@open-everywhere/core 0.1.0

package/agent/channels/turn-terminal-actions.ts

@@ -0,0 +1,134 @@
+// turn-terminal-actions — the userland half of the eve patch that makes eve's empty-response reissue COMPLETION-AWARE. A step with no text and no tool call is a failure for a turn that produced nothing, but the correct end of a turn that already discharged itself. The patch is one dumb helper; every judgement about which verbs are terminal is TypeScript here, and an UNREGISTERED hook keeps stock eve behaviour.
+// THE FAILURE RULE FOR THE WHOLE TERMINAL FAMILY: a terminal mark lands only on PLATFORM-CONFIRMED success; a DEFINITIVE failure leaves the turn OPEN, so a fresh post is a legitimate remedy; an AMBIGUOUS failure counts as terminal where a repeat is the larger harm. The rule is "fail toward the smaller harm", and it reads differently per verb because the action differs — `reply` and `react` put something NEW in the room, so a lost answer beats a duplicate, while `edit_reply` changes a message the room already has, so a double post is the loss direction.
+
+import { defineState } from "eve/context";
+import { currentTurnAddressed, windowGrainOf, type BindableContext } from "../identity/binding.js";
+
+/**
+ * THE TERMINAL VERBS — the tool names whose call discharges this turn's reply obligation, so an empty step after one of them is the CORRECT end of the turn. `stand_down`, `complete_thread` and `update_status` are deliberately OUT: each leaves the room still owed a line, and every absence keeps stock eve behaviour, which is the safe direction.
+ * `edit_reply` belongs because it adds NO message to the room, so counting it terminal cannot hide an undelivered answer. `react` is listed but its suppression is CONDITIONAL — on a turn the message ADDRESSED, a react only acknowledges and one short `reply` is still owed. Worker verbs are held out by the GRAIN GATE below, never by this list, so do not lean on an absence here.
+ */
+export const TURN_TERMINAL_TOOLS: ReadonlySet<string> = new Set(["reply", "no_reply", "react", "edit_reply"]);
+
+/** The `globalThis` slot the eve patch's `__oeThrowEmptyResponseUnlessTerminal` reads. */
+const HOOK_KEY = "__oeTurnTerminalActionScan";
+
+// THE GRAIN GATE — the suppression is for CONVERSATIONAL SEATS ONLY. `reply` and `edit_reply` mount on the `task` grain too, and the scan's window on a WORKER is the whole task rather than one wake, so one early `reply` would disarm eve's recovery for every remaining step and a worker ending on an empty step would return empty text to the parent waiting on its result.
+// The grain is RECORDED rather than read: the patch hands the scan a message array and no ctx, so it is written at the one moment a ctx is in hand. Fail direction is SUPPRESS UNLESS THE SESSION IS A KNOWN WORKER — an unrecorded grain reads as conversational, so a missing write can leave the worker hazard open on one verb but can never silently revert the seat-side fix. No offline probe reaches a worker turn, so the unit test is the only pin on this behaviour.
+
+/** The grain of the last session that called a terminal verb here. `null` until one does. */
+const grainSlot = defineState<string | null>("open-everywhere.terminal-call-grain", () => null);
+
+/**
+ * Record the grain of the session calling a terminal verb. Called by the four terminal tools beside their own marks.
+ * NEVER THROWS, and never blocks its caller: outside an eve context there is no slot to write, and a session with no record reads as conversational.
+ */
+export function noteTerminalCallGrain(ctx: BindableContext): void {
+  try {
+    const grain = windowGrainOf(ctx);
+    grainSlot.update(() => grain);
+  } catch {
+    /* no session context, or an unreadable ctx — the guard keeps its pre-OPE-819 behaviour */
+  }
+}
+
+/** Is this session a one-shot WORKER, as its own terminal call reported? */
+function terminalCallerIsWorker(): boolean {
+  try {
+    return grainSlot.get() === "task";
+  } catch {
+    return false;
+  }
+}
+
+// THE ADDRESSEDNESS GATE — `react` discharges an UNADDRESSED turn only. On a turn the message directly addressed, a react is ADDITIVE and one short `reply` is still owed; without this gate the scan suppressed the reissue after every confirmed react, so a model that reacted and stopped never posted the owed reply.
+// Recorded, not read, exactly like the grain gate, from the host-set `currentTurnAddressed` stamp that a model-authored body cannot forge. Fail direction: unrecorded or false reads as UNADDRESSED, so a react still fully suppresses the reissue and a missed write can never re-open the unwanted-reply regression. Scope is `react` ONLY — the other three verbs are unconditionally terminal.
+
+/** The addressedness of the last session whose `react` call ran here. `null` until one does. */
+const reactAddressedSlot = defineState<boolean | null>("open-everywhere.react-call-addressed", () => null);
+
+/**
+ * Record whether THIS `react` call answered an ADDRESSED wake, beside {@link noteTerminalCallGrain}. Called ONLY by `tools/react.ts`, because `react` is the one terminal verb whose suppression depends on addressedness.
+ * NEVER THROWS, and never blocks its caller: an unrecorded call reads as unaddressed, which is the safe direction, since it can only keep today's full suppression.
+ */
+export function noteReactCallAddressed(ctx: BindableContext): void {
+  try {
+    reactAddressedSlot.update(() => currentTurnAddressed(ctx));
+  } catch {
+    /* no session context, or an unreadable ctx — react keeps its pre-OPE-964 behaviour */
+  }
+}
+
+/** Did the last recorded `react` call answer an ADDRESSED wake? */
+function reactCallerWasAddressed(): boolean {
+  try {
+    return reactAddressedSlot.get() === true;
+  } catch {
+    return false;
+  }
+}
+
+/** A tool-result part, as far as this scan needs to know. */
+interface NamedPart {
+  readonly type?: unknown;
+  readonly toolName?: unknown;
+  readonly output?: unknown;
+}
+
+/**
+ * The `output.type` values that mean the call did NOT succeed — READ FROM THE SDK CONTRACT rather than invented: a thrown tool reaches the next model call as a `tool-result` part whose output is one of the two `error-*` shapes.
+ * `execution-denied` sits with them: a call the user refused never ran, so nothing changed at the platform either.
+ */
+const FAILED_OUTPUT_TYPES: ReadonlySet<string> = new Set(["error-text", "error-json", "execution-denied"]);
+
+/**
+ * Did a terminal verb in these parts come back CONFIRMED? THE RESULT PART IS THE ONLY WITNESS: a `tool-call` part records that the model ASKED for the verb, never that the platform did it, so only a `tool-result` with a non-error output counts. The result is always available by then, because eve appends each step's tool results before the next model call.
+ * An output with no `type` reads as success, so a shape this file cannot classify keeps the behaviour it had. A confirmed `react` counts only on an UNADDRESSED turn: the scan CONTINUES past an addressed one, so a `reply` elsewhere in the window still counts and a react-alone step leaves the nudge armed.
+ */
+function confirmedTerminalIn(parts: readonly unknown[]): boolean {
+  for (const part of parts) {
+    if (part === null || typeof part !== "object") continue;
+    const { type, toolName, output } = part as NamedPart;
+    if (type !== "tool-result") continue;
+    if (typeof toolName !== "string" || !TURN_TERMINAL_TOOLS.has(toolName)) continue;
+    const outcome = output !== null && typeof output === "object" ? (output as { type?: unknown }).type : undefined;
+    if (typeof outcome === "string" && FAILED_OUTPUT_TYPES.has(outcome)) continue;
+    if (toolName === "react" && reactCallerWasAddressed()) continue;
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Did THIS turn already call a terminal verb? The scan stops at the last `user` message, which is the wake that opened this turn, so a previous turn that ended in `no_reply` cannot silence this one.
+ * Anything that SHORTENS the window only makes the guard answer `false` more often, which is stock eve — the fail direction is deliberate and one-way. It NEVER THROWS: it runs inside eve's model call, where a throw would fail the turn, so any malformed input answers `false`.
+ */
+export function turnHasTerminalAction(messages: unknown): boolean {
+  try {
+    // THE GRAIN GATE FIRST (OPE-819). A worker's empty final step is a real failure — its caller is
+    // waiting on a result — so a worker keeps eve's recovery whatever its message array holds.
+    if (terminalCallerIsWorker()) return false;
+    if (!Array.isArray(messages)) return false;
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const message = messages[i];
+      if (message === null || typeof message !== "object") continue;
+      const role = (message as { role?: unknown }).role;
+      if (role === "user") return false;
+      if (role !== "assistant" && role !== "tool") continue;
+      const content = (message as { content?: unknown }).content;
+      if (Array.isArray(content) && confirmedTerminalIn(content)) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+/** Install the hook the eve patch consults. Idempotent; runs at module load. Imported for its side
+ *  effect by `channels/turn-delivery.ts` and by `tools/no_reply.ts`, so every process that can
+ *  route a wake or mount the silence verb has the guard armed before its first model call. */
+function installTurnTerminalActionHook(): void {
+  (globalThis as Record<string, unknown>)[HOOK_KEY] = turnHasTerminalAction;
+}
+
+installTurnTerminalActionHook();

package/agent/channels/unified-redrive.ts

@@ -0,0 +1,215 @@
+// unified-redrive — the catch-and-fix for a unified turn whose terminal prose was structurally DISCARDED by the message-tool-only gate. A corrective SYSTEM wake is re-injected into the SAME session, so the model gets ONE more turn to re-deliver through the `reply` tool; eve's hooks are observe-only, so the correction is the next turn, never a mid-turn stop. Nothing switches it off — what narrows it is the scope below and the gates in {@link maybeRedrive}.
+// It fires ONLY for a REAL drop: a turn whose prose was hard-dropped with `replied=false`, on ANY addressing — a direct mention reaches it exactly as an ambient wake does, because the prose bridge that used to claim the addressed case is deleted (OPE-1982). Never for a judged silence, and never for a `replied=true` drop, which is benign narration after a real post. The corrective wake re-stamps the ORIGINAL wake id, so the reply tool's authority fence resolves to the original conversation. It must NEVER import channels/unified.ts, which imports this.
+
+import { appendAudit, type AuditInput } from "../audit/audit.js";
+import { renderWake, mkMessageTrigger, REDRIVE_TRIGGER_ID_PREFIX, type NormalizedWake } from "./normalized-wake.js";
+import {
+  resolveUnifiedWakeTarget,
+  WAKE_TARGET_TTL_MS,
+  type UnifiedWakeOrigin,
+  type UnifiedWakeTargetStore,
+} from "./unified-window.js";
+import { postArm } from "./post-arms.js";
+
+/** The audit action for a fired redrive — joinable to the original turn by `detail.originalWakeId`
+ *  (the redriven turn's own reply.post carries the SAME wake-id, re-stamped) + `detail.sessionId`. */
+export const REDRIVE_ACTION = "unified.turn.redrive";
+
+/** Loop-guard key prefix (a durable markEventSeen mark keyed by the ORIGINAL wake id). */
+const REDRIVE_GUARD_PREFIX = "unified-redrive:";
+
+/** How long the loop-guard mark survives — matched to the wake-target TTL so it outlives any turn
+ *  that could still be answering the wake, then prunes with the map row it guards. */
+const REDRIVE_GUARD_TTL_MS = WAKE_TARGET_TTL_MS;
+
+/** The durable loop-guard key for one original wake id. */
+export function redriveGuardKey(wakeId: string): string {
+  return `${REDRIVE_GUARD_PREFIX}${wakeId}`;
+}
+
+/** A short, token-free description of WHERE the dropped answer was owed — for the corrective nudge
+ *  text (origins carry only public ids, never secrets). */
+export function describeRedriveTarget(origin: UnifiedWakeOrigin): string {
+  // Per-provider description via the post-arms registry (channels/post-arms.ts). The typed
+  // UnifiedWakeOrigin union is exhaustive over the six unified surfaces, so a missing arm only
+  // fires for a genuinely-unwired platform — fail LOUD rather than emit an undefined description.
+  const arm = postArm(origin.platform);
+  if (!arm?.describeRedriveTarget) {
+    throw new Error(`redrive: no post arm describes a "${origin.platform}" target.`);
+  }
+  return arm.describeRedriveTarget(origin);
+}
+
+/** The `<channel id>` the corrective envelope names — cosmetic (reply targeting is by wake-id/map,
+ *  never this), so a best-effort primary conversation id per origin is enough. */
+function originContainerId(origin: UnifiedWakeOrigin): string {
+  // Per-provider container id via the post-arms registry (cosmetic; the value never routes). Fail
+  // LOUD for a genuinely-unwired platform rather than emit an undefined id.
+  const arm = postArm(origin.platform);
+  if (!arm?.redriveContainerId) {
+    throw new Error(`redrive: no post arm resolves a container id for "${origin.platform}".`);
+  }
+  return arm.redriveContainerId(origin);
+}
+
+/**
+ * The corrective instruction (pure — asserted verbatim in the tests). OE's own notice about the model's OWN previous output: it states the drop, names the ORIGINAL wake id to answer, and names where the answer was owed.
+ * It offers the explicit `no_reply` escape, so it can NEVER coerce a reply the model has judged unwarranted. It renders as a TRUSTED envelope `<system-note>` ({@link buildRedriveWake}), never as a message body: a machine-authored body is `relay` and fenced with a do-not-follow notice, which the model obeys (OPE-2053).
+ */
+export function redriveCorrectiveText(chars: number, originalWakeId: string, origin: UnifiedWakeOrigin, owesWorkerReport = false): string {
+  return (
+    `Your previous turn's final prose (${chars} chars) was DISCARDED by the message-tool-only gate — ` +
+    `it reached no one. If it should reach someone, call the \`reply\` tool NOW with \`wake\` set to ` +
+    `"${originalWakeId}" (target: ${describeRedriveTarget(origin)}) and \`text\` set to your message. ` +
+    (owesWorkerReport
+      ? `Pass \`done: false\` on that call: a worker you started still owes this conversation its answer, ` +
+        `and a call that closes the wake is refused. `
+      : "") +
+    `If it should NOT reach anyone after all, call \`no_reply\` (or end with NO_REPLY) — staying silent ` +
+    `is still a valid outcome. This is a one-time correction: there is no second retry.`
+  );
+}
+
+/**
+ * Build the corrective SYSTEM wake (pure). AMBIENT `channel-watch` addressing, NOT `direct-mention`: the correction is a machine notice about the model's own output, so it must not claim an address no person made. Trust `relay`, the machine tier; sender `system`, a harness-authored notice rather than a fake human. The ONE-SHOT loop guard in {@link maybeRedrive}, keyed on the original wake id, is what caps the correction at one — a second prose-only ending is a final audited drop.
+ * It re-stamps the ORIGINAL `wakeId`, so the envelope's `<wake wake-id>` — and with it the reply tool's authority fence — targets the original wake's conversation.
+ * 🔴 THE INSTRUCTION RIDES `systemNote`, A TRUSTED `<system-note>`, AND THE BODY STAYS A ONE-LINE MARKER (OPE-2053). The envelope fences every `relay` body and tells the model not to follow it; with the instruction in the body, the seat read the correction as untrusted relay content and ended in `no_reply` — the re-drive could never work. The body stays fenced like every machine body; only OE's own framing moves to the skeleton.
+ */
+export function buildRedriveWake(originalWakeId: string, origin: UnifiedWakeOrigin, chars: number, nowIso: string, owesWorkerReport = false): NormalizedWake {
+  return {
+    platform: origin.platform,
+    reason: "channel-activity",
+    addressing: "channel-watch",
+    // The ORIGINAL wake id — makes the envelope carry `wake-id="<original>"`, which the reply tool
+    // echoes back; the re-stamp on the delivery auth (divertToUnifiedWindow) is what makes the fence
+    // accept it as THIS turn's wake.
+    wakeId: originalWakeId,
+    locus: { channel: { id: originContainerId(origin) } },
+    trigger: mkMessageTrigger({
+      from: "system",
+      author: "open-everywhere",
+      // The corrective turn's own marker — see REDRIVE_TRIGGER_ID_PREFIX. It is provenance for a
+      // reader of the prompt, never a gate: no product path branches on this id.
+      id: `${REDRIVE_TRIGGER_ID_PREFIX}${originalWakeId}`,
+      sentAt: nowIso,
+      trust: "relay",
+      body: `Corrective re-drive of wake ${originalWakeId}.`,
+    }),
+    systemNote: redriveCorrectiveText(chars, originalWakeId, origin, owesWorkerReport),
+  };
+}
+
+/**
+ * The eve-specific re-injection the caller supplies, bound over the captured cross-channel `receive` and this turn's token and auth.
+ * `null` means no receive is reachable in THIS process, so the redrive fail-soft skips and the drop stays a final audited drop, exactly as before the redrive existed.
+ */
+export type RedriveReinject = ((origin: UnifiedWakeOrigin, message: string, originalWakeId: string) => Promise<void>) | null;
+
+/** The operational-store slice the redrive needs: resolve the original origin (the re-stamp target)
+ *  + the durable, restart-surviving loop guard (markEventSeen — atomic first-sighting). */
+export interface RedriveStore extends UnifiedWakeTargetStore {
+  markEventSeen(org: string, key: string, at: string, ttlMs: number): Promise<boolean>;
+}
+
+export interface RedriveInput {
+  readonly org: string;
+  readonly workspace: string;
+  readonly surface?: string;
+  readonly sessionId?: string;
+  /** The wake id of the turn that dropped — its ORIGIN is the re-stamp/reply target and its id is
+   *  the loop-guard key. Undefined (no oe_wake_id stamp) ⇒ not a single-window wake ⇒ skip. */
+  readonly wakeId: string | undefined;
+  /** The dropped prose length (for the nudge + audit). */
+  readonly chars: number;
+  /** Did the reply tool already post this turn? TRUE ⇒ the dropped prose is benign narration after a
+   *  real reply — NOT a leak — so never redrive. */
+  readonly replied: boolean;
+  /**
+   * Does a background worker THIS TURN dispatched still owe this wake its answer? It changes only the
+   * corrective TEXT, never any gate: `done` defaults to TRUE on the `reply` tool and the OPE-701
+   * guard refuses a call that would close a wake a worker still owes, so a seat that follows a nudge
+   * naming no `done` is refused a second time — and the correction is capped at one, so its answer
+   * then reaches nobody. Naming the move that succeeds is what makes the one correction usable.
+   * This is the one reason the redrive fires on (`delegation-pending` is deliberately not a
+   * withholding), so the flag has exactly one true case.
+   */
+  readonly owesWorkerReport?: boolean;
+}
+
+export interface RedriveDeps {
+  readonly store: RedriveStore;
+  readonly reinject: RedriveReinject;
+  readonly now?: () => string;
+  /** Audit sink (default appendAudit) — injectable so the test captures the row without a store. */
+  readonly audit?: (entry: AuditInput) => Promise<void>;
+}
+
+export type RedriveStatus =
+  | "skip-replied" // replied=true — benign narration, not a leak
+  | "skip-no-wake" // no wake id (not a single-window wake)
+  | "skip-unresolved" // the original wake's origin isn't on record (can't re-stamp/target)
+  | "skip-loop-guard" // already redriven once for this wake — a drop here is FINAL
+  | "skip-no-reinject" // no receive reachable in this process — fail-soft (guard NOT burned)
+  | "reinject-failed" // the re-injection threw — treated as final (guard already burned)
+  | "redriven"; // the corrective wake was injected
+
+export interface RedriveResult {
+  readonly status: RedriveStatus;
+  readonly originalWakeId?: string;
+}
+
+/**
+ * Decide and fire the auto-redrive for a dropped-prose turn. The ORDERING is deliberate: the cheap replied, wake-id and origin gates first, so a skip there is byte-clean; then the `reinject` availability check BEFORE the loop guard, so a missing receive does not burn the one-shot guard and a later turn on a warm process can still correct it.
+ * Then the atomic loop guard — the FIRST drop for a wake proceeds and a second skips, so the redriven turn's own drop is FINAL — then the re-inject, then the audit row, which therefore means "actually fired". Fail-soft throughout: a store or re-inject error degrades to a skip and never throws out of here.
+ */
+export async function maybeRedrive(input: RedriveInput, deps: RedriveDeps): Promise<RedriveResult> {
+  if (input.replied) return { status: "skip-replied" };
+  if (!input.wakeId) return { status: "skip-no-wake" };
+  const wakeId = input.wakeId;
+  const now = deps.now ?? (() => new Date().toISOString());
+  const audit = deps.audit ?? appendAudit;
+
+  // The ORIGINAL origin — the reply/re-stamp target. Fail-closed on unknown/expired (never guess).
+  const origin = await resolveUnifiedWakeTarget(deps.store, input.org, wakeId).catch(() => null);
+  if (!origin) return { status: "skip-unresolved", originalWakeId: wakeId };
+
+  // No receive reachable in this process → fail-soft, and DON'T burn the guard.
+  if (!deps.reinject) return { status: "skip-no-reinject", originalWakeId: wakeId };
+
+  // LOOP GUARD (durable, atomic, restart-surviving): at most ONE redrive per original wake id. The
+  // FIRST drop marks + proceeds; a drop on the REDRIVEN turn (same re-stamped wake id) finds the
+  // mark set → FALSE → final drop, no second redrive.
+  let firstDrop: boolean;
+  try {
+    firstDrop = await deps.store.markEventSeen(input.org, redriveGuardKey(wakeId), now(), REDRIVE_GUARD_TTL_MS);
+  } catch {
+    return { status: "skip-loop-guard", originalWakeId: wakeId }; // store blip → don't risk a loop
+  }
+  if (!firstDrop) return { status: "skip-loop-guard", originalWakeId: wakeId };
+
+  // Build + render the corrective wake and re-inject it into the SAME session.
+  const rendered = renderWake(buildRedriveWake(wakeId, origin, input.chars, now(), input.owesWorkerReport === true));
+  try {
+    await deps.reinject(origin, rendered.message, wakeId);
+  } catch {
+    // The re-injection failed after the guard was burned — treat as final (no retry). The prose was
+    // already audited as dropped by the caller; nothing else to post.
+    return { status: "reinject-failed", originalWakeId: wakeId };
+  }
+
+  await audit({
+    org: input.org,
+    platform: "unified",
+    workspace: input.workspace,
+    ...(input.surface ? { surface: input.surface } : {}),
+    action: REDRIVE_ACTION,
+    detail: {
+      originalWakeId: wakeId,
+      chars: input.chars,
+      platform: origin.platform,
+      ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+    },
+  }).catch(() => undefined);
+
+  return { status: "redriven", originalWakeId: wakeId };
+}

package/agent/channels/unified-reply.ts

@@ -0,0 +1,300 @@
+// unified-reply — the single-window reply DISPATCH: post a unified-session reply back into the surface a wake came from, addressed EXCLUSIVELY by a resolved UnifiedWakeOrigin. Never the per-turn auth snapshot, which a cross-surface merge would make name one wake only, and never model prose. (That merge is unreachable on eve 0.54.3 — only the caller-less task completion cohort folds, and it carries no `auth` — but the map is not defensive: every reply resolves its target from it, single-wake turns included — OPE-2042.)
+// This spine keeps the choke-point audit, the spoof seam and the injectable deps, and dispatches by `origin.platform` through the post-arms registry, so it holds no vendor imports of its own. Every arm fails VISIBLE — thrown and token-free — when the post did not land, never a silent no-op.
+
+import type { UnifiedWakeOrigin } from "./unified-window.js";
+import {
+  auditReplyPost,
+  notePostFailure,
+  recordLandedPost,
+  releasePostKeyOnFailure,
+  REPLY_DEDUPE_SKIPPED_ID,
+  type ReplyAudit,
+  type ReplierLabel,
+} from "./reply-post.js";
+import { recordContainerAnswered } from "./answered-container-ledger.js";
+import { withReplierPrefix, truncateMemoryCitationPaths } from "./turn-delivery.js";
+import { applyReplyProvenance, auditReplyProvenance } from "./reply-provenance.js";
+import { auditWithheldMemoryClaim, guardMemoryClaims } from "./memory-claim-guard.js";
+import { auditWithheldApprovalClaim, guardApprovalClaims } from "./approval-claim-guard.js";
+import { auditWithheldRequestClaim, guardRequestClaims } from "./request-claim-guard.js";
+import { swallowRoomPost } from "./egress-spoof.js";
+import { postArm, type DirectMessageAction, type PostIntent } from "./post-arms.js";
+import { outboundKey, postOnce } from "../operational/post-once.js";
+import type { EditLocus } from "./reply-edit.js";
+
+type SlackOrigin = Extract<UnifiedWakeOrigin, { platform: "slack" }>;
+type GitHubOrigin = Extract<UnifiedWakeOrigin, { platform: "github" }>;
+type LinearOrigin = Extract<UnifiedWakeOrigin, { platform: "linear" }>;
+type NotionOrigin = Extract<UnifiedWakeOrigin, { platform: "notion" }>;
+type DiscordOrigin = Extract<UnifiedWakeOrigin, { platform: "discord" }>;
+type TeamsOrigin = Extract<UnifiedWakeOrigin, { platform: "teams" }>;
+
+export interface UnifiedReplyDeps {
+  /** Post into Slack; returns the posted message ts. Defaults to the live slackForm arm. */
+  readonly postSlack?: (origin: SlackOrigin, text: string) => Promise<string>;
+  /** Post a GitHub issue comment; returns the comment id. Defaults to the live REST arm. */
+  readonly postGitHub?: (origin: GitHubOrigin, text: string) => Promise<string>;
+  /** Post a Linear reply as an Agent Activity into the wake's open session; returns the activity id.
+   *  Defaults to the live createLinearAgentActivity arm. `intent` decides the activity TYPE, because
+   *  a `response` ENDS the session (OPE-869) — see linear-post-arm.ts's `activityTypeFor`. */
+  readonly postLinear?: (origin: LinearOrigin, text: string, intent?: PostIntent) => Promise<string>;
+  /** Complete an OPEN Linear agent session on a turn that judged SILENCE — no model prose ever
+   *  posts. Defaults to the live arm, which renders the FIXED HOST ack (OPE-884). `answered` picks
+   *  the ANSWERED line instead of the silence line (OPE-922). */
+  readonly closeLinear?: (origin: LinearOrigin, answered?: boolean) => Promise<void>;
+  /** Post a Notion discussion comment; returns the comment id. Defaults to the live REST arm. */
+  readonly postNotion?: (origin: NotionOrigin, text: string) => Promise<string>;
+  /** Post a Discord channel message; returns the message id. Defaults to the live REST arm. */
+  readonly postDiscord?: (origin: DiscordOrigin, text: string) => Promise<string>;
+  /** Post a Teams reply activity; returns the activity id. Defaults to the live Connector arm. */
+  readonly postTeams?: (origin: TeamsOrigin, text: string) => Promise<string>;
+}
+
+/**
+ * The (channel, threadTs) pair a unified reply's DEDUPE key hashes on. It mirrors {@link UnifiedWakeOrigin}'s discriminated union field for field, and is the single-window sibling of reply-post.ts's `replyDedupeLocus`.
+ * Both Discord variants share the `channelId` field, so no further discrimination is needed here.
+ */
+function unifiedDedupeLocus(origin: UnifiedWakeOrigin): { channel: string; threadTs?: string } {
+  switch (origin.platform) {
+    case "slack":
+      return { channel: origin.channelId, threadTs: origin.threadTs };
+    case "github":
+      return { channel: `${origin.owner}/${origin.repo}#${origin.issueNumber}` };
+    case "linear":
+      return { channel: origin.agentSessionId ?? `ambient:${origin.issueId}` };
+    case "notion":
+      return { channel: origin.discussionId };
+    case "discord":
+      return { channel: origin.channelId };
+    case "teams":
+      return { channel: `${origin.serviceUrl}::${origin.conversationId}`, threadTs: origin.replyToActivityId };
+    default:
+      // Same totality guard as replyDedupeLocus: an origin outside the typed union (test fake /
+      // out-of-tree arm) must dedupe on the serialized origin, never crash the post.
+      return { channel: JSON.stringify(origin) };
+  }
+}
+
+/**
+ * Post `text` into the conversation `origin` names and return the platform message id. It throws an honest, token-free error when the post did not land, so the model knows the reply failed rather than silently believing it posted.
+ * THE CHOKE POINT: when `audit` is supplied the single canonical `reply.post` row is written HERE, after the id is known, for BOTH callers — and it lands even under the egress spoof, because the eval targets score from the row. Idempotent across a step re-run or a genuine double call: a distinct action tag keeps its outbound key from ever colliding with the per-surface choke point's.
+ */
+export async function postUnifiedReply(
+  origin: UnifiedWakeOrigin,
+  text: string,
+  deps: UnifiedReplyDeps = {},
+  audit?: ReplyAudit,
+  replier?: ReplierLabel,
+  intent?: PostIntent,
+  /**
+   * TAPPABLE ACTIONS beside the text (OPE-1720) — rendered only by an arm that declares
+   * {@link PostArm.dispatchUnifiedActions}, and silently absent on every other surface, where the
+   * same text posts alone. The caller's copy must therefore stand on its own, exactly as it must for
+   * a DM ({@link DirectMessageAction}).
+   * They ride OUTSIDE the dedupe payload on purpose: the key is already the body, and two posts of
+   * one body differing only in their button row would be the same duplicate post this key exists to
+   * suppress.
+   */
+  actions: readonly DirectMessageAction[] = [],
+): Promise<string> {
+  // OPE-916: same truncation reply-post.ts's postReply applies, and for the same reason — before
+  // the prefix / dedupe key / audit chars.
+  // OPE-1608: and the same connector footer. THIS DOOR IS THE ONE A UNIFIED SEAT ACTUALLY USES, so
+  // leaving it out would have shipped the feature backwards: the post would carry nothing and an
+  // `edit_reply` of that same post — which funnels through the shared edit spine — would grow a host
+  // line out of nowhere. What the footer SAYS here is decided by the reach rule, and on this door the
+  // proof is the WAKE: the audit's `wakeId` is the fenced conversation this post lands in, and only
+  // the reads recorded under that same wake are named (channels/reply-provenance.ts, OPE-1713).
+  const claimGuard = guardMemoryClaims(truncateMemoryCitationPaths(text), audit);
+  // OPE-1876: and the no-approval claim, on the same body, at the same choke point — a door that
+  // struck one and posted the other would read as a rendering glitch.
+  const approvalGuard = guardApprovalClaims(claimGuard.body, audit);
+  // OPE-2022: and the propose claim, on the same body, at the same choke point. A seat may not say
+  // it submitted a request the host never saw the propose plane make.
+  const requestGuard = guardRequestClaims(approvalGuard.body, audit);
+  const provenance = applyReplyProvenance(requestGuard.body, audit);
+  const clean = provenance.body;
+  // OPE-508: the same choice reply-post.ts's postReply makes — Slack (displayNameCapable) gets
+  // `replier` passed through untouched; every other origin gets the shared bracket prefix baked
+  // into the body ONCE here, before dedupe-keying and dispatch.
+  const arm = postArm(origin.platform);
+  const nativeReplier = arm?.displayNameCapable ? replier : undefined;
+  const body = replier && !arm?.displayNameCapable ? withReplierPrefix(clean, replier) : clean;
+  const locus = unifiedDedupeLocus(origin);
+  // stableId = wakeId, same rationale as postReply's key: dedupe within one wake, never across
+  // wakes whose replies happen to share bytes.
+  const key = outboundKey({
+    surface: origin.platform,
+    channel: locus.channel,
+    threadTs: locus.threadTs,
+    action: "reply.dispatch.unified",
+    stableId: audit?.wakeId,
+    payload: body,
+  });
+  const id = await postOnce({
+    org: audit?.org,
+    key,
+    run: async () => {
+      let realId: string;
+      try {
+        realId = await dispatchUnifiedReply(origin, body, deps, nativeReplier, intent, actions);
+      } catch (err) {
+        // OPE-821 — the unified half of the same statement the per-surface choke point makes: one
+        // `reply.post.failed` row carrying the class, then the arm's own error re-thrown untouched.
+        await notePostFailure(audit, err, origin.platform);
+        throw err;
+      }
+      await auditReplyPost(audit, realId, origin.platform, body.length);
+      // OPE-1608 STORE-FIRST, the unified half: the row records the FULL source list, the footer
+      // carries the subset this reply's own WAKE proves, and `withheld` records the difference. On a
+      // turn that served several conversations the two genuinely differ, and the row is then the only
+      // place the turn's sibling sources are answerable at all.
+      await auditReplyProvenance(audit, realId, origin.platform, provenance.reads, provenance.shown);
+      await auditWithheldMemoryClaim(audit, origin.platform, claimGuard.withheld);
+      await auditWithheldApprovalClaim(audit, origin.platform, approvalGuard.withheld, approvalGuard.cause);
+      await auditWithheldRequestClaim(audit, origin.platform, requestGuard.withheld);
+      // The unified half of what a landed post owes — the own-post ledger row and the generation's tail ring, through the ONE seam both choke points share.
+      // The ledger key is the SAME locus the edit spine resolves from this origin, so a unified reply is editable by the wake that produced it.
+      await recordLandedPost({
+        org: audit?.org,
+        editLocus: unifiedEditLocus(origin),
+        messageId: realId,
+        body,
+        platform: origin.platform,
+        wake: audit?.wakeId,
+      });
+      // The DURABLE half of "this room has been answered", which the silent-turn close gate reads on a LATER turn to pick between its two fixed host lines.
+      // The per-turn reply record cannot carry it: the answer and the sibling wake's close ran in separate turns on the measured run.
+      await recordContainerAnswered(audit?.org, origin);
+      return realId;
+    },
+    // Same rule as the per-surface choke point: DEFINITIVE releases the claim (an identical retry
+    // must be able to post), AMBIGUOUS keeps it (an identical retry must not double-post).
+    releaseKeyOnFailure: releasePostKeyOnFailure,
+    skipped: () => REPLY_DEDUPE_SKIPPED_ID,
+  });
+  return id ?? REPLY_DEDUPE_SKIPPED_ID;
+}
+
+/**
+ * The {@link EditLocus} for a unified wake origin — the host-resolved half of `edit_reply`'s address on a cross-surface session, and the key the own-post ledger records under. PURE, and `null` for an origin with no editable address.
+ * THIS IS THE POST-TIME LOCUS, and `edit_reply` must not use it directly — call {@link resolveUnifiedEditLocus} instead. On Discord an arm can answer inside an auto-thread that did not exist when this origin was frozen, so the frozen channel id is the wrong address for an edit.
+ */
+export function unifiedEditLocus(origin: UnifiedWakeOrigin): EditLocus | null {
+  switch (origin.platform) {
+    case "slack":
+      return { platform: "slack", channelId: origin.channelId };
+    case "discord":
+      return { platform: "discord", channelId: origin.channelId };
+    case "teams":
+      return { platform: "teams", channelId: origin.conversationId, serviceUrl: origin.serviceUrl };
+    case "github":
+      // OPE-862: the same composite "owner/repo" locus replyEditLocus resolves for a mid-turn target.
+      return { platform: "github", channelId: `${origin.owner}/${origin.repo}` };
+    case "linear":
+      // OPE-872: the sibling of reply-post.ts's `replyEditLocus` linear case — read its note for why
+      // ONLY the ambient route (`origin.ambient`) has an editable address, and why the mention route's
+      // `null` is a permanent platform limit rather than a not-yet.
+      return origin.ambient
+        ? { platform: "linear", channelId: origin.issueId, ...(origin.organizationId ? { organizationId: origin.organizationId } : {}) }
+        : null;
+    case "notion":
+      // OPE-1046: the sibling of reply-post.ts's `replyEditLocus` notion case — read its note for the
+      // `<workspace>/<page>` composite and why a missing workspace/page falls to `null`.
+      return origin.workspaceId && origin.pageId
+        ? { platform: "notion", channelId: `${origin.workspaceId}/${origin.pageId}` }
+        : null;
+    default:
+      // `replyEditLocus`'s default arm — a new surface needs a case here AND an `editMessage` arm, and
+      // only the pair arms the verb.
+      return null;
+  }
+}
+
+/**
+ * Does a TERMINAL post on this origin CLOSE the conversation, so nothing further can land in the
+ * same turn? (OPE-1452.)
+ *
+ * 🔴 IT IS THE ONE PLACE A SECOND ANSWER IS IMPOSSIBLE RATHER THAN MERELY UNWANTED, and that is why
+ * the same-turn `done` teeth read it. A Linear MENTION reply is a `response` Agent Activity, and a
+ * `response` ENDS the agent session — measured over every session in the live workspace, 2026-08-20
+ * (OPE-869, and see the note on `activityTypeFor` in the Linear post arm). The next post on that
+ * session fails `Entity not found: AgentSession`; it cost deploy #99 the real answer to Linear
+ * TOM-67, 38 seconds after the hand-off note that closed the session.
+ *
+ * So the reply path's duplicate-post valve stays SHUT here. Everywhere else a second message is a
+ * matter of style and the model's judgement decides it (Tommy's ruling, 2026-09-03); on this route
+ * the host would be inviting a call that cannot succeed, and the model would burn its remaining
+ * steps re-sending it with no steer left.
+ *
+ * The AMBIENT Linear route is not this shape: it posts a normal issue comment through
+ * `commentCreate` on the workspace token, which is editable and can be posted twice. Same split, and
+ * for the same underlying reason, as {@link unifiedEditLocus}'s `linear` case. The origin codec
+ * enforces the XOR, and `!== true` is the fail-closed read of it: an origin carrying neither flag
+ * refuses a second post rather than inviting a doomed one.
+ *
+ * Every other surface answers FALSE. This is deliberately not a general "is the room closed"
+ * question — {@link PostIntent} is read by exactly one post arm, so no other wired surface ends a
+ * conversation on a post, and inventing a broader predicate here would turn one measured platform
+ * limit into a policy nobody asked for.
+ */
+export function terminalPostClosesConversation(origin: UnifiedWakeOrigin): boolean {
+  return origin.platform === "linear" && origin.ambient !== true;
+}
+
+/**
+ * The address `edit_reply` uses on a unified session: {@link unifiedEditLocus}, then the post arm's optional `retargetEditLocus` on top. One arm can answer somewhere the FROZEN origin cannot name — a Discord auto-thread is its own channel id — so the reply lives at an address the origin does not carry, and the ownership READ and the PATCH must both address the conversation the message is actually in.
+ * The retarget runs BEFORE the ownership fence on purpose: checking the base channel and then dispatching to the thread would be a fence on one conversation and a write on another. It NEVER throws — an arm that cannot resolve a better address, or one that throws, degrades to the base locus, which is the correct answer for a reply that did land in the base channel.
+ */
+export async function resolveUnifiedEditLocus(origin: UnifiedWakeOrigin): Promise<EditLocus | null> {
+  const locus = unifiedEditLocus(origin);
+  if (!locus) return null;
+  const retarget = postArm(origin.platform)?.retargetEditLocus;
+  if (!retarget) return locus;
+  return (await retarget(origin, locus).catch(() => locus)) ?? locus;
+}
+
+async function dispatchUnifiedReply(
+  origin: UnifiedWakeOrigin,
+  text: string,
+  deps: UnifiedReplyDeps = {},
+  replier?: ReplierLabel,
+  intent?: PostIntent,
+  actions: readonly DirectMessageAction[] = [],
+): Promise<string> {
+  // LOCAL EVAL SPOOF — the shared exit, the same seam and rationale as the per-surface choke point. It stays SPINE-level, before the registry lookup, so no arm is reached with real credentials.
+  // The `unified-` id tag is load-bearing: it tells a unified post apart from a per-surface arm's own spoof id in the audit trail.
+  const swallowed = swallowRoomPost(`a unified ${origin.platform} reply (${text.length}c)`, `unified-${origin.platform}`);
+  if (swallowed !== undefined) return swallowed;
+  // Dispatch by origin platform through the post-arms registry (channels/post-arms.ts); each arm
+  // resolves `deps.postX ?? live` internally. An unregistered origin fails LOUD (the typed
+  // UnifiedWakeOrigin union is exhaustive, so this only fires for a genuinely-unwired platform).
+  const arm = postArm(origin.platform);
+  if (!arm?.dispatchUnified) {
+    throw new Error(`unified reply couldn't post — no post arm registered for "${origin.platform}".`);
+  }
+  // THE COMPONENT PLANE (OPE-1720), and the fallback is STRUCTURAL rather than a flag: an arm that
+  // declares `dispatchUnifiedActions` renders the buttons, and one that does not posts the same text
+  // through `dispatchUnified`. Nothing here decides whether a surface "should" have buttons — the
+  // registry's own "presence IS the declaration" rule answers that, so a surface cannot be given a
+  // button row before its tap route exists.
+  if (actions.length > 0 && arm.dispatchUnifiedActions) {
+    return arm.dispatchUnifiedActions(origin, text, actions, deps, replier, intent);
+  }
+  return arm.dispatchUnified(origin, text, deps, replier, intent);
+}
+
+/**
+ * Complete the wake's OPEN session for a turn that judged SILENCE — no model prose ever posts — routed generically through the post arm's optional close. Only Linear has an open session to complete today: its @mention divert keeps the native agent session open so an async answer can complete it, and without this a silent turn would leave the session on a spinner forever.
+ * THE RENDERING IS THE ARM'S, and on Linear it is VISIBLE: the platform offers no activity that terminates a session invisibly, so the arm posts a FIXED HOST ack, never model prose. `answered` says the turn already answered this container through a SIBLING wake — the caller PROVES that and this function never re-derives it. The return says whether a session was actually completed, so the caller stamps its audit only when one was.
+ */
+export async function completeUnifiedSessionSilently(origin: UnifiedWakeOrigin, deps: UnifiedReplyDeps = {}, answered = false): Promise<boolean> {
+  // AMBIENT origins hold no open session to close (the `ambient` discriminator lives on the linear
+  // arm of the union; absent/false on every other platform's origin). Nothing to stop, nothing to
+  // stamp — matching the previous linear-only `if (origin.ambient) return` short-circuit.
+  if ((origin as { ambient?: boolean }).ambient) return false;
+  const arm = postArm(origin.platform);
+  if (!arm?.closeUnifiedSilently) return false; // platform has no open-session-to-close (or unregistered)
+  await arm.closeUnifiedSilently(origin, deps, answered);
+  return true;
+}