@open-everywhere/core 0.1.0

package/agent/hooks/turn-anchor.ts

@@ -0,0 +1,682 @@
+// Writes the stop-registry anchor row and owns the whole stop-hand lifecycle, across `turn.started`, `actions.requested`, `action.result` and the three terminal arms.
+// Fail-soft throughout: this hook observes and decorates and must never fail a turn, so an unresolvable binding simply produces no anchor and no glyph.
+
+import { defineHook, type HookContext } from "eve/hooks";
+import { defineState } from "eve/context";
+import { appendAudit, readAudit } from "../audit/audit.js";
+import { resolvePartition } from "../memory/partition.js";
+import { bindFrom, channelPlatform, currentWakeId, deploymentOrg, type BindableContext } from "../identity/binding.js";
+import { STOP_HAND_SLACK_NAME, STOP_HAND_UNICODE } from "../status/status.js";
+import { setSurfaceReaction } from "../channels/surface-message-ops.js";
+import { postSurfaceText } from "../channels/surface-message-ops.js";
+import { clearTurnAnchor, recordTurnAnchor, turnAnchorAddress, turnAnchorKey, turnChannelKey } from "../channels/turn-registry.js";
+import { attachCancelNoteRequester, clearPendingCancelNoteAfter, readPendingCancelNote, setPendingCancelNote } from "../channels/cancel-note.js";
+import { findCancelRequest, findCancelRequester, TURN_CANCELLED_ACTION, TURN_STOP_IGNORED_ACTION, type CancelRequestRecord } from "../channels/turn-cancel.js";
+import { forgetBridgedQuestion } from "../channels/question-bridge.js";
+import { bareTokenFromEveContext } from "../channels/window-key.js";
+import { seedTailWindow, tailWindowFor } from "../channels/session-tail-record.js";
+import { domainKeyOf } from "../memory/partition.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { uningressedTurn } from "../access/task-wake-signal.js";
+import { closeTurnTally, openTurnTally, readTurnTally, recordTallyAction, recordTallyHand, recordTallyStep } from "./turn-tally.js";
+
+// Re-exported from channels/turn-cancel.ts, where the cancel action names live beside the request row they join back to, so a consumer that reads them from here keeps the import it always had.
+export { TURN_CANCELLED_ACTION, TURN_STOP_IGNORED_ACTION };
+
+/**
+ * What the room is told when a stop did not take effect. It must agree with the audit: the ingress already answered "Standing down", so a dropped cancel that nobody mentions leaves the person with a claim the evidence contradicts.
+ * The wording deliberately does NOT say the work finished — a `turn.failed` end reaches this line too.
+ */
+export const IGNORED_STOP_NOTE = "The stop did not take effect — this turn ended on its own before the cancel reached it. Nothing was interrupted.";
+
+/**
+ * eve emits `turn.completed` for a stopped turn whose in-flight model call RETURNED rather than aborted, and only then settles the cancel — measured about 455 ms apart — so at the ordinary arm "no cancel has settled" and "no cancel will settle" are one observation.
+ * It is a scheduling delay, never a sleep inside the arm: eve awaits this handler, so a blocking wait starves the very `turn.cancelled` dispatch it waits for. Too short writes a false finding; too long only delays a true one. It remains a horizon, not a proof — the residuals are in docs/security/audit-and-provenance.md.
+ */
+const CANCEL_SETTLE_GRACE_MS = 10_000;
+
+/** The live grace. Only {@link __setCancelSettleGraceForTest} changes it, so a deterministic tier can drive the whole arm without waiting out the shipped window. */
+let cancelSettleGraceMs = CANCEL_SETTLE_GRACE_MS;
+
+/** Shorten (or restore) the settle grace for a test. `undefined` restores the shipped value. The
+ *  grace must stay long enough for the test's own `turn.cancelled` to reach `markCancelSettled` —
+ *  that arm sets the flag on its first synchronous line, so a few hundred milliseconds is ample. */
+export function __setCancelSettleGraceForTest(ms?: number): void {
+  cancelSettleGraceMs = ms ?? CANCEL_SETTLE_GRACE_MS;
+}
+
+/** `(sessionId, turnId)` for every cancel this PROCESS has seen settle, with when it was seen. */
+const SETTLED_CANCELS = new Map<string, number>();
+
+/** For a test that must drive the DURABLE half of the settle check alone, with the in-memory witness out of the way. */
+export function __clearSettledCancelsForTest(): void {
+  SETTLED_CANCELS.clear();
+}
+
+const settledKey = (sessionId: string, turnId: string): string => `${sessionId}\u0000${turnId}`;
+
+/**
+ * Ignored-stop checks this process has scheduled and not yet resolved, by {@link settledKey}.
+ * The timer is best-effort: on this platform work scheduled "for later" may never run while work awaited inside a hook does, so the map is also drained from awaited hook arms ({@link drainDueIgnoredStops}). Awaiting the grace inline instead was measured to starve the `turn.cancelled` dispatch.
+ */
+const PENDING_IGNORED_STOPS = new Map<string, { timer: ReturnType<typeof setTimeout>; dueAt: number; resolve: () => Promise<void> }>();
+
+/**
+ * Resolve every scheduled check whose grace window has already elapsed, and wait for them.
+ * Only what is DUE: a check still inside its window is left alone, because a cancel that settles inside the window is not an ignored stop. That matters most at the earliest drain point, the next turn's start.
+ */
+async function drainDueIgnoredStops(): Promise<void> {
+  const now = Date.now();
+  const due = [...PENDING_IGNORED_STOPS.entries()].filter(([, entry]) => entry.dueAt <= now);
+  for (const [key, entry] of due) {
+    clearTimeout(entry.timer);
+    PENDING_IGNORED_STOPS.delete(key);
+  }
+  await Promise.all(due.map(([, entry]) => entry.resolve()));
+}
+
+/** Run every scheduled ignored-stop check now, due or not, so no test assertion about this arm depends on a clock. */
+export async function __flushIgnoredStopChecksForTest(): Promise<void> {
+  const pending = [...PENDING_IGNORED_STOPS.values()];
+  PENDING_IGNORED_STOPS.clear();
+  for (const entry of pending) clearTimeout(entry.timer);
+  await Promise.all(pending.map((entry) => entry.resolve()));
+}
+
+/** How many checks are scheduled and unresolved — so a test can assert a DROP actually happened,
+ *  rather than inferring it from a silence the settled-witness guard would produce anyway. */
+export function __pendingIgnoredStopCountForTest(): number {
+  return PENDING_IGNORED_STOPS.size;
+}
+
+/** Drop a scheduled check without running it — the cancel settled, so there is nothing to report. */
+function dropPendingIgnoredStop(sessionId: string, turnId: string): void {
+  const key = settledKey(sessionId, turnId);
+  const entry = PENDING_IGNORED_STOPS.get(key);
+  if (entry === undefined) return;
+  clearTimeout(entry.timer);
+  PENDING_IGNORED_STOPS.delete(key);
+}
+
+/**
+ * Record that `turn.cancelled` really reached this process, at the EARLIEST point the arm can say so — before any await, so a slow store read in the cancelled arm can never let the ignored-stop arm conclude the cancel never came.
+ * Entries are pruned on write, well past {@link CANCEL_SETTLE_GRACE_MS}, so a long-lived warm process cannot accumulate them.
+ */
+function markCancelSettled(sessionId: string, turnId: string): void {
+  const cutoff = Date.now() - 10 * Math.max(cancelSettleGraceMs, CANCEL_SETTLE_GRACE_MS);
+  for (const [key, at] of SETTLED_CANCELS) if (at < cutoff) SETTLED_CANCELS.delete(key);
+  SETTLED_CANCELS.set(settledKey(sessionId, turnId), Date.now());
+  dropPendingIgnoredStop(sessionId, turnId);
+}
+
+/**
+ * Turns this process saw reach an ORDINARY terminal event — the witness {@link onTurnCancelled} needs to tell "the slot died with the cancelled step" apart from "this turn already finished".
+ * `stopRequested` is three-state and `undefined` is not `false`: it stays undefined whenever the turn's own end arm did not conclude, and the cancelled arm suppresses on a definite `false` and on nothing else.
+ */
+const ENDED_TURNS = new Map<string, { at: number; stopRequested?: boolean }>();
+
+/** For a test that must drive the cancelled arm's recovery path with the ended-turn witness out of the way. */
+export function __clearEndedTurnsForTest(): void {
+  ENDED_TURNS.clear();
+}
+
+/**
+ * Record that a turn reached `turn.completed` or `turn.failed` in this process, before any await — the same discipline {@link markCancelSettled} keeps.
+ * The stop answer is UNKNOWN at this point and {@link recordEndedTurnStopAnswer} fills it in. Pruned on write on the same horizon as the settled-cancel witness.
+ */
+function markTurnEnded(sessionId: string, turnId: string): void {
+  const cutoff = Date.now() - 10 * Math.max(cancelSettleGraceMs, CANCEL_SETTLE_GRACE_MS);
+  for (const [key, at] of ENDED_TURNS) if (at.at < cutoff) ENDED_TURNS.delete(key);
+  ENDED_TURNS.set(settledKey(sessionId, turnId), { at: Date.now() });
+}
+
+/** Fill in the stop answer for a turn this process already marked ended. Never CREATES an entry: a
+ *  turn whose end this process did not see is not one the cancelled arm may suppress. */
+function recordEndedTurnStopAnswer(sessionId: string, turnId: string, stopRequested: boolean): void {
+  const entry = ENDED_TURNS.get(settledKey(sessionId, turnId));
+  if (entry) entry.stopRequested = stopRequested;
+}
+
+/**
+ * Did this process see the turn end ordinarily AND establish that no accepted stop was asked for?
+ * It answers `false` for every inconclusive shape — the turn is still running, it ended in another process, or its end arm could not read the store.
+ */
+function endedWithNoStopRequested(sessionId: string, turnId: string): boolean {
+  return ENDED_TURNS.get(settledKey(sessionId, turnId))?.stopRequested === false;
+}
+
+/** Per-session state in eve's slot, reset at every `turn.started`. */
+interface TurnAnchorState {
+  readonly turnId: string;
+  /** eve's session id. Half of the turn tally's key — a turn id alone repeats across sessions. */
+  readonly sessionId: string;
+  readonly org: string;
+  readonly windowKey: string;
+  /** Resolved once at turn start so the later arms never re-derive (and never disagree). */
+  readonly platform?: string;
+  readonly channelId?: string;
+  readonly messageId?: string;
+  readonly workspace: string;
+  readonly surfaceKey: string;
+  /** True once ✋ has actually landed — so later delegations in the same turn are no-ops, and the
+   *  turn-end arm never tries to remove a glyph that was never added. */
+  handPlaced: boolean;
+  /** Tool names that COMPLETED in this turn, oldest first. Names only, never inputs or outputs. */
+  ran: string[];
+  /** Model calls that completed — the unit the cancel note reports as "steps in". */
+  steps: number;
+  // The last three are also kept in hooks/turn-tally.ts, and the tally is what the terminal arms
+  // read. These copies are the RECOVERY fallback: they cross a process boundary, which the tally
+  // cannot, and they are short by the aborted step, which the tally is not.
+}
+
+const slot = defineState<TurnAnchorState | null>("open-everywhere.turn-anchor", () => null);
+
+function read(): TurnAnchorState | null {
+  try {
+    return slot.get();
+  } catch {
+    return null; // no session context (sessionless schedules/evals) — nothing to anchor
+  }
+}
+
+function write(next: TurnAnchorState | null): void {
+  try {
+    slot.update(() => next);
+  } catch {
+    /* no session context */
+  }
+}
+
+function mutate(fn: (s: TurnAnchorState) => void): void {
+  try {
+    slot.update((prev) => {
+      if (prev) fn(prev);
+      return prev;
+    });
+  } catch {
+    /* no session context */
+  }
+}
+
+/**
+ * Both delegation routes count: a `subagent-call`, and a `tool-call` named `agent`.
+ * Measured (OPE-1188): eve reports the built-in `agent` as a `tool-call`, so deleting that arm turns tests/integration/liveness/turn-delegation-glyph.test.ts red while deleting the other leaves it green. The `subagent-call` arm is unwitnessed rather than known-dead — keep both.
+ */
+function isDelegation(action: { readonly kind: string; readonly toolName?: string }): boolean {
+  return action.kind === "subagent-call" || (action.kind === "tool-call" && action.toolName === "agent");
+}
+
+/** The ✋ glyph in both spellings — Slack wants a bare shortcode, Discord wants the unicode char. */
+const STOP_HAND = { slackName: STOP_HAND_SLACK_NAME, unicode: STOP_HAND_UNICODE } as const;
+async function onTurnStarted(turnId: string, ctx: HookContext): Promise<void> {
+  const c = ctx as unknown as BindableContext;
+  const partition = resolvePartition(c);
+  const binding = bindFrom(c);
+  // On a UNIFIED window the platform is per-DELIVERY, not per-session, so ask the delivery stamp
+  // first — a unified seat bound at session start would otherwise decorate the wrong surface.
+  const platform = channelPlatform(c) ?? binding.platform;
+  // The message half of the address is the thread ROOT, where the status reactions already live — deliberately not the triggering message, because an anchor that moves per message is a different affordance.
+  // The derivation and its fallback order live in `turnAnchorAddress`, so the recovery rebuild below cannot drift from this one.
+  const { channelId, messageId } = turnAnchorAddress(binding);
+  // Falls back to the session id so the row is ALWAYS written: a turn with no continuation token — a task session, a routine fire — is still stoppable by its anchor message, and a row that exists beats a hole in the registry.
+  const windowKey = ctx.channel?.continuationToken ?? ctx.session.id;
+
+  write({
+    turnId,
+    sessionId: ctx.session.id,
+    org: partition.org,
+    windowKey,
+    ...(platform ? { platform } : {}),
+    ...(channelId ? { channelId } : {}),
+    ...(messageId ? { messageId } : {}),
+    workspace: partition.workspace,
+    surfaceKey: partition.surfaceKey,
+    handPlaced: false,
+    ran: [],
+    steps: 0,
+  });
+
+  // Only where the eve slot is writable. `action.result` and `step.completed` read the slot to learn which turn they belong to, so where it is unwritable — a sessionless schedule, an eval — they write nothing.
+  // A tally opened there would sit empty and then report "nothing ran" as a MEASURED fact, which is the one claim this seam exists to prevent.
+  // THE WAKE THIS TURN WAS OPENED FOR is captured HERE, from the delivery that opened it, and carried
+  // on the tally to the turn's end (OPE-2051). `onTurnEnded` cannot read it itself: the auth slot
+  // holds the LAST delivery, which on a standing seat need not be the one this turn ran for. It is an
+  // ID only — what it MEANS is resolved at turn end, and only when a cancel note is actually pending.
+  if (read()?.turnId === turnId) openTurnTally(ctx.session.id, turnId, currentWakeId(c));
+
+  // Seed the TAIL window here: the reply choke points run deep inside a tool execute with no context of their own, so the facts they need are resolved once per turn where a live ctx exists. Which generation, or none, is `tailWindowFor`'s decision.
+  // The slot does cross from this hook into a tool execute, and that is measured: eve dispatches a `turn.started` hook from inside the same `runStep` context scope the tool execute runs in, so both see one `defineState` container.
+  seedTailWindow(
+    tailWindowFor({
+      org: partition.org,
+      domainKey: domainKeyOf(partition),
+      surfaceKey: partition.surfaceKey,
+      rawToken: ctx.channel?.continuationToken,
+      ...(platform ? { platform } : {}),
+    }),
+  );
+
+  await recordTurnAnchor(
+    partition.org,
+    {
+      windowKey,
+      ...(turnAnchorKey(platform, channelId, messageId) ? { anchorKey: turnAnchorKey(platform, channelId, messageId)! } : {}),
+      ...(turnChannelKey(platform, channelId) ? { channelKey: turnChannelKey(platform, channelId)! } : {}),
+      sessionId: ctx.session.id,
+      turnId,
+      surfaceKey: partition.surfaceKey,
+    },
+    new Date().toISOString(),
+  );
+}
+
+/** Add ✋ once per turn, on the first delegation. Idempotent by the `handPlaced` flag, so a turn that
+ *  delegates ten times still makes one API call. */
+async function placeStopHand(): Promise<void> {
+  const s = read();
+  if (!s || s.handPlaced || !s.platform || !s.channelId || !s.messageId) return;
+  // Mark BEFORE the await: two delegations in one `actions.requested` batch would otherwise both
+  // see `handPlaced: false` and both call out. Marked in BOTH writers — the slot keeps the recovery
+  // path working, and the tally is the one the cancelled arm reads (OPE-765).
+  mutate((st) => {
+    st.handPlaced = true;
+  });
+  recordTallyHand(s.sessionId, s.turnId, true);
+  const landed = await setSurfaceReaction(s.platform, { channelId: s.channelId, messageId: s.messageId }, STOP_HAND, true);
+  if (!landed) {
+    // The surface has no reaction primitive, or the scope is missing. Un-mark so the turn-end arm
+    // doesn't try to remove a glyph that never appeared.
+    mutate((st) => {
+      st.handPlaced = false;
+    });
+    recordTallyHand(s.sessionId, s.turnId, false);
+  }
+}
+
+async function removeStopHand(s: TurnAnchorState): Promise<void> {
+  if (!s.handPlaced || !s.platform || !s.channelId || !s.messageId) return;
+  await setSurfaceReaction(s.platform, { channelId: s.channelId, messageId: s.messageId }, STOP_HAND, false);
+}
+
+/**
+ * What the turn had already done, in one sentence a human can read. A cancel undoes nothing, and on a chat surface the human cannot otherwise see the work that was interrupted.
+ * "Stood down", never "stopped" and never "undone": a running sandbox command cannot be killed at all, so a stronger word would be a lie.
+ *
+ * 🔴 THE NOTE COUNTS THE ACTIONS AND NEVER NAMES THEM (OPE-1819). `ran` holds the harness's own tool vocabulary — `bash`, `todo` — and this text is HOST-authored, so it lands in a member's channel with no prompt rule able to reach it. A member cannot act on a tool name, and the names read as internals: soak-2026-09-12-a step 15 posted "Already done, and NOT undone: `bash`, `bash`, `todo` (and 13 earlier)". The member-facing fact is how much ran and that none of it was undone, so that is what the note says.
+ */
+export function renderCancelNote(steps: number, ran: readonly string[], accounted = true): string {
+  // `accounted: false` means the per-turn accumulator died with the cancelled step. "Nothing had run yet" would then be an INVENTED fact when the truth is that nobody knows, so say what is known and say that the rest is not.
+  if (!accounted) return CANCEL_NOTE_UNACCOUNTED;
+  const where = steps === 1 ? "one step in" : `${steps} steps in`;
+  if (ran.length === 0) return `Stood down — ${where}, nothing had run yet.`;
+  const done = ran.length === 1 ? "One action had already run, and it is" : `${ran.length} actions had already run, and they are`;
+  return `Stood down — ${where}. ${done} NOT undone.`;
+}
+
+/** The one sentence {@link renderCancelNote} writes when the turn tally did not survive the cancel.
+ *  Named so {@link isTurnCancelNote} and the renderer cannot drift apart. */
+const CANCEL_NOTE_UNACCOUNTED =
+  "Stood down. I cannot say how far in it was — the cancel discarded that record. Anything already done is NOT undone.";
+
+/**
+ * The accounted shapes {@link renderCancelNote} produces, matched by their own shape and never by `.+`.
+ * Measured: a wildcard tail matched model prose that merely opened the same way — "Stood down - 2 steps in. Already done, and NOT undone: the report." passed as a cancel note — and a reader that believed it would discard the very message it waits for. The counts are the only variable parts, so they are the only thing this pattern leaves open.
+ */
+const CANCEL_NOTE_ACCOUNTED =
+  /^Stood down — (?:one step in|\d+ steps in)(?:, nothing had run yet\.|\. (?:One action had already run, and it is|\d+ actions had already run, and they are) NOT undone\.)$/;
+
+/**
+ * Is this room message a turn-CANCEL note rather than an answer? The `turn.cancelled` arm posts it and writes no `reply.post` row, so an unfiltered `awaitReply` can return it instead of the answer (measured on ship #197).
+ * The match is EXACT over the shapes {@link renderCancelNote} produces, never a "Stood down" prefix and never a wildcard action list: the stand-down acknowledgement is model-authored prose on the same subject.
+ */
+export function isTurnCancelNote(text: string): boolean {
+  const t = text.trim();
+  return t === CANCEL_NOTE_UNACCOUNTED || CANCEL_NOTE_ACCOUNTED.test(t);
+}
+
+/** `accounted` is the honest half: `false` says NEITHER the turn tally NOR the eve slot could answer, so `steps` and `ran` are unknown rather than zero and empty. Every consumer must branch on it. */
+interface CancelledTurnFacts extends TurnAnchorState {
+  readonly accounted: boolean;
+}
+
+/**
+ * Rebuild the ADDRESSING half of a cancelled turn from the hook's own context; the counts are the caller's business.
+ * Measured (OPE-745): eve serializes a context slot at the END of a workflow step, so a turn cancelled inside its FIRST step has no committed slot and `read()` answers `null`. Returns `null` when there is no usable context, which restores the old early return exactly.
+ */
+function reconstructCancelledTurn(turnId: string, ctx: HookContext | undefined): TurnAnchorState | null {
+  if (ctx === undefined) return null;
+  try {
+    const c = ctx as unknown as BindableContext;
+    const partition = resolvePartition(c);
+    const binding = bindFrom(c);
+    const platform = channelPlatform(c) ?? binding.platform;
+    const { channelId, messageId } = turnAnchorAddress(binding);
+    const windowKey = ctx.channel?.continuationToken ?? ctx.session.id;
+    return {
+      turnId,
+      sessionId: ctx.session.id,
+      org: partition.org,
+      windowKey,
+      ...(platform ? { platform } : {}),
+      ...(channelId ? { channelId } : {}),
+      ...(messageId ? { messageId } : {}),
+      workspace: partition.workspace,
+      surfaceKey: partition.surfaceKey,
+      // Neutral values, not claims: this function answers where the turn is, never what it did. The caller overwrites all three from the turn tally, or marks the result `accounted: false`.
+      // `handPlaced: false` is also the SAFE direction on a tally miss — the glyph lives on the SEAT's thread root, so a worker's cancel that assumed `true` would strip the stop button off the seat's own turn, which is usually still running.
+      handPlaced: false,
+      ran: [],
+      steps: 0,
+    };
+  } catch {
+    return null;
+  }
+}
+
+async function onTurnCancelled(turnId: string, ctx?: HookContext): Promise<void> {
+  const live = read();
+  // First line, before every guard and every await: the ordinary terminal arm is waiting out a grace window to decide whether this cancel is ever coming, and this is the answer.
+  // Recorded under BOTH session ids the two arms can derive, because a mismatch or a missing slot makes them disagree — and disagreeing posts a false "the stop did not take effect" into a room whose stop worked.
+  for (const sessionId of new Set([live?.sessionId, ctx?.session.id])) {
+    if (sessionId !== undefined) markCancelSettled(sessionId, turnId);
+  }
+  // A slot holding a DIFFERENT turn still returns. The recovery below answers only "the slot is empty"; a mismatch means the session holds live state for another turn.
+  // Closing this event against it would clear that turn's anchor row and wipe its accumulator, taking the stop button off a turn that is still running.
+  if (live && live.turnId !== turnId) {
+    // The arm does nothing for a mismatch, but the cancelled turn is dead either way — drop its
+    // tally so the entry does not wait for the eviction bound in a warm process.
+    closeTurnTally(live.sessionId, turnId);
+    return;
+  }
+  const addressing = live ?? reconstructCancelledTurn(turnId, ctx);
+  if (!addressing) return;
+  // A cancel for a turn this process already saw END, whose end arm ESTABLISHED that no stop was accepted, cancelled nothing. Measured: eve stamps a late delivery cancellation from the last persisted emission state, so it comes back addressed to the finished turn.
+  // The suppression needs that definite `false` carried on {@link ENDED_TURNS}, never an absent request row read here, and the witness is process-local. The branch drops only the orphaned bridged question; the anchor row is left to its TTL rather than risk clearing a live turn's.
+  if (endedWithNoStopRequested(addressing.sessionId, turnId)) {
+    closeTurnTally(addressing.sessionId, turnId);
+    const orphaned = bareTokenFromEveContext(addressing.windowKey);
+    if (orphaned !== undefined) await forgetBridgedQuestion(getOperationalStore(), addressing.org, orphaned);
+    return;
+  }
+  // The tally wins whenever it answers: it is the only witness that saw the ABORTED step, so it names the tools that ran there. The slot is second and is short by exactly that step; neither answering means `accounted: false`.
+  const tally = readTurnTally(addressing.sessionId, turnId);
+  const s: CancelledTurnFacts = tally
+    ? { ...addressing, handPlaced: tally.handPlaced, ran: [...tally.ran], steps: tally.steps, accounted: true }
+    : { ...addressing, accounted: live !== null };
+  // Dropped here, not at the end: nothing below reads it, and a throw on any later await would
+  // otherwise leave the entry to the eviction bound.
+  closeTurnTally(addressing.sessionId, turnId);
+  // First, before any await that could throw: hand the reconstruction to the next turn.
+  // The room's copy and the audit row below are for people; this is the MODEL's copy, and the only one that stops the agent redoing work whose history the cancel just discarded.
+  setPendingCancelNote({ turnId, steps: s.steps, ran: [...s.ran], accounted: s.accounted });
+  await removeStopHand(s);
+  await clearTurnAnchor(s.org, s.windowKey);
+  // The cancel ORPHANS any question this window was proxying for a delegated worker: eve's `settleCancelledTurnStep` ends by calling `clearAllProxyInputRequests`, which wipes the session's whole proxy map.
+  // Leaving the row would make the room's next message a `respond` addressed to nothing. Best-effort: `forgetBridgedQuestion` never throws, and the row also dies by TTL.
+  const bare = bareTokenFromEveContext(s.windowKey);
+  if (bare !== undefined) await forgetBridgedQuestion(getOperationalStore(), s.org, bare);
+
+  // The human-facing truth. It comes from HERE, not from the ingress route that asked for the
+  // cancel, because eve's `cancel()` returns `accepted` even when nothing was cancelled — this
+  // event is the only proof a turn actually stopped.
+  const note = renderCancelNote(s.steps, s.ran, s.accounted);
+  if (s.platform && s.channelId) {
+    await postSurfaceText(s.platform, { channelId: s.channelId, text: note, threadTs: s.messageId ?? null });
+  }
+
+  // Naming the requester runs LAST, deliberately: after `setPendingCancelNote`, so a slow or failed audit read costs the name and never the reconstruction, and after the room post, so nothing a human waits on sits behind a store read.
+  // The read never throws and yields `undefined` when nothing matches; the note then renders as it did before.
+  const by = await findCancelRequester(s.org, turnId, s.sessionId);
+  if (by) attachCancelNoteRequester(turnId, by);
+
+  try {
+    await appendAudit({
+      org: s.org,
+      platform: s.platform ?? "unknown",
+      workspace: s.workspace,
+      action: TURN_CANCELLED_ACTION,
+      // Tool NAMES and counts only — what the actions did is already in their own per-action audit rows.
+      // The unaccounted row OMITS `steps` and `ran` rather than writing 0 and []: a reader cannot tell an invented zero from a measured one, and this row is the operator's evidence that a turn really stopped. `sessionId` and `turnId` are the join keys to the paired rows.
+      detail: s.accounted
+        ? { surfaceKey: s.surfaceKey, sessionId: s.sessionId, turnId, steps: s.steps, ran: s.ran, accounted: true }
+        : { surfaceKey: s.surfaceKey, sessionId: s.sessionId, turnId, accounted: false },
+    });
+  } catch {
+    /* observation only */
+  }
+  write(null);
+}
+
+/** Throws when the store does, on purpose. The caller must tell "the cancel did not settle" apart from "I could not find out", because reading an unreadable store as the former posts a false "the stop did not take effect" into the room. */
+/**
+ * Is there already a row of `action` for this exact turn? The window is anchored at the turn's END, never at the moment this runs: the check resolves on a timer or a later drain, and a window measured backwards from then would start after the row it looks for was written. The shipped grace is the unit, never the test one.
+ * The idempotency guard is a READ, not a transaction: two processes each holding a grace window for the same `(sessionId, turnId)` can both read no row and both append one, so a consumer counts distinct pairs and never rows.
+ */
+async function pairedRowExists(org: string, action: string, sessionId: string, turnId: string, endedAt: number): Promise<boolean> {
+  const since = new Date(Math.min(Date.now(), endedAt) - 4 * CANCEL_SETTLE_GRACE_MS).toISOString();
+  const rows = await readAudit({ org, action, since, limit: 50 });
+  return rows.some((row) => row.detail?.["turnId"] === turnId && row.detail?.["sessionId"] === sessionId);
+}
+
+/**
+ * The ignored-stop arm, the only writer of {@link TURN_STOP_IGNORED_ACTION}. An ordinary terminal event is only provisional evidence, so it ASKS TWICE: once for the request row, then again after the grace window for any sign the cancel landed. Only an ACCEPTED request counts, and the row is written before the room post.
+ * It returns that request answer so the cancelled arm never asks again, and a throw propagates instead of being reported as `false`, which leaves the ended-turn witness UNKNOWN.
+ */
+async function auditIgnoredStop(s: TurnAnchorState, turnId: string, endedAs: "completed" | "failed"): Promise<boolean> {
+  const request = await findCancelRequest({ org: s.org, turnId, sessionId: s.sessionId });
+  if (request?.outcome !== "requested") return false;
+  // Schedule, never sleep in the arm. A blocking wait here was measured wrong on the real host: eve awaits this handler, so the wait cannot be told apart from starving the very `turn.cancelled` dispatch it waits for, and makes its own answer come out "ignored".
+  const key = settledKey(s.sessionId, turnId);
+  if (PENDING_IGNORED_STOPS.has(key)) return true;
+  // WHEN the turn ended, carried down so every later read is measured from HERE and not from
+  // whenever the check happens to run. See `pairedRowExists`.
+  const endedAt = Date.now();
+  const resolve = async (): Promise<void> => {
+    PENDING_IGNORED_STOPS.delete(key);
+    try {
+      await writeIgnoredStop(s, turnId, endedAs, request, endedAt);
+    } catch (err) {
+      console.error(
+        `[open-everywhere:turn-anchor] 🔴 the ignored-stop check FAILED for turn ${turnId}: ${String(err)} — a stop was accepted for this turn and its ${TURN_STOP_IGNORED_ACTION} record may be incomplete (the row, the room note, or both)`,
+      );
+    }
+  };
+  const timer = setTimeout(() => void resolve(), cancelSettleGraceMs);
+  PENDING_IGNORED_STOPS.set(key, { timer, dueAt: endedAt + cancelSettleGraceMs, resolve });
+  return true;
+}
+
+/**
+ * Two signals suppress the row and they cover different cases: `SETTLED_CANCELS`, set on the cancelled arm's first synchronous line so a slow store cannot turn a settled cancel into a false finding, and the durable `turn.cancelled` ROW, which answers in a process that never saw the event. A cancel that arrived but wrote no row, in another process, still defeats both.
+ * The row is idempotent on `(sessionId, turnId)`: eve re-executes an uncommitted inline step body on redelivery, so without these reads a redelivery appends a second row and posts the room note twice.
+ */
+async function writeIgnoredStop(s: TurnAnchorState, turnId: string, endedAs: "completed" | "failed", request: CancelRequestRecord, endedAt: number): Promise<void> {
+  if (SETTLED_CANCELS.has(settledKey(s.sessionId, turnId))) return;
+  if (await pairedRowExists(s.org, TURN_CANCELLED_ACTION, s.sessionId, turnId, endedAt)) return;
+  if (await pairedRowExists(s.org, TURN_STOP_IGNORED_ACTION, s.sessionId, turnId, endedAt)) return;
+  await appendAudit({
+    org: s.org,
+    platform: s.platform ?? "unknown",
+    workspace: s.workspace,
+    action: TURN_STOP_IGNORED_ACTION,
+    // WHO asked, verbatim and in the same column the request row uses, so one query answers "which
+    // of this person's stops actually worked".
+    ...(request.principalId ? { principalId: request.principalId } : {}),
+    // Ids and names only, the same discipline every other operational row keeps. `sessionId` and
+    // `turnId` are the join back to the request row; `endedAs` is the fact that makes this row a
+    // FINDING rather than a guess — the turn reached an ordinary terminal event.
+    detail: {
+      surfaceKey: s.surfaceKey,
+      sessionId: s.sessionId,
+      turnId,
+      endedAs,
+      ...(request.via ? { via: request.via } : {}),
+      ...(request.at ? { requestedAt: request.at } : {}),
+    },
+  });
+  if (s.platform && s.channelId) {
+    await postSurfaceText(s.platform, { channelId: s.channelId, text: IGNORED_STOP_NOTE, threadTs: s.messageId ?? null });
+  }
+}
+
+/**
+ * Did a PERSON send the delivery that opened the turn that just ended (OPE-2051)? TWO facts answer it, and neither costs anything on an ordinary turn.
+ * 🔴 FIRST, A TURN THAT BROUGHT NO DELIVERY OF ITS OWN IS NOT A TURN A PERSON SENT. A background task settling wakes its parent through the session's own command hook with NO auth, so it carries no wake id at `turn.started` at all — the task's own wake id is installed later, at the settlement edge. {@link uningressedTurn} is the fact that names it, it is turn-keyed, and it already answers FALSE for everything it cannot prove, so the unknown direction below is unchanged.
+ * SECOND, for a turn that DID bring a delivery, the wake row's own `inbound` column — the fact the divert decides once, from the same `internalDispatch` input the spend gate and the ingress row turn on.
+ * 🔴 WHAT THIS DOES NOT COVER, said out loud: the AUTO-REDRIVE. Its corrective wake deliberately re-stamps the ORIGINAL wake id (`channels/unified-redrive.ts`), and `inbound` is STICKY-TRUE on upsert, so a correction of a person's own dropped answer reads attended and retires the note exactly as it did before. That stickiness is right for the reply-freshness gate, which is what it was written for, and this reader inherits it. Covering the re-drive needs a per-DELIVERY carrier, and the one that was tried perturbed a scripted fixture for reasons nobody established.
+ * 🔴 EVERY UNKNOWN READS AS ATTENDED, which is exactly the behaviour this deployment had before the ticket. A wake id with no row (a per-surface delivery registers none), a legacy row with no column, or a store error all answer TRUE. Answering false on an unknown would leave a cancel reconstruction standing for the rest of the session.
+ * BOTH reads are taken only where a cancel note is actually pending, so the ordinary turn pays nothing — the gate's own note records what that cost measured as.
+ */
+async function endedTurnWasAttended(turnId: string, wakeId: string | undefined): Promise<boolean> {
+  // 🔴 NOTHING PENDING ⇒ READ NOTHING AT ALL, and this gate comes FIRST for a measured reason. Both
+  // reads below touch state the turn-end arm never touched before — an eve `defineState` slot and the
+  // store — and eve SERIALIZES a step's slot container, so a read on the ordinary turn is not free the
+  // way a pure call is. Reading `uningressedTurn` unconditionally here turned
+  // `tests/integration/tasks/scripted-model-redrive-silence.test.ts` red in shard 2 of the full tier,
+  // on a branch whose previous head ran that shard green. The NOTE slot is not new traffic: the clear
+  // below has always read and written it on every turn end.
+  if (readPendingCancelNote() === null) return true;
+  if (wakeId === undefined || wakeId.length === 0) return !uningressedTurn(turnId);
+  try {
+    const record = await getOperationalStore().getUnifiedWakeRecord(deploymentOrg(), wakeId);
+    return record?.inbound !== false;
+  } catch {
+    return true;
+  }
+}
+
+async function onTurnEnded(turnId: string, ctx: HookContext | undefined, endedAs: "completed" | "failed"): Promise<void> {
+  const s = read();
+  // Before every await, and under BOTH session ids the arms can derive — the same discipline and the same reason as `markCancelSettled`.
+  // This is the only record that the turn reached an ordinary end, and the cancelled arm's guard reads it for a cancel event that arrives after.
+  for (const id of new Set([s?.sessionId, ctx?.session.id])) if (id !== undefined) markTurnEnded(id, turnId);
+  const sessionId = s?.sessionId ?? ctx?.session.id;
+  // ONE rule for glyph ownership on both terminal paths: the tally answers when it can. On this path
+  // the slot is usually right too — the delegating step committed — so the two agree except when the
+  // ✋ landed in the same step that ended the turn.
+  const tally = sessionId === undefined ? null : readTurnTally(sessionId, turnId);
+  // 🔴 ONLY A TURN A PERSON SENT RETIRES THE CANCEL RECONSTRUCTION (OPE-2051; Tommy's ruling of 2026-09-24). The note is "the only thing standing between a cancel and a silent double-execution" (`channels/cancel-note.ts`), and it is addressed to the next turn a person opens. A turn the deployment minted for ITSELF — a task spawn, a task settling, an approval-decision wake, a routine fire — that ends between the cancel and the human's next message used to retire it, and the human's next prompt then carried no reconstruction at all. {@link endedTurnWasAttended} states which classes this covers and which one it does not.
+  // 🔴 THE RENDER CANNOT BE THE DISCRIMINATOR, and the ticket's own wording ("unless it rendered the note") reads as though it could. It cannot: `instructions/access.ts` re-renders the dynamic scope on EVERY turn of the session with no attendedness test, so "rendered it" is true of every turn including the self-minted ones. The fact that separates them is WHO SENT THE DELIVERY, and the host already decides it once, at the divert, and writes it to the wake row's `inbound` column.
+  // 🔴 THE READ IS PAID ONLY WHEN A NOTE IS PENDING, which is the rare turn after a cancel and never the ordinary one. Carrying the fact on the delivery AUTH instead was tried and reverted: an extra attribute on an internal dispatch's bag turned `tests/integration/tasks/scripted-model-redrive-silence.test.ts` red in the full tier while the whole tier is green on clean `main`, and the mechanism was not established. The wake row was already keeping the fact, so nothing about a delivery changes here.
+  // Still BEFORE the anchor guard, for the reason the clear has always been: a turn with no anchor row must retire the note too, or a stale reconstruction rides every later prompt. Every unknown reads as ATTENDED — no tally, no wake id, an unreadable row, a legacy row with no column, or a per-surface delivery that registers no row at all — which is today's behaviour in each case.
+  clearPendingCancelNoteAfter(turnId, await endedTurnWasAttended(turnId, tally?.wakeId));
+  // Dropped even when there is no anchor state to act on, so a fail-softed `turn.started` arm cannot
+  // leave an entry behind in a warm process.
+  if (sessionId !== undefined) closeTurnTally(sessionId, turnId);
+  const live = s && s.turnId === turnId ? s : null;
+  if (live) {
+    await removeStopHand(tally ? { ...live, handPlaced: tally.handPlaced } : live);
+    await clearTurnAnchor(live.org, live.windowKey);
+    write(null);
+  }
+  // The ignored-stop check runs even where the clean-up above did not, and the two guards ask different questions: clearing an anchor or a glyph against a slot holding ANOTHER turn would take the stop button off a running turn.
+  // This half only reads the audit and writes a row of its own, so a slot that cannot answer costs nothing — the addressing then comes from the hook's own ctx.
+  const addressing = live ?? reconstructCancelledTurn(turnId, ctx);
+  if (!addressing) return;
+  // Fail-loud, unlike every other arm here: losing this costs the only record that a stop was ignored, and an absence reads exactly like "no stop was ever requested".
+  try {
+    const stopRequested = await auditIgnoredStop(addressing, turnId, endedAs);
+    // 🔴 ONLY ON A CONCLUDED READ (OPE-1724), and under every session id `markTurnEnded` marked. The
+    // throw below deliberately leaves the witness UNKNOWN: the cancelled arm must not read "I could
+    // not find out" as "nobody asked to stop" and delete a note that a person is owed.
+    for (const id of new Set([s?.sessionId, ctx?.session.id, addressing.sessionId])) if (id !== undefined) recordEndedTurnStopAnswer(id, turnId, stopRequested);
+  } catch (err) {
+    console.error(
+      `[open-everywhere:turn-anchor] 🔴 the ignored-stop check FAILED for turn ${turnId}: ${String(err)} — if a stop was accepted for this turn, NO ${TURN_STOP_IGNORED_ACTION} row was written for it`,
+    );
+  }
+}
+
+export default defineHook({
+  events: {
+    "turn.started": async (event, ctx: HookContext) => {
+      try {
+        await onTurnStarted(event.data.turnId, ctx);
+      } catch (err) {
+        console.warn(`[open-everywhere:turn-anchor] turn.started failed: ${String(err)}`);
+      }
+      // An awaited drain, because a timer is not enough: on this platform work scheduled "for later" may never run while work awaited inside a hook does, and a turn end can be an invocation's last act.
+      // Every awaited arm that can run after a turn ended drains what is due — this one for the next turn in the same window, the two session arms below for the end of the session.
+      try {
+        await drainDueIgnoredStops();
+      } catch (err) {
+        console.warn(`[open-everywhere:turn-anchor] ignored-stop drain failed: ${String(err)}`);
+      }
+    },
+    "actions.requested": async (event) => {
+      try {
+        if (event.data.actions.some((a) => isDelegation(a as { kind: string; toolName?: string }))) await placeStopHand();
+      } catch (err) {
+        console.warn(`[open-everywhere:turn-anchor] actions.requested failed: ${String(err)}`);
+      }
+    },
+    "action.result": async (event) => {
+      // Names of the actions that actually EXECUTED — the raw material for the cancel note. Skip
+      // `rejected` (an approval-denied call never ran, so naming it would be a false confession).
+      try {
+        const result = event.data.result as { kind?: string; toolName?: string };
+        if (result?.kind === "tool-result" && event.data.status !== "rejected" && typeof result.toolName === "string") {
+          const name = result.toolName;
+          // BOTH writers, on purpose. The slot is the recovery fallback; the tally is what survives
+          // an abort inside this step, and it is the one the cancelled arm prefers (OPE-764).
+          const s = read();
+          if (s) recordTallyAction(s.sessionId, s.turnId, name);
+          mutate((st) => {
+            st.ran.push(name);
+          });
+        }
+      } catch {
+        /* accumulation is best-effort */
+      }
+    },
+    "step.completed": async () => {
+      try {
+        const s = read();
+        if (s) recordTallyStep(s.sessionId, s.turnId);
+        mutate((st) => {
+          st.steps += 1;
+        });
+      } catch {
+        /* accumulation is best-effort */
+      }
+    },
+    "turn.completed": async (event, ctx: HookContext) => {
+      try {
+        await onTurnEnded(event.data.turnId, ctx, "completed");
+      } catch (err) {
+        console.warn(`[open-everywhere:turn-anchor] turn.completed failed: ${String(err)}`);
+      }
+    },
+    "turn.failed": async (event, ctx: HookContext) => {
+      try {
+        await onTurnEnded(event.data.turnId, ctx, "failed");
+      } catch (err) {
+        console.warn(`[open-everywhere:turn-anchor] turn.failed failed: ${String(err)}`);
+      }
+    },
+    "turn.cancelled": async (event, ctx: HookContext) => {
+      try {
+        await onTurnCancelled(event.data.turnId, ctx);
+      } catch (err) {
+        console.warn(`[open-everywhere:turn-anchor] turn.cancelled failed: ${String(err)}`);
+      }
+    },
+    // The last awaited points in a session's life, and the only ones a window that goes quiet after
+    // an ignored stop ever reaches. Neither observes a turn, so draining is all they do.
+    "session.completed": async () => {
+      try {
+        await drainDueIgnoredStops();
+      } catch (err) {
+        console.warn(`[open-everywhere:turn-anchor] ignored-stop drain failed: ${String(err)}`);
+      }
+    },
+    "session.failed": async () => {
+      try {
+        await drainDueIgnoredStops();
+      } catch (err) {
+        console.warn(`[open-everywhere:turn-anchor] ignored-stop drain failed: ${String(err)}`);
+      }
+    },
+  },
+});