@open-everywhere/core 0.1.0

package/agent/channels/turn-delivery.ts

@@ -0,0 +1,484 @@
+// turn-delivery — the provider-NEUTRAL turn and delivery decisions: the final-message action, bare-stop detection, name-drop matching, the replier tier label, the rotation chain and the message-tool-only gate.
+// Dependency direction is ONE-WAY: a provider channel file imports these from here and never from another provider's file, and an import of anything provider-specific into this module is a design smell.
+
+// Side-effect import: arms the empty-step terminal guard (OPE-762) the eve tool-loop patch reads.
+// Every channel file imports this module to decide its terminal action, so the guard is installed
+// wherever a wake can be routed. See channels/turn-terminal-actions.ts for what it decides.
+import "./turn-terminal-actions.js";
+import { NO_REPLY_SENTINEL } from "./normalized-wake.js";
+import { getSettings } from "../settings/settings.js";
+import { configuredAgentName } from "../identity/bot-name.js";
+import { consumeNoReplyThisTurn } from "./no-reply-signal.js";
+import { silentRoutineThisTurn, SILENT_ROUTINE_DROP_REASON } from "../routines/report.js";
+import { consumeStandDownSilenceThisTurn, STAND_DOWN_SILENCE_REASON } from "./stand-down-silence.js";
+import { OE_GRAIN_ATTR, OE_TASK_LABEL_ATTR } from "./unified-window.js";
+import type { ChannelSessionRow } from "../operational/store.js";
+
+// NO_REPLY_SENTINEL genuinely lives in normalized-wake.ts; re-exported here so provider-neutral
+// callers reach the silence vocabulary through the neutral module, not through a provider file.
+export { NO_REPLY_SENTINEL };
+
+/**
+ * True when a turn's final message is the silence sentinel. It is a PREFIX match after trimming rather than an exact one: a model that half-complies must still be swallowed, because posting its private rationale is worse than over-silencing.
+ * A genuine reply never STARTS with the bare sentinel.
+ */
+export function isNoReply(message: string): boolean {
+  return message.trimStart().startsWith(NO_REPLY_SENTINEL);
+}
+
+/** What the slack `message.completed` override should do with a turn's final text. */
+export type FinalMessageAction =
+  | { readonly kind: "buffer-tool-status" }
+  | { readonly kind: "silent"; readonly reason: string }
+  | { readonly kind: "post"; readonly text: string };
+
+/**
+ * `FinalMessageAction.reason` when the turn's final text was the bare sentinel.
+ * Exported so a caller can tell the sentinel route apart from an empty completion or the `no_reply` tool route, rather than each provider file re-typing the string.
+ */
+export const NO_REPLY_SENTINEL_REASON = "NO_REPLY sentinel — judged not warranted";
+
+/**
+ * The pure decision behind the `message.completed` override: it mirrors eve's default handler — tool calls buffer for the typing status, an empty completion posts nothing — plus the ONE addition.
+ * The silence sentinel is SWALLOWED, not posted.
+ */
+export function finalMessageAction(finishReason: string, message: string | null): FinalMessageAction {
+  if (finishReason === "tool-calls") return { kind: "buffer-tool-status" };
+  // trim(): a WHITESPACE-ONLY completion is truthy but renders as an invisible empty
+  // message (live 2026-07-07 — deepseek-flash emitted a blank first completion and
+  // Discord posted it as an empty turd in the thread; Slack would 400 on it instead).
+  if (!message || !message.trim()) return { kind: "silent", reason: "empty final message" };
+  if (isNoReply(message)) return { kind: "silent", reason: NO_REPLY_SENTINEL_REASON };
+  return { kind: "post", text: message };
+}
+
+/**
+ * {@link finalMessageAction} plus the `no_reply` TOOL route: a turn that called the tool ends its reply obligation exactly like the sentinel would, EVEN IF the model still emits trailing narration, because the tool call already made the decision. Every channel's completion override calls THIS, so the tool works identically on every surface the sentinel already works on. The signal is read-and-reset only on a genuinely terminal call, because an intermediate step's pending tool call might BE the `no_reply` call.
+ * Plus the SILENT-ROUTINE gate: a turn belonging to a routine whose product is an action, not a message, NEVER posts its terminal completion. That check is deliberately STRUCTURAL, because a routine that exists to say nothing must not depend on the model remembering to say nothing. ORDER: the tool signal is consumed FIRST and unconditionally, so a set flag can never bleed into the next turn of a resumed session; the silent verdict then wins on reason text, because it is the stronger fact.
+ *
+ * 🔴 PLUS THE STAND-DOWN LATCH (OPE-1647), and it is the arm that catches a turn whose `no_reply` was REFUSED. `tools/no_reply.ts` refuses the silence call while the stand-down acknowledgement is still owed, and a refused call sets NO signal — so before this arm existed the model acknowledged the stop through `reply` and then had its trailing prose posted into the very conversation it had just been asked to leave (measured on deploy #187: the acknowledgement at 09:40:50, the trailing post at 09:41:01). `channels/stand-down-silence.ts` latches on the post that discharged the stop, so this reads a fact rather than a promise.
+ * `turnId` is OPTIONAL because the latch is turn-keyed and a caller that cannot name its turn must never be silenced on another turn's latch. Absent ⇒ the latch is still CLEARED (it can never outlive its turn) and this returns exactly what it returned before the latch existed.
+ * 🔴 ONE ARM'S CLOSING PROSE STILL POSTS, and it is the set to check against when adding a caller — not a surface count. Linear's NATIVE arm: its non-silent verdict hands the completion to the framework's default poster, which puts the terminal text in the room, and that is what makes the latch load-bearing there. Every other arm DROPS its closing prose since OPE-2006 — `channels/closing-prose-drop.ts` on the chat surfaces and GitHub's native arm, the message-tool-only gate on the ticketing supervisors, and structurally on the unified window — so the latch has no door to shut on them. They still PASS the turn id, because the latch also decides WHICH row a dropped turn files: a stood-down turn files its silence under the stand-down reason rather than as a lost answer. Discord's GUILD path reaches the same latch by its own read (`discord-gateway.ts`), because that handler consumes the `no_reply` signal itself and so cannot call this function.
+ * ORDER: the two consuming reads run FIRST and unconditionally, for the bleed reason above. The silent-routine verdict then keeps its win on reason text, because a routine that exists to say nothing is the stronger fact; the stand-down reason then wins over the `no_reply` one, because a stop the person ASKED for says more about the turn than the reason the model picked for its silence.
+ */
+export function finalMessageActionForTurn(finishReason: string, message: string | null, turnId?: string): FinalMessageAction {
+  const action = finalMessageAction(finishReason, message);
+  if (action.kind === "buffer-tool-status") return action;
+  const reason = consumeNoReplyThisTurn();
+  const stoodDownSilent = consumeStandDownSilenceThisTurn(turnId);
+  if (silentRoutineThisTurn()) return { kind: "silent", reason: SILENT_ROUTINE_DROP_REASON };
+  if (stoodDownSilent) return { kind: "silent", reason: STAND_DOWN_SILENCE_REASON };
+  if (reason) return { kind: "silent", reason: `no_reply tool: ${reason}` };
+  return action;
+}
+
+// BARE-STOP DETECTION. A turn must end with a reply, a react or a judged silence, never silently nothing — but a HARD pre-completion gate is not reachable through eve's public seams: the completion override fires AFTER the model has produced its terminal text, and there is no earlier documented hook that could block or redirect it. Inventing one would mean forking the turn loop, not extending it.
+// What IS reachable is DETECT-AND-LOG from that same override, using information already in hand. It runs strictly after the turn has gone silent, and the caller only logs a warning and an audit row — it never invents a post.
+/**
+ * True when this turn is a "bare stop": nothing explains the silence. `action` must already be the terminal decision for this turn.
+ * `actedThisTurn` is the caller's OR of the per-turn action signals, so a turn that reacted OR posted mid-turn DID something even if its final text is empty, and is never a bare stop.
+ */
+export function isBareStop(action: Extract<FinalMessageAction, { kind: "silent" } | { kind: "post" }>, actedThisTurn: boolean): boolean {
+  return action.kind === "silent" && action.reason === "empty final message" && !actedThisTurn;
+}
+
+/**
+ * Case-insensitive matcher for the agent's display name as a standalone phrase.
+ * It uses non-word boundaries rather than `\b`, so a name that starts or ends with a symbol still anchors, and inner whitespace is normalised so a doubled space still hits.
+ */
+export function nameDropPattern(name: string): RegExp {
+  const escaped = name
+    .trim()
+    .replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+    .replace(/\s+/g, "\\s+");
+  return new RegExp(`(?:^|[^\\p{L}\\p{N}_])${escaped}(?=$|[^\\p{L}\\p{N}_])`, "iu");
+}
+
+/**
+ * The unified name-drop WAKE token set: the surface's live vendor display name UNION the deployment's canonical name, extended by the operator's include list and NARROWED by the exclude list — EXCLUDE WINS over include and over the automatic base. De-duplication and exclusion are case-insensitive, and an empty-after-trim token is dropped rather than handed to the matcher, where an empty needle would match almost every position.
+ * Deliberately NOT the broader agent-name helper: this set never carries that helper's brand-default tiers, because folding those in would broaden a real display name's ambient trigger for no gain. Everything past the two automatic members is the operator's explicit choice, made by a reviewed diff — token lists, no regex and no predicate.
+ */
+export function wakeNameDropTokens(displayName: string | undefined): string[] {
+  const settings = getSettings();
+  const exclude = new Set(
+    settings.wake.nameDropExclude.map((t) => t.trim().toLowerCase()).filter((t) => t.length > 0),
+  );
+  const candidates = [displayName, configuredAgentName(), ...settings.wake.nameDropInclude];
+  const out: string[] = [];
+  const seen = new Set<string>();
+  for (const raw of candidates) {
+    const t = raw?.trim();
+    if (!t) continue;
+    const key = t.toLowerCase();
+    if (seen.has(key) || exclude.has(key)) continue;
+    seen.add(key);
+    out.push(t);
+  }
+  return out;
+}
+
+// THE REPLIER TIER SIGNAL: a bare name means the ambient supervisor answered, a bracketed one means a delegated WORKER replied, so one glance tells a reader which tier is speaking. Today that split is otherwise visible only in the audit trail.
+// SCOPE is the ONE grain that brackets: `task`, the sole WIDE-HANDS worker grain. A standing supervisor, a persistent conversational seat and a raw mention are all conversational-root seats and render BARE. The label text rides the delegated task's OWN brief, stamped ONCE host-side on the worker's opening delivery and never re-derived — so {@link replierLabelFor} still brackets with a generic fallback when the label is absent, because the binary supervisor-versus-worker distinction must never depend on the label text surviving.
+
+/** A worker/delegated-turn REPLIER TIER label — present ⇔ a task-grain worker's reply, as opposed
+ *  to a bare supervisor/ambient one. `taskLabel` is a short, already-truncated, single-line
+ *  description of the delegated work — never the raw multi-line brief. */
+export interface ReplierLabel {
+  readonly taskLabel: string;
+}
+
+/**
+ * Collapse a possibly long, possibly multi-line task brief into a short ONE-LINE display label: whitespace-normalised, brackets STRIPPED, and capped with a trailing ellipsis. Pure, and an empty input yields an empty string.
+ * THE BRACKET STRIP IS LOAD-BEARING, NOT COSMETIC. The label is the model's OWN brief text rendered verbatim inside the bracket pair that IS the tier signal, so a brief starting with a close bracket would end the real one early and open a fake one — forging the exact framing the signal exists to be trustworthy about. Stripped rather than escaped, because the label is a short display string and not markup a reader parses.
+ */
+export function truncateTaskLabel(text: string, max = 60): string {
+  // Strip brackets BEFORE trimming: a leading `]`/trailing `[` (the hostile case) leaves a stray
+  // space exposed once the bracket itself is gone, and that space must trim away too — not just
+  // whatever whitespace was already at the raw edges before stripping.
+  const oneLine = text
+    .replace(/[[\]]/g, "")
+    .trim()
+    .replace(/\s+/g, " ");
+  if (oneLine.length <= max) return oneLine;
+  return `${oneLine.slice(0, Math.max(1, max - 1)).trimEnd()}…`;
+}
+
+/**
+ * The REPLIER label for a turn of this grain, or `undefined` for a bare, non-worker reply. Only the task grain ever brackets; every other grain, an unset or unknown one included, renders bare.
+ * An absent or blank label still brackets, with a generic fallback: a worker turn is ALWAYS visibly distinguishable from a supervisor one, even when the specific brief text is not available on this wake.
+ */
+export function replierLabelFor(grain: string | undefined, taskLabel: string | undefined): ReplierLabel | undefined {
+  if (grain !== "task") return undefined;
+  return { taskLabel: taskLabel && taskLabel.trim().length > 0 ? taskLabel : "task" };
+}
+
+/**
+ * {@link replierLabelFor} straight off a turn's own host-stamped auth attributes — the ONE read every provider channel file's turn-start snapshot needs, because a completion handler has no live auth ctx and the decision must be made here and read back at completion time.
+ * Pure, total and fail-soft: a non-string or absent attribute on either key reads as absent, and it never throws.
+ */
+export function replierLabelFromAuthAttributes(attrs: Record<string, unknown> | undefined): ReplierLabel | undefined {
+  const str = (v: unknown): string | undefined => (typeof v === "string" && v.length > 0 ? v : undefined);
+  return replierLabelFor(str(attrs?.[OE_GRAIN_ATTR]), str(attrs?.[OE_TASK_LABEL_ATTR]));
+}
+
+/** Render `text` with its worker-turn bracket prefix applied — the fallback every surface without a
+ *  native per-message display-name override renders (Discord/Teams/Notion/Linear body text; Slack
+ *  uses a native `username` override instead, see slack-post-arm.ts). No-op (`text` unchanged) when
+ *  `replier` is undefined — a bare supervisor/ambient reply is never touched. */
+export function withReplierPrefix(text: string, replier: ReplierLabel | undefined): string {
+  return replier ? `[${replier.taskLabel}] ${text}` : text;
+}
+
+// NO PENDING-WORK FRAME. The host adds NOTHING to a post made while a worker this turn dispatched still owes the answer (OPE-1516). It used to prefix a constant line saying so.
+// The line is gone because it asserted nothing the message did not already carry: a model that says what it is doing has said it, and a host prefix on top of that reads as machinery rather than as help. The mechanism that remains is the INSTRUCTION (`PENDING_WORK_INSTRUCTION`, defined in THIS module below; `access/pending-delegation-signal.ts` owns only the CONDITION) — the tool result tells the model, on exactly the turns where a worker still owes the answer, that its message must say it is still working and must not present a final result.
+// 🔴 WHICH DOORS CARRY IT, EXACTLY (OPE-1544, OPE-1575): ALL FOUR TOOL VARIANTS of the reply plane — `unifiedReplyEntry` and `baseReplyEntry` in `tools/reply.ts`, `unifiedEditReplyEntry` and `baseEditReplyEntry` in `tools/edit_reply.ts`. Those are the paths where the model is still choosing what to say AND the sentence reaches it. Every OTHER path that writes the model's words into a room carries nothing; the note below counts them all, and they are a different gap.
+// WHY THE PER-SURFACE PAIR IS IN THAT LIST (OPE-1575). `access/window-gate-manifest.ts` scopes the delegation verb as `agent: ["standing", "thread"]`, so a standing channel-root seat on a per-surface deployment delegates, and both `session.started` resolvers mount the `_base` variant for exactly that seat. Leave those two doors out and that seat dispatches a worker and then posts or edits with no instruction anywhere — the OPE-1544 hazard, on the deployment shape OPE-1544 did not cover. The reply half carries the sentence in a `note` field its output schema declares for this purpose. The condition it reads is the WAKE-FREE one, `pendingDelegationThisTurn` (`access/pending-delegation-signal.ts`, OPE-1601): a per-surface seat holds no wake id at all, and it holds ONE conversation for the whole turn, so "a worker this turn dispatched is still running" is the whole question on this door. That module states the equality and why it may never be assumed on a unified door.
+// THE TERMINAL-PROSE GAP IS CLOSED, AND IT WAS CLOSED BY REMOVING THE ROAD (OPE-1982, OPE-2006). A turn whose ENDING TEXT was the reply carried no instruction anywhere, and no schema change could fix that: the model has stopped talking by the time a completion handler runs, so there is nothing left to instruct. The answer was to stop that text reaching a room at all.
+//   • THE UNIFIED WINDOW (OPE-1982). `channels/unified.ts` drops a turn's closing text on every addressing and re-drives it once towards the `reply` tool, so the only way a unified seat's words reach a room is a tool door that DOES carry the sentence.
+//   • THE PER-SURFACE COMPLETION HANDLERS (OPE-2006). Each chat surface's own `message.completed` handler — `slack.ts`, `discord.ts`, `discord-gateway.ts`, `teams.ts` and `github.ts`'s NATIVE arm — now DROPS the terminal text and writes one `turn.supervisor_prose_dropped` row (`channels/closing-prose-drop.ts`). The raw FALLBACK writes that sat beside each call are gone with it, so a partition-less state posts nothing through eve's own primitive either. ("Completion handler", not "arm": `arm` already names a delivery arm in `channels/reply-signal.ts` §ARM and a per-provider post arm in `channels/post-arms.ts`.)
+// So a routine fire that ends in prose posts NOTHING on any seat shape, and `reply` is the channel a fire owing an answer must use. ONE path still writes a turn's ending text into a room: Linear's NATIVE arm hands its completion to the framework's default poster. It carries no pending-work sentence either, and it is the one arm the stand-down latch above is still load-bearing on.
+// What did NOT change: the mark guards still refuse to CLOSE such a wake, the conversation stays open so the worker's real answer can land in it, and the audit rows behind both are untouched. The host's restraint is only about what it writes in the room.
+
+/**
+ * 🔴 THE PENDING-WORK INSTRUCTION — THE WHOLE MECHANISM, ON THE FOUR TOOL DOORS
+ * (OPE-1516, OPE-1544, OPE-1575). Those four are now every door a seat's words leave by, bar the one
+ * path the note above names. It lives HERE, beside the note that explains why the frame is gone,
+ * because it is model-facing DELIVERY COPY: it decides what a message says, never what the agent may
+ * reach.
+ * `access/pending-delegation-signal.ts` owns the CONDITION (`pendingDelegationOwing`) and this
+ * module owns the SENTENCE, which is the same split every other line the host writes on a body
+ * follows.
+ *
+ * ONE STRING, FOUR DOORS — the unified pair and the per-surface pair, one post door and one edit
+ * door each. The edit door is the sharper of each pair, because it rewrites the very message that
+ * carried the caveat and notifies nobody.
+ *
+ * NO terminal-prose path can use the string, and none pretends to. By the time a completion handler
+ * runs the model has stopped talking, so there is nothing left to instruct — which is why the
+ * per-surface handlers DROP that text rather than post it uninstructed.
+ *
+ * It opens with a leading space: every caller appends it to a note that is already a sentence.
+ */
+export const PENDING_WORK_INSTRUCTION =
+  " Your background worker for this conversation has NOT reported yet, so you do not have the answer it was asked for" +
+  " — never write that answer out yourself; report what the worker returns." +
+  " Nothing is added to your message on its way out, so your own words are the only thing that tells this conversation" +
+  " where the work stands: say plainly that you are still working on it, and do not present what you have as the final result.";
+
+// MEMORY CITATION RENDER. A citation is MODEL-AUTHORED: the seat cites the memory file it read, but that mount path is real only inside this turn's ephemeral sandbox, so a member sees an unresolvable link — or the raw markup — plus a little internal memory layout leaking into the room.
+// The CITATION is good, because "recorded, not guessed" is warranted trust; the RENDER is wrong for a member. Truncate to the silo-relative path and render it as PLAIN TEXT, never a link and never carrying the mount prefix: the silo persists and only the mount is ephemeral, so that path is the stable referent. It runs at every reply and edit choke point on the model's own text, so the prompt stays silent about it — a rendering fix, not a behaviour the model must remember.
+
+/** The sandbox path segment every memory citation is anchored under (memory/sandbox-sync.ts's
+ *  `BASE`) — everything before it is either the `file://` scheme or nothing (a bare absolute
+ *  path); everything after it is the silo-relative path the citation should keep. */
+const MEMORY_MOUNT_SEGMENT = "workspace/memory/";
+
+// ── 🔴 THE TRAVERSED WEB URL — A MEMORY CITATION DRESSED AS A REPO LINK (OPE-1763) ──────────────
+// Soak step 17, on the GitHub review surface: the seat answered from memory and cited
+// `https://github.com/<owner>/<repo>/blob/main/../workspace/memory/soak-brain/decisions.md#L3`. The
+// FACT was right and the citation was invented — the model concatenated the repo's blob base with
+// the sandbox path it had actually read, and the `..` between them is the seam where the two were
+// joined. It is the worst shape a citation can take: a reviewer clicks it, because on GitHub a blob
+// URL is what a real citation looks like, and it 404s.
+// 🔴 THE `..` IS THE SEAM, AND THE SEAM IS THE ONLY TELL — THIS RULE IS A HEURISTIC, NOT A PROOF.
+// A `..` segment does NOT make a URL unresolvable. RFC 3986 §5.2.4 `remove_dot_segments` is applied
+// by every browser, by curl and by `new URL()`, so the URL resolves to a DIFFERENT path than the one
+// written. The soak spelling collapses to `/blob/workspace/memory/soak-brain/decisions.md`, which
+// names no branch, and THAT is why it 404s. What the `..` really marks is the join: a model that
+// concatenates a repository base with the sandbox path it read leaves the segment behind, and no
+// hand-written citation needs one. So the host treats the seam as the tell and renders the whole
+// token as the silo-relative path, in plain text, per the OPE-916 ruling.
+// 🔴 THE TWO RESIDUALS, BOTH STATED.
+//   • FALSE NEGATIVE. A fabricated URL with NO traversal
+//     (`https://…/blob/main/workspace/memory/x.md`) is not caught, and must not be: it is
+//     byte-identical to a link to a real repository file that genuinely lives at `workspace/memory/`.
+//     Closing it needs a per-turn ledger of the URLs the turn actually read, which nothing records.
+//   • FALSE POSITIVE. A GENUINE link written with a `..` segment, whose collapsed path reaches
+//     `workspace/memory/`, is rewritten too. Accepted: the shape is rare in hand-written prose, and
+//     the cost is a citation rendered as a path rather than a member shown a receipt that lies.
+// `file://` IS IN THE SCHEME SET FOR A DIFFERENT REASON, and it carries no ambiguity at all: a
+// `file://` URL that names the memory mount is ALWAYS the ephemeral sandbox mount — that is the whole
+// OPE-916 premise — so a traversed spelling of it (`file:///srv/../workspace/memory/…`) is the same
+// leak written a second way, and it escaped the rule until it was listed here.
+// 🔴 `:` IS EXCLUDED FROM BOTH RUNS SO A MATCH CANNOT CROSS A SECOND `scheme://`. Without it one
+// whitespace-delimited token could start at one URL, take ITS `/../`, run on through a second URL's
+// scheme and finish on that second URL's mount — deleting a genuine, un-traversed repository link
+// from a member's message (measured in cold review on
+// `https://example.com/r?to=/a/../b&next=https://github.com/a/h/blob/main/workspace/memory/n.md`).
+// The cost is a traversed URL carrying an explicit PORT (`https://host:8443/a/../workspace/memory/x`)
+// is no longer matched: a miss, never a false rewrite, which is the side this must fail on.
+// The two runs are BOUNDED (`{0,200}`) rather than open `*?`. A lazy run either side of a literal
+// backtracks once per candidate `/../` on a long token that never reaches the mount, and a reply body
+// is model-authored text of unbounded length; a bound keeps this linear in practice. 200 characters
+// is past any URL path this has to match — the soak's own path was 78.
+const TRAVERSED_URL_MOUNT = String.raw`(?:https?|file):\/\/[^\s()|<>:]{0,200}?\/\.\.\/[^\s()|<>:]{0,200}?workspace\/memory\/`;
+
+/** The three URL shapes that reach the memory mount, as one alternation: the `file://` scheme, the
+ *  bare absolute path (only where it is NOT embedded in a larger token — the negative lookbehind is
+ *  what keeps an unrelated link that merely contains the substring untouched), and the traversed URL
+ *  above. Spelled once so the three matchers below cannot drift in WHICH shapes they accept. */
+const MOUNT_URL = String.raw`(?:file:\/\/\/workspace\/memory\/|${TRAVERSED_URL_MOUNT}|(?<![\w./:-])\/workspace\/memory\/)`;
+
+/** A memory-mount reference wrapped in Markdown link syntax: `[label](file:///workspace/memory/…)`
+ *  or `[label](/workspace/memory/…)` — Notion's comment API renders the model's Markdown as a real
+ *  hyperlink, which is how this shape reached a member (soak step 28). Captures the URL. */
+const MARKDOWN_LINK_RE = new RegExp(String.raw`\[[^\]\n]*\]\((${MOUNT_URL}[^\s()]+)\)`, "g");
+
+/** A memory-mount reference wrapped in Slack's mrkdwn link syntax: `<file:///workspace/memory/…|label>`
+ *  or `</workspace/memory/…|label>` — an unresolvable scheme, so Slack shows the raw markup verbatim
+ *  rather than a hyperlink (soak steps 7 and 24). Captures the URL. */
+const SLACK_LINK_RE = new RegExp(String.raw`<(${MOUNT_URL}[^\s|>]+)\|[^>]*>`, "g");
+
+/** Any remaining, un-wrapped memory-mount reference in prose. Captures the WHOLE URL rather than the
+ *  tail, because the traversed shape carries a scheme and a host before the mount and only
+ *  {@link siloRelativePath} knows where to cut; the two older shapes cut to the same byte either way. */
+const BARE_MEMORY_REF_RE = new RegExp(String.raw`${MOUNT_URL}[^\s()|<>]+`, "g");
+
+/** Strip the mount prefix off a URL/path already known to start with it, leaving the silo-relative
+ *  path (`<silo>/<path>`) verbatim — including any trailing line anchor (`#L2`, `:2`), which is
+ *  part of the citation text, not the ephemeral part. */
+function siloRelativePath(url: string): string {
+  const idx = url.indexOf(MEMORY_MOUNT_SEGMENT);
+  // Both capturing regexes above only ever hand this a string that contains the segment (that is
+  // what they matched on), so `idx` is never -1 in practice; the fallback keeps this function
+  // total rather than throwing on a future caller that skips the guard.
+  return idx < 0 ? url : url.slice(idx + MEMORY_MOUNT_SEGMENT.length);
+}
+
+/**
+ * Render every memory citation in `text` as its bare silo-relative path in plain text — never a link, and never carrying the sandbox mount prefix.
+ * Conservative by construction: only a token that literally names the memory mount is touched, and every other URL, path or code-block byte passes through unchanged. ORDER MATTERS — the two wrapped shapes are unwrapped FIRST, so their inner URL is not left half-mangled by the bare pass.
+ */
+export function truncateMemoryCitationPaths(text: string): string {
+  let out = text.replace(MARKDOWN_LINK_RE, (_m, url: string) => siloRelativePath(url));
+  out = out.replace(SLACK_LINK_RE, (_m, url: string) => siloRelativePath(url));
+  out = out.replace(BARE_MEMORY_REF_RE, (m: string) => siloRelativePath(m));
+  return out;
+}
+
+// ROTATION IS 100% CONTEXT-MOTIVATED. It is NOT a hygiene boundary, NOT a taint boundary and NOT a deploy or instruction-change lever: a generation is retired because its CONTEXT has gone stale or unwieldy, and for no other reason. Any future trigger has to argue itself on context grounds or it does not belong in the chain below.
+// The division of labour: eve COMPACTION owns size in-generation, for every window type; ROTATION owns TIME, because a standing seat's context goes stale on a CALENDAR rather than on a counter, so the primary trigger is the generation's AGE; and everything else is a BACKSTOP. The cumulative-token trigger meters step-count times cache re-reads rather than context size, which is why it was ruled accidental as a primary and demoted rather than re-valued. Unchanged deliberately: the two fail-safes, and the session-park saturation that retires a parked generation by pushing its counter past the last rung.
+
+// THE ROTATION THRESHOLDS BELOW ARE FUNCTIONS, NOT CONSTANTS, and that is the whole point rather than a style preference. As module-load constants they were read BEFORE the settings registration ran, so they could never see an app override, and the schema had to REFUSE those names to avoid one silently doing nothing.
+// As functions they read the settings at CALL time, which is the schema's default posture, so the names can be owned like any other. Do not collapse one back into a constant: the load-order defect returns silently, with no test to catch it.
+
+/**
+ * Quiet-gap rotation threshold: a generation not woken in this long rotates fresh on its NEXT wake rather than resuming a stale session. The default is affordable BECAUSE the tail got tight — a rotation now rebuilds from a recorded, capped tail rather than a re-fetched backscroll bundle, and the two changes shipped together on purpose.
+ * This is IDLENESS, not AGE — a sibling of the expiry trigger below, not a duplicate: a seat woken hourly for a month never trips the gap and always trips the expiry, and a seat woken twice a week trips the gap without ever aging out. Both are context arguments; keep both.
+ */
+export function supervisorRotateQuietGapMs(): number {
+  return getSettings().rotation.quietGapHours * 3_600_000;
+}
+
+/**
+ * Read a rotation clock expressed in DAYS off the environment, with the fail-safe posture the rest of this chain uses. Shared by the window default here and the DM seat's longer clock, so the two can never drift in how they PARSE, only in what they default to.
+ * Unset, blank or unparseable all yield the committed default — a typo'd override must never silently DISABLE a trigger, and the loudest safe answer is "behave as shipped" — while zero or negative yields infinity, the deliberate "disabled" spelling.
+ */
+export function rotationClockMsFromDays(raw: string | undefined, defaultDays: number): number {
+  const fallback = defaultDays * 86_400_000;
+  if (raw === undefined || raw.trim() === "") return fallback;
+  const days = Number(raw);
+  if (!Number.isFinite(days)) return fallback;
+  return rotationClockMs(days);
+}
+
+/**
+ * The days-to-milliseconds half of the rule above, split out so a clock whose days already came through the settings schema — which does the unset-or-unparseable half itself — reaches the same answer without round-tripping through a string.
+ * Zero or negative yields infinity, the deliberate "disabled" spelling. The parse and the conversion are two named steps rather than one function that had to be both.
+ */
+function rotationClockMs(days: number): number {
+  return days > 0 ? days * 86_400_000 : Number.POSITIVE_INFINITY;
+}
+
+/**
+ * PRIMARY rotation trigger: a window rotates once THIS GENERATION has been alive longer than this, measured from a timestamp every rotation resets — so it is the generation's own age and never the seat's.
+ * WHY TIME: a standing seat's context decays on a calendar — last month's norms, a resolved incident still framed as open, a person who has since left — and none of that shows up in a token counter or a turn count. Age is a coarse proxy deliberately: it is a FRESHNESS lever, not a size one, and its job is to guarantee no generation carries a stale world view indefinitely. NO OTHER WINDOW TYPE GETS IT, because a clock over a session that lives for one unit of work measures nothing, and those seats never reach the chain at all.
+ */
+export function supervisorRotateExpiryMs(): number {
+  return rotationClockMs(getSettings().rotation.expiryDays);
+}
+
+/**
+ * TOKEN BACKSTOP, and the former primary trigger: the measured cumulative input plus cache-read tokens the spend hook accumulates onto the registry row.
+ * DEMOTED, NOT RE-VALUED, and the reason to keep the number is the reason it stopped being primary — it is not a size measurement. Every step re-counts the full context, so it meters step-count times cache re-reads and fires after a handful of mature wakes rather than the turn count it was modelled on. As a primary that made rotation a slow-drip amnesia machine; as a BACKSTOP the same early-firing conservatism is what you want from a last line of defence, and it keeps the session-park remedy working unchanged.
+ */
+export function supervisorRotateTokenBudget(): number {
+  return getSettings().rotation.tokenBudget;
+}
+
+/**
+ * TURN BACKSTOP: it binds if the spend hook is broken while wakes still deliver, so the token counter stalls, and — the reason it moved — if a generation outgrows the SUBSTRATE. The old value was derived against ONE wall, and a SECOND, LOWER wall then appeared underneath it: a durable session is a workflow run, and a run is capped at a fixed number of EVENTS, so at the measured events-per-turn that wall binds far below where the old backstop sat.
+ * The current value leaves real headroom on the MEAN, because a tool-heavy turn is a multiple of it and a backstop set at the mean-derived limit protects only an average seat. FRAGILE POINT: both the event cap and the events-per-turn figure are measurements of someone else's substrate, so the latter should be RE-MEASURED after any change to tool-call shape or step ceiling, and this number re-derived from it rather than nudged.
+ */
+export function supervisorRotateTurnBudget(): number {
+  return getSettings().rotation.turnBudget;
+}
+
+/**
+ * CONTEXT-SIZE BACKSTOP: the LAST request's measured input plus cache-read tokens — the size of the context the model actually saw, which is the measure compaction reads. It is a DIFFERENT QUANTITY from the cumulative counter, and that distinction is why this rung exists: the cumulative one meters step-count times cache re-reads and says nothing about how big the context is.
+ * What it buys is that a standing seat which would otherwise COMPACT re-mints instead, carrying a recorded tail rather than a utility-model summary of itself. THE ORDERING IS LOAD-BEARING AND PINNED OUTSIDE THIS FILE: this threshold must stay under the deployed stack's compaction fire point, or the seat compacts before it rotates and the whole design is inert — the two numbers live in different files and only a dedicated test joins them.
+ */
+export function supervisorRotateContextSize(): number {
+  return getSettings().rotation.contextSizeTokens;
+}
+
+/** Which rung of the rotation chain fired. Ordered as the chain evaluates: fail-safes, then the
+ *  PRIMARY time triggers, then the backstops. Exposed (rather than a bare boolean) so a call site
+ *  or a test can say WHY a generation was retired without re-deriving it from the row. */
+export type RotationTrigger =
+  /** FAIL-SAFE: the eve build changed under this seat, so its session cannot be proven resumable
+   *  (channels/runtime-rotation.ts, OPE-599). Supplied by the caller, not derived from the row. */
+  | "runtime-changed"
+  /** OPERATOR: a human ops sweep stamped `channel_session.rotate_marked_at` on this generation
+   *  (OPE-820). Nothing in the product ever sets it, and the rotation it asks for is the seat's own
+   *  in-band leg — which is the point, because only that leg carries the recorded tail. */
+  | "operator-marked"
+  /** FAIL-SAFE: the token counter is NULL — a pre-migration row whose accumulation can't be proven safe. */
+  | "unknown-accumulation"
+  /** FAIL-SAFE: `now`, `created_at` or `last_wake_at` did not parse — an age we can't prove is an age we don't trust. */
+  | "unparseable-timestamp"
+  /** PRIMARY: this generation is older than its expiry clock (context freshness). */
+  | "expiry"
+  /** PRIMARY: nothing has woken this generation for longer than the quiet gap (idleness ⇒ pseudo-session boundary). */
+  | "quiet-gap"
+  /** BACKSTOP: the LAST request's input tokens crossed the context-size line, so the seat re-mints
+   *  with a tail instead of compacting into a summary (see {@link supervisorRotateContextSize}). */
+  | "context-size"
+  /** BACKSTOP: turn count past the substrate-derived bound (see {@link supervisorRotateTurnBudget}). */
+  | "turn-backstop"
+  /** BACKSTOP: the measured cumulative-token counter reached its budget (also the OPE-171 park remedy's route). */
+  | "token-backstop";
+
+/**
+ * The options {@link rotationTrigger} evaluates against. The NUMBERS are thresholds, each overridable per call — the DM seat passes its own set and tests pass narrow ones — defaulting to the module readers above, each resolved at the moment the chain is evaluated.
+ * `runtimeChanged` is not a threshold: it is a per-wake verdict the CALLER resolves against the store, carried here so the chain still has one home.
+ */
+export interface RotationThresholds {
+  readonly quietGapMs?: number;
+  readonly turnBudget?: number;
+  readonly tokenBudget?: number;
+  /** Last-request input tokens past which a standing generation re-mints (OPE-794). */
+  readonly contextSizeTokens?: number;
+  /** Max age of ONE generation, from `created_at`. `Number.POSITIVE_INFINITY` disables expiry. */
+  readonly expiryMs?: number;
+  /**
+   * FAIL-SAFE, CALLER-SUPPLIED: the eve build changed under this seat, so OE cannot prove the durable session is resumable. True means rotate, whatever the row says.
+   * It is an INPUT rather than a rung this function derives, because the verdict needs a durable one-shot claim and this function is pure. Another module owns that claim and its audit; every surface reads it there and passes the boolean here, so the rotation CHAIN still has exactly one home. Absent is byte-identical to the chain before the rung existed.
+   */
+  readonly runtimeChanged?: boolean;
+}
+
+/**
+ * Pure: WHICH rotation trigger, if any, applies to this generation before the next wake is delivered. `null` means resume the current generation.
+ * ORDER IS THE CHAIN'S MEANING, not an optimisation: the runtime fail-safe first, because a session we cannot prove resumable must never be resumed; then the OPERATOR MARK, because an explicit instruction outranks every measurement of the row; then the backfill fail-safes, because a row we cannot read must not be reasoned about; then the two TIME triggers rotation actually owns; then the backstops, context size leading them. Every timestamp is parsed up front, and an unparseable one reads as ROTATE — the same fail-safe posture the null counter takes.
+ */
+export function rotationTrigger(
+  row: Pick<ChannelSessionRow, "createdAt" | "lastWakeAt" | "turnCount" | "inputTokensTotal"> & Partial<Pick<ChannelSessionRow, "lastInputTokens" | "rotateMarkedAt">>,
+  now: string,
+  opts: RotationThresholds = {},
+): RotationTrigger | null {
+  if (opts.runtimeChanged === true) return "runtime-changed"; // fail-safe (OPE-599) — FIRST, and it reads no field of the row
+  // THE OPERATOR MARK, second and above every row-derived rung: an ops sweep asked for this generation to be retired, and that answer must not depend on the seat's own counters. An absent or null field reads as UNMARKED, so every pre-migration row keeps its exact prior chain.
+  // THIS IS NOT A DEPLOY LEVER, and the context-motivated ruling still stands: a deploy sets nothing, and the mark has one writer and one caller, which a human runs. It exists so an operator's rotation runs HERE, through the seat's own rotate leg, rather than as a store-level token swap — only this leg carries the outgoing generation's recorded tail, and an out-of-band swap read that tail and destroyed it.
+  if (row.rotateMarkedAt != null) return "operator-marked";
+  if (row.inputTokensTotal == null) return "unknown-accumulation"; // fail-safe (backfill posture)
+  const nowMs = Date.parse(now);
+  const createdAtMs = Date.parse(row.createdAt);
+  const lastWakeAtMs = Date.parse(row.lastWakeAt);
+  if (!Number.isFinite(nowMs) || !Number.isFinite(createdAtMs) || !Number.isFinite(lastWakeAtMs)) return "unparseable-timestamp";
+  if (nowMs - createdAtMs > (opts.expiryMs ?? supervisorRotateExpiryMs())) return "expiry"; // PRIMARY — context freshness
+  if (nowMs - lastWakeAtMs > (opts.quietGapMs ?? supervisorRotateQuietGapMs())) return "quiet-gap"; // PRIMARY — idleness
+  // CONTEXT SIZE, FIRST OF THE BACKSTOPS. It leads the group because it is the only rung RACING another mechanism: cross the compaction threshold and the generation is summarised rather than re-minted, and there is no way back from that. The other backstops race nothing.
+  // A NULL here reads as SKIP, not as the fail-safe ROTATE its cumulative sibling gets, and the difference is real: a null cumulative counter is an accumulation that cannot be proven safe, but a null last-request value is the NORMAL state of every generation that has not yet run a turn. Rotating on it would retire each new generation before its first wake, endlessly.
+  if (row.lastInputTokens != null && row.lastInputTokens >= (opts.contextSizeTokens ?? supervisorRotateContextSize())) return "context-size";
+  if (row.turnCount > (opts.turnBudget ?? supervisorRotateTurnBudget())) return "turn-backstop";
+  if (row.inputTokensTotal >= (opts.tokenBudget ?? supervisorRotateTokenBudget())) return "token-backstop";
+  return null;
+}
+
+/**
+ * Pure: should this generation rotate BEFORE the next wake is delivered?
+ * The boolean face of {@link rotationTrigger} — every surface's rotate leg calls THIS, and the trigger enum is there for anything that wants to say why.
+ */
+export function shouldRotate(
+  row: Pick<ChannelSessionRow, "createdAt" | "lastWakeAt" | "turnCount" | "inputTokensTotal"> & Partial<Pick<ChannelSessionRow, "lastInputTokens" | "rotateMarkedAt">>,
+  now: string,
+  opts: RotationThresholds = {},
+): boolean {
+  return rotationTrigger(row, now, opts) !== null;
+}
+
+// THE MESSAGE-TOOL-ONLY HARD-SILENCE GATE, enforced STRUCTURALLY rather than by prompt. On a supervisor turn the terminal completion text is NOT a reply — it is DROPPED — and a visible reply must come from a positive `reply` tool call, which posts mid-turn to the real per-turn target. Without it, a judge that emitted stray narration as its terminal completion would have that prose posted into the watched channel.
+// FAIL-OPEN where the surface has NO mid-turn post primitive: with no tool route, terminal text must still post or the supervisor would be mute. Thread binding is unaffected either way — only the leak-prone terminal post is removed.
+
+/** The message-tool-only decision for a supervisor turn's TERMINAL completion text. */
+export interface SupervisorTextDelivery {
+  /** May the terminal completion text be posted as a reply? false under message-tool-only. */
+  readonly postText: boolean;
+  /** Non-empty terminal prose that the gate is dropping (→ an observability signal). */
+  readonly droppedProse: boolean;
+  readonly reason: string;
+}
+
+/**
+ * The pure message-tool-only gate. `hasTerminalProse` is the only case that can leak; `midTurnPostAvailable` says whether the reply tool is armed on this surface.
+ * When the tool IS available, terminal text never posts; when it is NOT, the gate fails open and lets it post, because there is no tool route to reply through.
+ */
+export function supervisorTextDelivery(hasTerminalProse: boolean, midTurnPostAvailable: boolean): SupervisorTextDelivery {
+  if (!midTurnPostAvailable) {
+    return { postText: hasTerminalProse, droppedProse: false, reason: "no reply tool on this surface — fail open, terminal text posts" };
+  }
+  return {
+    postText: false,
+    droppedProse: hasTerminalProse,
+    reason: hasTerminalProse ? "message-tool-only: terminal prose dropped (reply via the tool)" : "message-tool-only: no terminal text",
+  };
+}
+
+/**
+ * Pure: is a dropped terminal completion on a supervisor turn a STRAY-PROSE LEAK worth a loud audit? True when there WAS terminal prose, the model did NOT reply through the tool, and no approval card narrated for it — a judge that emitted prose it never took a positive action to post.
+ * Trailing narration after a real tool reply, or a card-suppressed narration, is dropped just the same but is expected, not a leak signal.
+ */
+export function isSupervisorProseLeak(hasTerminalProse: boolean, repliedViaTool: boolean, cardPosted: boolean): boolean {
+  return hasTerminalProse && !repliedViaTool && !cardPosted;
+}

package/agent/channels/turn-registry.ts

@@ -0,0 +1,117 @@
+// turn-registry — the durable index that makes "stop" a FREE, PRE-MODEL act. A mid-turn message queues behind the very turn it would stop, so the decision is taken in the INGRESS process, from a durable read alone, before any session is minted. The registry keys on eve's `sessionId` rather than the continuation token, because the token addresses a WINDOW and the window is not what gets cancelled.
+// Do NOT re-anchor it on "the message wearing 👀": that reaction is set on two doors only, so anchoring there would silently exclude most turns from being stoppable. Every read fails SAFE to `null` — cancelling nothing beats cancelling the wrong turn.
+
+import { getOperationalStore } from "../operational/provider.js";
+import type { TurnAnchorRow, TurnAnchorWrite } from "../operational/store.js";
+
+/**
+ * How long an anchor row stays resolvable. SHORT on purpose: a turn is minutes, and a longer window would leave a tail of rows whose turn ended without a clear, where a stale row is a stop that silently cancels nothing.
+ * `turnId` is the real guard — a stale anchor cannot amputate a LATER turn, because the id will not match.
+ */
+export const TURN_ANCHOR_TTL_MS = 45 * 60_000;
+
+/** `"<platform>:<channelId>:<messageId>"` — the key a REACTION resolves by (it knows exactly which
+ *  message it landed on). Returns undefined when either id is missing: a partial key would collide
+ *  across channels. */
+export function turnAnchorKey(platform: string | undefined, channelId: string | undefined, messageId: string | undefined): string | undefined {
+  return platform && channelId && messageId ? `${platform}:${channelId}:${messageId}` : undefined;
+}
+
+/** `"<platform>:<channelId>"` — the key a SLASH COMMAND resolves by. Slack's slash payload carries
+ *  no message ts and no continuation token, so without this arm `/oe stop` could never find a turn. */
+export function turnChannelKey(platform: string | undefined, channelId: string | undefined): string | undefined {
+  return platform && channelId ? `${platform}:${channelId}` : undefined;
+}
+
+/** The two ids a binding contributes to this registry's keys. Both optional: a turn with neither is
+ *  still anchored by its `windowKey`, which is why the writer never fails on a missing one. */
+export interface TurnAnchorAddress {
+  readonly channelId?: string;
+  readonly messageId?: string;
+}
+
+/**
+ * The CONTAINER and MESSAGE ids one turn's keys resolve by — the ONE derivation hooks/turn-anchor.ts uses for both the live write and the recovery rebuild.
+ * `anchorChannelId` BEATS `target.channelId`, and the order is load-bearing on Teams: the registry must key on the REPLY CHAIN a stop trigger can actually name, not the channel. The same order holds on the message half, and an absent or non-string value yields undefined rather than a guess.
+ */
+export function turnAnchorAddress(binding: {
+  readonly anchorChannelId?: string;
+  readonly anchorMessageId?: string;
+  readonly threadTs?: string;
+  readonly target?: Readonly<Record<string, unknown>>;
+}): TurnAnchorAddress {
+  const fromTarget = typeof binding.target?.["channelId"] === "string" ? (binding.target["channelId"] as string) : undefined;
+  const channelId = binding.anchorChannelId && binding.anchorChannelId.length > 0 ? binding.anchorChannelId : fromTarget;
+  const messageId = binding.threadTs ?? binding.anchorMessageId;
+  return { ...(channelId ? { channelId } : {}), ...(messageId ? { messageId } : {}) };
+}
+
+/** Record the anchor for a turn that has just started. Best-effort — bookkeeping must never fail a
+ *  turn; the only cost of a lost write is that this one turn has no stop affordance. */
+export async function recordTurnAnchor(org: string, anchor: TurnAnchorWrite, atIso: string): Promise<void> {
+  try {
+    await getOperationalStore().putTurnAnchor(org, anchor, atIso, TURN_ANCHOR_TTL_MS);
+  } catch (err) {
+    console.warn(`[open-everywhere:turn-anchor] putTurnAnchor failed (${anchor.windowKey}): ${String(err)}`);
+  }
+}
+
+/** Drop the anchor for a finished turn (completed / failed / cancelled). Best-effort. */
+export async function clearTurnAnchor(org: string, windowKey: string): Promise<void> {
+  try {
+    await getOperationalStore().clearTurnAnchor(org, windowKey);
+  } catch (err) {
+    console.warn(`[open-everywhere:turn-anchor] clearTurnAnchor failed (${windowKey}): ${String(err)}`);
+  }
+}
+
+/** The keys a trigger can offer. A reaction has an `anchorKey`; a slash command has only a
+ *  `channelKey`; a path that already holds the window has a `windowKey`. */
+export interface TurnAnchorQuery {
+  readonly anchorKey?: string;
+  readonly windowKey?: string;
+  readonly channelKey?: string;
+}
+
+/** eve's channel NAMESPACE prefix on a unified-window continuation token. */
+const UNIFIED_TOKEN_PREFIX = "unified:";
+
+/**
+ * The two spellings ONE window token can wear in an anchor row, newest-write form first.
+ * The writer stores eve's RAW token, which is NAMESPACED for a unified window, while every caller that holds a token holds the BARE one — so an exact-match lookup would leave the `windowKey` arm permanently dead. Trying both is safe rather than a guess: the prefix is eve's own channel namespace, so no other channel's token can wear that head.
+ */
+function windowKeySpellings(windowKey: string): readonly string[] {
+  return windowKey.startsWith(UNIFIED_TOKEN_PREFIX)
+    ? [windowKey, windowKey.slice(UNIFIED_TOKEN_PREFIX.length)]
+    : [windowKey, `${UNIFIED_TOKEN_PREFIX}${windowKey}`];
+}
+
+/**
+ * Resolve the turn a stop trigger means, MOST-SPECIFIC FIRST: the exact anchor message, then the window the trigger already holds, then the channel's most recent in-flight turn. Null when nothing resolves.
+ * The order IS the policy. `channelKey` is the only ambiguous arm — a channel can host several live windows — so it comes last and is narrowed to the newest row; without it `/oe stop` could never resolve anything on Slack.
+ */
+export async function resolveTurnAnchor(org: string, q: TurnAnchorQuery): Promise<TurnAnchorRow | null> {
+  const store = getOperationalStore();
+  try {
+    if (q.anchorKey) {
+      const byAnchor = await store.getTurnAnchorByAnchor(org, q.anchorKey);
+      if (byAnchor) return byAnchor;
+    }
+    if (q.windowKey) {
+      for (const key of windowKeySpellings(q.windowKey)) {
+        const byWindow = await store.getTurnAnchorByWindow(org, key);
+        if (byWindow) return byWindow;
+      }
+    }
+    if (q.channelKey) {
+      const byChannel = await store.getLatestTurnAnchorForChannel(org, q.channelKey);
+      if (byChannel) return byChannel;
+    }
+    return null;
+  } catch (err) {
+    // Fail SAFE, not merely soft: an unreadable registry means we do not know which turn the human
+    // meant, and cancelling nothing is strictly better than cancelling a guess.
+    console.warn(`[open-everywhere:turn-anchor] resolve failed: ${String(err)}`);
+    return null;
+  }
+}