@open-everywhere/core 0.1.0

package/agent/channels/unified.ts

@@ -0,0 +1,1575 @@
+// unified — the synthetic UNIFIED channel, the single-context cross-surface window's delivery SPINE, with unified-window.ts as its tested core. eve namespaces every continuation token by the receiving channel's slug, so every surface that fans a wake in here through eve's cross-channel send lands under ONE effective token: one durable hook, one workflow run, ONE literal model context window across providers. The RAW token is the unchanged unified-supervisor token, so the whole spend, rotation and model-routing apparatus that reads it works with zero change. WHAT LIVES HERE vs the surfaces: each surface keeps its ENTIRE pre-dispatch pipeline — signature verification, trust gating, mention and ambient classification, domain opt-in, engagement tiers, wake rendering — and this channel only ever receives POST-GATE judged wakes, re-verifies the gate fail-closed as defence in depth, registers the wake's reply target in the durable map, and delivers under the shared token.
+// 🔴 THE REPLY MODEL. A turn that MERGED queued deliveries carries a single auth snapshot, so on a cross-PLATFORM session the per-turn auth cannot address each wake: reply targeting is therefore EXCLUSIVELY map-based. The auth-carrying merge is unreachable on the pinned eve 0.54.3 — eve batches adjacent queued deliveries only when their full auth contexts match, and `stampUnifiedWindowAuth` below writes a fresh per-delivery `oe_delivery_id` into `auth.attributes` — and only the caller-less task COMPLETION COHORT still folds, which carries no `auth` at all. That closes the MERGE road only: the map is not defensive, because every reply — single-wake turns included — resolves its target from it, and the reply fence's same-conversation and pending arms still put two conversations in one turn with no merge (OPE-2042; `scripts/coalesced-delivery-merge-assumption-test.ts` pins the merge road alone). The model echoes the envelope's `wake-id` to the `reply` tool, the host resolves the origin from the map, fail-closed, and the reply arm posts into that exact conversation. The terminal completion NEVER posts — message-tool-only, unconditional here because `reply` is always armed on this channel — so there is no auth-snapshot reply path to be wrong, and judged silence and dropped prose are both audited. FLAG-OFF IS BYTE-IDENTICAL: no surface dispatches here unless the window gates hold, and the `receive` hook re-checks them and refuses anyway, so a session can never open under an un-flagged config.
+
+import { defineChannel, GET, POST } from "eve/channels";
+import type { Session, RouteHandlerArgs } from "eve/channels";
+import { SELF_DISPATCH_PATH, handleSelfDispatch, postSelfDispatch, selfDispatchConfigured, type UnifiedDispatchPayload } from "./self-dispatch.js";
+import { appendAudit, auditSilencesEnabled } from "../audit/audit.js";
+import { deploymentOrg, currentWakeId, currentTurnId, currentTurnAddressing, currentTurnAddressed, bindFrom, carriesPlatformIdentity, type BindableContext, type SurfaceBinding } from "../identity/binding.js";
+import { isFrozenSurfaceBinding, OE_FROZEN_SURFACE_BINDING_ATTR } from "../identity/frozen-surface-binding.internal.js";
+import { getConfig } from "../access/config.js";
+// Side effect only: refuses to boot on an eve missing any live patch part (OPE-2182). This channel
+// is one of core's two wake doors, so the refusal lands before a consumer of `@open-everywhere/core`
+// can serve a wake through it.
+import "../access/eve-patch-probe-boot.js";
+import { windowedSupervisorEnabled, domainRoster } from "../memory/domain.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { registerUnifiedWakeTarget, resolveUnifiedWakeAuthority, resolveUnifiedWakeTarget, isUnifiedWakeAuthority, isUnifiedWakeOrigin, mintWakeId, stampUnifiedWindowAuth, proseBlockingRefusal, unifiedThreadRef, unifiedPlacementRef, sameUnifiedContainer, isThreadScopedWakeOrigin, wakeBindingMatchesOrigin, wakeBindingMatchesSurfaceKey, OE_ADDRESSING_ATTR, OE_GRAIN_ATTR, OE_TASK_LABEL_ATTR, type UnifiedWakeAuthority, type UnifiedWakeOrigin, type UnifiedWindowWake } from "./unified-window.js";
+import {
+  WAKE_INGRESS_ACTION,
+  wakeIngressDetail,
+  WAKE_RETRY_ACTION,
+  wakeRetryDetail,
+  WAKE_DISPATCH_RETRY_POLICY,
+  WAKE_DISPATCH_OPERATION,
+} from "./wake-timing.js";
+import { withRetryAfterThrown, isRateLimitThrow, RateLimitExhaustedError } from "./rate-limit-retry.js";
+import { postUnifiedReply, completeUnifiedSessionSilently } from "./unified-reply.js";
+import { canPostUnifiedActions, postArm } from "./post-arms.js";
+import { approvalCardActions, mintApprovalCardTicket, rememberApprovalCardTicket } from "./approval-card.js";
+import { containerAnsweredSince } from "./answered-container-ledger.js";
+// The two pure readers of a rendered wake. `wake-envelope.ts` is a leaf (it imports no channel
+// module), so this adds no cycle — see the option-match note in `resolveInboundAnswer`.
+import { isWakeEnvelopeShaped, triggerMessageBody } from "./wake-envelope.js";
+import {
+  detectBridgeableInputRequest,
+  bridgeQuestionToSurface,
+  forgetBridgedQuestion,
+  settleAnsweredWake,
+  readBridgedQuestion,
+  rememberBridgedQuestion,
+  resolveInboundAnswerRouting,
+  isAddressedMentionWake,
+  approvalOptionIds,
+  QUESTION_ANSWERED_AUDIT_ACTION,
+  QUESTION_ANSWER_DROPPED_AUDIT_ACTION,
+} from "./question-bridge.js";
+import { admitInputResponse } from "../approvals/input-response-floor.js";
+import { resolvePartition } from "../memory/partition.js";
+import { unifiedDomainFromToken, unifiedDomainSessionKey, isUnifiedSupervisorToken } from "./unified-supervisor.js";
+import { parseWindowToken, isTaskWindowId, isThreadSeatWindowId, isThreadSeatWindowToken, dmAnchorSurfaceForToken, dmSurfaceKeyFromAnchorDomain, bareTokenFromEveContext } from "./window-key.js";
+import { resolveThreadOwner, clearThreadOwner, routeThreadMessage } from "./thread-ownership.js";
+import { drainGenerationRetirements } from "./generation-retirement.js";
+import { oneshotAgentEnabled } from "../access/delegation-flag.js";
+import { INVOKER_POSTURE_ATTR } from "../access/invoker-posture.js";
+import { currentInvokerPosture } from "../access/invoker-posture-state.js";
+import {
+  OE_REQUESTER_ATTR,
+  OE_REQUESTER_CANDIDATES_ATTR,
+  REQUESTER_UNVERIFIED,
+  requesterCandidatesStampForDispatch,
+  requesterStampForDispatch,
+  requesterVerdictFor,
+  type RequesterVerdict,
+} from "../access/requester-identity.js";
+import { OE_CHAT_NONMEMBER_ATTR } from "../access/taint-signal.js";
+import { carryRunRefusalsToRedrive, dropCarriedRunRefusals } from "../approvals/card-signal.js";
+import { DELEGATION_PENDING_REFUSAL_REASON } from "../access/pending-delegation-signal.js";
+import { sourcesForWindow, windowSourcesNeedConfig } from "./window-sources.js";
+import { finalMessageActionForTurn, isBareStop, NO_REPLY_SENTINEL_REASON } from "./turn-delivery.js";
+import { auditNoReplySentinelObserved } from "./chat-turn-audit.js";
+import { consumeRepliedThisTurn, repliedWakesThisTurn, declinedWakesThisTurn, refusalsForWakeThisTurn } from "./reply-signal.js";
+import { replyCarriesSubstance } from "./reply-post.js";
+import { consumeReactedThisTurn } from "./react-signal.js";
+import { settleWakeAccounting, UNACCOUNTED_WAKES_AUDIT_ACTION, WAKE_ACCOUNTING_SKIPPED_AUDIT_ACTION, MAX_ACCOUNTING_WAKES } from "./wake-accounting.js";
+import { maybeRedrive, type RedriveReinject } from "./unified-redrive.js";
+import { unresumableAuditDetail } from "./session-resume.js";
+import { healPrunedDeploymentStrand } from "./stranded-seat.js";
+import { admitInboundSurface, providerSelection } from "../access/provider-selection.js";
+import { ingressSpendGate } from "../spend/ingress-gate.js";
+
+function ulog(msg: string): void {
+  console.log(`[open-everywhere:unified] ${msg}`);
+}
+
+/** eve's cross-channel send auth, derived structurally from the primitive because the option type is not re-exported from the channels barrel. */
+type UnifiedSendAuth = Parameters<ReturnType<RouteHandlerArgs["to"]>["send"]>[1]["auth"];
+
+/**
+ * eve's session-inbox wire format VALIDATES every hook payload: `auth` must carry an attributes record plus a string authenticator, principal id and principal type — fields OE's host-built wakes never set, and which provider diverts set only partially. A partial bag was once accepted; now the SEND is refused and the wake is stranded. This completes the bag at the send seam: it fills ONLY the absent fields and never overwrites an identity a provider supplied.
+ * The fill value is the empty string, this codebase's established "empty means absent" sentinel, so every reader, equality predicate and fall-through behaves exactly as it did when the fields were undefined. It is a wire-shape shim and NOT an identity: naming host wakes is a design decision this helper deliberately does not take.
+ */
+export function completeWakeAuth(
+  auth:
+    | {
+        readonly attributes?: Readonly<Record<string, unknown>>;
+        readonly authenticator?: string;
+        readonly principalId?: string;
+        readonly principalType?: string;
+      }
+    | null
+    | undefined,
+): UnifiedSendAuth {
+  return {
+    ...auth,
+    attributes: auth?.attributes ?? {},
+    authenticator: auth?.authenticator ?? "",
+    principalId: auth?.principalId ?? "",
+    principalType: auth?.principalType ?? "",
+  } as UnifiedSendAuth;
+}
+
+// AUTO-REDRIVE CROSS-CHANNEL-DISPATCH CAPTURE. The completion handler runs in the WORKFLOW process and, unlike a route or schedule handler, is handed NO cross-channel dispatch primitive, so the auto-redrive cannot re-inject on its own. Every surface's single-window dispatch funnels through {@link divertToUnifiedWindow} with a LIVE one, so the most recent is captured here and the completion handler reuses it; the captured closure targets the deployment-static runtime bundle, so reuse across turns is safe for starting a fresh delivery on a durable session.
+// When the completion runs on a process that never handled a webhook dispatch — the normal case, because the workflow process handles none — the holder is unset and delivery falls back to the SELF-DISPATCH hop, a POST to this deployment's own internal dispatch route, whose eve route handler holds a live primitive. FAIL-SOFT only when NEITHER path exists: the redrive is skipped and the drop stays a final audited drop, exactly as before the redrive existed.
+let rememberedReceive: RouteHandlerArgs["to"] | undefined;
+
+/** Array-tolerant read of one host auth attribute. */
+function authString(value: unknown): string | undefined {
+  const first = Array.isArray(value) ? value[0] : value;
+  return typeof first === "string" && first.length > 0 ? first : undefined;
+}
+function rememberUnifiedReceive(to: RouteHandlerArgs["to"]): void {
+  rememberedReceive = to;
+}
+
+// CROSS-PROCESS DISPATCH, the self-dispatch fallback. The capture above is PER-PROCESS, and the tool-execute callers run in eve's separate durable WORKFLOW process, which handles no webhooks, so the capture is structurally NEVER set there — the live-prod root cause of async spawn always throwing "no live cross-surface dispatch". The fallback POSTs the full divert payload to the deployment's OWN internal dispatch route, whose handler holds a live primitive and re-performs the exact same divert. The warm in-process path is kept first: a process that DID handle a webhook dispatches directly, cheaper, no HTTP hop, identical semantics.
+// EVERY caller of this function is an INTERNAL host dispatch — a task spawn, a completion wake, an approval-decision wake, the auto-redrive — which is what makes it the right place to stamp `internalDispatch` ONCE for both of its legs: the warm divert here, and the cold hop whose route handler re-performs the divert under the same stamp. The marker is deliberately NOT a field of the dispatch payload: it never crosses the wire, so no signed body can assert it.
+async function deliverUnifiedDispatch(input: UnifiedDispatchPayload): Promise<void> {
+  if (rememberedReceive) return divertToUnifiedWindow(rememberedReceive, { ...input, internalDispatch: true });
+  await postSelfDispatch(input); // throws instructively on failure — callers pick loud vs best-effort
+}
+
+/** Can THIS process deliver a unified dispatch at all — a captured in-process `to`, or a
+ *  configured self-dispatch route to hop through? */
+function crossProcessDispatchAvailable(): boolean {
+  return rememberedReceive !== undefined || selfDispatchConfigured();
+}
+
+/**
+ * A representative window-enabled surface key for a domain — the receive fail-closed gate needs SOME key in the domain, which the original wake already proved window-enabled.
+ * It prefers a channel on the origin's own platform, for the closest audit label, else the domain's first channel. Null when the domain or its channels cannot be resolved, which skips the redrive.
+ * 🔴 THE SEAT'S OWN WINDOW ID COMES FIRST (OPE-1695). A SOLO seat's windowId IS its fully-qualified surface key, and since seats became universal a seat's domain can be the `org` pseudo-domain, which has NO roster to pick from — so the roster read alone would answer null and silently kill every spawn, redrive and decision wake in an undeclared room. Every caller holds a token or key that names the seat, so each passes it. It is also the MORE exact answer where both work: a solo seat resolves its OWN channel rather than a sibling in the domain.
+ * The windowId is used only when it POSITIVELY looks like a surface key on the origin's platform — a group name carries no slash and a task/thread windowId carries a `t/`/`s/` prefix, so neither can pass — and anything else falls through to the roster read, unchanged.
+ */
+function pickRedriveSurfaceKey(domain: string | undefined, platform: string, windowId?: string): string | null {
+  if (!domain) return null;
+  // DM DELEGATION ANCHOR: a pseudo-domain is not in config at all — it IS a surface key, so the one surface it resolves to is the DM itself.
+  // Returned WITHOUT consulting the domain roster, and the reserved prefix is refused as a config domain NAME at load, so this can never shadow or be shadowed by a real domain.
+  const dmSurface = dmSurfaceKeyFromAnchorDomain(domain);
+  if (dmSurface) return dmSurface;
+  if (windowId !== undefined && windowId.startsWith(`${platform}/`) && windowId.split("/").length >= 3) return windowId;
+  try {
+    const d = getConfig().loadDomains().find((dm) => dm.name === domain && domainRoster(dm).length > 0);
+    const roster = d ? domainRoster(d) : [];
+    if (roster.length === 0) return null;
+    return roster.find((c) => c.startsWith(`${platform}/`)) ?? roster[0]!;
+  } catch {
+    return null;
+  }
+}
+
+/** The cross-channel receive target every surface's single-window diversion supplies. All fields
+ *  are HOST-built at dispatch time (post-gate), never model-authored. */
+export interface UnifiedReceiveTarget {
+  /** The raw unified-supervisor continuation token (`oe-dom:<domain>:oe-sup:g<n>`) — eve
+   *  prefixes `unified:` on send, which is the whole single-window mechanism. */
+  readonly token: string;
+  /** Host-minted wake id — already rendered into the wake envelope by the surface. */
+  readonly wakeId: string;
+  /** The wake's reply target (surface + conversation ids) for the durable map. */
+  readonly origin: UnifiedWakeOrigin;
+  /** The originating container's fully-qualified surface key — for the fail-closed flag
+   *  re-check (the gate is per-channel) and audit labels. */
+  readonly surfaceKey: string;
+  /** Exact authority of THIS wake, captured before another surface can replace seat auth.
+   * Optional only for a target already queued by a pre-upgrade deployment. */
+  readonly authority?: UnifiedWakeAuthority;
+  /** Side-channel context strings (GenericReceiveInput carries only `message`, so surfaces
+   *  whose wakes ship context — GitHub's issue-title line — pass it through here). */
+  readonly context?: readonly string[];
+  /**
+   * THE RETURN LEG: this message ANSWERS the window's outstanding bridged question, so `receive` responds to that request id instead of sending an ordinary message.
+   * 🔴 HOST-DECIDED, NEVER CARRIED ON THE WIRE. {@link divertToUnifiedWindow} is the only writer, it only writes on an ATTENDED arrival, and it derives the request id from a durable row this deployment wrote — the self-dispatch payload has no such field, so a signed body cannot assert one.
+   */
+  readonly answer?: {
+    readonly requestId: string;
+    /** The audience floor the admission resolved — recorded on the routed row. */
+    readonly floor: string;
+    /** DERIVED, audit only (channels/question-bridge.ts `taskIdOfBridgedRequestId`). */
+    readonly taskId?: string;
+    /** THE OPTION eve SETTLES ON, for an APPROVAL only — eve's `resolveApprovalOutcome` reads
+     *  `optionId` and nothing else, so an approval answered without one resolves `invalid` and
+     *  denies the tool call (OPE-1056). Host-decided at the same site, from the ids the durable row
+     *  recorded when the request was bridged; absent for an `ask_question`, whose answer is text. */
+    readonly optionId?: string;
+  };
+  /**
+   * THIS WAKE CARRIES A MESSAGE FROM THE ROOM — an ATTENDED arrival, as opposed to a wake the deployment minted for itself: a task spawn, a completion wake, an approval-decision wake, the auto-redrive. Stamped onto the durable wake row and read ONLY by the reply freshness gate.
+   * 🔴 HOST-DECIDED AT THE SAME SITE, AND FOR THE SAME REASON, AS `answer` above: the divert is the only place that knows an arrival is attended, and the self-dispatch payload has no such field, so a signed body cannot assert one. Absent ⇒ the row is NOT inbound, which costs a missed refusal, never a false one.
+   */
+  readonly inbound?: boolean;
+  /** {@link UnifiedWindowWake.addressing}, carried through to the wake-target row — see {@link registerUnifiedWakeTarget} for why it is a tolerated extra field on the stored origin and never a new column. Absent ⇒ ambient, the safe default. */
+  readonly addressing?: string;
+}
+
+/**
+ * Fail-closed gate re-check: the surfaces only divert here when the grain says single-window, but the channel must not trust its callers' config reads, so a receive under an un-flagged, or no-longer-flagged, config is refused loudly. Any config-load error means OFF.
+ * EXPORTED FOR ONE REASON, THE PARITY PIN: this decision is duplicated at the self-dispatch gate, which sits one gate upstream. The two diverged once — the receive gate had the DM carve-in, the HTTP gate did not, and every DM spawn died at the hop — and neither could be exercised directly from a test, because the receive body only runs inside eve's own channel dispatch. A test now asserts the two gates agree row-for-row over a corpus. It is not part of the channel's contract, and nothing outside the tests should call it.
+ */
+export function windowEnabledFor(surfaceKey: string, token: string): boolean {
+  // DM ANCHOR — the ONE carve-in, and it is NARROWER than the config gate beside it, not wider. A DM-anchored session rides a window on a pseudo-domain that is itself a surface key, so admission is a self-consistency check on the dispatch rather than a config read: the surface being delivered to must be EXACTLY the surface the token's own anchor names. The arm admits ANY grain on an anchor domain, because the DM SEAT is itself a standing window on one, and a seat that cannot be delivered to is not a seat. THE PRIVACY INVARIANT is untouched and is the whole fence: the match is byte-exact against the token's own anchor surface, so a DM window may only ever be delivered to ITS OWN DM. It still cannot open a shared window, because a pseudo-domain matches no config row, and it still cannot reach another surface. Fail-closed on any mismatch, exactly like the config arm below.
+  // 🔴 THIS CARVE-IN IS DUPLICATED AT THE SELF-DISPATCH GATE AND THE TWO MUST MOVE TOGETHER — they diverged once, and every DM spawn died at the hop. Both now read the SAME {@link dmAnchorSurfaceForToken} seam, so the derivation itself can no longer drift; what still has to be kept in step by hand is the DECISION either side of it.
+  const dmAnchorSurface = dmAnchorSurfaceForToken(token);
+  if (dmAnchorSurface !== undefined) return dmAnchorSurface === surfaceKey;
+  try {
+    const domains = getConfig().loadDomains();
+    // A window is enabled for this surface under EITHER topology — the cross-surface window or a solo per-channel window — and both divert here.
+    return windowedSupervisorEnabled(surfaceKey, domains);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Audit labels for a unified session: the DOMAIN is the human-meaningful workspace, and the synthetic WINDOW registry key doubles as the surface label, matching the channel-session row the spend hook bumps. Both are recovered through the window-key parse seam. `rawToken` is OPTIONAL: an event on a session addressed by durable id carries no token at all, and the parse fail-softs, so an absent token labels the row `workspace: "unknown"` — the same posture a malformed token has always had, and deliberately NOT an exception, because an audit row is worth more than the label it is missing.
+ * 🔴 A DM WINDOW IS THE ONE DOMAIN THAT IS NOT A WORKSPACE LABEL. Its domain is a reserved pseudo-domain — a routing identity, not a human-meaningful anchor — and stamping it here would put that routing key in the `workspace` column of every audit row this seam labels, violating the recorded ruling that a reply row's workspace is ALWAYS the PLATFORM workspace. So an anchor domain is mapped back to the platform workspace it was derived from: the pseudo-domain literally CONTAINS the surface key it was built from, whose middle segment IS that workspace — no store read, no config, just the inverse of the mint. Nothing is lost, because the `surface` label keeps the full registry key, so a DM row stays exactly identifiable. Applied at THIS seam rather than at each row's own call site on purpose: every row these labels feed wants the same answer to "which workspace is this?", and one derivation cannot drift from another.
+ */
+export function auditLabels(rawToken: string | undefined): { workspace: string; surface: string | undefined } {
+  const key = parseWindowToken(rawToken);
+  return {
+    workspace: key ? platformWorkspaceForWindowDomain(key.domain) : "unknown",
+    surface: key ? unifiedDomainSessionKey(key.windowId) : undefined,
+  };
+}
+
+/**
+ * The audit `workspace` label for a window token's domain: the domain itself for a real config domain, and — for a DM anchor pseudo-domain — the PLATFORM workspace inside the surface key it was minted from. See {@link auditLabels} for the ruling this enforces.
+ * FAIL-SOFT to the domain string: a malformed anchor labels as it always did, because an odd label is a better outcome than a thrown audit. Exported for its own test pin, and not part of the channel's contract.
+ */
+export function platformWorkspaceForWindowDomain(domain: string): string {
+  const surfaceKey = dmSurfaceKeyFromAnchorDomain(domain);
+  if (surfaceKey === undefined) return domain;
+  // A surface key is `platform/workspace/surface` (memory/partition.ts domainKeyOf) — segment 1.
+  return surfaceKey.split("/")[1] || domain;
+}
+
+/**
+ * The classification a dropped-prose audit row carries: WHICH addressing kind was dropped, and WHY. Pure and eve-free, so it is unit-testable without a channel context, and the drop branch is its sole caller. It never takes or returns prose text — only the classification, matching every other field that row carries. `rawAddressing` is the turn's own addressing read, which on this channel is only ever the addressed-mention value or absent, and since OPE-1982 an ADDRESSED turn reaches this branch too — the prose bridge that used to claim it first is deleted, so a direct mention's dropped prose is classified here like every other. It stays a parameter rather than a constant, so the row keeps naming what it SAW and a future addressing value is reported honestly with no change here. `addressed` is the BROADER read, true for a surface's own addressed stamp too — a name-drop, an @mention outside the single window — so it is what tells a genuinely unaddressed watch drop apart from an addressed one. `replied` is the branch's own distinction between narration after a real reply-tool post and prose that IS the whole dropped answer, reused as the drop reason.
+ * `blockingRefusal` REPLACES the no-reply reason when present: this turn drew a host refusal on the wake it was going to answer, so the refusal is why nothing reached the room, and it reports as `refused:<reason>`, which names WHICH host decision took effect — where the no-reply reason reports the SYMPTOM of that decision as if it were the cause. `replied` still wins over both, because a turn that DID post through the tool and then narrated is benign narration whatever else it drew. The two fields read together: on an addressed turn the pair says "an owed answer was withheld, and here is the decision that withheld it", while on an ambient turn no answer was owed, so the pair says only "this turn also drew that refusal" and the drop is the ordinary message-tool-only drop. That is what keeps the ambient adherence count honest — an ambient drop the HOST refused was never an adherence failure, and it no longer counts as one.
+ * `carriesSubstance` is the FOURTH way an addressed turn's prose can fail to reach the room, and it reports as {@link NO_SUBSTANCE_DROP_REASON} (OPE-1911). It is its own reason rather than a shade of `no-reply-call` because the two ask a reader for different things: `no-reply-call` says the model narrated instead of calling `reply`, and the answer is in the dropped text; this one says the turn produced NO answer to deliver, so the dropped text holds nothing to recover and the redrive below is the only road to one. Ship #216 spent three legs undiagnosable for exactly this reason — the rows could not say whether the answer was withheld or was never written. It is the WEAKEST of the four: a refusal, a real reply-tool post, or an UNADDRESSED turn all decide the drop before it, so a substance-free stub reports as the decision that actually took effect. 🔴 THE `addressed` CONJUNCT IS LOAD-BEARING, not tidiness: an ambient watch turn's prose is dropped BY DESIGN and its text is routinely substance-free, so without it this reason would answer "which addressed turns produced no answer" with ordinary ambient chatter — the same dilution that made ship #216 undiagnosable, rebuilt inside the row meant to end it.
+ */
+export function ambientProseDropDetail(
+  rawAddressing: string | undefined,
+  addressed: boolean,
+  replied: boolean,
+  blockingRefusal: string | undefined,
+  carriesSubstance: boolean,
+): { readonly addressing: string; readonly reason: string } {
+  return {
+    addressing: rawAddressing ?? (addressed ? "addressed-other" : "ambient"),
+    reason: replied
+      ? "narration-after-reply"
+      : blockingRefusal !== undefined
+        ? `refused:${blockingRefusal}`
+        : carriesSubstance || !addressed
+          ? "no-reply-call"
+          : NO_SUBSTANCE_DROP_REASON,
+  };
+}
+
+/**
+ * Does a dropped-prose turn owe this wake's open session its ENDING? (OPE-2000.) PURE, and the whole decision in one place, because neither conjunct can be driven from the deterministic tier on its own: the completion handler is reached through eve's adapter, which builds its own channel with no continuation token, so `redriven` is structurally false there and a live drive can never separate the two.
+ * BOTH conjuncts are load-bearing and say different things. `answeredThisWake` is the per-WAKE reply record, never the turn-wide one: a coalesced turn that answered a Slack sibling and ended in prose for a Linear @mention still owes THAT session its ending. `redriven` says the one corrective re-drive went out, so a turn is still coming that can answer this wake — closing the session under it would end the conversation one turn before the answer arrives.
+ */
+export function proseDropClosesWakeSession(answeredThisWake: boolean, redriven: boolean): boolean {
+  return !answeredThisWake && !redriven;
+}
+
+/** `detail.reason` on the drop row for an addressed turn whose terminal prose carried no answer — see {@link ambientProseDropDetail} and {@link replyCarriesSubstance}. ONE greppable string, so an operator query and the test read the same token. */
+export const NO_SUBSTANCE_DROP_REASON = "no-substance";
+
+/**
+ * Did THIS turn already answer `origin`'s own CONTAINER, through a SIBLING wake? THE DEFECT THIS ANSWERS: a turn that merged several deliveries holds them all, and each Linear mention or comment-backed follow-up materialises its OWN agent session, so two wakes on ONE issue share a turn whenever the reply fence admits a sibling wake. The model answers one of them; the other reaches the close gate below with nothing delivered through it, and the close used to state that no response was needed on the very issue that had just received a real answer — measured on a soak run, the answer and the denial seconds apart. The auth-carrying MERGE road into this shape is unreachable on eve 0.54.3 (see this module's header), and this gate is still LIVE: the fence's same-conversation and pending arms put two wakes in one turn without any merge, and {@link answeredContainerVia}'s durable arm covers the two-turn shape below (OPE-2042).
+ * WHY THE CONTAINER, AND NOT THE TURN: a turn-wide "did we reply anywhere" read is the easy one and it is WRONG, because a turn that answered a Slack sibling and stayed silent on this Linear mention still owes that session a real silence ack. What makes the ack a CONTRADICTION is that the answer is visible IN THE SAME ROOM, so the room is the question this asks. And not the THREAD, because Linear renders every agent activity onto one issue feed, so an answer in a neighbouring thread of the same issue is just as visible: the thread-grain comparator stays where authority is decided, and the copy question is a room question. FAIL-SOFT toward the OLD behaviour — no turn id, no replied wakes, an unresolvable wake row or a store error all answer false, which renders the silence ack exactly as before. The flag only ever REPLACES one fixed host line with another; it never decides whether to close. Exported for its own test, not for any other caller.
+ */
+export async function answeredSameContainerThisTurn(org: string, turnId: string | undefined, wakeId: string | undefined, origin: UnifiedWakeOrigin): Promise<boolean> {
+  const replied = repliedWakesThisTurn(turnId).filter((w) => w !== wakeId);
+  if (replied.length === 0) return false;
+  const store = getOperationalStore();
+  for (const w of replied) {
+    const other = await resolveUnifiedWakeTarget(store, org, w).catch(() => null);
+    if (other && sameUnifiedContainer(other, origin)) return true;
+  }
+  return false;
+}
+
+/**
+ * Has `origin`'s CONTAINER been answered, by THIS turn or by an EARLIER one? It returns which arm found the answer, or `undefined` for "no answer on record", and the close then carries the ordinary silence line.
+ * 🔴 THE SECOND ARM IS THE POINT. {@link answeredSameContainerThisTurn} is exact and cheap, and it is blind to the shape that reopened this: eve ran the two Linear wakes as TWO TURNS, so the answering turn's reply record was already gone when the sibling turn asked. The durable arm reads the answered-container ledger, which the reply choke point stamps per container, and asks whether an answer landed AT OR AFTER this wake's own registration stamp — that "at or after" is what keeps the claim honest, because an answer posted BEFORE the member wrote is not an answer to them. FAIL-SOFT throughout: an unresolvable wake row, a store error or a missing stamp all read as "no answer", the pre-fix direction, and nothing here decides WHETHER a session closes. Exported for its own test, not for any other caller.
+ */
+export async function answeredContainerVia(org: string, turnId: string | undefined, wakeId: string | undefined, origin: UnifiedWakeOrigin): Promise<"turn" | "container" | undefined> {
+  if (await answeredSameContainerThisTurn(org, turnId, wakeId, origin)) return "turn";
+  if (wakeId === undefined) return undefined;
+  const record = await getOperationalStore()
+    .getUnifiedWakeRecord(org, wakeId)
+    .catch(() => null);
+  if (!record) return undefined;
+  return (await containerAnsweredSince(org, origin, record.createdAt)) ? "container" : undefined;
+}
+
+/**
+ * THE PER-WAKE ACCOUNTING AUDIT, independent of that turn's own action kind: the question it asks — did the turn account for every wake it was SHOWN, not just the one its own wake stamp names — is orthogonal to what happened with the last coalesced wake. AUDIT-ONLY, ZERO BEHAVIOUR CHANGE: it never throws into the turn, never refuses a tool call and never nudges the model. It writes ONE audit row and ONE horizon stamp, a column no gate's query filters on, so neither the reply-freshness gate nor the answerable-reply fence can see it. See wake-accounting.ts for what a delivered wake id means here and why a wake is reported at most once.
+ * 🔴 TWO CALL SITES, ONE FUNCTION. `message.completed` calls this on every non-buffer finish, which is most turns — but a turn whose LAST model step ends on a tool-calls finish, the measured step-ceiling shape, never reaches that branch, so that site alone left WHOLE GENERATIONS with no audit stamp at all. The turn-lifecycle hook is the second call site, firing on turn completion, turn cancellation and session failure, so it runs even when the last completion never got past its buffer early return. Calling this twice for one turn is safe by construction: the first call stamps EVERY candidate it considered, so the second call's read finds nothing left to diff. An unresolved window token, turn id or turn wake leaves nothing to anchor the read on, so it no-ops — but the no-op is COUNTABLE, as a low-volume, reason-tagged skipped row, so "the pass did not run on this turn" is distinguishable from "the pass ran and reported nothing" without adding a row to the common, high-volume path.
+ */
+export async function auditUnaccountedWakesForTurn(
+  org: string,
+  workspace: string,
+  surface: string | undefined,
+  windowToken: string | undefined,
+  turnId: string | undefined,
+  turnWake: string | undefined,
+  reacted: boolean,
+): Promise<void> {
+  if (!windowToken || !turnId || !turnWake) {
+    const reason = !windowToken ? "no-window-token" : !turnId ? "no-turn-id" : "no-turn-wake";
+    await appendAudit({
+      org,
+      platform: "unified",
+      workspace,
+      surface,
+      action: WAKE_ACCOUNTING_SKIPPED_AUDIT_ACTION,
+      detail: { reason },
+    }).catch(() => undefined);
+    return;
+  }
+  try {
+    const accounted = new Set<string>([...repliedWakesThisTurn(turnId), ...declinedWakesThisTurn(turnId)]);
+    // A react has NO per-wake record of its own — the react signal is a plain turn-scoped boolean and not a wake set, the same scope limitation the declined mark has — so a react is credited only to this turn's OWN wake.
+    // `reacted` is the CALLER's single read of that read-and-reset signal: the bare-stop detector below needs the same fact, and a second consuming read in one turn would leave it false.
+    if (reacted) accounted.add(turnWake);
+    const unaccounted = await settleWakeAccounting(getOperationalStore(), org, { windowToken, turnWake }, accounted);
+    if (unaccounted.length === 0) return;
+    const addressedCount = unaccounted.filter((w) => w.addressing === "addressed").length;
+    await appendAudit({
+      org,
+      platform: "unified",
+      workspace,
+      surface,
+      action: UNACCOUNTED_WAKES_AUDIT_ACTION,
+      detail: {
+        turnId,
+        turnWake,
+        unaccounted: unaccounted.map((w) => ({ wakeId: w.wakeId, addressing: w.addressing })),
+        count: unaccounted.length,
+        addressedCount,
+        ambientCount: unaccounted.length - addressedCount,
+        capped: unaccounted.length >= MAX_ACCOUNTING_WAKES,
+      },
+    }).catch(() => undefined);
+  } catch {
+    /* best-effort — a measurement pass must never fail the turn it is measuring */
+  }
+}
+
+/**
+ * A bounded, redaction-safe diagnostic subset of a failed-turn or failed-session eve event, for the audit detail. Recording only the message left a run of prod delegation failures UNATTRIBUTABLE — a bare "the model did not return a response" with no code, error id or provider.
+ * This records the eve error `code` plus the well-known gateway and provider diagnostic keys eve surfaces when it has them: an empty-model-response carries only an id and a name, because it is detected client-side from an empty but successful stream and there is no provider to attribute, whereas a gateway failure carries the status and generation fields that DO name the provider. WHITELISTED keys only, never a blind dump, and each capped, so nothing large or PII-shaped rides into the audit log.
+ */
+function failureDiag(code: string | undefined, details: Record<string, unknown> | undefined): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (typeof code === "string" && code.length > 0) out.code = code;
+  if (details && typeof details === "object") {
+    for (const k of ["errorId", "name", "statusCode", "generationId", "gatewayName", "gatewayType", "upstreamType", "upstreamStatusCode", "upstreamMessage"]) {
+      const v = details[k];
+      if (typeof v === "string" && v.length > 0) out[k] = v.slice(0, 200);
+      else if (typeof v === "number" && Number.isFinite(v)) out[k] = String(v);
+    }
+  }
+  return out;
+}
+
+/**
+ * The `sources` vector to stamp on a diverted wake — the platforms whose wakes fan into this window. Derived from the raw window token's own identity plus the domain config: a cross-surface window resolves the domain's distinct channel platforms and a NAMED GROUP window resolves that group's, while a solo or task window derives its single platform straight from the window id, so no config load is needed there.
+ * FAIL-CLOSED: any parse or config failure, and any unresolvable identity, falls back to the SINGLE origin platform — never empty, never a wider set. This is the ONE derivation site for the stamp, and the child-inheritance and redrive paths flow back through {@link divertToUnifiedWindow}, so a task child re-derives its own single-source vector.
+ */
+function windowSourcesForDivert(token: string, originPlatform: string): readonly string[] {
+  try {
+    const key = parseWindowToken(token);
+    if (key) {
+      // Only the CONFIG-DERIVED window shapes consult the domain config; a solo, task or thread window derives purely from its window id, so the config load and its failure modes are skipped there.
+      // {@link windowSourcesNeedConfig} owns that list, next to the derivation it describes — a private copy of it here is how a new window shape silently loses its sources.
+      const domains = windowSourcesNeedConfig(key.windowId, key.domain) ? getConfig().loadDomains() : [];
+      const s = sourcesForWindow(key.windowId, key.domain, domains);
+      if (s.length > 0) return s;
+    }
+  } catch {
+    // parse or config-load failure → fall through to the fail-closed single-origin default.
+  }
+  return [originPlatform];
+}
+
+/**
+ * THE WINDOW SPEND GATE — the cross-surface window's own attended-wake spend decision, at the ONE choke point every single-window wake passes through. WHY HERE AND NOT ONLY ON EACH SURFACE: every surface has a native attended gate, but a surface's SINGLE-WINDOW leg is a different code path from its native one, and on three surfaces it returns BEFORE the native gate can run, handing the wake to this function without ever reaching their own handlers — so on a domain with the flagship topology, attended mentions on those surfaces were UN-CAPPED. Two surfaces happen to gate before their divert, which is a property of where their gate sits and not of the divert, and it is exactly the kind of per-surface accident this gate removes. The refusal posts through the same per-platform arm registry the window's own replies use, which is what makes ONE gate here viable at all: it can speak on every surface in the window, including the AMBIENT legs that have no native post seam of their own. No reply row is written for it — a refusal is not a reply, and the eval scorers join on that action name — so the spend row is the record. A RE-CHECK on the surfaces that already gated is ACCEPTED, not avoided: an over-budget wake never reaches here from them, an under-budget one pays one more cheap check, and the only visible duplication is a second bypass row on an ADMIN BYPASS, where the hourly throttle still posts exactly one warning. Accountability rows are cheap; a second unguarded door is not.
+ * ⚠️ ONE KNOWN WART, ON LINEAR ONLY: a declined wake is invisible to the caller, because this returns void and widening it would thread a decision back through every surface's supervisor dispatch. Everywhere else that is harmless, since the caller simply posted nothing — but on Linear the mention leg holds an OPEN native agent session across the divert, and the refusal lands as its TERMINAL response activity, so the human sees the refusal and the session closes cleanly, after which the mention leg's own audit row and its best-effort "working on it" thought no-op or fail against the now-completed session. The spend row is the truthful record of what happened; the row alongside it is not. 🔴 DELIBERATELY NOT APPLIED to an INTERNAL dispatch — a task spawn, a completion wake, the auto-redrive, an approval-decision wake, a routine fire. Those are not attended arrivals: each is either already gated at its own unattended origin or is the delivery of work ALREADY admitted and paid for, where refusing would starve a caller of a result rather than prevent a spend — and refusing a routine fire here would post into the room, which is precisely what the silent-routine carve-out exists to prevent. The flag is opt-OUT, so a future ingress that forgets it is GATED, not un-gated, the fail-closed direction.
+ */
+async function windowSpendGate(input: {
+  readonly window: UnifiedWindowWake;
+  /** The surface's OWN wake auth. The scope comes from HERE, never from the divert's `surfaceKey`
+   *  argument: the partition this resolves is the one `recordSpend` writes under, so the cap and the
+   *  ledger measure the same scope even if a caller labelled the wake differently. */
+  readonly auth: { attributes?: Record<string, unknown> };
+}): Promise<"proceed" | "declined"> {
+  const platform = input.window.origin.platform;
+  // The SAME derivation the session's own auth will use: the surface's verbatim wake auth, read through its OWN registered identity mapper, so the gate scopes the real workspace and surface.
+  // That also resolves the real SPEND grain inside the gate — a Discord thread caps against its parent channel.
+  const bindable = { channel: { kind: platform }, session: { auth: { current: input.auth } } } as unknown as BindableContext;
+  // The ATTRIBUTED principal — the person this turn's spend would be recorded under, and therefore
+  // the only person whose admin standing can honestly buy a bypass of their own bill.
+  const principalId = bindFrom(bindable).principalId;
+  return ingressSpendGate({
+    bindable,
+    door: "window",
+    // No independent mode resolution at this seam — the binding's own dm/mpim/channel verdict is the
+    // one the session will run under, which is what the perDomain criteria layer must see.
+    ...(principalId !== undefined ? { principalId } : {}),
+    post: async (text) => {
+      // Fails VISIBLE-or-not, never silently changes the decision (the gate's own contract): a
+      // throw here is swallowed by the gate and the wake is STILL declined.
+      await postUnifiedReply(input.window.origin, text);
+    },
+  });
+}
+
+/**
+ * THE INBOUND-ANSWER DECISION — is this arrival the answer to the window's outstanding bridged question, and may THIS room give it? The pure shape lives in question-bridge.ts; this is the live wiring, the durable row read plus the same admission the three WIDGET arms already run — the same gate over a different transport, and that module's header says why the transport must not be the control. FAIL-SOFT TO AN ORDINARY WAKE: no row, an unreadable store, a message from another room, a refused answerer or a thrown floor all land on the behaviour every message had before this leg existed — the message is delivered, the seat hears it, and the question stays open for someone who may answer it. Nothing here may drop a message and nothing here may throw.
+ * 🔴 THE ROOM IS PART OF THE DECISION, not just the person: one window token spans every room and surface on the domain, so the stored row alone cannot say where the question is showing. This passes the inbound wake's container key, and the pure router compares it against the container the question was posted into; a mismatch is an ordinary wake. ⚠️ THE PER-MEMBER LEG OF THE ADMISSION IS NOT PASSED, and that is a decision: it is a POSITIVE per-member verdict, while this seam holds a per-SURFACE trust verdict, and reading one as the other would refuse whole external-trust rooms. Undefined is inert, so the room floor carries this arm alone — and all three WIDGET arms do pass the per-member leg, which makes the two ROOM-MESSAGE arms the places a guest in an ordinary internal channel may still answer. COST: ONE indexed store read per ATTENDED wake, deliberately NOT flag-gated the way the recovery reader beside it is, because this one also serves a question the WINDOW ITSELF raised, which any build can do. An internal dispatch pays nothing, because the decision short-circuits before the read.
+ */
+async function resolveInboundAnswer(
+  input: {
+    readonly window: UnifiedWindowWake;
+    readonly auth: { attributes?: Record<string, unknown> };
+    readonly internalDispatch?: true;
+    /** The arriving delivery — the RENDERED WAKE, not the person's words (see the answer leg below:
+     *  "THE ANSWER TEXT IS THE RENDERED WAKE, deliberately"). Read ONLY to select a parked
+     *  APPROVAL's option id, and only after the trigger BODY is taken out of it; a question's answer
+     *  is the whole rendered wake and this decision never inspects it.
+     *  TYPED LOOSELY ON PURPOSE, though every caller passes a `string`: this is also where a future
+     *  non-text ingress would arrive, and such a delivery names no option, so it must settle no
+     *  approval. */
+    readonly message?: unknown;
+  },
+  bareToken: string,
+): Promise<UnifiedReceiveTarget["answer"] | undefined> {
+  try {
+    const org = deploymentOrg();
+    // THE ROOM THIS MESSAGE CAME FROM, in the same vocabulary the question was stored under. A
+    // derivation that throws leaves it undefined, which never answers — an ordinary wake.
+    let containerKey: string | undefined;
+    try {
+      containerKey = unifiedThreadRef(input.window.origin).channelKey;
+    } catch {
+      containerKey = undefined;
+    }
+    // 🔴 THE OPTION IS MATCHED AGAINST THE TRIGGER BODY, NEVER THE DELIVERY (cold review, 2026-09-11).
+    // `input.message` here is the RENDERED WAKE — `<wake reason="dm" …><message trigger="true"
+    // author-id="…">\n    Approve\n  </message></wake>` — because only `addressing:"direct"` passes a
+    // body verbatim and Slack never emits one (instructions/access.ts records that verification). A
+    // raw match would therefore normalise a Slack DM reply to `wake reason=…`, select no option, and
+    // leave EVERY approval on the surface S-EVE-CARD drives permanently parked — the OPE-1056 symptom
+    // this fix exists to remove, reintroduced one seam earlier.
+    // `triggerMessageBody` answers `undefined` for a COALESCED delivery (several envelopes, whose
+    // turn auth belongs to the last one), which keeps the approval parked rather than settling it on
+    // text somebody else wrote. That is the fail-closed direction and it is the whole reason to use
+    // this helper rather than a regex here.
+    const roomText =
+      typeof input.message !== "string" ? undefined : isWakeEnvelopeShaped(input.message) ? triggerMessageBody(input.message) : input.message;
+    const routing = await resolveInboundAnswerRouting(
+      {
+        internalDispatch: input.internalDispatch === true,
+        ...(containerKey ? { containerKey } : {}),
+        ...(roomText !== undefined ? { text: roomText } : {}),
+        addressedMention: isAddressedMentionWake(input.window, bareToken),
+      },
+      {
+        read: () => readBridgedQuestion(getOperationalStore(), org, bareToken),
+        admit: async () => {
+          // The SAME derivation the spend gate makes, and for the same reason: the room this message was really sent in is the one the floor must judge, and the surface's verbatim wake auth, read through its OWN registered identity mapper, is what names that room.
+          // The divert's `surfaceKey` argument is the caller's label; this is the platform's.
+          const bindable = {
+            channel: { kind: input.window.origin.platform },
+            session: { auth: { current: input.auth } },
+          } as unknown as BindableContext;
+          const p = resolvePartition(bindable);
+          return admitInputResponse({
+            org: p.org,
+            platform: p.platform,
+            workspace: p.workspace,
+            ...(p.surface === undefined ? {} : { surface: p.surface }),
+            surfaceKey: p.surfaceKey,
+            principalId: bindFrom(bindable).principalId ?? "",
+            responses: 1,
+          });
+        },
+      },
+    );
+    if (routing.kind === "wake") {
+      if (routing.reason === "refused") {
+        // The refusal row is `input_response.denied`, written by the admission itself — one action
+        // name across all five arms, so a reader can count refusals without knowing the transport.
+        ulog(`REFUSED an answer to the outstanding question on ${bareToken} — delivering it as an ordinary wake, the question stays open`);
+      } else if (routing.reason === "unmatched-option") {
+        // The window is parked on an APPROVAL and this message named none of its options. Not a
+        // refusal and not an answer: the row is LEFT IN PLACE so the room can still answer, and the
+        // message reaches the seat as an ordinary wake. Logged because "the approval is still
+        // waiting" is otherwise indistinguishable from "nothing happened".
+        ulog(`the outstanding APPROVAL on ${bareToken} was not answered by this message (it names no option) — ordinary wake, the approval stays parked`);
+      } else if (routing.reason === "addressed-mention") {
+        // Not a refusal and not audited: an @-mention is the seat's wake by ruling (OPE-2116). The
+        // question stays open, so a plain reply in its room can still answer the worker.
+        ulog(`the outstanding question on ${bareToken} was not answered by this message (it @-mentions the agent) — ordinary wake, the question stays open`);
+      } else if (routing.reason === "foreign-room") {
+        // Not a refusal and not audited: this person was not answering anything. The window holds an open question in a DIFFERENT room, and this is an ordinary message that happens to share the window token.
+        // Logged, because a question that never gets answered is otherwise hard to explain from the outside.
+        ulog(`the outstanding question on ${bareToken} is showing in another room — this message is an ordinary wake, the question stays open`);
+      }
+      return undefined;
+    }
+    return {
+      requestId: routing.requestId,
+      floor: routing.floor,
+      ...(routing.taskId !== undefined ? { taskId: routing.taskId } : {}),
+      ...(routing.optionId !== undefined ? { optionId: routing.optionId } : {}),
+    };
+  } catch (err) {
+    // An answer we could not decide is an ordinary message. Loud enough to diagnose, never fatal.
+    console.warn(`[open-everywhere:unified] inbound-answer decision skipped (${String(err)}) — delivering as an ordinary wake`);
+    return undefined;
+  }
+}
+
+const channel = defineChannel<undefined, void, UnifiedReceiveTarget>({
+  // The unified channel is not a public HTTP surface — wakes arrive through cross-channel send and replies leave through the reply tool — so the GET is an inert registration anchor, and the POST is the INTERNAL self-dispatch ingress, HMAC-authenticated and a fail-closed not-found without its secret.
+  // That route is what lets the workflow-process dispatch legs reach a live cross-channel primitive, because an eve route is the ONE place eve hands one out. The divert is INJECTED, not imported, so the self-dispatch module never imports this one and no cycle exists.
+  routes: [
+    GET("/eve/v1/unified", async () => new Response("not found", { status: 404 })),
+    // `internalDispatch: true` — this route is the COLD leg of the dispatch helper above, and its only clients are that function's internal callers, reaching it over the HMAC-authenticated hop because a tool execute runs in the workflow process, which holds no dispatch primitive.
+    // Same class of wake, same skip. The marker is set HERE rather than read off the signed, but still remote, payload, so nothing on the wire can claim it.
+    POST(SELF_DISPATCH_PATH, async (req, { to }) => handleSelfDispatch(req, to, (r, i) => divertToUnifiedWindow(r, { ...i, internalDispatch: true }))),
+  ],
+  kindHint: "unified",
+  // The window sessions LIVE on this channel, so THIS field is the one that governs a delivery landing while a window turn runs: the turn policy resolves per RECEIVING channel, and without this pin the platform default applies.
+  // That default steers, and a mid-turn wake then CANCELS the running turn while eve rolls history back to the last completed model call, silently discarding the interrupted ask — live-proven by two mentions seconds apart, where the first turn was cancelled and the first question never answered. All six vendor channels pin the queueing policy for their own native sessions, and this pin is the one that covers every unified window and DM seat.
+  turnPolicy: "queue",
+  async receive(input, { from }): Promise<Session> {
+    const t = input.target as Partial<UnifiedReceiveTarget> | undefined;
+    // Structural validation, fail-loud: every field is host-built by the surface dispatch, so a
+    // malformed target is a caller bug (or a receive from something that isn't a surface
+    // dispatch) — refuse rather than mint a mis-keyed session.
+    if (
+      !t ||
+      typeof t.token !== "string" ||
+      !isUnifiedSupervisorToken(t.token) ||
+      typeof t.wakeId !== "string" ||
+      t.wakeId.length === 0 ||
+      typeof t.surfaceKey !== "string" ||
+      (t.authority !== undefined && !isUnifiedWakeAuthority(t.authority)) ||
+      !isUnifiedWakeOrigin(t.origin) ||
+      // The answer decision follows the same fail-loud rule as the rest: it is host-built or absent, never partly-formed. A shape this cannot read would silently degrade to an ordinary wake and swallow the answer, which is the failure class the whole leg exists to remove.
+      (t.answer !== undefined &&
+        (typeof t.answer.requestId !== "string" ||
+          t.answer.requestId.length === 0 ||
+          typeof t.answer.floor !== "string" ||
+          // Same fail-loud rule: the option id is host-built or absent, never partly-formed. An empty
+          // string would reach eve as an option it never offered and resolve the approval `invalid`,
+          // which is the exact failure this field exists to remove.
+          (t.answer.optionId !== undefined && (typeof t.answer.optionId !== "string" || t.answer.optionId.length === 0))))
+    ) {
+      throw new Error("unified receive: malformed target (host dispatch bug) — refusing the wake");
+    }
+    if (!windowEnabledFor(t.surfaceKey, t.token)) {
+      // Defense-in-depth (the surface already checked): the standing-window gate no longer holds
+      // for this container — refuse, so a stale/raced dispatch can't open a shared window the
+      // config doesn't authorize. The surface's waitUntil catch logs the refusal.
+      throw new Error(`unified receive: no standing window is enabled for ${t.surfaceKey} — refusing the wake (fail-closed)`);
+    }
+    // Register the wake's reply target BEFORE the send, so the mapping exists before the model could possibly answer this wake. A store failure here propagates and the wake is NOT delivered: a wake whose reply could never be routed is better re-driven by the platform's webhook retry than answered into a black hole.
+    // The row is stamped with the BARE window token this wake is being DISPATCHED to, already structurally validated above. That stamp is the cross-domain fence the answerable-reply predicate checks, and because THIS is the single registration site it covers every wake class automatically: inbound diverts, task-window opening wakes scoped to the TASK's own token so a worker's pending set never leaks into the standing seat's, completion wakes, and redrive re-registers.
+    const org = deploymentOrg();
+    // 🔴 THE SURFACE KEY RIDES TOO (OPE-1756), and this is the only site that can write it. A
+    // propose site derives its scope from the TURN's ctx, which on a MERGED turn names the LAST
+    // delivery the merge kept rather than the wake that carried the ask — so the card and the halt
+    // address the wrong room. `t.surfaceKey` is the dispatching surface's own fully-qualified key,
+    // structurally validated above and never model-authored, so the addressed-wake road below
+    // (`proposalScopeKey`) can read the ASKING room back out of the wake it was asked under.
+    // The auth-carrying merge is unreachable on eve 0.54.3 — see this module's header — so the
+    // frozen key is still LOAD-BEARING: the fence admits sibling wakes with no merge (OPE-2042).
+    const store = getOperationalStore();
+    const existingAuthority = await resolveUnifiedWakeAuthority(store, org, t.wakeId);
+    // The resolver adds routing fields to its return value; persist only the closed authority
+    // sub-shape. Passing the enriched object back into the strict codec would make a redrive of a
+    // valid row fail because `origin`/`surfaceKey` are deliberately not authority fields.
+    const authority = existingAuthority
+      ? {
+          binding: existingAuthority.binding,
+          requester: existingAuthority.requester,
+          nonMemberWake: existingAuthority.nonMemberWake,
+        }
+      : t.authority;
+    await registerUnifiedWakeTarget(store, org, t.wakeId, t.origin, new Date().toISOString(), t.token, t.inbound === true, t.addressing, t.surfaceKey, authority?.binding, authority);
+    ulog(`wake ${t.wakeId} from ${t.surfaceKey} → ${t.token} (origin ${t.origin.platform})`);
+    // GENERATION RETIREMENT (OPE-627). A rotation elsewhere in this process noted the OUTGOING generation's token; THIS is the only place that can retire it, because `from` binds a `unified`-local address and every window and DM seat lives on this channel. Retiring it runs eve's own child reaper over the workers that generation parked.
+    // Placed BEFORE the two delivery branches so the answer leg's early return cannot skip it, and BEFORE the send so the retirement does not depend on a delivery that may throw. It never throws and it never touches the incoming generation — channels/generation-retirement.ts holds the guards.
+    await drainGenerationRetirements(from, { org, incomingToken: t.token }, { labelsFor: auditLabels });
+    // THE ANSWER LEG. `respond` is the ONLY primitive that reaches a delegated worker: eve routes an answer to a child solely through response entries whose request id is in the parent session's proxy map, and a plain send falls to the PARENT every time. So this branch is the whole return leg; everything else was already here. THE ANSWER TEXT IS THE RENDERED WAKE, deliberately — byte-exactly what eve consumed as the answer before this branch existed — so what changed is WHERE the message is addressed, not what the model reads, and it keeps the envelope's provenance fence around the human's words, which a stripped body would lose. The residual is stated rather than hidden: the child also sees a `wake-id` it must never answer, and it cannot, because a subagent child has no wake identity at all and its `reply` refuses.
+    // NEVER DROP A MESSAGE: a `respond` that throws — a dead address, an empty batch — falls through to the ordinary send with the row LEFT IN PLACE, so the room is still heard and the question is still answerable, and both outcomes are audited. TEXT ONLY: an answer is a string, while a channel delivery may be structured content. Every OE divert renders a string today, so the non-string arm is unreachable — it is written as an AUDITED fall-through rather than a cast, because a future attachment-carrying wake must degrade to an ordinary message and never be flattened into an answer.
+    const answerText = typeof input.message === "string" ? input.message : undefined;
+    if (t.answer) {
+      const bare = bareTokenFromEveContext(t.token) ?? t.token;
+      const answerDetail = {
+        requestId: t.answer.requestId,
+        floor: t.answer.floor,
+        wakeId: t.wakeId,
+        chars: answerText?.length ?? 0,
+        // The ROOM the answer came from. These two rows are partitioned like every other row this channel writes, on the window's own domain, while the REFUSAL row is partitioned on the answering surface by the admission itself.
+        // Carrying the surface key in the detail is what lets an operator join the three.
+        surfaceKey: t.surfaceKey,
+        ...(t.answer.taskId !== undefined ? { taskId: t.answer.taskId } : {}),
+        // WHICH OPTION SETTLED IT — an eve-minted enum (`approve` / `cancel`), never human prose, so
+        // it obeys the redaction rule the answer TEXT does not. It is the only durable trace that an
+        // approval was settled through this leg rather than merely delivered.
+        ...(t.answer.optionId !== undefined ? { optionId: t.answer.optionId } : {}),
+      };
+      const { workspace: answerWorkspace, surface: answerSurface } = auditLabels(t.token);
+      try {
+        if (answerText === undefined) throw new Error("the delivery is structured content, not text — an answer must be text");
+        // 🔴 THE OPTION ID RIDES THE ANSWER (OPE-1056). eve's `inputResponseSchema` is
+        // `{optionId?, requestId, text?}`, and `harness/input-request-resolution.js`
+        // `resolveApprovalOutcome` reads `optionId` ALONE: `approve` approves, `cancel`/`deny`
+        // denies, and an ABSENT one answers `{approved:false, status:"invalid"}`. Sending only
+        // `text` therefore made every bridged approval unapprovable — the room's "Approve" denied
+        // the tool call. The TEXT still rides beside it, unchanged, because a question's answer IS
+        // the text and an approval's transcript should still carry what the human actually wrote.
+        const session = await from(t.token).respond([{ requestId: t.answer.requestId, text: answerText, ...(t.answer.optionId ? { optionId: t.answer.optionId } : {}) }], {
+          auth: input.auth,
+          // The side-channel context rides the answer for the same reason it rides the send: a
+          // surface that ships context (GitHub's issue-title line) must not lose it because the
+          // message happened to resolve a question.
+          ...(t.context && t.context.length > 0 ? { context: [...t.context] } : {}),
+        });
+        // CONSUME-ONCE, and only after eve accepted the delivery: the row is what makes the NEXT
+        // message an ordinary wake again.
+        await forgetBridgedQuestion(getOperationalStore(), org, bare);
+        // …and the wake it rode is settled, because the seat will never see it (OPE-2116).
+        await settleAnsweredWake(getOperationalStore(), org, t.wakeId);
+        ulog(`answer ${t.answer.requestId} delivered to ${t.token} (floor ${t.answer.floor})`);
+        // Ids/enums/counts only — the answer TEXT is human prose and is never audited, the same
+        // redaction rule the question side states.
+        await appendAudit({
+          org,
+          platform: "unified",
+          workspace: answerWorkspace,
+          surface: answerSurface,
+          action: QUESTION_ANSWERED_AUDIT_ACTION,
+          detail: answerDetail,
+        }).catch(() => undefined);
+        return session;
+      } catch (err) {
+        // 🔴 A RATE-LIMITED ANSWER IS NOT A DROPPED ANSWER (OPE-1871). This hook re-runs on every
+        // attempt of the dispatch retry above it, so a 429 caught here would write one
+        // `question_answer_dropped` row PER ATTEMPT — each claiming "the question stays open" — for
+        // an answer the next attempt then delivers. Rethrow instead: the refusal belongs to the ONE
+        // retry loop that owns it, which either delivers this answer or ends in a named failure.
+        if (isRateLimitThrow(err)) throw err;
+        const error = (err instanceof Error ? err.message : String(err)).slice(0, 300);
+        console.warn(`[open-everywhere:unified] answer ${t.answer.requestId} could NOT be delivered (${error}) — falling back to an ordinary wake, the question stays open`);
+        await appendAudit({
+          org,
+          platform: "unified",
+          workspace: answerWorkspace,
+          surface: answerSurface,
+          action: QUESTION_ANSWER_DROPPED_AUDIT_ACTION,
+          detail: { ...answerDetail, error },
+        }).catch(() => undefined);
+      }
+    }
+    // The channel-local continuation address binds at `from(...)` time, and the per-send options carry the auth snapshot and the channel `context` strings. Same durable dispatch underneath — same token, same session.
+    return from(t.token).send(input.message, {
+      auth: completeWakeAuth(input.auth),
+      ...(t.context && t.context.length > 0 ? { context: [...t.context] } : {}),
+    });
+  },
+  events: {
+    // MESSAGE-TOOL-ONLY, unconditional. On this channel the `reply` tool is ALWAYS armed, so a turn's terminal prose is NEVER a reply: a judge that wants to speak calls `reply` with the wake-id it answers. Terminal prose is dropped and AUDITED, and judged silence is audited too.
+    // This is also what makes coalesced cross-surface turns safe: there is no "post the completion somewhere" fallback whose somewhere could be the wrong surface.
+    async "message.completed"(data, channel, ctx) {
+      const sessionId = ctx?.session?.id; // stamped into the terminal audit rows → joins to the transcript
+      const action = finalMessageActionForTurn(data.finishReason, data.message);
+      if (action.kind === "buffer-tool-status") return;
+      // TURN-ID KEYED (OPE-805): consumeRepliedThisTurn only answers true for THIS turn's own mark —
+      // see reply-signal.ts's header for why a bare read-and-reset let a stale mark answer a LATER
+      // turn's read when this turn's own consuming call never ran.
+      const replied = consumeRepliedThisTurn(currentTurnId({ session: ctx.session } as unknown as BindableContext));
+      const org = deploymentOrg();
+      const { workspace, surface } = auditLabels(channel.continuation?.token);
+      // Measurement only — see {@link auditUnaccountedWakesForTurn}. It runs on every action kind reaching this line, before the branches below decide what THIS turn's own wake does.
+      // 🔴 NOT the only call site: the turn-lifecycle hook covers the buffer early return just above, where this line is never reached at all.
+      const accountingBind = { session: ctx.session } as unknown as BindableContext;
+      // ONE read of the react signal per turn: it is read-and-reset, and TWO readers need the answer — the accounting pass, and the bare-stop detector in the silent branch.
+      // A second consuming call always reads false, which would report a turn that reacted as a bare stop.
+      const reacted = consumeReactedThisTurn();
+      await auditUnaccountedWakesForTurn(
+        org,
+        workspace,
+        surface,
+        bareTokenFromEveContext(channel.continuation?.token),
+        currentTurnId(accountingBind),
+        currentWakeId(accountingBind),
+        reacted,
+      ).catch(() => undefined);
+      if (action.kind === "silent") {
+        // Silent turn, routed GENERICALLY through the post arm: a provider whose surface keeps a session OPEN across the divert must still COMPLETE it on a SILENT turn, or it hangs on a spinner forever. Only Linear has one today, and THE MODEL'S PROSE NEVER POSTS on either side of this branch — what the arm renders is the ARM's own decision, and Linear's is a FIXED HOST ack, because it has no activity that terminates a session invisibly. Every non-Linear silent turn is unchanged: no arm means a no-op, nothing posted and the audit detail untouched, and an ambient origin with no open session is a no-op too.
+        // 🔴 A WAKE THIS TURN ANSWERED IS NOT SILENT. The action kind reads the model's FINAL MESSAGE, and the taught discipline is to post through the `reply` tool and then end with `no_reply` — so the ordinary, correct shape of a turn that spoke arrives here as "silent". Closing the session then is wrong twice over: it contradicts a post that already happened, and where the post was a hand-off it DESTROYS the session the answer still has to go to. Measured live: the seat delegated a Linear mention, posted the hand-off note, ended with `no_reply`, and the grounded answer moments later hit "entity not found", leaving the member only the hand-off note. KEYED ON THE WAKE, NOT THE TURN: the turn-wide mark would be the easy read and it is the WRONG one, because a turn that answered a Slack sibling and stayed silent on this Linear mention would stop closing a session nothing is going to answer — a spinner that hangs until the surface times it out. The per-wake record names the wakes `reply` actually posted to, done or not, and it is a NON-consuming read, so it disturbs no other reader. Fail-soft: an unreadable record reads empty and the close runs, the pre-fix behaviour.
+        const bind = { session: ctx.session } as unknown as BindableContext;
+        const wakeId = currentWakeId(bind);
+        const silentTurnId = currentTurnId(bind);
+        const answeredThisWake = wakeId !== undefined && repliedWakesThisTurn(silentTurnId).includes(wakeId);
+        const silentOrigin = !answeredThisWake && wakeId ? await resolveUnifiedWakeTarget(getOperationalStore(), org, wakeId).catch(() => null) : null;
+        // The close still runs; only the LINE it leaves changes. A sibling wake on the SAME container answered this room already, so denying that an answer exists is the contradiction the ack module's own contract forbids.
+        // TWO ARMS, AND THE SECOND CATCHES THE MEASURED SHAPE. The in-turn arm joins this turn's own reply record and is EXACT — it names the sibling wake that was answered — and it is blind by construction to a sibling wake eve ran as its OWN turn, which is what the soak run did. The durable arm asks the ledger whether an answer landed in this container AT OR AFTER this wake arrived, which survives the turn boundary. Ordered cheap-first, so the in-turn arm short-circuits and the extra store reads only happen on a turn that answered nothing here.
+        const answeredVia = silentOrigin ? await answeredContainerVia(org, silentTurnId, wakeId, silentOrigin) : undefined;
+        const answeredContainer = answeredVia !== undefined;
+        let linearClosed: boolean | undefined;
+        if (silentOrigin) {
+          try {
+            // Stamp ONLY when a session was actually closed (a MENTION origin whose arm ran); a
+            // no-arm / ambient origin returns false and leaves the audit detail unchanged.
+            if (await completeUnifiedSessionSilently(silentOrigin, {}, answeredContainer)) {
+              linearClosed = true;
+              ulog(`silent turn: closed the wake's open ${silentOrigin.platform} session without posting model prose (answered elsewhere in this container: ${answeredContainer})`);
+            }
+          } catch (err) {
+            // A failed close leaves the spinner up until the surface times it out — non-fatal, but log
+            // it so a persistent spinner is diagnosable. NOTHING visible was posted (silence held).
+            linearClosed = false;
+            ulog(`silent turn: FAILED to close the open ${silentOrigin.platform} session (spinner may persist until timeout): ${(err instanceof Error ? err.message : String(err)).slice(0, 200)}`);
+          }
+        }
+        // ONE exception: the model ended the turn on the bare no-reply SENTINEL. The TOOL route already carries an always-on observed row, which fires on this window too, so only the SENTINEL route was missing an unconditional trace — this is that route's twin, with the same action name, the same route detail and the same best-effort posture.
+        // `surface` falls back to "unknown" the same way `workspace` already does, because an audit row is worth more than the label it is missing. The wake id rides along too: this is a STANDING window, so many turns share one session id, and the wake id is what tells them apart.
+        if (action.reason === NO_REPLY_SENTINEL_REASON) {
+          await auditNoReplySentinelObserved({ org, platform: "unified", workspace, surface: surface ?? "unknown" }, sessionId, wakeId).catch(() => undefined);
+        }
+        // 🔴 BARE STOP — THE SECOND ALWAYS-ON EXCEPTION. The turn woke, ended with an EMPTY final message, and did nothing: no reply, no react, no `no_reply`, no sentinel. Nothing explains the silence, so it is an ANOMALY — a judgement that went missing — and not a judged silence, which is why the silences gate below must not hide it. Same reasoning, same action name and the same detect-and-log posture as the native Slack channel's own bare-stop arm; nothing is posted, and silence stays silence.
+        // THE HOLE THIS CLOSES, MEASURED: the bare-stop row had ONE producer, the NATIVE channel — a road no shipped domain travels, because every shipped surface windows. On this window a bare stop wrote NO row at all on prod's actions-only posture: an edit woke the seat, the wake row was registered a second later, the turn ran to completion and left an observation row on its own delivery, and the run left no reply row, no silence row and no failure row. The wake was never dropped; the TURN was, invisibly.
+        if (isBareStop(action, replied || reacted)) {
+          ulog(
+            `BARE STOP — turn ended with no reply, no react and no no_reply (wake ${wakeId ?? "none"}) — ` +
+              `this usually means a judgement went missing, not that one was made.`,
+          );
+          await appendAudit({
+            org,
+            platform: "unified",
+            workspace,
+            surface,
+            action: "turn.bare_stop",
+            detail: { wakeId: wakeId ?? null, ...(sessionId ? { sessionId } : {}) },
+          }).catch(() => undefined);
+        }
+        // ACTIONS-ONLY: the judged-silence row is GATED behind the silences flag, default OFF, so prod is actions-only. The session COMPLETION above runs UNCONDITIONALLY — it is real work, a terminal activity on an open agent session, and not a silence record — so only the audit write is gated.
+        // The eval targets set the flag and score abstention from this exact row. The sentinel route's minimal row above is the one exception, matching every other surface.
+        if (auditSilencesEnabled()) {
+          await appendAudit({
+            org,
+            platform: "unified",
+            workspace,
+            surface,
+            action: "unified.no_reply",
+            // `answeredContainer` rides ALONGSIDE `linearClosed`, and only when a session was actually closed: together they say WHICH fixed host line the member read, and it is absent on every turn that closed nothing.
+            // `answeredVia` names WHICH arm decided it, and rides only when one did — a false reading is one fact, but a true reading from the durable ledger and a true reading from this turn's own reply record are different findings, and the run that reopened this ticket was undiagnosable precisely because the row could not tell them apart.
+            detail: { reason: action.reason, replied, wakeId: wakeId ?? null, ...(linearClosed !== undefined ? { linearClosed, answeredContainer, ...(answeredVia ? { answeredVia } : {}) } : {}), ...(sessionId ? { sessionId } : {}) },
+          }).catch(() => undefined);
+        }
+        return;
+      }
+      // Terminal prose is structurally DROPPED by message-tool-only, on EVERY addressing. There is no second door. The ADDRESSED-MENTION PROSE BRIDGE, which used to deliver a direct mention's closing prose to that turn's wake, is DELETED (OPE-1982 — Tommy ruled on 2026-09-20 that the agent always answers through the `reply` tool). A direct-mention turn that ends in prose with no reply call therefore takes the SAME path an unaddressed turn takes: this drop row, then ONE corrective redrive that tells the seat to answer through the tool. One code path for every addressing, and every `reply.post` this deployment writes is a tool call the model made.
+      // 🔴 AND ON A LINEAR @MENTION WINDOW IT COSTS AN OPEN AGENT SESSION, WHICH THIS HANDLER NOW ENDS (OPE-2000). A Linear @MENTION wake holds an OPEN agent session (an AMBIENT Linear origin holds none), and only a `response` Agent Activity ends it. `completeUnifiedSessionSilently` has TWO callers: the silence arm above, and the FINAL PROSE DROP arm at the end of this handler. A prose ending keeps the session open exactly as long as an answer may still arrive — the corrective re-drive's `reply` with `done: true`, or the `thought` a `done: false` correction posts (`linear-post-arm.ts` `activityTypeFor`) when a worker still owes the wake — and once the correction cannot fire, the close arm below leaves the arm's own fixed host line instead of a spinner that hangs until Linear ages the session out.
+      // 🔴 WHAT THE DELETION COSTS, stated rather than hidden. A bridged answer used to reach the room whatever the model did next. Now it reaches the room only when the re-driven turn calls `reply`, and a second prose-only ending is audited silence — the loop guard on the redrive below caps the correction at one. Measured share before the deletion (board #225, 08:50–12:00Z): 5 bridged posts against 183 tool posts, 2.7%. The signal that would falsify the trade is a board where `turn.supervisor_prose_dropped` on `addressing=direct-mention` wakes outruns the `reply.post` rows that follow the redrive.
+      const bind = { session: ctx.session } as unknown as BindableContext;
+      // The host refusals this turn already drew on THIS wake. Nothing delivers here any more, so they stop no post; what they still do is NAME the withholding — an owed answer the host refused is a different event from an ambient drop, and the reason is the only thing that tells them apart — and SUPPRESS the redrive below, because correcting a turn towards the tool the host just refused is the host contradicting itself.
+      const blockingRefusal = proseBlockingRefusal(refusalsForWakeThisTurn(currentTurnId(bind), currentWakeId(bind)));
+      // Did the closing text carry an ANSWER, or a stub a reader gets nothing out of? `replyCarriesSubstance` is the shared floor (`channels/reply-post.ts`). Here it only LABELS the drop row, so an addressed turn that trailed off on `...` stays countable apart from one that wrote a real answer nobody received.
+      const proseCarriesSubstance = replyCarriesSubstance(action.text);
+      // Structurally dropped. `replied` distinguishes narration after a real reply-tool post, which is benign and common, from prose with no reply at all, which is the leak the gate exists to stop. Both drop, and the audit row says which.
+      // The row fires for every drop on this channel, and it carries WHICH addressing kind was dropped, so a reader can tell a genuinely ambient drop from an addressed one — the distinction the deleted bridge used to make by acting on it, and the only one left now that both take this path. See {@link ambientProseDropDetail} for what the two fields mean and why. A drop a HOST REFUSAL withheld arrives here too, and it is a different event from an ambient drop — the answer was owed, the host refused it, and the reason it refused is the only thing that tells the two apart — so it rides the same row under the same reason key, never a new row family. Ids, enums and counts only, never the prose text, which may hold the undelivered answer.
+      const { addressing: addressingKind, reason: dropReason } = ambientProseDropDetail(
+        currentTurnAddressing(bind),
+        currentTurnAddressed(bind),
+        replied,
+        blockingRefusal,
+        proseCarriesSubstance,
+      );
+      ulog(`message-tool-only: DROPPED terminal prose (${action.text.length} chars; replied=${replied}; addressing=${addressingKind}; reason=${dropReason}) — replies must come from the reply tool`);
+      await appendAudit({
+        org,
+        platform: "unified",
+        workspace,
+        surface,
+        action: "turn.supervisor_prose_dropped",
+        detail: {
+          chars: action.text.length,
+          replied,
+          addressing: addressingKind,
+          reason: dropReason,
+          wakeId: currentWakeId(bind) ?? null,
+          ...(sessionId ? { sessionId } : {}),
+        },
+      }).catch(() => undefined);
+
+      // AUTO-REDRIVE THE REAL DROP, ON EVERY ADDRESSING: a drop with no reply reached no one, so a corrective SYSTEM wake is re-injected into THIS session for one more turn to deliver through the reply tool. It is the ONLY correction now — a direct mention has no bridge to fall back on — and it fires at most once per wake, so a second prose-only ending is audited silence. Three gates stand here — no reply, because benign narration after a real reply is not a drop; no blocking refusal; and a present continuation token, because that is the address the corrective wake is re-delivered TO. The redrive itself re-checks the reply mark and adds the origin resolve, the loop guard and the fail-soft-on-no-dispatch arm, and the corrective wake carries the ORIGINAL wake's id and origin, so a reply lands in the ORIGINAL conversation.
+      // 🔴 THE TOKEN CANNOT FAIL SOFT: an absent one would build a malformed dispatch, a wake to nowhere, which is a brand-new mis-keyed session — so the redrive is SKIPPED instead and the drop stays a final audited drop, exactly the fail-soft arm the redrive already has for "no dispatch path available". 🔴 AND A REFUSAL-WITHHELD DROP IS NOT REDRIVEN: the corrective wake tells the model to deliver this answer through the reply tool, which on a turn the host just refused is the host contradicting itself one turn later, when the refusal message it already read named the move it should make instead. That drop is the refusal taking effect, not a delivery failure to correct.
+      // Did the ONE correction actually go out? It is the whole question the session-close below asks, so it is read from the redrive's own outcome rather than re-derived: a turn whose correction fired still has a turn coming that can answer this wake, and closing the session under it would cut that answer off.
+      let redriven = false;
+      if (!replied && blockingRefusal === undefined && channel.continuation?.token !== undefined) {
+        const wakeId = currentWakeId(bind);
+        const rawToken = channel.continuation.token;
+        const domain = unifiedDomainFromToken(rawToken);
+        // The original delivery's auth attributes ride through (identity binding routes the redriven
+        // turn to the right domain), with any oe_addressing STRIPPED: the correction is a machine notice
+        // about the model's own output, not a person addressing the agent, so it must not claim an
+        // address it does not have. The one-shot loop guard, not the addressing, is what caps the
+        // correction at one.
+        const baseAttrs: Record<string, unknown> = { ...(bind.session?.auth?.current?.attributes ?? {}) };
+        delete baseAttrs[OE_ADDRESSING_ATTR];
+        // Bind the eve-specific re-injection over the best dispatch path — the captured primitive, else the self-dispatch hop, because this handler runs in the WORKFLOW process, where the capture is typically unset.
+        // Null when neither is available, which fail-softs: the redrive is skipped and the drop stays final. A failed delivery throws into the redrive's own failure arm.
+        const reinject: RedriveReinject = buildRedriveReinject(domain, rawToken, baseAttrs);
+        // 🔴 THE CORRECTION NAMES THE MOVE THAT SUCCEEDS. `delegation-pending` is the one refusal
+        // that does NOT withhold a drop, so the nudge fires on a turn whose worker still owes this
+        // wake — and `done` defaults to TRUE on the tool, so a nudge that names no `done` draws the
+        // same refusal a second time and the one correction is spent. The reason ledger this turn
+        // already read is what tells the two apart.
+        const owesWorkerReport = refusalsForWakeThisTurn(currentTurnId(bind), wakeId).includes(DELEGATION_PENDING_REFUSAL_REASON);
+        // 🔴 CARRY BEFORE THE RE-INJECTION, NOT AFTER IT. `maybeRedrive` AWAITS the re-injection, and
+        // on a warm in-process receive the corrective turn can run inside that await. A carry written
+        // afterwards would land after that turn's `reply` had already read an unclaimed ledger and
+        // nulled it — the block lost in exactly the case this exists for. Carrying first has no cost
+        // on the other paths: the `else` arm below drops it again on every outcome but `redriven`.
+        if (wakeId) carryRunRefusalsToRedrive(wakeId);
+        const outcome = await maybeRedrive(
+          { org, workspace, surface, ...(sessionId ? { sessionId } : {}), wakeId, chars: action.text.length, replied, owesWorkerReport },
+          { store: getOperationalStore(), reinject },
+        );
+        if (outcome.status === "redriven") {
+          // THE LEDGER IS NOW THE CORRECTIVE TURN'S (carried above). The deleted bridge posted
+          // `withRunRefusalBlock(prose, consume())` on the fire's OWN turn, so a fire refused a
+          // permission and then narrating still told the room what it could not do. The correction
+          // is a NEW turn and the ledger is turn-keyed, so without the carry it would be dropped
+          // exactly when the fire's report is written. The first `reply` answering this wake
+          // consumes it.
+          ulog(`auto-redrive: re-injected a corrective wake for wake ${outcome.originalWakeId} (dropped ${action.text.length} chars) — one more turn to reply`);
+        } else if (outcome.status !== "skip-replied") {
+          // THE CORRECTION IS EXHAUSTED (a spent loop guard, an unresolved origin, no dispatch
+          // path). Nothing further will answer this wake, so a ledger carried to it on an earlier
+          // drop is dropped rather than left to surface on some later turn that names the same wake.
+          if (wakeId) dropCarriedRunRefusals(wakeId);
+          ulog(`auto-redrive: NOT fired (${outcome.status}) for wake ${outcome.originalWakeId ?? "none"} — drop is final`);
+        }
+        redriven = outcome.status === "redriven";
+      }
+      // 🔴 A FINAL PROSE DROP CLOSES THE WAKE'S OPEN SESSION (OPE-2000). A Linear @MENTION wake holds an OPEN agent session, and only a `response` Agent Activity ends it — Linear has no invisible close, because `stop` is human-to-agent only. The silence arm above already closes such a session; this branch did not, so every prose ending on a Linear-origin window left the member watching a spinner until Linear timed it out. It closes ONLY when nothing is coming: the reply tool posted nothing TO THIS WAKE AND the one corrective re-drive did not fire, which is the same "the correction is exhausted" state the `else` arm above names. A redriven wake keeps its session open on purpose — the corrective turn's `reply` is the answer that session is waiting for.
+      // WHAT IT POSTS: the arm's own FIXED HOST ACK, never the model's dropped text (`completeUnifiedSessionSilently` → `post-arms.ts` `closeUnifiedSilently`), so the ruling this drop enforces is not undone by the close. `answeredContainerVia` picks WHICH fixed line, exactly as the silence arm does: a sibling wake that answered this room already must not be told nobody answered.
+      // GENERIC BY CONSTRUCTION, not a Linear branch: an origin whose arm registers no `closeUnifiedSilently`, and an AMBIENT origin, both return false and post nothing. The ORIGIN decides, never the turn's own platform stamp — a coalesced window can end a turn stamped with a sibling surface, and gating on that stamp would skip the close on exactly the wake that owns the open session. The cost is the same origin read the silence arm above already pays, on the rarer branch.
+      // 🔴 KEYED ON THE WAKE, NOT ON THE TURN, for the reason the silence arm above is (`answeredSameContainerThisTurn`'s own header states it): a turn-wide "did we reply anywhere" read is the easy one and it is WRONG. A coalesced turn that answered a Slack sibling and then ended in prose for a Linear @mention still owes THAT session its ending, and a turn-wide read would skip the close on exactly the wake holding the open session. The re-drive gate above keeps the turn-wide read it has always had — that is its own pre-existing contract, not this ticket's.
+      const dropWakeId = currentWakeId(bind);
+      const answeredThisWake = dropWakeId !== undefined && repliedWakesThisTurn(currentTurnId(bind)).includes(dropWakeId);
+      if (proseDropClosesWakeSession(answeredThisWake, redriven)) {
+        // Fail-soft in every direction, like the silence arm: an unresolvable origin closes nothing
+        // and a failed close leaves the spinner up until the surface times it out. Neither is worth
+        // failing a turn whose prose was already dropped and audited.
+        const dropOrigin = dropWakeId ? await resolveUnifiedWakeTarget(getOperationalStore(), org, dropWakeId).catch(() => null) : null;
+        // THE REGISTRY IS ASKED BEFORE THE `answered` READ, not instead of it: `completeUnifiedSessionSilently` would answer false for an arm with no member anyway, but the read that picks WHICH fixed line costs two more store round trips, and an ordinary ambient drop — the common case on every surface — must not pay them to learn that nothing can be closed.
+        if (dropOrigin && postArm(dropOrigin.platform)?.closeUnifiedSilently) {
+          try {
+            const answered = (await answeredContainerVia(org, currentTurnId(bind), dropWakeId, dropOrigin)) !== undefined;
+            if (await completeUnifiedSessionSilently(dropOrigin, {}, answered)) {
+              ulog(`final prose drop: closed the wake's open ${dropOrigin.platform} session with the host ack (answered elsewhere in this container: ${answered})`);
+            }
+          } catch (err) {
+            ulog(`final prose drop: FAILED to close the open ${dropOrigin.platform} session (spinner may persist until timeout): ${(err instanceof Error ? err.message : String(err)).slice(0, 200)}`);
+          }
+        }
+      }
+    },
+    // THE QUESTION BRIDGE. `ask_question` on this channel used to be a DEAD AFFORDANCE: eve emits the request, the harness parks the session, and until this handler existed nothing carried the prompt to a surface — no post, no row, no log line. The room saw silence, and its NEXT message was silently eaten as the unseen question's answer. Worse, two shipped prompts steer the model here on injection-shaped content, so the highest-stakes turns were the ones that went quiet. The bridge posts the prompt to THIS turn's wake through the exact route the `reply` tool resolves, and writes no reply row, because a question is not an answer: the wake stays unanswered and the reply tool can still answer it.
+    // 🔴 AND IT REMEMBERS, ONLY ON A POSTED QUESTION. The row keyed by this window's token is what turns the room's next message into a response addressed to the request id — the return leg a DELEGATED WORKER's question has no other way to reach, because eve's implicit "the next message is the answer" only ever served a question the window session raised itself, and a proxied child's answer falls to the parent unless a request id addresses it. A DROPPED question writes nothing: nobody was shown anything, so nothing may be consumed as its answer. eve's session-limit PARK is NOT ours and flows on untouched to the park hook, which retires the generation; both sides read the ONE predicate, so neither can claim the other's request.
+    async "input.requested"(data, channel, ctx) {
+      try {
+        const question = detectBridgeableInputRequest((data as { requests?: unknown } | undefined)?.requests);
+        if (!question) return; // eve's token-limit park (or an unrecognisable batch) — not ours.
+        const org = deploymentOrg();
+        const { workspace, surface } = auditLabels(channel.continuation?.token);
+        const bind = { session: ctx?.session } as unknown as BindableContext;
+        const wakeId = currentWakeId(bind);
+        const sessionId = typeof ctx?.session?.id === "string" && ctx.session.id.length > 0 ? ctx.session.id : undefined;
+        // THE BARE WINDOW TOKEN, hoisted above the post (OPE-1720). It keys the outstanding-question
+        // row below, and the card's click ticket has to be written BEFORE the card is visible — a row
+        // written after the post is a row a fast tap can miss. eve reports the token NAMESPACED with
+        // the channel name (`unified:oe-dom:…`), so strip it the same way every other reader does.
+        const bare = bareTokenFromEveContext(channel.continuation?.token);
+        // ONE ticket per posted card, minted before the post and written by it. An approval this host
+        // renders no buttons for yields NO actions and the post stays exactly what it was — text.
+        const cardTicket = mintApprovalCardTicket();
+        let cardActionCount = 0;
+        const outcome = await bridgeQuestionToSurface(
+          { org, platform: "unified", workspace, surface, ...(sessionId ? { sessionId } : {}), ...(wakeId ? { wakeId } : {}) },
+          question,
+          {
+            resolveOrigin: async () => (wakeId ? await resolveUnifiedWakeTarget(getOperationalStore(), org, wakeId).catch(() => null) : null),
+            // No audit struct ⇒ no `reply.post` row, the same call windowSpendGate's refusal makes.
+            post: async (origin, text) => {
+              // 🔴 THE CARD IS ONLY POSTED WHERE THE TAP CAN LAND. Three conditions, each of which
+              // degrades to the TEXT post rather than to a half-built card: the arm must declare the
+              // unified component plane (`canPostUnifiedActions` — the registry's own "presence is
+              // the declaration"), the question must yield host-labelled buttons at all
+              // (`approvalCardActions` is empty for every non-approval and for an eve vocabulary this
+              // host has no label for), and the click ticket must actually be stored. A button whose
+              // ticket was never written settles nothing, so the last one is what keeps a store blip
+              // from putting a dead Approve button on a governed connector write.
+              // 🔴 FOUR CONDITIONS NOW, and the fourth is the tap's own ADDRESS (OPE-1863): the
+              // answer is delivered by durable session id, because a continuation token is
+              // channel-local and the tap lands on the surface's route rather than on this channel's
+              // (see `approval-card.ts` `approvalCardRespondVia`). A turn whose session id this
+              // handler cannot read is a card nothing could settle, so it degrades to TEXT.
+              const actions = canPostUnifiedActions(origin.platform) ? approvalCardActions(question, cardTicket) : [];
+              // LOUD on the one condition no offline tier can drive: the session id is read off the
+              // live turn context, so a card that degrades for want of it degrades in silence unless
+              // this line says so. The same value is already stamped on the `turn.question_bridged`
+              // row, which is where an operator confirms it on a real host.
+              if (actions.length > 0 && sessionId === undefined) {
+                console.warn(`[open-everywhere:unified] question bridge: the turn names no session id — posting ${question.toolName} as TEXT, because a tap would have nowhere to deliver`);
+              }
+              if (actions.length === 0 || bare === undefined || sessionId === undefined) return postUnifiedReply(origin, text);
+              let cardContainerKey: string | undefined;
+              try {
+                cardContainerKey = unifiedThreadRef(origin).channelKey;
+              } catch {
+                cardContainerKey = undefined;
+              }
+              const stored = await rememberApprovalCardTicket(getOperationalStore(), org, cardTicket, {
+                sessionId,
+                bareToken: bare,
+                ...(cardContainerKey ? { containerKey: cardContainerKey } : {}),
+                requestId: question.requestId,
+                optionIds: approvalOptionIds(question),
+              });
+              if (!stored) return postUnifiedReply(origin, text);
+              cardActionCount = actions.length;
+              return postUnifiedReply(origin, text, {}, undefined, undefined, undefined, actions);
+            },
+          },
+        );
+        if (outcome.status === "bridged") {
+          // WHICH ROOM MAY ANSWER, derived from the origin the post actually used, so the stored key and the posted room cannot disagree. A window token spans every room on the domain, so without this the next message anywhere would be eaten as the answer.
+          // A derivation that throws leaves the key ABSENT, and an absent key never answers: the question stays open rather than being answered by a guess.
+          let containerKey: string | undefined;
+          try {
+            containerKey = unifiedThreadRef(outcome.origin).channelKey;
+          } catch {
+            containerKey = undefined;
+          }
+          const remembered =
+            bare === undefined
+              ? false
+              : await rememberBridgedQuestion(getOperationalStore(), org, bare, {
+                  requestId: question.requestId,
+                  ...(containerKey ? { containerKey } : {}),
+                  ...(wakeId ? { wakeId } : {}),
+                  // AN APPROVAL'S OPTION IDS, and nothing for any other kind. The room answers with
+                  // a word; eve settles on an id; this row is the only place the two can be joined,
+                  // because the parked request itself is not readable from the answering wake.
+                  optionIds: approvalOptionIds(question),
+                });
+          ulog(
+            `question bridge: posted ${question.toolName} (${question.kind}) to ${outcome.platform} for wake ${wakeId ?? "none"} — id ${outcome.id}` +
+              (cardActionCount > 0 ? ` (card: ${cardActionCount} button(s))` : " (text only)") +
+              (remembered && containerKey
+                ? ` (answerable from ${containerKey}: ${question.requestId})`
+                : " (NOT answerable — no outstanding-question row, or no room to bind it to)"),
+          );
+        } else {
+          // LOUD: the turn is parked on a question nobody can see, which is the pre-fix failure —
+          // the difference now is that it is a row and a line rather than silence.
+          console.warn(
+            `[open-everywhere:unified] question bridge: DROPPED ${question.toolName} (${outcome.reason}) for wake ${wakeId ?? "none"} — the session is parked on a question the room cannot see (audited)`,
+          );
+        }
+      } catch (err) {
+        // The turn has already parked; a throw here would only break the event dispatch on top of it.
+        console.warn(`[open-everywhere:unified] question bridge skipped: ${String(err)}`);
+      }
+    },
+    // A failed judge turn must not spam ANY surface (there is no error-post arm here by
+    // construction) — audit + log, reserved posture, same as the per-surface supervisors.
+    async "turn.failed"(data, channel) {
+      const { workspace, surface } = auditLabels(channel.continuation?.token);
+      ulog(`supervisor turn failed on domain ${workspace} (audited, nothing posted): ${data.message}`);
+      await appendAudit({
+        org: deploymentOrg(),
+        platform: "unified",
+        workspace,
+        surface,
+        action: "unified.supervisor_turn_failed",
+        detail: {
+          message: String(data.message).slice(0, 500),
+          ...failureDiag(data.code, data.details),
+          ...unresumableAuditDetail(data.message, data.code),
+        },
+      }).catch(() => undefined);
+    },
+    async "session.failed"(data, channel) {
+      const { workspace, surface } = auditLabels(channel.continuation?.token);
+      ulog(`supervisor session failed on domain ${workspace} (audited, nothing posted): ${data.message}`);
+      await appendAudit({
+        org: deploymentOrg(),
+        platform: "unified",
+        workspace,
+        surface,
+        action: "unified.supervisor_session_failed",
+        // `unresumable` names the one failure class a retry can never fix — a session whose stamped spec version the current runtime cannot read.
+        // It is a LABEL, not a remedy: the measured mismatch never reaches this handler at all, so nothing here rotates, and the row exists so the class is nameable if it ever arrives.
+        detail: {
+          message: String(data.message).slice(0, 500),
+          ...failureDiag(data.code, data.details),
+          ...unresumableAuditDetail(data.message, data.code),
+        },
+      }).catch(() => undefined);
+    },
+  },
+});
+
+export default channel;
+
+/**
+ * The ONE diversion helper every surface's single-window wiring calls: stamp the origin platform and wake id into the forwarded auth, which is what the binding's unified hop resolves per-delivery identity from, assemble the typed receive target, and hand the wake to eve's cross-channel send pointing at THIS channel.
+ * That hop is what makes the effective token a unified one, and thereby ONE context window across providers. Shared so the surfaces cannot drift, and so the deterministic proof exercises the REAL wiring with a capture.
+ */
+export async function divertToUnifiedWindow(
+  receive: RouteHandlerArgs["to"],
+  input: {
+    readonly message: string;
+    readonly context?: readonly string[];
+    /** The RAW unified-supervisor token (eve prefixes `unified:` on the target channel's send). */
+    readonly token: string;
+    readonly window: UnifiedWindowWake;
+    readonly surfaceKey: string;
+    /** The surface's own wake auth — forwarded verbatim plus the two window stamps. */
+    readonly auth: { attributes?: Record<string, unknown> };
+    /** Exact host-frozen authority for a continuation whose delivery has no platform identity of
+     * its own. Ordinary ingress omits this and derives the binding from its verified auth. */
+    readonly binding?: SurfaceBinding;
+    /**
+     * This wake is an INTERNAL host dispatch and not an attended arrival from a human — a task spawn, a completion wake, the auto-redrive, an approval-decision wake, a routine fire. It skips the attended spend gate; see {@link windowSpendGate} for why refusing one would starve a caller, or break the silent-routine carve-out, rather than prevent a spend.
+     * The flag is opt-OUT, so a forgotten ingress fails CLOSED and is gated. Host-set at the dispatch site, never model-authored, and never carried on a payload the model can shape.
+     */
+    readonly internalDispatch?: true;
+  },
+): Promise<void> {
+  // THE INGRESS RECEIPT INSTANT (OPE-1716) — read on the FIRST line, before the gates, the store
+  // reads and the dispatch, so the number means "when this deployment took the wake" and not "when
+  // it finished deciding about it". The row that carries it is written below, after admission.
+  const ingressMs = Date.now();
+  // PROVIDER-SELECTION admission. This is the ONE cross-surface ingress every provider front door funnels through, and the origin platform is the only thing a wake carries that names a provider — so it is where a deployment that did NOT select a provider refuses that provider's inbound traffic, audibly.
+  // Structurally the case should be unreachable, because an unselected bundle has no route at all, but a stored origin, a stale webhook still pointed at a de-selected surface, or a half-pruned fork can all still land here — and a wake delivered for a platform whose registries were all refused would sit in a window it can never reply from, so dropping it AUDITED is the honest outcome. An undeclared selection admits everything, so library mode and tests are unaffected.
+  if (!admitInboundSurface(input.window.origin.platform)) {
+    ulog(`REFUSED inbound wake from unselected provider "${input.window.origin.platform}" (audited, not delivered)`);
+    await appendAudit({
+      org: deploymentOrg(),
+      platform: input.window.origin.platform,
+      workspace: parseWindowToken(input.token.startsWith("unified:") ? input.token.slice("unified:".length) : input.token)?.domain ?? "unknown",
+      surface: input.surfaceKey,
+      action: "provider.unselected_wake_refused",
+      detail: { wakeId: input.window.wakeId, selected: [...(providerSelection() ?? [])] },
+    }).catch(() => undefined);
+    return;
+  }
+  if (input.binding !== undefined) {
+    if (
+      !isFrozenSurfaceBinding(input.binding) ||
+      input.binding.org !== deploymentOrg() ||
+      !wakeBindingMatchesSurfaceKey(input.binding, input.surfaceKey) ||
+      !wakeBindingMatchesOrigin(input.binding, input.window.origin)
+    ) {
+      throw new Error("unified continuation binding does not match its durable origin");
+    }
+  }
+  // SPEND GATE (attended arrivals only — see {@link windowSpendGate}). Placed BEFORE the dispatch
+  // capture, the wake-target registration and the F1 recovery read, so a declined wake costs
+  // nothing beyond the check itself and leaves no map row behind: it is a wake that never happened.
+  if (input.internalDispatch !== true && (await windowSpendGate(input)) === "declined") {
+    ulog(`DECLINED single-window wake ${input.window.wakeId} from ${input.surfaceKey} — over its spend cap (refusal posted, no model turn)`);
+    return;
+  }
+  // Capture this live cross-channel `to` so the completion handler (which eve hands no dispatch
+  // primitive) can fire the auto-redrive from the same process. See rememberUnifiedReceive's note.
+  rememberUnifiedReceive(receive);
+  const sources = windowSourcesForDivert(input.token, input.window.origin.platform);
+  // The BARE dispatched-to token for the window-token stamp — the input is documented RAW, and the prefix is stripped defensively. It is the per-delivery FALLBACK identity channel for a resumed seat whose session-static continuation token is blank at tool-execute time.
+  // Truthful by construction: this IS the token being dispatched to — an owner divert passes the route's token, a task dispatch the task token, never a stale default.
+  const bareToken = input.token.startsWith("unified:") ? input.token.slice("unified:".length) : input.token;
+  // THE ORIGIN'S REPLY ANCHOR — where inside its conversation a post for this wake hangs — rides the
+  // delivery as oe_reply_anchor, so a binding can thread approval cards / post_file / notices under
+  // the message that woke the seat: the native adapter's thread_ts semantic the raw-event auth does
+  // not carry (OE_REPLY_ANCHOR_ATTR).
+  // 🔴 ASKED OF THE CODEC, NEVER OF A PLATFORM NAME (OPE-1826). This line read
+  // `origin.platform === "slack" ? origin.replyAnchorTs : undefined`, which is the whole of the
+  // "the anchor codec is Slack-only" defect in one expression: a second surface with a placement
+  // outside its conversation identity had nowhere to say so, and adding one meant editing core. Each
+  // codec now declares its own placement axis (`placementRef`), and a surface that keeps placement
+  // INSIDE its thread key declares nothing and stamps nothing — the same `undefined` as before.
+  // Only Slack's binding READS the stamp today (`slack-identity.ts`); a surface whose binding does
+  // not read it is unaffected by carrying it.
+  const replyAnchor = unifiedPlacementRef(input.window.origin);
+  // A nonce unique to THIS delivery, minted HERE at the one send in the tree, so every wake class gets one — inbound diverts, task-window opening wakes and completion wakes alike.
+  // The REDRIVE is why it matters: it is the one path that re-stamps an EXISTING wake id, so without the nonce it cannot be told apart from "no delivery at all".
+  const deliveryId = mintWakeId();
+  const authorityAttributes: Record<string, unknown> = { ...(input.auth.attributes ?? {}) };
+  // Provider auth never gets to author this host-only stamp. Delete first on every road, then add
+  // only the explicit binding that passed the origin/surface/org checks above.
+  delete authorityAttributes[OE_FROZEN_SURFACE_BINDING_ATTR];
+  if (input.binding !== undefined) authorityAttributes[OE_FROZEN_SURFACE_BINDING_ATTR] = JSON.stringify(input.binding);
+  const authorityAuth = { ...input.auth, attributes: authorityAttributes };
+  const auth = stampUnifiedWindowAuth(authorityAuth, input.window.origin.platform, input.window.wakeId, input.window.addressing, sources, bareToken, replyAnchor, deliveryId);
+  // Snapshot the binding from THIS wake's stamped auth, before the standing seat can accept another
+  // surface. The durable row copies it into delegated task wakes; delayed workers restore it.
+  const bindingContext: BindableContext = { channel: { kind: "unified" }, session: { auth: { current: auth as never } } };
+  const binding = input.binding ?? (carriesPlatformIdentity(bindingContext) ? bindFrom(bindingContext) : undefined);
+  // THE INGRESS ANCHOR (OPE-1716). One row per ADMITTED ATTENDED wake, written here because this is
+  // the one cross-surface ingress every provider front door funnels through — the same property the
+  // provider-selection gate above relies on — and written AFTER both gates, so a refused or declined
+  // wake leaves no row: it is a wake that never happened, and counting it would inflate the measure.
+  // An INTERNAL dispatch writes nothing: it has no vendor behind it, so it has no vendor→ingress
+  // stretch to record, and rowing task spawns and redrives would bury the arrivals this measures.
+  // Best-effort like every other audit call on this path — an observability row must never fail a wake.
+  // 🔴 AWAITED, AND BEFORE THE SEND, both deliberately. Awaited because a row scheduled "for later"
+  // on this platform may never run (the reality hooks/log-flush.ts records), and a measurement row
+  // that is sometimes missing makes the measure unreadable. Before the send because a wake whose
+  // dispatch THROWS is exactly the one an incident reader needs the ingress instant for. The write
+  // therefore costs the delivery one store round trip; `ingressMs` is read before it, so the row's
+  // own number is unaffected, and what the round trip shifts is the turn-start anchor — which lands
+  // in the pre-turn segment, where it is reported rather than judged.
+  // 🔴 THE WHOLE BLOCK IS INSIDE THE TRY, not just the append. The detail is BUILT from clock
+  // readings, and a build that threw inside `appendAudit(...)`'s argument expression would reject
+  // this function before the `.catch` could ever attach — turning an observability row into a lost
+  // message. The readings are bounded at their source too (wake-timing.ts `usable`); this is the
+  // second of the two, because "an observability row must never fail a wake" has to be enforced
+  // here rather than merely stated.
+  try {
+    if (input.internalDispatch !== true) {
+      await appendAudit({
+        org: deploymentOrg(),
+        platform: input.window.origin.platform,
+        workspace: parseWindowToken(bareToken)?.domain ?? "unknown",
+        surface: input.surfaceKey,
+        action: WAKE_INGRESS_ACTION,
+        // The row's `ts` IS the ingress receipt time, stamped from the same instant the detail carries,
+        // so a reader who joins on `ts` and a reader who joins on `ingressTs` get the same answer.
+        ts: new Date(ingressMs).toISOString(),
+        detail: wakeIngressDetail({
+          wakeId: input.window.wakeId,
+          deliveryId,
+          surfaceKey: input.surfaceKey,
+          ...(input.window.vendorTs ? { vendor: input.window.vendorTs } : {}),
+          ingressMs,
+        }),
+      });
+    }
+  } catch {
+    /* observation only — the wake proceeds without its anchor rather than dying with it */
+  }
+  // THE ANSWER DECISION — is this message the answer to a question this window already showed the room? Decided HERE and not in `receive` for one reason: this is the only site that knows an arrival is ATTENDED.
+  // An internal dispatch has no human behind it and must never resolve a question. The verdict rides the target, so nothing on the self-dispatch wire can claim it.
+  const answer = await resolveInboundAnswer(input, bareToken);
+  const target: UnifiedReceiveTarget = {
+    token: input.token,
+    wakeId: input.window.wakeId,
+    origin: input.window.origin,
+    ...(binding
+      ? {
+          authority: {
+            binding,
+            requester: requesterVerdictFor({
+              text: input.message,
+              seat: input.internalDispatch === true ? "worker" : "room",
+              inherited: authString(authorityAttributes[OE_REQUESTER_ATTR]),
+              inheritedCandidates: authString(authorityAttributes[OE_REQUESTER_CANDIDATES_ATTR]),
+            }),
+            nonMemberWake: authString(authorityAttributes[OE_CHAT_NONMEMBER_ATTR]) === "true",
+          },
+        }
+      : {}),
+    ...(answer ? { answer } : {}),
+    surfaceKey: input.surfaceKey,
+    // The same ATTENDED fact the answer decision above turns on, carried to the wake row.
+    inbound: input.internalDispatch !== true,
+    // The accounting audit's addressing signal, carried straight through from the same wake this whole target was built from.
+    ...(input.window.addressing ? { addressing: input.window.addressing } : {}),
+    ...(input.context && input.context.length > 0 ? { context: input.context } : {}),
+  };
+  const message = input.message;
+  const deliveredAuth = auth;
+  // PRUNED-DEPLOYMENT STRAND. This await is the ONE place OE holds a wake-delivery failure: the run key is fetched while eve DISPATCHES the continuation, before any turn is queued, so a seat pinned to a deleted deployment rejects HERE rather than in the unobservable queue-triggered turn.
+  // Classify it and mark the seat for rotation, then rethrow unchanged — the caller's own failure handling is untouched, and a surface that wants THIS message answered re-delivers after the mark. Every other failure passes through unchanged.
+  //
+  // 🔴 A RATE-LIMITED DISPATCH IS RETRIED, NEVER DROPPED (OPE-1871). This send is the ONE dispatch
+  // every WINDOWED wake takes — on all six surfaces — so wrapping it here puts those six on one road
+  // rather than six roads. The road is `channels/rate-limit-retry.ts` — the same bounded backoff the
+  // six provider write seams already use — reached through its thrown-shape adapter, because eve's
+  // queue client turns the 429 into a `TooManyRequestsError` before OE ever sees a response. What was
+  // measured on ship #213: a Slack seat's wake died on `surface.wake_failed {"message":"Too many
+  // requests — please retry later"}` 14 s after its `wake.ingress` row, with no `wake.turn_start` at
+  // all. The member's mention was lost, and nothing retried it.
+  // The NATIVE per-container send a domain takes when `window.topology` is off never reaches this
+  // function. OPE-1881 wraps the seven launch closures in the five native provider modules through
+  // `channels/native-wake-retry.ts`, using this same primitive and policy. Keeping the two funnels
+  // explicit matters: a windowed retry has a wakeId join; a native dispatch truthfully has only its
+  // per-dispatch deliveryId.
+  // EVERY OTHER FAILURE IS UNTOUCHED, on its first attempt: the adapter rethrows anything that is not
+  // a rate-limit refusal, so the pruned-deployment strand below classifies exactly the errors it did
+  // before. A refusal that outlasts the budget arrives there too, as a `RateLimitExhaustedError` —
+  // not this class, so the heal correctly marks nothing, and the surface's own `wake_failed` row then
+  // carries a message naming the attempts and the time waited.
+  try {
+    await withRetryAfterThrown(() => receive(channel, target).send(message, { auth: completeWakeAuth(deliveredAuth) }), {
+      surface: input.window.origin.platform,
+      operation: WAKE_DISPATCH_OPERATION,
+      ...WAKE_DISPATCH_RETRY_POLICY,
+      // ONE ROW PER REFUSAL, awaited before the wait it describes, so a wake that was refused and
+      // then delivered is tellable apart from one that was refused and lost. Best-effort like every
+      // other audit call on this path: an observability row must never fail a wake.
+      onRefusal: (refusal) =>
+        appendAudit({
+          org: deploymentOrg(),
+          platform: input.window.origin.platform,
+          workspace: parseWindowToken(bareToken)?.domain ?? "unknown",
+          surface: input.surfaceKey,
+          action: WAKE_RETRY_ACTION,
+          detail: wakeRetryDetail({
+            wakeId: input.window.wakeId,
+            deliveryId,
+            surfaceKey: input.surfaceKey,
+            attempt: refusal.attempt,
+            delayMs: refusal.delayMs,
+            waitedMs: refusal.waitedMs,
+            outcome: refusal.outcome,
+            refusalStatus: refusal.refusalStatus,
+          }),
+        }).catch(() => undefined),
+    });
+  } catch (err) {
+    await healPrunedDeploymentStrand({
+      token: bareToken,
+      surfaceKey: input.surfaceKey,
+      platform: input.window.origin.platform,
+      atIso: new Date().toISOString(),
+      err,
+    });
+    throw err;
+  }
+}
+
+/**
+ * INBOUND-ingress variant of {@link divertToUnifiedWindow} — the thread-ownership ROUTING leg, whose pure decision lives in thread-ownership.ts. A spawn records a durable ownership row for its thread, and THIS is the read that makes it live: when an inbound surface message lands in a thread OWNED by a live task worker or thread seat, the wake is dispatched to the OWNER session's token instead of the standing seat's — ownership-versus-awareness routing, where the owner ACTS on the message and the standing seat is not woken by it.
+ * 🔴 WHAT THE STANDING SEAT THEN KNOWS, STATED EXACTLY (OPE-1696). The header used to claim the seat "stays ambiently aware through backscroll on its next wake", and that was FALSE when it was written: a standing wake carried no backscroll at all after its first, so an owned thread's replies reached the seat through nothing. Two mechanisms make the claim true now, and neither is universal, so read the bound with the claim: (1) the SINCE-LAST-WAKE CATCH-UP (OPE-1695 (b)) — on a surface whose adapter fetches container history, the seat's next wake reads the room since the seat last looked, THREAD-ENRICHED, so an owned thread's replies do arrive as context; today that is wired on SLACK only, and on every other surface the seat reads nothing between its own wakes. (2) The HAND-BACK REPORT — `complete_thread` stores the thread seat's closing report and wakes the standing seat with it, on every surface. Where neither reaches, `read_thread_seat` is the seat's own way to ask, and that is the documented path rather than an assumed awareness. Everything else about the delivery is UNCHANGED: same message, same wake registration so the owner's `reply` resolves the same conversation, same surface re-check, same addressing, so a mention in an owned thread keeps its owed-reply treatment. WHO CALLS THIS: a surface's INBOUND single-window divert only. The INTERNAL dispatch legs — a spawn, the auto-redrive, an approval-decision wake — MUST stay on the raw divert, because each already names its exact target token and must never be re-routed by ownership.
+ * FLAG-GATED and FAIL-CLOSED-TO-STANDING at every step, so flag-off, and every unowned thread, is unchanged. The flag off is a straight passthrough, with no store read and no audit. A NON-thread-scoped wake — a container's TOP-LEVEL message — goes standing UNCONDITIONALLY, with NO ownership lookup at all: thread sessions own THREADS, and top-level traffic is the standing seat's domain, full stop. That is the CHANNEL-CAPTURE guard: a top-level wake keys on its container fallback, so an ownership row recorded off a top-level spawn, legacy rows already on disk included, would otherwise match EVERY top-level message in the channel and blind the standing seat until its TTL. Such rows are now simply unreachable from ingress and die by TTL, deliberately NOT reaped here, because reaping would need the very lookup this guard exists to skip. No ownership row, or a store error, means standing. A STALE owner — a rotated generation, a re-homed domain, a non-owner token shape — means standing, and the dead row is lazily reaped and audited. The owner divert itself failing FALLS BACK to the standing divert, because a message is never dropped, and a standing-divert failure then propagates loudly. The routing decision is audited with ids and counts only, NEVER message text, and ONLY when an ownership row existed, because a plain unowned message is not an event.
+ */
+export async function divertInboundToUnifiedWindow(
+  receive: RouteHandlerArgs["to"],
+  input: {
+    readonly message: string;
+    readonly context?: readonly string[];
+    /** The RAW standing window token the surface resolved for this container (eve prefixes
+     *  `unified:` on the target channel's send) — the DEFAULT wake target, and the source of the
+     *  live domain+generation the staleness checks compare against. */
+    readonly token: string;
+    readonly window: UnifiedWindowWake;
+    readonly surfaceKey: string;
+    /** The surface's own wake auth — forwarded verbatim; an owner divert adds only the `oe_grain`
+     *  re-stamp (host-set, matching what the owner session booted as). */
+    readonly auth: { attributes?: Record<string, unknown> };
+  },
+): Promise<void> {
+  // Flag off ⇒ byte-identical passthrough (no store read on the hot path at all).
+  if (!oneshotAgentEnabled()) return divertToUnifiedWindow(receive, input);
+  // Only a STANDING window target can be re-routed (a task/seat-token target would mean the caller
+  // is not an inbound surface divert — defensive, the callers above never do this).
+  const standing = parseWindowToken(input.token);
+  if (!standing || isTaskWindowId(standing.windowId) || isThreadSeatWindowId(standing.windowId)) {
+    return divertToUnifiedWindow(receive, input);
+  }
+  // CHANNEL-CAPTURE guard, see the header: only a wake that POSITIVELY landed inside a thread can be routed by ownership.
+  // A top-level container message goes to the standing seat with NO lookup, because its thread key is the container fallback, which a top-level-spawned ownership row would match channel-wide.
+  if (!isThreadScopedWakeOrigin(input.window.origin)) {
+    return divertToUnifiedWindow(receive, input);
+  }
+  // ONE indexed lookup per inbound THREAD message (the §S2 hot-path budget), keyed by the SAME
+  // unifiedThreadRef derivation the spawn used — so spawn and ingress always agree on identity.
+  const org = deploymentOrg();
+  const store = getOperationalStore();
+  const ref = unifiedThreadRef(input.window.origin);
+  const owner = await resolveThreadOwner(store, org, ref); // fail-closed: store error ⇒ null ⇒ standing
+  const route = routeThreadMessage(owner, standing.generation, standing.domain);
+  // ids/counts ONLY in detail (never the message) — the routing story without the content.
+  const audit = (detail: Record<string, unknown>) =>
+    appendAudit({
+      org,
+      platform: "unified",
+      workspace: standing.domain,
+      action: "thread.ingress_routed",
+      detail: { wakeId: input.window.wakeId, channelKey: ref.channelKey, threadKey: ref.threadKey, surfaceKey: input.surfaceKey, ...detail },
+    }).catch(() => undefined);
+  if (route.kind !== "task") {
+    if (owner !== null) {
+      // A row existed but no longer routes (stale generation / re-homed domain / non-owner shape):
+      // the §S2 lazy reap — clear it so the thread cleanly returns to the standing seat, and
+      // record the decision (this is the one "standing" outcome worth a row; unowned is not).
+      const reaped = await clearThreadOwner(store, org, ref);
+      await audit({ routed: "standing", reason: "stale-owner", ownerId: owner, reaped });
+    }
+    return divertToUnifiedWindow(receive, input);
+  }
+  // OWNED thread ⇒ dispatch to the OWNER session's token. Pre-stamp the grain the owner booted as
+  // (`t/`→task, `s/`→thread — the token-shape read routeThreadMessage did), so stampUnifiedWindowAuth's
+  // `??` preserves it over its "standing" default and windowGrainOf resolves the owner's real hands.
+  const attributes: Record<string, unknown> = { ...(input.auth.attributes ?? {}), [OE_GRAIN_ATTR]: route.grain };
+  try {
+    await divertToUnifiedWindow(receive, { ...input, token: route.token, auth: { ...input.auth, attributes } });
+  } catch (err) {
+    // 🔴 AN EXHAUSTED RETRY IS NOT A FALLBACK CASE (OPE-1871). The owner divert already spent this
+    // wake's whole backoff budget against the queue, and the standing divert would meet the SAME
+    // queue — so falling back here would spend a second full budget, double the sleep, and write a
+    // second `wake.ingress` row for one wake. The fallback exists for a failure the standing path
+    // might not share (a cold-process edge, a raced refusal in the receive gate); a rate limit is
+    // not one. Rethrow to the surface's loud catch, which records it exactly as it records any
+    // other undelivered wake.
+    if (err instanceof RateLimitExhaustedError) {
+      await audit({ routed: "none", reason: "owner-divert-rate-limited", ownerId: route.token, grain: route.grain, attempts: err.attempts, waitedMs: err.waitedMs });
+      throw err;
+    }
+    // NEVER drop a message: an owner divert that fails (a cold-process edge, a raced refusal in the
+    // receive gate) falls back to the standing path — the seat that spawned the owner can still act.
+    // A failure of the standing divert itself then propagates to the surface's loud catch, as today.
+    const errMsg = (err instanceof Error ? err.message : String(err)).slice(0, 300);
+    await audit({ routed: "standing", reason: "owner-divert-failed", ownerId: route.token, grain: route.grain, error: errMsg });
+    return divertToUnifiedWindow(receive, input);
+  }
+  await audit({ routed: "owner", ownerId: route.token, grain: route.grain });
+}
+
+/**
+ * Build the auto-redrive's re-injection dependency over the best available dispatch path — the captured in-process primitive when this process has one, else the self-dispatch hop. NULL when neither is available, which fail-softs the redrive without burning the loop guard, exactly the old no-dispatch behaviour.
+ * The corrective wake is AMBIENT, with no addressing, so no addressing stamp rides — it is a machine notice about the model's own output, never a person addressing the agent. Exported, with the availability decision inside, so the unit test drives the offline arms — the warm captured dispatch, and the unavailable one — without a live channel event; the cold signed-HTTP hop is covered by its own test.
+ */
+export function buildRedriveReinject(domain: string | undefined, rawToken: string, baseAttrs: Record<string, unknown>): RedriveReinject {
+  if (!crossProcessDispatchAvailable()) return null;
+  // The seat's own windowId, for the solo/pseudo-domain arm of the surface-key pick (see that
+  // function). A token that will not parse simply leaves it undefined and the roster read decides.
+  const seatWindowId = parseWindowToken(rawToken)?.windowId;
+  return async (origin, message, originalWakeId) => {
+    const surfaceKey = pickRedriveSurfaceKey(domain, origin.platform, seatWindowId);
+    if (!surfaceKey) throw new Error(`unified redrive: no crossSurfaceWindow surface key for domain ${domain ?? "?"}`);
+    await deliverUnifiedDispatch({
+      message,
+      token: rawToken,
+      window: { wakeId: originalWakeId, origin }, // ambient (no addressing) ⇒ no oe_addressing stamp
+      surfaceKey,
+      auth: { attributes: baseAttrs },
+    });
+  };
+}
+
+/**
+ * Auth attribute marking a TASK session's OPENING wake as spawned from a TAINTED parent turn. HOST-set on the child auth and never model-authored — see unified-window.ts's §AUTH-ATTRIBUTE PROVENANCE for the verified source citation — the same unforgeable channel as the window stamps.
+ * The child's boot-seed reads it to taint turn one, so a consequential write the child makes on that turn gates exactly as if the child had itself read the untrusted content the parent's brief was composed from.
+ */
+export const OE_SPAWN_TAINTED_ATTR = "oe_spawn_tainted";
+
+/**
+ * Async-dispatch a wake to a TASK, thread-grain window — the async spawn primitive's delivery leg. It delivers through the in-process capture when this process holds one, else the self-dispatch hop, because a tool execute runs in eve's WORKFLOW process, which handles no webhooks, so the capture is structurally unset there — the live-prod root cause of async spawn never working.
+ * Either way it is DISPATCH, not join: it hands eve the delivery for a never-before-seen token, so a fresh session opens, and returns — the spawning standing seat's turn NEVER blocks, so it keeps servicing channel messages. The surface key for the fail-closed window-enabled re-check and the audit label is derived from the domain the same way the redrive does, and the domain is already proven window-enabled because the standing seat exists, so any of its window channels satisfies the re-check. FAIL-SOFT-LOUD: with NEITHER path available, or on a failed self-call, it THROWS an instructive error, so the seat falls back to declining rather than dropping silently. `tainted` forwards the parent turn's taint onto the child's opening auth.
+ */
+export async function dispatchTaskWindow(input: {
+  /** The task window token (window-key.ts taskWindowId → formatWindowToken), same domain+generation as the parent. */
+  readonly token: string;
+  /** The rendered brief the child boots on (its opening wake body). */
+  readonly message: string;
+  /** A fresh host-minted wakeId for the child's opening delivery (its reply-map key). */
+  readonly wakeId: string;
+  /** The domain the task belongs to — resolves the window-enabled surfaceKey for the re-check. */
+  readonly domain: string;
+  /** The thread the task owns — the SAME origin the standing seat is handling, so the child replies there. */
+  readonly origin: UnifiedWakeOrigin;
+  /** The parent turn's auth attributes, forwarded verbatim — egress policy and capability inheritance. */
+  readonly parentAuthAttributes?: Record<string, unknown>;
+  /** Stamp the child's opening auth tainted iff the parent turn ingested untrusted content (§S1). */
+  readonly tainted: boolean;
+  /** The child's GRAIN (host-stamped `oe_grain`). Default "task" — the async worker (full wide hands).
+   *  spawn_thread_session (Stage T2) passes "thread" to mint a CONVERSATIONAL seat (narrow hands). */
+  readonly grain?: "task" | "thread";
+  /**
+   * A short, already-truncated description of the delegated work, stamped onto the opening delivery so the worker's replies can bracket a tier signal.
+   * Omitted ⇒ no stamp, and the reply still brackets on grain alone, with the generic fallback label.
+   */
+  readonly taskLabel?: string;
+  /** The DISPATCHING turn's eve turn id (identity/binding.ts `currentTurnId`), so the WHO-ASKED
+   *  stamp below is read for THIS turn and not for whatever the seat served last. Omitted ⇒ the
+   *  unkeyed read, which is what a caller with no context can honestly offer. */
+  readonly turnId?: string;
+  /** The SPAWNING seat's own windowId (window-key.ts `parseWindowToken(...).windowId`) — a solo
+   *  seat's IS its surface key, which is the only resolvable answer on a seat whose domain is the
+   *  `org` pseudo-domain. Omitted ⇒ the domain-roster pick, unchanged. */
+  readonly seatWindowId?: string;
+}): Promise<void> {
+  if (!crossProcessDispatchAvailable()) {
+    throw new Error(
+      "dispatchTaskWindow: no live cross-surface dispatch is available on this instance — this process has handled no surface webhook (no captured cross-channel dispatch) and the self-dispatch route is not configured (arm OE_CREDENTIAL_ENCRYPTION_KEY; plus OE_PUBLIC_BASE_URL when the deployment's own URL isn't discoverable). Retry from a message-driven turn.",
+    );
+  }
+  const surfaceKey = pickRedriveSurfaceKey(input.domain, input.origin.platform, input.seatWindowId);
+  if (!surfaceKey) {
+    throw new Error(`dispatchTaskWindow: couldn't resolve a window-enabled surface for domain "${input.domain}" — the task cannot be dispatched.`);
+  }
+  const attributes: Record<string, unknown> = { ...(input.parentAuthAttributes ?? {}) };
+  // GRAIN stamp: host-set and unforgeable — see unified-window.ts's §AUTH-ATTRIBUTE PROVENANCE — and it OVERRIDES any standing grain forwarded verbatim from the parent seat's auth, because the stamp helper preserves it over its own default, so the grain reader resolves the child's real hands.
+  // The default is the full-hands worker grain; a thread seat passes the narrow conversational one.
+  attributes[OE_GRAIN_ATTR] = input.grain ?? "task";
+  // TASK-LABEL stamp, the reply tier signal: host-set from the caller's already-truncated brief, and ONLY when supplied.
+  // A caller that needs no visible label simply omits it, and the worker's reply still brackets on grain alone. It never overwrites a forwarded stamp with a blank one.
+  if (input.taskLabel) attributes[OE_TASK_LABEL_ATTR] = input.taskLabel;
+  // INVOKER-POSTURE stamp, host-set here at the one place the delegation edge is built, so the child's kit is bounded by whoever caused the PARENT's run rather than by its own token shape. It is read off the parent's own per-wake slot, because this function is a plain call inside the parent's turn step, so the classification made at turn start is live.
+  // BELT, NOT BRACES — and it is worth being precise about which is which, because the security property must not rest on this line. A WEBHOOK fire's child already classifies correctly WITHOUT any stamp, because its discriminator is an ATTRIBUTE and the whole bag is forwarded verbatim one line above. What the stamp adds is the class whose raw discriminator does NOT survive the hop: an EVENT-SUBSCRIPTION fire, identified by the auth's principal id, which is not forwarded. It cannot widen anything by construction, because the resolver folds the stamp in with a MINIMUM over the lattice, so a stale, absent or garbage stamp loses to the child's own markers. The NATIVE subagent child needs nothing here at all: eve hands it the parent's auth slot BY REFERENCE, so it reads this same bag through the same markers with no separate plumbing.
+  attributes[INVOKER_POSTURE_ATTR] = currentInvokerPosture();
+  // WHO-ASKED stamp, host-set here at the one place the cross-session delegation edge is built. A dispatched worker is NOT an eve-native child — no session parent, its own token, the synthetic channel — so it was never covered by the child fence, and its opening message is a RAW interpolation of the parent MODEL's brief. Without a stamp the worker read that brief, and a forged wake frame inside it minted an admin requester at a gate that hands out the widest tools.
+  // UNCONDITIONAL, and that is the security property: an ABSENT stamp is what lets a worker read its own text, so a turn that cannot name its asker must stamp the unverified value OUT LOUD rather than stay silent. It also OVERWRITES any value forwarded from the parent, so a stale asker from an earlier delivery on the seat cannot ride the hop.
+  attributes[OE_REQUESTER_ATTR] = requesterStampForDispatch(input.turnId);
+  // THE CANDIDATE SET beside it — the evidence the all-candidates admin-standing rule needs. The measured escalation ran in a WORKER, so the set has to survive THIS hop; a rule that reached only the eve-native child would not close it.
+  // SET-OR-DELETE, for the same reason the stamp above is unconditional: the attribute bag starts as the parent seat's whole bag, so a list a PREVIOUS delivery left there names some other turn's askers, and writing only on a value would let it ride the hop and serve a worker under a stale set.
+  const requesterCandidates = requesterCandidatesStampForDispatch(input.turnId);
+  if (requesterCandidates !== undefined) attributes[OE_REQUESTER_CANDIDATES_ATTR] = requesterCandidates;
+  else delete attributes[OE_REQUESTER_CANDIDATES_ATTR];
+  if (input.tainted) attributes[OE_SPAWN_TAINTED_ATTR] = "true";
+  // addressing:"direct-mention" — a task IS owed a reply, so its wake renders as addressed and the
+  // child is told it owes an answer (the same owed-reply treatment a mention gets). There is no prose
+  // fallback behind that: a child that ends in prose without calling `reply` is dropped and re-driven
+  // like any other turn (OPE-1982).
+  // A failed delivery (in-process or self-call) propagates LOUDLY — the seat declines and says so.
+  await deliverUnifiedDispatch({
+    message: input.message,
+    token: input.token,
+    window: { wakeId: input.wakeId, origin: input.origin, addressing: "direct-mention" },
+    surfaceKey,
+    auth: { attributes },
+  });
+}
+
+/**
+ * Wake an EXISTING standing WINDOW seat with an AMBIENT system notice that a pending approval it was waiting on has just been DECIDED, or has EXPIRED through the click path. A sibling of {@link dispatchTaskWindow}, but deliberately AMBIENT with NO addressed stamp, because the decide handler already posted the human-facing decision NOTICE into the anchor thread: this delivery only updates the SESSION's own belief, so it stops answering fresh asks from a stale "still pending" memory. The decision render is silence-biased, and the ambient wake's turn-final prose is DROPPED by message-tool-only, so the model must consciously `reply`, naming the wake id, if a follow-up is genuinely warranted — its default is silence.
+ * It delivers through the same dispatch helper, so it works from either process; the decide handler runs in the webhook process, unlike a tool execute. BEST-EFFORT: it returns a boolean and NEVER throws, because the in-thread notice is the human-facing source of truth, so a lost session wake only means the belief updates on the session's NEXT human wake through backscroll. LOOP-SAFE: this is a message delivery that re-enters NO approval code, and a decision wake is emitted ONLY from the decide path and never from a session turn, so a wake can never trigger another wake. The notice carries no buttons, so the woken session cannot decide anything.
+ */
+export async function dispatchApprovalDecisionWake(input: {
+  /** The CURRENT window token of the proposing session (read off its channel_session registry row). */
+  readonly token: string;
+  /** The proposing session's reply target — the anchor thread the card lived in. */
+  readonly origin: UnifiedWakeOrigin;
+  /** Host-minted wakeId for this delivery (the caller mints it + rendered it into the message). */
+  readonly wakeId: string;
+  /** The pre-rendered ambient decision notice (approvals/decision-wake.ts). */
+  readonly message: string;
+  /** The proposing session's domain — resolves the window-enabled surfaceKey for the fail-closed re-check. */
+  readonly domain: string;
+  /** The proposal wake's exact host-validated authority. Present for newly minted approvals; legacy
+   * rows omit it and get no session wake; their in-thread decision notice remains the truth. */
+  readonly binding?: SurfaceBinding;
+  /** The authenticated requester frozen on the proposal turn. The later decision actor is not the
+   * requester of any work the resumed seat delegates. */
+  readonly requester?: RequesterVerdict;
+  readonly nonMemberWake?: boolean;
+  /**
+   * Auth to resume under. Empty, the default, means the stamp helper defaults the grain to standing — the ambient supervisor's own narrow-hands posture, which is exactly right for an informational notice.
+   * The delivery carries no clicker's platform identity. Newly minted rows instead restore the exact
+   * proposal binding through the separate host-frozen field above; legacy rows carry neither and can
+   * update belief but cannot lend ambient/env authority to later work.
+   */
+  readonly authAttributes?: Record<string, unknown>;
+}): Promise<boolean> {
+  // No exact proposal authority means no internal session delivery. The human-facing decision
+  // notice already landed beside the card; falling through here would let the standing seat's
+  // ambient bridge or env stand-in choose a different surface for later work.
+  if (input.binding === undefined || input.requester === undefined) return false;
+  const attributes: Record<string, unknown> = { ...(input.authAttributes ?? {}) };
+  if (input.requester !== undefined) {
+    attributes[OE_REQUESTER_ATTR] = input.requester.kind === "requester" ? input.requester.principalId : REQUESTER_UNVERIFIED;
+    if (input.requester.kind === "unverified" && input.requester.candidates !== undefined) {
+      attributes[OE_REQUESTER_CANDIDATES_ATTR] = JSON.stringify(input.requester.candidates);
+    } else {
+      delete attributes[OE_REQUESTER_CANDIDATES_ATTR];
+    }
+  }
+  if (input.nonMemberWake === true) attributes[OE_CHAT_NONMEMBER_ATTR] = "true";
+  else delete attributes[OE_CHAT_NONMEMBER_ATTR];
+  return dispatchAmbientSeatWake({ ...input, authAttributes: attributes });
+}
+
+/**
+ * Wake an EXISTING seat — standing or thread — with an AMBIENT delivery. The shared body behind {@link dispatchApprovalDecisionWake} and the two seat-to-seat deliveries OPE-1696 adds: a `message_thread_seat` steer, and a thread seat's hand-back REPORT to the parent that spawned it.
+ * 🔴 AMBIENT IS THE WHOLE SAFETY PROPERTY OF THIS SHAPE. There is no addressed stamp, so the woken turn's terminal prose is DROPPED by message-tool-only: a seat that wants to put words in the room must consciously call `reply` with a wake id it holds, and its default is silence. That is what lets one seat message another without the message becoming a post in somebody's room.
+ * BEST-EFFORT: returns a boolean and NEVER throws. A caller whose delivery is the ONLY copy of the information says so in its own doc; every current caller has a durable record behind it (the decision notice in the thread, the stored report row), so a lost wake costs awareness, never the fact.
+ */
+async function dispatchAmbientSeatWake(input: {
+  readonly token: string;
+  readonly origin: UnifiedWakeOrigin;
+  readonly wakeId: string;
+  readonly message: string;
+  readonly domain: string;
+  readonly binding?: SurfaceBinding;
+  readonly authAttributes?: Record<string, unknown>;
+}): Promise<boolean> {
+  if (!crossProcessDispatchAvailable()) return false; // no path at all → skip (the durable record is the truth)
+  // The woken seat's own token names its window, which is the resolvable surface key on a solo
+  // seat and the only one on a seat whose domain is the `org` pseudo-domain (pickRedriveSurfaceKey).
+  // 🔴 THE DOMAIN GRAIN, `domainSurface ?? surface`. `windowEnabledFor` asks which domain's reach
+  // lists this key, and an operator declares a CHANNEL, never a thread id or a Teams `;messageid=`
+  // conversation. The conversational grain therefore resolves no domain, the receive gate refuses
+  // fail-closed, and this function's own catch swallows it — the seat never resumes after the
+  // click. The ingress divert passes the same grain (`domainKeyOf`, discord-gateway.ts), so the
+  // decision wake and the wake it answers now name ONE key. A binding with no `domainSurface` —
+  // every DM, and every surface whose two grains are one string — is byte-identical to before.
+  const surfaceKey = input.binding
+    ? `${input.binding.platform}/${input.binding.workspace}/${input.binding.domainSurface ?? input.binding.surface}`
+    : pickRedriveSurfaceKey(input.domain, input.origin.platform, parseWindowToken(input.token)?.windowId);
+  if (!surfaceKey) return false;
+  try {
+    await deliverUnifiedDispatch({
+      message: input.message,
+      token: input.token,
+      // AMBIENT: no `addressing` — see the header for why that is the property, not an omission.
+      window: { wakeId: input.wakeId, origin: input.origin },
+      surfaceKey,
+      auth: { attributes: input.authAttributes ?? {} },
+      ...(input.binding ? { binding: input.binding } : {}),
+    });
+    return true;
+  } catch {
+    return false; // best-effort — every caller holds a durable record of what this wake carried
+  }
+}
+
+/**
+ * THE SEAT-TO-SEAT DELIVERY (OPE-1696): wake one seat with another seat's words. It is {@link dispatchAmbientSeatWake} under a name that says what it is for, so the two tools and the hand-back report all read as one mechanism.
+ * WHAT IT IS NOT: a reply, a post, or an instruction with authority. The woken seat reads the text as an ambient delivery from its own deployment and decides what to do; the sender's hands never reach into the receiver's turn. A steer the humans should also see is MIRRORED into the room by the caller, as a separate, ordinary post — the wire and the audit trail stay two different things.
+ */
+export async function dispatchSeatMessage(input: {
+  /** The RECEIVING seat's window token (a thread seat's `s/…`, or a standing seat's own). */
+  readonly token: string;
+  /** The thread this message is about — the receiving seat's own reply target. */
+  readonly origin: UnifiedWakeOrigin;
+  /** Host-minted wakeId for this delivery. */
+  readonly wakeId: string;
+  /** The rendered delivery (the caller states who it is from and what it is for). */
+  readonly message: string;
+  /** The receiving seat's domain — resolves the window-enabled surfaceKey for the fail-closed re-check. */
+  readonly domain: string;
+  /** Auth to resume under; empty means the standing grain, the narrow-hands posture. */
+  readonly authAttributes?: Record<string, unknown>;
+}): Promise<boolean> {
+  return dispatchAmbientSeatWake(input);
+}