const kpi = require("./core/recall/kpi");
+const packs = require("./core/packs");
+
+// ── tuning: bounds, precedence, revert ──
+tuning._resetForTest();
+assert.strictEqual(tuning.get("walkerMaxCandidates"), 14, "default value");
+assert.strictEqual(tuning.get("cascade"), "on", "enum default");
+assert.strictEqual(tuning.get("nope"), undefined, "unknown knob → undefined");
+
+const ch = tuning.set("walkerMaxCandidates", 18, { reason: "test", evidence: "unit" });
+assert.deepStrictEqual({ knob: ch.knob, from: ch.from, to: ch.to }, { knob: "walkerMaxCandidates", from: 14, to: 18 });
+assert.strictEqual(tuning.get("walkerMaxCandidates"), 18, "set applies");
+assert.strictEqual(tuning.set("walkerMaxCandidates", 18), null, "no-op set rejected");
+assert.strictEqual(tuning.set("walkerMaxCandidates", 99).to, 20, "clamped to max");
+assert.strictEqual(tuning.set("bogusKnob", 5), null, "unknown knob rejected");
+assert.strictEqual(tuning.set("cascade", "sideways"), null, "illegal enum clamps to default → no-op");
+assert.strictEqual(tuning.get("cascade") === "on" || tuning.get("cascade") === "off", true);
+
+process.env.RECALL_WALKER_MAX_CANDIDATES = "10";
+assert.strictEqual(tuning.get("walkerMaxCandidates"), 10, "env pin wins over tuning file");
+assert.strictEqual(tuning.set("walkerMaxCandidates", 16), null, "env-pinned knob refuses dream writes");
+delete process.env.RECALL_WALKER_MAX_CANDIDATES;
+
+const rv = tuning.revert("walkerMaxCandidates", { reason: "test rollback" });
+assert.strictEqual(rv.to, 18, "revert restores the value before the last change");
+assert.ok(tuning.history().some((h) => /^rollback:/.test(h.reason)), "rollback recorded in history");
+assert.ok(tuning.lastChange() && !/^rollback:/.test(tuning.lastChange().reason), "lastChange skips rollbacks");
+
+// ── cascade verdicts: conservative, evidence-only ──
+assert.strictEqual(disc.cascadeVerdict(null), null, "no history → judge");
+assert.strictEqual(disc.cascadeVerdict({ seen: 6, kept: 0, open: 0, rev: 0 }), "drop", "seen≥6 never kept never used → drop");
+assert.strictEqual(disc.cascadeVerdict({ seen: 5, kept: 4, open: 1 }), "keep", "keep-rate ≥0.8 with real use → keep");
+assert.strictEqual(disc.cascadeVerdict({ seen: 5, kept: 4, open: 0, rev: 0 }), null, "high keep but never used → judge");
+assert.strictEqual(disc.cascadeVerdict({ seen: 3, kept: 0, open: 0 }), null, "too little history → judge");
+assert.strictEqual(disc.cascadeVerdict({ seen: 6, kept: 1, open: 0 }), null, "ambiguous middle → judge");
+
+// ── metrics: node stats, rescues, co-rescue pairs, evidence ──
+metrics._resetForTest();
+for (let i = 0; i < 7; i++) {
+  metrics.logTurn({
+    query: "q", tier: "full",
+    seeds: [{ id: "pack:seeded", score: 3 }],
+    activated: [{ id: "pack:noisy", activation: 0.5, hop: 1 }],
+    cand: [{ id: "pack:seeded", act: false }, { id: "pack:noisy", act: true }],
+    kept: i < 3 ? [{ id: "pack:seeded", why: "w" }, { id: "pack:resc-a", why: "w" }, { id: "pack:resc-b", why: "w" }]
+                : [{ id: "pack:seeded", why: "w" }],
+    latencyMs: 1000, costUsd: 0.001,
+  });
+}
+metrics.logUse(["pack:seeded"]);
+metrics.logUse(["pack:seeded"], "reviewer");
+const ns = metrics.nodeStats().nodes;
+assert.strictEqual(ns["pack:noisy"].seen, 7, "candidate seen count accumulates");
+assert.strictEqual(ns["pack:noisy"].kept, 0, "never-kept stays zero");
+assert.strictEqual(ns["pack:noisy"].act, 7, "graph-arrival count tracked");
+assert.strictEqual(ns["pack:resc-a"].resc, 3, "kept-without-seed counts as rescue");
+assert.strictEqual(ns["pack:seeded"].open, 1, "📖 open tracked per node");
+assert.strictEqual(ns["pack:seeded"].rev, 1, "reviewer credit tracked per node");
+
+const ev = metrics.evidence({ minSeen: 6, coRescueMin: 3 });
+assert.ok(ev.neverKept.some((n) => n.id === "pack:noisy"), "noisy node lands in neverKept");
+assert.ok(!ev.neverKept.some((n) => n.id === "pack:seeded"), "used node never in neverKept");
+assert.ok(ev.coRescuePairs.some((p) => p.a === "pack:resc-a" && p.b === "pack:resc-b" && p.n === 3), "co-rescue pair counted");
+assert.ok(ev.summary.turns === 7, "evidence carries the raw summary");
+
+// cascadeVerdict against the accumulated stats: noisy is a drop, seeded needs more
+assert.strictEqual(disc.cascadeVerdict(ns["pack:noisy"]), "drop", "real accumulated stats produce a drop verdict");
+
+// ── dream: windowed deltas + health ──
+const delta = dream.summaryDelta(
+  { turns: 10, opens: 5, keptTotal: 12, rescueTurns: 3, latencyMsTotal: 30000, shadowChecks: 4, shadowAgree: 4, byTier: { full: { n: 4, ms: 40000 }, seeds: { n: 6, ms: 600 } } },
+  { turns: 6, opens: 2, keptTotal: 6, rescueTurns: 1, latencyMsTotal: 10000, byTier: { full: { n: 2, ms: 10000 } } }
+);
+assert.strictEqual(delta.turns, 4);
+assert.strictEqual(delta.opens, 3);
+assert.deepStrictEqual(delta.byTier.full, { n: 2, ms: 30000 });
+assert.deepStrictEqual(delta.byTier.seeds, { n: 6, ms: 600 });
+const health = dream.healthOf({ turns: 10, rescueTurns: 3, keptTotal: 10, opens: 2, reviewerUses: 1, latencyMsTotal: 20000 });
+assert.strictEqual(health.rescueRate, 0.3);
+assert.strictEqual(health.noiseRate, 0.7);
+assert.strictEqual(health.avgLatencyMs, 2000);
+
+// ── dream: merge clusters (similarity + ability boundary) ──
+const mkPack = (dir, name, description, kind) => ({ dir, name, description, tags: ["kazee", "mobile"], kind });
+const clusters = dream.mergeClusters([
+  mkPack("kazee-mobile-deploy", "Kazee Mobile Deployment", "APK versionCode updater pipeline GitLab CI"),
+  mkPack("kazee-mobile-deployment", "Kazee Mobile Deployment", "APK versionCode updater pipeline GitLab"),
+  mkPack("villa-heatmap", "Villa WiFi Heatmap", "LAN hosted survey renders access points"),
+]);
+assert.strictEqual(clusters.length, 1, "one similar pair clusters");
+assert.deepStrictEqual([...clusters[0]].sort(), ["kazee-mobile-deploy", "kazee-mobile-deployment"]);
+const abilitySplit = dream.mergeClusters([
+  mkPack("deploy-a", "Kazee Mobile Deployment", "APK versionCode updater pipeline", "ability"),
+  mkPack("deploy-b", "Kazee Mobile Deployment", "APK versionCode updater pipeline"),
+]);
+assert.strictEqual(abilitySplit.length, 0, "ability/context never cluster together");
+
+// ── dream: delta dump selection ──
+const now = Date.now();
+const iso = (d) => new Date(d).toISOString();
+const corpus = [
+  { dir: "touched", updated: iso(now - 3600e3), tags: [] },
+  { dir: "stale", updated: iso(now - 40 * 86400e3), tags: [] },
+  { dir: "concernpack", updated: iso(now - 40 * 86400e3), tags: ["concern"] },
+  { dir: "clustered", updated: iso(now - 40 * 86400e3), tags: [] },
+];
+const since = iso(now - 86400e3);
+const dump = dream.selectDumpDirs(corpus, { sinceTs: since, fullSweep: false, clusters: [["clustered", "touched"]] });
+assert.ok(dump.has("touched"), "touched pack dumped in full");
+assert.ok(dump.has("concernpack"), "shared concern always dumped");
+assert.ok(dump.has("clustered"), "merge-cluster member dumped");
+assert.ok(!dump.has("stale"), "untouched pack stays an index row");
+const sweep = dream.selectDumpDirs(corpus, { sinceTs: since, fullSweep: true, clusters: [] });
+assert.strictEqual(sweep.size, 4, "full sweep dumps everything");
+
+// ── reviewer skip-gate: only provably-empty turns skip ──
+const pad = "The deployment pipeline completed and artifacts were archived. ".repeat(8); // ~500 chars, no preference words
+assert.strictEqual(review.shouldSkipReview({ userText: "ok", assistantText: "", signals: {} }), "short");
+assert.strictEqual(review.shouldSkipReview({ userText: "thanks!", assistantText: pad, signals: { tier: "skip" } }), "trivial");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad, signals: { tier: "seeds", wrote: false } }), "lookup");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad, signals: { tier: "seeds", wrote: true } }), null, "a write means review");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad, signals: { tier: "seeds" } }), null, "unknown wrote-state means review");
+assert.strictEqual(review.shouldSkipReview({ userText: "remember the fup rule", assistantText: pad, signals: { tier: "seeds", wrote: false } }), null, "preference language escapes the skip");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad, signals: { tier: "full", wrote: false } }), null, "full tier always reviews");
+assert.strictEqual(review.shouldSkipReview({ userText: "fup status today", assistantText: pad + pad + pad, signals: { tier: "seeds", wrote: false } }), null, "long turns always review");
+
+// ── dream: journal backfill dedupe ──
+packs.createPack({ dir: "backfill-me", name: "Backfill", description: "test" });
+const p = packs.readPack("backfill-me");
+p.sections.Journal = [
+  "- [2026-06-01] Tuned the FUP enforcer thresholds and reran the dry-run",
+  "- [2026-06-02] Tuned the FUP enforcer thresholds and reran the dry-run",
+  "- [2026-06-03] Tuned FUP enforcer thresholds and reran the dry-run again",
+  "- [2026-06-04] Shipped the tiered recall gate with the candidate cap",
+].join("\n");
+packs.writePack(p);
+const backupRoot = path.join(tmp, "backup");
+const jd = dream.journalBackfillDedupe(backupRoot);
+assert.ok(jd.removed >= 2, `near-dup journal lines collapsed (removed ${jd.removed})`);
+const after = packs.readPack("backfill-me").sections.Journal.split("\n").filter((l) => l.trim());
+assert.ok(after.some((l) => /tiered recall gate/.test(l)), "distinct line survives");
+assert.ok(after.some((l) => /FUP enforcer/.test(l)), "one representative of the dup family survives");
+assert.ok(fs.existsSync(path.join(backupRoot, "packs", "backfill-me")), "deduped pack backed up first");
+
+// ── KPI: version-stamped aggregation + snapshots + report ──
+metrics._resetForTest();
+const L = (o) => JSON.stringify(o) + "\n";
+fs.writeFileSync(metrics.LOG_FILE, [
+  L({ ts: "2026-06-01T00:00:00Z", v: "2.6.50", model: "haiku", tier: "full", seeds: [{ id: "pack:a" }], kept: [{ id: "pack:a" }, { id: "pack:b" }], latencyMs: 10000, costUsd: 0.01 }),
+  L({ ts: "2026-06-01T00:01:00Z", v: "2.6.50", use: ["pack:a"] }),
+  L({ ts: "2026-06-02T00:00:00Z", v: "2.6.50", model: "haiku", tier: "full", gated: true, latencyMs: 5 }),
+  L({ ts: "2026-07-01T00:00:00Z", v: "2.6.59", model: "haiku", tier: "seeds", seeds: [{ id: "pack:a" }], kept: [{ id: "pack:a" }], latencyMs: 2000, costUsd: 0, auto: { kept: ["pack:a"], dropped: ["pack:z"] } }),
+  L({ ts: "2026-05-01T00:00:00Z", tier: "full", seeds: [], kept: [], latencyMs: 3000, walker: "failed" }),
+].join(""));
+const rows = kpi.aggregate();
+assert.strictEqual(rows.length, 3, "three version buckets (two stamped + legacy)");
+assert.strictEqual(rows[0].v, kpi.LEGACY_VERSION, "unstamped records fall into the legacy bucket, ordered first");
+const v50 = rows.find((r) => r.v === "2.6.50");
+assert.strictEqual(v50.turns, 2);
+assert.strictEqual(v50.gatedPct, 50);
+assert.strictEqual(v50.rescuePct, 100, "kept-without-seed counts as a rescue turn");
+assert.strictEqual(v50.noisePct, 50, "one of two kept nodes was used");
+assert.deepStrictEqual(v50.models, ["haiku"]);
+const v59 = rows.find((r) => r.v === "2.6.59");
+assert.strictEqual(v59.rescuePct, 0);
+assert.strictEqual(v59.autoKept, 1);
+assert.strictEqual(v59.autoDropped, 1);
+assert.strictEqual(rows.find((r) => r.v === kpi.LEGACY_VERSION).walkerFailPct, 100);
+
+metrics.appendKpi({ trigger: "test", health: { rescueRate: 0.25, noiseRate: 0.5, avgLatencyMs: 8000 }, window: { turns: 40 } });
+metrics.appendKpi({ trigger: "test", health: { rescueRate: 0.30, noiseRate: 0.4, avgLatencyMs: 7000 }, window: { turns: 55 } });
+const snaps = metrics.readKpi();
+assert.strictEqual(snaps.length, 2, "nightly snapshots append");
+assert.ok(snaps[0].v && snaps[0].ts, "snapshots are version-stamped");
+
+const table = kpi.renderTable(rows);
+assert.ok(/2\.6\.50/.test(table) && /rescue/.test(table), "table renders versions and metrics");
+const html = kpi.htmlReport();
+assert.ok(/<svg/.test(html) && /2\.6\.59/.test(html) && /rescue/i.test(html), "HTML report has charts and versions");
+const outPath = kpi.writeHtmlReport(path.join(tmp, "kpi.html"));
+assert.ok(fs.existsSync(outPath), "report file written");
+
+// ── dream: prompt carries evidence + knob table; parseDream accepts tuning ──
+const prompt = dream.buildDreamPrompt({ sinceTs: since, fullSweep: false, clusters: [], evidence: ev, windowDelta: { turns: 4, rescueTurns: 1, keptTotal: 4, opens: 1, latencyMsTotal: 8000, byTier: {} } });
+assert.ok(/RECALL EVIDENCE/.test(prompt), "evidence section present");
+assert.ok(/walkerMaxCandidates/.test(prompt), "knob table present");
+assert.ok(/delta night/.test(prompt), "delta framing present");
+const parsed = dream.parseDream(JSON.stringify({ report: "hi", tuning: { knob: "episodeLimit", to: 4, reason: "r" } }));
+assert.deepStrictEqual(parsed.tuning, { knob: "episodeLimit", to: 4, reason: "r" }, "tuning proposal parses");
+assert.strictEqual(dream.parseDream(JSON.stringify({ report: "hi", tuning: "bogus" })).tuning, null, "non-object tuning ignored");
+
+console.log("recall evolution OK");

package/test-unified-identity.js

@@ -0,0 +1,106 @@
+// Unified multi-channel identity. Verifies, in hermetic child processes (fresh
+// require cache per flag state), that:
+//   flag OFF (=0) → resolution is byte-identical to before; auto-link is inert.
+//   flag ON  (=1) → configured owner channels resolve to one owner canonical,
+//               strangers stay isolated, and the first owner-channel contact
+//               folds its siloed state into the owner bucket (merge, idempotent,
+//               backed up, nothing lost).
+//   default (unset) → ON: the flag now defaults on, so an unset env resolves
+//               owner channels to the owner canonical. Only an explicit 0/off
+//               (the operator kill-switch) reverts to per-channel behaviour.
+// Isolation: each child sets its own temp HOME so config-dir points at a
+// throwaway .open-claudia — the real vault/state is never touched.
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const assert = require("assert");
+const { execFileSync } = require("child_process");
+
+const REPO = __dirname;
+
+function seedHome() {
+  const HOME = fs.mkdtempSync(path.join(os.tmpdir(), "oc-idtest-"));
+  const CFG = path.join(HOME, ".open-claudia");
+  fs.mkdirSync(CFG, { recursive: true });
+  // .env deliberately omits OC_UNIFIED_IDENTITY so the parent controls it via
+  // process.env per child.
+  fs.writeFileSync(path.join(CFG, ".env"), [
+    `WORKSPACE=${path.join(HOME, "ws")}`,
+    `CLAUDE_PATH=${process.execPath}`,
+    `TELEGRAM_BOT_TOKEN=dummy`,
+    `TELEGRAM_CHAT_ID=6251055967`,
+    `VOICE_OWNER_USER_ID=voice-owner`,
+    ``,
+  ].join("\n"));
+  fs.writeFileSync(path.join(CFG, "people.json"), JSON.stringify([{
+    id: "person_owner", name: "Owner", isOwner: true,
+    handles: [{ adapter: "telegram", channelId: "6251055967", canonicalUserId: "telegram:6251055967" }],
+    primaryChannel: { adapter: "telegram", channelId: "6251055967" }, notes: [],
+  }]));
+  fs.writeFileSync(path.join(CFG, "identities.json"), JSON.stringify({ channels: {}, preferred: {} }));
+  fs.writeFileSync(path.join(CFG, "state.json"), JSON.stringify({ users: {
+    "telegram:6251055967": { currentSession: { name: "tickets", dir: "/ws/tickets" }, lastSessionId: "t-sess",
+      settings: { model: "claude-opus-4-8" }, sessionUsage: { turns: 10, costUsd: 5 } },
+    "voice:voice-owner": { currentSession: { name: "hr", dir: "/ws/hr" }, lastSessionId: "v-sess",
+      settings: {}, sessionUsage: { turns: 3, costUsd: 1 } },
+  } }));
+  fs.writeFileSync(path.join(CFG, "sessions.json"), JSON.stringify({
+    "voice:voice-owner": { hr: [{ id: "v-sess", title: "HR", created: "x", lastUsed: "x" }] },
+  }));
+  return { HOME, CFG };
+}
+
+function runChild(mode) {
+  const { HOME, CFG } = seedHome();
+  process.env.HOME = HOME;
+  const id = require(path.join(REPO, "core/identity"));
+  const state = require(path.join(REPO, "core/state"));
+
+  if (mode === "off") {
+    assert.strictEqual(id.canonicalForChannel("voice", "voice-owner"), "voice:voice-owner", "off: voice stays siloed");
+    assert.strictEqual(id.canonicalForChannel("telegram", "6251055967"), "telegram:6251055967", "off: owner telegram unchanged");
+    assert.strictEqual(state.autoLinkOwnerChannel("voice", "voice-owner"), null, "off: auto-link inert");
+    const after = JSON.parse(fs.readFileSync(path.join(CFG, "state.json"), "utf-8"));
+    assert.ok("voice:voice-owner" in after.users, "off: voice bucket untouched");
+  } else if (mode === "default") {
+    // No OC_UNIFIED_IDENTITY in env or .env → the new default (ON) must apply.
+    assert.strictEqual(id.canonicalForChannel("voice", "voice-owner"), "telegram:6251055967", "default: unset resolves to owner (default ON)");
+    assert.strictEqual(id.canonicalForChannel("telegram", "9999999999"), "telegram:9999999999", "default: stranger stays isolated");
+  } else {
+    assert.strictEqual(id.ownerCanonical(), "telegram:6251055967", "on: ownerCanonical");
+    assert.strictEqual(id.canonicalForChannel("voice", "voice-owner"), "telegram:6251055967", "on: voice unified to owner");
+    assert.strictEqual(id.canonicalForChannel("telegram", "9999999999"), "telegram:9999999999", "on: stranger stays isolated");
+    const r1 = state.autoLinkOwnerChannel("voice", "voice-owner");
+    assert.deepStrictEqual(r1, { from: "voice:voice-owner", to: "telegram:6251055967" }, "on: migrate result");
+    assert.strictEqual(state.autoLinkOwnerChannel("voice", "voice-owner"), null, "on: idempotent second call");
+    const after = JSON.parse(fs.readFileSync(path.join(CFG, "state.json"), "utf-8"));
+    assert.ok(!("voice:voice-owner" in after.users), "on: voice bucket folded away");
+    assert.ok("telegram:6251055967" in after.users, "on: owner bucket present");
+    const sess = JSON.parse(fs.readFileSync(path.join(CFG, "sessions.json"), "utf-8"));
+    assert.ok(sess["telegram:6251055967"] && sess["telegram:6251055967"].hr, "on: hr session folded into owner");
+    const backups = fs.existsSync(path.join(CFG, "backups")) ? fs.readdirSync(path.join(CFG, "backups")) : [];
+    assert.ok(backups.length >= 3, "on: state/sessions/identities backed up before merge");
+  }
+
+  fs.rmSync(HOME, { recursive: true, force: true });
+  console.log(`unified-identity child(${mode}) OK`);
+}
+
+if (process.argv[2] === "--child") {
+  runChild(process.argv[3]);
+} else {
+  for (const mode of ["off", "on", "default"]) {
+    const childEnv = { ...process.env };
+    if (mode === "on") childEnv.OC_UNIFIED_IDENTITY = "1";
+    else if (mode === "off") childEnv.OC_UNIFIED_IDENTITY = "0";
+    else delete childEnv.OC_UNIFIED_IDENTITY; // default: prove unset ⇒ ON
+    try {
+      execFileSync(process.execPath, [__filename, "--child", mode], { env: childEnv, stdio: "pipe" });
+    } catch (e) {
+      console.error(`unified-identity ${mode} FAILED:\n${e.stdout || ""}${e.stderr || ""}`);
+      process.exit(1);
+    }
+  }
+  console.log("unified-identity OK");
+}