@open-everywhere/core 0.1.0

package/agent/control/test-route.ts

@@ -0,0 +1,527 @@
+// The TEST-WAKE INJECTION control route — a spoofed-wake seam for the ambient-model EVAL harness
+// (scripts/eval/ambient-eval.ts). It lets the eval feed a synthesised wake straight into the unified
+// cross-surface window's `receive` path, so the model's experience is BYTE-IDENTICAL to a real
+// surface wake (same rendered envelope, same single-window session, same message-tool-only gate) —
+// WITHOUT driving Slack/Notion/Linear. The eval measures MODEL adherence on the accumulating window;
+// the e2e drivers already prove the ingest plumbing, so the eval skips it and spoofs directly
+// (Tommy, 2026-07-13: "we can spoof more if it lets us bring more back under our control").
+//
+// OUTBOUND STAYS REAL: the injected wake carries a REAL UnifiedWakeOrigin (a real Slack channel /
+// Notion discussion / Linear session from .env.e2e), so the model's `reply` tool posts genuinely and
+// the `reply.post` audit row is honest. The map row the receive writes is keyed off that origin.
+//
+// SECURITY — this endpoint injects arbitrary TRUSTED-shaped wakes, so it is a spoofing vector and
+// this repo is open source. It is therefore TRIPLE-gated, fail-closed:
+//   1. `OE_TEST_WAKE` must be truthy — DEFAULT OFF ⇒ the route 404s (does not exist). An operator
+//      must deliberately arm it on the deployment.
+//   2. `OE_CONTROL_INJECT_TOKENS` must be configured AND the request must carry a matching bearer
+//      from THAT family (eve's `routeAuth` walk over auth.ts injectTokenAuth, whose one entry is
+//      the constant-time verifyInjectToken compare) ⇒ else 401.
+//      ⚠️ NOT `OE_CONTROL_READ_TOKENS` (OPE-136). This route used to authenticate against the read
+//      family — the one auth.ts/server.ts label READ-ONLY — even though, as the paragraph below
+//      says, wake injection transitively WRITES, the caller's `authAttributes` override the
+//      host-derived identity, and `taskThread` mints a TASK-grain (full-kit) seat. So a "read-only"
+//      token could inject a full-kit task seat, and that same token is what the deploy health-probe
+//      carries. The families are now DISJOINT, deliberately not additive: a read token presented
+//      here is refused at gate 2 (401), and an inject token buys nothing on the read routes or the
+//      MCP mount (adminAuthenticatorFromEnv never parses the inject family). Do not add a fallback.
+//   3. A standing WINDOW must be enabled for the target surface — a cross-surface (`mode: "unified"`)
+//      or a solo per-channel (`mode: "solo"`) window, detected via grainUsesUnifiedWindow, re-checked
+//      here AND fail-closed again inside the unified `receive` — the claimed `domain` must be the one
+//      the surfaceKey actually resolves to, and the origin must be a structurally-valid
+//      UnifiedWakeOrigin ⇒ else 400. So even an authorised caller can only inject into a
+//      window-enabled domain it named correctly, with a real, well-formed reply target.
+// Every authenticated call is self-audited (`control.service_call`, view `test_wake`), exactly like
+// a service-token call on the read routes / MCP mount.
+//
+// This module is DELIBERATELY separate from read-route.ts (which is structurally read-only — it
+// imports no write path): wake injection transitively WRITES (the receive registers the wakeId→origin
+// map row), so it lives here and mounts through its own channel (channels/test-wake.ts).
+
+import type { RouteHandlerArgs } from "eve/channels";
+import { routeAuth } from "eve/channels/auth";
+import { injectTokenEntries, injectTokenAuth } from "./auth.js";
+import { appendAudit } from "../audit/audit.js";
+import { deploymentOrg } from "../identity/binding.js";
+import { getConfig } from "../access/config.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { supervisorGrainFor, grainUsesUnifiedWindow, type SupervisorGrain } from "../channels/unified-supervisor.js";
+import { mintWakeId, isUnifiedWakeOrigin, type UnifiedWakeOrigin } from "../channels/unified-window.js";
+import { renderWake, mkMessageTrigger, type NormalizedWake, type WakeAddressing } from "../channels/normalized-wake.js";
+import type { WakeReason, WakeTrust, WakeParticipant, WakeMessageInput } from "../channels/wake-envelope.js";
+import { divertToUnifiedWindow } from "../channels/unified.js";
+import { parseWindowToken, formatWindowToken, taskWindowId } from "../channels/window-key.js";
+import { OE_GRAIN_ATTR } from "../channels/unified-window.js";
+import type { WindowGrain } from "../identity/binding.js";
+
+/** The mounted route path — POST, arms only with OE_TEST_WAKE + a service bearer. */
+export const CONTROL_TEST_WAKE_PATH = "/control/v1/test/wake";
+
+function json(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+}
+
+/** Is the test-wake seam armed? DEFAULT OFF. Accepts "1"/"true"/"yes" (case-insensitive). */
+export function testWakeEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  const v = (env.OE_TEST_WAKE ?? "").trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+
+/** The POST body a caller sends — the SEMANTIC content of one spoofed wake; the handler mints the
+ *  wakeId, resolves the live session token, builds the NormalizedWake, and renders it. */
+export interface TestWakeRequest {
+  /** The unified domain — the token source (its live channel_session row) + audit label. */
+  readonly domain: string;
+  /** The originating surface platform (also the `oe_platform` stamp divert applies). */
+  readonly platform: UnifiedWakeOrigin["platform"];
+  /** The originating container's fully-qualified surface key (`platform/workspace/surface`) — must
+   *  be a crossSurfaceWindow-enabled channel; drives the fail-closed gate + partition + audit. */
+  readonly surfaceKey: string;
+  /** How the wake addresses the agent. Default "channel-watch" (the ambient supervisor path) —
+   *  EXCEPT when {@link mention} or a `"mention"` {@link reason} states the wake IS addressed, which
+   *  selects "direct-mention" instead. Pairing either of those with a watch addressing is a 400
+   *  ({@link resolveInjectedAddressing}). */
+  readonly addressing?: WakeAddressing;
+  /** The wake reason. Default derived from addressing (mention→"mention", else "channel-activity"). */
+  readonly reason?: WakeReason;
+  /** The trigger message body (RAW — the renderer escapes + untrusted-wraps it). Optional ONLY when
+   *  {@link messages} is supplied (the coalesced form carries its own bodies). */
+  readonly text?: string;
+  /** OPTIONAL coalesced multi-message form — a run of close-together messages real ingest folds
+   *  into ONE wake (slack-events coalescing: backscroll siblings + the trigger). When present, every
+   *  entry renders as an envelope `<message>` in order and the LAST one is the trigger (newest =
+   *  trigger, earlier = same-delivery context), so `text` may be omitted. Capped at 10 entries, each
+   *  body ≤ 4000 chars (400 on violation). ABSENT ⇒ the single-`text` path is byte-identical to
+   *  before this field existed (the eval/e2e flows depend on that). Each entry's `author`/`authorId`
+   *  fall back to the wake-level {@link author}/{@link authorId}; the wake-level {@link mention}
+   *  applies to the trigger (last) message only. */
+  readonly messages?: readonly { readonly text: string; readonly author?: string; readonly authorId?: string }[];
+  /** Trigger author display name (default "tester") + optional raw id. */
+  readonly author?: string;
+  readonly authorId?: string;
+  /** Per-message trust tier (default "peer"). */
+  readonly trust?: WakeTrust;
+  /** Explicit @mention flag on the trigger message (rendered `mention="true"`). It ASSERTS the wake
+   *  is addressed, so it also selects the addressed `addressing` value — see {@link addressing}. */
+  readonly mention?: boolean;
+  /** The REAL reply target (validated by isUnifiedWakeOrigin) — outbound replies post here. */
+  readonly origin: UnifiedWakeOrigin;
+  /** Auth attributes for identity binding (team_id/channel_id/… — the partition the model routes by).
+   *  Merged OVER a minimal set the handler derives from surfaceKey, so a caller can omit them for the
+   *  common case and still get correct domain resolution, or override trust/visibility bits. */
+  readonly authAttributes?: Readonly<Record<string, string>>;
+  /** Container noun for the `<channel container>` attribute. DEFAULTS per platform to what the real
+   *  surface adapters pass (notion→"doc", linear→"team", github→"repo"; else "channel") so an
+   *  injected wake renders like a real one (2026-07-13 transcript byte-diff: the injected Notion wake
+   *  said "channel", real says "doc"). Pass explicitly to override. */
+  readonly containerNoun?: string;
+  readonly engagementTier?: "aggressive" | "neutral" | "reserved";
+  readonly participants?: readonly WakeParticipant[];
+  /** WakeChannelMeta.type (e.g. Slack "channel") for the locus. */
+  readonly channelType?: string;
+  /** The conversation the wake is scoped to (Slack thread ts / Notion discussion / …) — locus.thread. */
+  readonly threadTs?: string;
+  // --- GRAIN-ROUTE SELECTORS (window-tool-gating Stage F: the per-route e2e injection paths) -----
+  // By DEFAULT the injection dispatches the domain's live STANDING unified-window token (grain
+  // "standing"). These optional, mutually-exclusive selectors re-mint the dispatched token so the
+  // Stage-F e2e can drive the OTHER grains through the SAME real resolve path (session.started →
+  // windowGrainOf → gated toolset). They mint server-side from the resolved standing token's
+  // (domain, generation) — the caller never supplies a raw token (the whole gate rests on tokens
+  // being host-minted, never model/caller-authored). Behind the same OE_TEST_WAKE + bearer +
+  // window-enabled triple gate as every injection; unset ⇒ today's behaviour byte-identical.
+  /** SOLO / per-channel STANDING seat (F2): mint `oe-dom:<domain>:win:<soloWindowId>:oe-sup:g<gen>`
+   *  (a standing token whose windowId ≠ domain) instead of the degenerate unified token. Still
+   *  grain "standing" ⇒ narrowed — proves the gate bites a standing seat that is NOT the degenerate
+   *  domain window (the whole point of the grain predicate over `isUnifiedWindowContext`). */
+  readonly soloWindowId?: string;
+  /** TASK (thread-grain) worker (F4/F5): mint the task token `oe-dom:<domain>:win:t/<chan>/<thread>:
+   *  oe-sup:g<gen>` and stamp grain "task" ⇒ FULL kit, no narrowing row. Deterministic in the thread
+   *  key, so two injections with the SAME `taskThread` resume the SAME eve session (F5 identity). */
+  readonly taskThread?: string;
+  // NB: there is deliberately NO native-grain selector — a native `cse_…` session runs on the
+  // surface's OWN eve channel, and the unified `receive` refuses any non-supervisor token
+  // (isUnifiedSupervisorToken), so a native seat is not reachable through this unified test-wake
+  // seam. The over-narrowing guard for the native grain is a windowGrainOf unit (a suffix-less token
+  // ⇒ native ⇒ full) + a real-surface @mention e2e (the prod pack), not this route.
+}
+
+/** Minimal identity attributes derived from a `platform/workspace/surface` key, so a caller that
+ *  omits `authAttributes` still binds to the right domain (the model routes by the resolved
+ *  surfaceKey). Covers the wired single-window surfaces; unknown platforms get a bare workspace/
+ *  surface pair (still enough for domainKeyOf). The caller's own authAttributes override these. */
+function attrsFromSurfaceKey(platform: string, surfaceKey: string): Record<string, string> {
+  const parts = surfaceKey.split("/");
+  const workspace = parts[1] ?? "";
+  const surface = parts.slice(2).join("/");
+  switch (platform) {
+    case "slack":
+      return { team_id: workspace, channel_id: surface, channel_type: "channel", is_private: "false" };
+    case "discord":
+      return { guild_id: workspace, channel_id: surface };
+    case "github":
+      return { owner: workspace, repo: surface };
+    case "linear":
+      return { organization_id: workspace, team_id: surface };
+    case "notion":
+      return { workspace_id: workspace, page_id: surface };
+    case "teams":
+      return { tenant_id: workspace, conversation_id: surface };
+    default:
+      return { workspace_id: workspace, surface_id: surface };
+  }
+}
+
+function defaultReason(addressing: WakeAddressing): WakeReason {
+  if (addressing === "direct" || addressing === "direct-mention") return "mention";
+  if (addressing === "thread-follow") return "thread-activity";
+  return "channel-activity";
+}
+
+/** Every value {@link WakeAddressing} admits — the runtime list the route validates against, so an
+ *  unknown string lands on a named 400 instead of renderWake's exhaustive-switch throw (a 500). */
+const WAKE_ADDRESSINGS: readonly WakeAddressing[] = ["direct", "direct-mention", "thread-follow", "channel-watch", "name-drop"];
+
+/** The addressings that state the wake IS addressed and owes an answer — the enveloped
+ *  `direct-mention`, or the raw `direct` body with no envelope at all. Every OTHER addressing is
+ *  ambient, and the standing "Reading a wake" block holds an ambient wake to a high silence bar. */
+const ADDRESSED_ADDRESSINGS: readonly WakeAddressing[] = ["direct", "direct-mention"];
+
+/** The resolved addressing for one injection, or the reason the route refuses the body. */
+type InjectedAddressing =
+  | { readonly ok: true; readonly addressing: WakeAddressing }
+  | { readonly ok: false; readonly error: string };
+
+/**
+ * Resolve an injection's ADDRESSING, and refuse a body whose addressed attributes contradict it
+ * (OPE-643). Pure — the whole decision is unit-testable without a Request.
+ *
+ * 🔴 WHY THIS EXISTS. `mention`, `reason` and `addressing` are three independent fields on the wire,
+ * and `addressing` used to default to `channel-watch` on its own. So `{ mention: true }` alone
+ * rendered `mention="true"` on the trigger beside `addressing="channel-watch"`, and
+ * `{ reason: "mention" }` alone did the same. Those two attributes contradict each other: `mention`
+ * says this message addressed the seat, and `channel-watch` is the attribute the standing "Reading a
+ * wake" block keys the HIGHEST silence bar to. NO real surface can produce that pair: every adapter
+ * derives all three from ONE `directMention` fact (slack-events.ts slackJudgedWake,
+ * github-supervisor.ts, linear-supervisor.ts, discord-gateway.ts, teams-supervisor.ts). An envelope
+ * whose own attributes disagree is the "never lie to the model" defect, and an eval or e2e that
+ * injected it would measure a model failure the product cannot cause.
+ *
+ * Two rules, in this order:
+ *  1. An addressed ATTRIBUTE with no stated addressing SELECTS the addressed value
+ *     (`direct-mention`) rather than falling to the ambient default. This is what every real
+ *     adapter does with the same facts.
+ *  2. An addressed attribute the caller pairs EXPLICITLY with a watch addressing is REFUSED. The
+ *     caller stated both halves of a contradiction, so guessing which half it meant would be worse
+ *     than a named 400.
+ * A body that states neither attribute is UNCHANGED — it still defaults to `channel-watch`.
+ */
+function resolveInjectedAddressing(body: {
+  readonly addressing?: unknown;
+  readonly reason?: unknown;
+  readonly mention?: unknown;
+}): InjectedAddressing {
+  if (body.addressing !== undefined && !WAKE_ADDRESSINGS.includes(body.addressing as WakeAddressing)) {
+    return { ok: false, error: `invalid \`addressing\` "${String(body.addressing)}" (expected one of ${WAKE_ADDRESSINGS.join(", ")})` };
+  }
+  const stated = body.addressing as WakeAddressing | undefined;
+  // The wire fields that ASSERT "this wake is addressed to you": the trigger's response-obligation
+  // flag, and the two envelope reasons that carry the same claim. `dm` belongs here because a DM
+  // wake is addressed by the SHAPE of the room, not by anybody @mentioning anything — every DM
+  // builder states `direct-mention` addressing unconditionally (slack-events.ts slackDmWake,
+  // discord-gateway.ts, teams-front.ts), and telling a DM "you are this channel's standing session"
+  // is as false as telling an @mention "you were not mentioned".
+  const addressedAttr =
+    body.mention === true ? "mention: true" : body.reason === "mention" ? 'reason: "mention"' : body.reason === "dm" ? 'reason: "dm"' : undefined;
+  if (addressedAttr === undefined) return { ok: true, addressing: stated ?? "channel-watch" };
+  if (stated === undefined) return { ok: true, addressing: "direct-mention" };
+  if (!ADDRESSED_ADDRESSINGS.includes(stated)) {
+    return {
+      ok: false,
+      error:
+        `\`${addressedAttr}\` contradicts \`addressing: "${stated}"\` — that addressing renders the ` +
+        `ambient wake the standing prompt holds to its highest silence bar, which no addressed wake ` +
+        `may claim. Use addressing "direct-mention" (judged envelope + wake-id) or "direct" (raw ` +
+        `body), or drop the addressed attribute.`,
+    };
+  }
+  return { ok: true, addressing: stated };
+}
+
+/** The container noun each real surface adapter passes to renderWake (evidence: notion-supervisor
+ *  "doc", linear-supervisor "team", github-supervisor "repo"; slack/discord/teams leave it unset →
+ *  "channel"). Injected wakes default to the same so the rendered envelope matches a real wake. */
+function defaultContainerNoun(platform: string): string | undefined {
+  switch (platform) {
+    case "notion": return "doc";
+    case "linear": return "team";
+    case "github": return "repo";
+    default: return undefined; // renderWake defaults "channel"
+  }
+}
+
+/**
+ * Handle `POST /control/v1/test/wake` — inject a synthesised wake into the unified window.
+ * Transport-neutral over a WHATWG Request; `to` is the eve cross-channel primitive the route
+ * handler holds (channels/test-wake.ts passes args.to). Statuses: 404 seam disarmed (flag off
+ * or no tokens), 401 missing/bad bearer, 400 bad body / disabled window / bad origin / no session,
+ * 200 injected.
+ */
+export async function handleTestWakeInjection(req: Request, to: RouteHandlerArgs["to"]): Promise<Response> {
+  // Gate 1: the seam must be deliberately armed AND the INJECTION family configured — else the
+  // route 404s (it effectively does not exist), same fail-closed posture as the read routes with no
+  // tokens. Both halves are independent: arming OE_TEST_WAKE without provisioning
+  // OE_CONTROL_INJECT_TOKENS leaves the route as dead as it was before it was armed.
+  const entries = injectTokenEntries();
+  if (!testWakeEnabled() || entries.length === 0) return new Response("not found", { status: 404 });
+
+  // Gate 2: a matching INJECTION bearer (constant-time), walked by eve's own `routeAuth` over the
+  // INJECTION family alone (OPE-1613 — auth.ts injectTokenAuth carries the compare). A READ-family
+  // token hashes to no entry here and lands on eve's 401 — the OPE-136 separation, enforced at the
+  // route boundary. There is no fallback to the read family by design; adding one would restore the
+  // defect wholesale, and the separation is now structural in the WALK too: the walk this route runs
+  // holds exactly one entry, and that entry reads only {@link injectTokenEntries}.
+  const identity = await routeAuth(req, injectTokenAuth(entries));
+  if (identity instanceof Response) return identity;
+
+  let body: Partial<TestWakeRequest>;
+  try {
+    body = (await req.json()) as Partial<TestWakeRequest>;
+  } catch {
+    return json(400, { error: "invalid JSON body" });
+  }
+
+  // --- structural validation (fail-loud on a malformed injection) ---
+  const domain = typeof body.domain === "string" ? body.domain.trim() : "";
+  const platform = body.platform;
+  const surfaceKey = typeof body.surfaceKey === "string" ? body.surfaceKey.trim() : "";
+  const text = typeof body.text === "string" ? body.text : "";
+
+  // OPTIONAL coalesced multi-message form: validate + normalise `messages` up front. When present,
+  // `text` may be omitted; when absent, `coalesced` stays null and every path below is byte-identical
+  // to the single-`text` behaviour that predates this field (the hard back-compat requirement).
+  const MSG_CAP = 10;
+  const MSG_MAX_CHARS = 4000;
+  let coalesced: { text: string; author?: string; authorId?: string }[] | null = null;
+  if (body.messages !== undefined) {
+    if (!Array.isArray(body.messages) || body.messages.length === 0) {
+      return json(400, { error: "`messages` must be a non-empty array of { text, author?, authorId? }" });
+    }
+    if (body.messages.length > MSG_CAP) {
+      return json(400, { error: `\`messages\` is capped at ${MSG_CAP} entries (got ${body.messages.length})` });
+    }
+    const out: { text: string; author?: string; authorId?: string }[] = [];
+    for (let i = 0; i < body.messages.length; i++) {
+      const m = body.messages[i] as { text?: unknown; author?: unknown; authorId?: unknown } | undefined;
+      const mt = typeof m?.text === "string" ? m.text : "";
+      if (mt.length === 0) return json(400, { error: `messages[${i}].text must be a non-empty string` });
+      if (mt.length > MSG_MAX_CHARS) return json(400, { error: `messages[${i}].text exceeds ${MSG_MAX_CHARS} chars (got ${mt.length})` });
+      out.push({
+        text: mt,
+        ...(typeof m?.author === "string" ? { author: m.author } : {}),
+        ...(typeof m?.authorId === "string" ? { authorId: m.authorId } : {}),
+      });
+    }
+    coalesced = out;
+  }
+
+  if (!domain || !platform || !surfaceKey || (coalesced === null && text.length === 0)) {
+    return json(400, { error: "expected body: { domain, platform, surfaceKey, text|messages, origin, … }" });
+  }
+  if (!isUnifiedWakeOrigin(body.origin)) {
+    return json(400, { error: "invalid or missing `origin` (must be a valid UnifiedWakeOrigin for the platform)" });
+  }
+  const origin = body.origin;
+  if (origin.platform !== platform) {
+    return json(400, { error: `origin.platform "${origin.platform}" != platform "${platform}"` });
+  }
+
+  // ADDRESSING — a PURE body check, so it sits with the other structural 400s and costs no store
+  // read. An addressed attribute (`mention: true` / `reason: "mention"`) selects the addressed
+  // addressing when the caller stated none, and is REFUSED when the caller explicitly paired
+  // it with a watch addressing (OPE-643). See {@link resolveInjectedAddressing} for why no real
+  // surface can produce that pair.
+  const resolvedAddressing = resolveInjectedAddressing(body);
+  if (!resolvedAddressing.ok) return json(400, { error: resolvedAddressing.error });
+  const addressing: WakeAddressing = resolvedAddressing.addressing;
+
+  // Gate 3a: a standing-window topology must hold for this surface (re-checked fail-closed inside the
+  // unified receive too — this is the friendly 400 rather than a thrown 500). BOTH window shapes are
+  // injectable: the CROSS-SURFACE window (`mode: "unified"`, one window per domain) and the SOLO
+  // per-channel window (`mode: "solo"`, windowId === surfaceKey) — {@link grainUsesUnifiedWindow}'s two
+  // arms, and exactly the pair the divert below fans through the synthetic `unified` channel. Admitting
+  // only the cross-surface arm made the solo topology structurally UNINJECTABLE (the e2e pack had to
+  // fake it). Still fail-closed: the WINDOW_TOPOLOGY_ENABLED code gate defaults OFF, so the grain is
+  // native per-container (grainUsesUnifiedWindow false) until an operator arms it in a reviewed change.
+  let grain: SupervisorGrain | undefined;
+  try {
+    const domains = getConfig().loadDomains();
+    const g = supervisorGrainFor(surfaceKey, domains);
+    if (grainUsesUnifiedWindow(g)) grain = g;
+  } catch {
+    grain = undefined;
+  }
+  if (!grain) {
+    return json(400, { error: `no standing window (mode solo / unified) is enabled for surfaceKey "${surfaceKey}" — refusing (fail-closed)` });
+  }
+  // The claimed `domain` must BE the surface's resolved domain. The registry row is keyed off the
+  // GRAIN below (which resolves the domain from the surfaceKey, not from the body), so a mismatch
+  // would dispatch one domain's window token into another domain's surface — structurally incoherent,
+  // and refused rather than silently re-pointed at whichever row the caller named.
+  if (grain.domainName !== domain) {
+    return json(400, { error: `surfaceKey "${surfaceKey}" resolves to domain "${grain.domainName}", not the requested "${domain}" — refusing (fail-closed)` });
+  }
+
+  // Resolve the LIVE session token from the WINDOW's channel_session row (the accumulating window's
+  // current generation) — a wake sent under any other token would open a different session. The key
+  // is the GRAIN's, never a hardcoded `unifiedDomainSessionKey(domain)`: a SOLO window's row is keyed
+  // by its per-channel windowId (the surfaceKey), so a domain-keyed read would find the wrong row (or
+  // none at all). Byte-identical on the cross-surface path — a non-solo grain's windowId defaults to
+  // the domain name, so `registryKey === unifiedDomainSessionKey(domain)` exactly as before.
+  const org = deploymentOrg();
+  const store = getOperationalStore();
+  const sessionRow = await store.getChannelSession(org, grain.registryKey).catch(() => null);
+  const standingToken = sessionRow?.token;
+  if (!standingToken) {
+    return json(400, { error: `no unified session for window "${grain.registryKey}" (domain "${domain}") — rotate/seed the window first (channel_session row absent)` });
+  }
+  const wakeId = mintWakeId();
+
+  // GRAIN-ROUTE resolution (Stage F): re-mint the dispatched token + pick a grain stamp from the
+  // resolved standing token's (domain, generation). Mutually exclusive; default = the standing token
+  // unchanged. Host-minted only — the caller supplies a windowId/thread selector, never a raw token.
+  const selectors = [body.soloWindowId, body.taskThread].filter((v) => v !== undefined).length;
+  if (selectors > 1) {
+    return json(400, { error: "at most ONE of soloWindowId / taskThread may be set (they re-mint the dispatched token for a single grain route)" });
+  }
+  let token = standingToken;
+  let grainStamp: WindowGrain | undefined;
+  if (body.soloWindowId !== undefined || body.taskThread !== undefined) {
+    const key = parseWindowToken(standingToken);
+    const noColon = (s: string): string => s.replace(/:/g, "_");
+    if (!key) {
+      return json(400, { error: `cannot re-mint a grain-route token: the live standing token "${standingToken}" is not a parseable window token` });
+    } else if (body.taskThread !== undefined) {
+      const chan = noColon(surfaceKey);
+      const thread = noColon(body.taskThread);
+      if (thread.length === 0) return json(400, { error: "`taskThread` must be a non-empty string" });
+      token = formatWindowToken({ domain: key.domain, windowId: taskWindowId(chan, thread), generation: key.generation });
+      grainStamp = "task";
+    } else if (body.soloWindowId !== undefined) {
+      const wid = noColon(body.soloWindowId);
+      if (wid.length === 0 || wid === key.domain) {
+        return json(400, { error: "`soloWindowId` must be a non-empty windowId distinct from the domain (else it degenerates to the standing token)" });
+      }
+      token = formatWindowToken({ domain: key.domain, windowId: wid, generation: key.generation });
+      grainStamp = "standing";
+    }
+  }
+
+  // --- build the NormalizedWake exactly as a surface adapter would, and render it ---
+  // `addressing` was resolved + validated with the other structural body checks above.
+  const reason: WakeReason = body.reason ?? defaultReason(addressing);
+  const containerId = surfaceKey.split("/").slice(2).join("/") || surfaceKey;
+  // Faithful-by-default enricher (2026-07-13 byte-diff): each surface passes its own container
+  // noun, so default it here — an injected wake then renders like a real one; the body can override.
+  const containerNoun = body.containerNoun ?? defaultContainerNoun(platform);
+  const trust = (body.trust ?? "peer") as WakeTrust;
+
+  // Trigger + optional backscroll. The single-`text` path is UNCHANGED (byte-identical). The
+  // coalesced path folds `messages` the way real ingest does: the last entry is the trigger and the
+  // earlier ones are oldest-first backscroll siblings of the same delivery (renderWake feeds
+  // `[...backscroll, trigger]` into renderWakeEnvelope, which enforces trigger-last). Each entry's
+  // author/authorId fall back to the wake-level defaults; the wake-level `mention` marks the trigger.
+  let trigger: ReturnType<typeof mkMessageTrigger>;
+  let backscroll: WakeMessageInput[] | undefined;
+  if (coalesced) {
+    const base = Date.now();
+    const n = coalesced.length;
+    const authorIdOf = (a?: string): string | undefined => a ?? body.authorId;
+    const mkBackscroll = (e: { text: string; author?: string; authorId?: string }, i: number): WakeMessageInput => ({
+      from: "human",
+      author: e.author ?? body.author ?? "tester",
+      ...(authorIdOf(e.authorId) !== undefined ? { authorId: authorIdOf(e.authorId) } : {}),
+      id: `test-${wakeId}-b${i}`,
+      // Oldest-first, ending just before the trigger's clock — one second apart, deterministic order.
+      sentAt: new Date(base - (n - i) * 1000).toISOString(),
+      trust,
+      body: e.text,
+    });
+    backscroll = n > 1 ? coalesced.slice(0, n - 1).map((e, i) => mkBackscroll(e, i)) : undefined;
+    const last = coalesced[n - 1];
+    trigger = mkMessageTrigger({
+      from: "human",
+      author: last.author ?? body.author ?? "tester",
+      ...(authorIdOf(last.authorId) !== undefined ? { authorId: authorIdOf(last.authorId) } : {}),
+      id: `test-${wakeId}`,
+      sentAt: new Date(base).toISOString(),
+      trust,
+      ...(body.mention !== undefined ? { mention: body.mention } : {}),
+      body: last.text,
+    });
+  } else {
+    trigger = mkMessageTrigger({
+      from: "human",
+      author: body.author ?? "tester",
+      ...(body.authorId !== undefined ? { authorId: body.authorId } : {}),
+      id: `test-${wakeId}`,
+      sentAt: new Date().toISOString(),
+      trust,
+      ...(body.mention !== undefined ? { mention: body.mention } : {}),
+      body: text,
+    });
+  }
+
+  const nw: NormalizedWake = {
+    platform,
+    reason,
+    addressing,
+    wakeId,
+    ...(containerNoun !== undefined ? { containerNoun } : {}),
+    ...(body.engagementTier !== undefined ? { engagementTier: body.engagementTier } : {}),
+    ...(body.participants !== undefined ? { participants: body.participants } : {}),
+    ...(backscroll !== undefined ? { backscroll } : {}),
+    locus: {
+      channel: { id: containerId, ...(body.channelType !== undefined ? { type: body.channelType } : {}) },
+      ...(body.threadTs !== undefined ? { thread: { ts: body.threadTs } } : {}),
+    },
+    trigger,
+  };
+  const rendered = renderWake(nw);
+
+  // The auth the unified session runs under: identity attributes so the model routes by the right
+  // domain (divert stamps oe_platform + oe_wake_id on top). Caller attributes override the derived.
+  // The grain stamp (Stage F) rides in the auth attributes so stampUnifiedWindowAuth's `??` preserves
+  // it over the "standing" default (the same channel dispatchTaskWindow uses for a real task worker).
+  // Caller-supplied authAttributes still win last (so a test can force the oe_grain="" token-backstop
+  // path, e.g. F7's routine-fired turn), but a grain-route selector sets the default.
+  const authAttributes = {
+    ...attrsFromSurfaceKey(platform, surfaceKey),
+    ...(grainStamp !== undefined ? { [OE_GRAIN_ATTR]: grainStamp } : {}),
+    ...(body.authAttributes ?? {}),
+  };
+
+  // Self-audit BEFORE dispatch — the injection is the auditable event (best-effort; never throws).
+  await appendAudit({
+    org,
+    platform: "control",
+    workspace: "control",
+    principalId: identity.principalId,
+    action: "control.service_call",
+    detail: { service: identity.principalId, view: "test_wake", domain, injectedPlatform: platform, surfaceKey, addressing, wakeId, messageCount: coalesced ? coalesced.length : 1 },
+  }).catch(() => undefined);
+
+  try {
+    await divertToUnifiedWindow(to, {
+      message: rendered.message,
+      ...(rendered.context && rendered.context.length > 0 ? { context: rendered.context } : {}),
+      token,
+      window: { wakeId, origin, ...(addressing === "direct-mention" ? { addressing: "direct-mention" } : {}) },
+      surfaceKey,
+      auth: { attributes: authAttributes },
+    });
+  } catch (err) {
+    return json(500, { error: `injection failed: ${err instanceof Error ? err.message : String(err)}` });
+  }
+
+  return json(200, { ok: true, wakeId, token, domain, platform, surfaceKey, addressing, messageChars: rendered.message.length, messageCount: coalesced ? coalesced.length : 1 });
+}