@open-everywhere/core 0.1.0

package/agent/memory/domain.ts

@@ -0,0 +1,1276 @@
+// A channel belongs to AT MOST ONE domain, enforced at config load by assertChannelExclusivity, so a fact has exactly one home and resolution is a single hop.
+// This is ROUTING, not ISOLATION: a reach entry decides where a surface lands, never a confidentiality boundary. See docs/capabilities/memory.md.
+
+import { windowTopologyEnabled } from "../access/capabilities.js";
+import { isQualifiedPrincipalKey } from "../identity/principal-key.js";
+import {
+  isGroupSegment,
+  parseSurfaceKeyEntry,
+  surfaceKeyEntriesEquivalent,
+  surfaceKeyEntriesIntersect,
+  surfaceKeyEntryContains,
+  surfaceKeyEntryMatches,
+  type SurfaceKeyEntry,
+} from "../identity/surface-key-grammar.js";
+import { tenantRungRemedy } from "../access/tenant-admission.js";
+import { DM_ANCHOR_DOMAIN_PREFIX } from "../channels/window-key.js";
+// channels/seat-admission.ts imports only a TYPE from the wake envelope, so this edge adds no runtime cycle back into memory/.
+import { DEFAULT_ADMISSION, admissionFunctionNames, isAdmissionFunctionName } from "../channels/seat-admission.js";
+import { credentialGrantDeclarationProblems } from "../access/credential-grant.js";
+import { domainCredentialProblems, type DomainCredentialOverride } from "../access/domain-credentials.js";
+import type { SessionMode } from "../access/resolver.js";
+import type { Trust } from "../identity/binding.js";
+import type { ApprovalModeConfig } from "../access/approver-chain.js";
+// TYPE-ONLY, and it must stay so. access/external-policy.ts sits in access/taint-signal.ts's import
+// cone, which is inside audit/audit.ts's — a value import from here would close a module-init cycle.
+import type { ExternalPolicyOverride, ExternalRoomGrain } from "../access/external-policy.js";
+
+export type DomainMatch = "org" | "public" | "dm";
+
+/**
+ * Consulted ONLY when the code capability windowTopologyEnabled() holds; with the gate off every domain runs the native per-container path.
+ * "solo" (the default) gives each channel its own standing window; "unified" merges the whole domain into one context window.
+ */
+export type WindowMode = "solo" | "unified";
+
+/**
+ * A group slices the CONTEXT WINDOW only: the silo, the trust plane, the access bundle and the audit scope all stay at the DOMAIN grain.
+ * The group name is a GLOBAL window id, so assertWindowGroupExclusivity refuses a name another domain uses and a name equal to any domain name.
+ */
+export interface WindowGroup {
+  readonly name: string;
+  /** Every entry must narrow WITHIN the enclosing domain: an exact key must already be a member of it, and a container must intersect one of the domain's own containers. */
+  readonly reach?: readonly string[];
+  /** Exclusions from this group's {@link reach} — exclude always wins, as at the domain grain. */
+  readonly exclude?: readonly string[];
+}
+
+/**
+ * The name travels as a windowId through the session registry key and the supervisor token, where "/" and ":" are structure.
+ * Bounded at 64 characters so a name can never crowd out the token's other segments.
+ */
+export const WINDOW_GROUP_NAME_RE = /^(?=.{1,64}$)[a-z0-9]+(?:-[a-z0-9]+)*$/;
+
+/**
+ * The operator-facing calibration dial for how eagerly a standing seat engages: `reserved` raises the engagement bar, `aggressive` lowers it, `neutral` leaves it unchanged.
+ * It calibrates a judged wake only. It never bypasses the judge.
+ */
+export type EngagementTier = "aggressive" | "neutral" | "reserved";
+
+/** Reasoning effort (AI SDK provider-agnostic; an upstream that can't map it ignores it). */
+export type ModelReasoning =
+  | "provider-default"
+  | "none"
+  | "minimal"
+  | "low"
+  | "medium"
+  | "high"
+  | "xhigh";
+
+/** The org's model-policy allow-list (model/policy.ts) tags each allowed model with a tier, so a role or domain names a tier instead of a model and stays portable across orgs. */
+export type ModelTier = "high" | "medium" | "low";
+
+/** Every field is optional and absent fields INHERIT: explicit domain, then the `org` pseudo-domain, then the agent.ts static defaults (see modelRouteFor). */
+export interface ModelRoute {
+  /** Model id in the configured backend's namespace — `creator/model` on a gateway, for example "anthropic/claude-sonnet-5". */
+  readonly id?: string;
+  /** A HINT the backend maps. Deliberately NOT inherited across a model change: a route that sets `id` but no `providers` DROPS the inherited pin, because a pin belongs to the id it was set with. */
+  readonly providers?: readonly string[];
+  /** Self-serve up to the org's `reasoningCeiling` (model/policy.ts), not allow-list constrained; `xhigh` is a per-turn cost amplifier behind a deliberately raised ceiling. */
+  readonly reasoning?: ModelReasoning;
+  /**
+   * A concrete `id` on the SAME route wins over `tier`, and that id must be in the org allow-list (fail-loud at config load, assertRoutesWithinPolicy).
+   * ASYMMETRIC across layers: a layer that sets one of `id`/`tier` DROPS any inherited value of the other.
+   */
+  readonly tier?: ModelTier;
+}
+
+/**
+ * `primary` answers in the channel, `utility` is the shared cheap summarizer (compaction plus the dream judge), `supervisor` is the standing ambient session.
+ * `supervisor` FALLS BACK to `primary` when unset, so adding the role is inert until a domain routes it.
+ */
+export interface ModelRoutes {
+  readonly primary?: ModelRoute;
+  readonly utility?: ModelRoute;
+  readonly supervisor?: ModelRoute;
+}
+
+export type ModelRole = keyof ModelRoutes;
+
+/** Cosmetic tuning, so FAIL-OPEN end to end: any resolution or update error falls back to the backend's default size and never blocks a turn. */
+export interface SandboxPreset {
+  /** On Vercel the sandbox's memory scales with this vCPU count. */
+  readonly vcpus?: number;
+}
+
+export interface Domain {
+  /**
+   * IMMUTABLE ONCE REFERENCED. The name is persisted verbatim into rows and keys that outlive a deploy, and a rename migrates none of them — the old rows are orphaned silently.
+   * To change what humans see, set Domain.title instead. A real rename is a data migration.
+   */
+  readonly name: string;
+  /** Purely cosmetic: nothing resolves, matches, partitions or authorizes on it, and it is never persisted as a key. Absent means humans see `name`. */
+  readonly title?: string;
+  /**
+   * Three shapes: an exact `platform/<tenant>/<surface>` key, a whole-tenant `platform/<tenant>` container, or a same-level `platform/<tenant>/<prefix>*` glob. The NARROWEST matching entry wins, across domains and within one.
+   * The `*` is legal only as the last character of a three-segment entry, refused fail-loud at config load, because overlap between two entries must be decidable. Pair with `exclude`, which always wins.
+   */
+  readonly reach?: readonly string[];
+  /**
+   * A surface an exclusion matches is not in this domain, whatever `reach` says. An entry is a three-segment surface key or a same-level glob, never a whole tenant.
+   * Fail-loud at config load: an exclusion must intersect one of THIS domain's reach entries, and may not cancel a whole entry.
+   */
+  readonly exclude?: readonly string[];
+  /** At most one domain per match value, and a domain has `reach` XOR `match` — both enforced fail-loud at config load. */
+  readonly match?: DomainMatch;
+  /** A LIST composes several silos. Each silo materialises into its OWN sandbox dir; they co-exist and are never merged. Omitted means a grouping with no memory. */
+  readonly memory?: string | readonly string[];
+  /**
+   * `"readonly"` includes the `org` pseudo-domain's silos forced read-only here; `"inherit"` includes them with their native per-silo read/write.
+   * Forbidden on the `org` and `public` pseudo-domains, refused at config load. A silo this domain lists in `memory` wins over the includeOrg copy.
+   */
+  readonly includeOrg?: "readonly" | "inherit";
+  /**
+   * `DANGEROUSLY_BYPASS` turns ask into allow: it kills approval CARDS only. It cannot lift a deny, and cannot lift the taint ask-floor. `APPROVE_ALL` floors every open verb to a card, except tool names on `allowlist`. `DENY_ALL` tightens every verdict to deny.
+   * Config-as-code only: there is deliberately no runtime toggle for a lowering mode.
+   */
+  readonly approvalMode?: ApprovalModeConfig;
+  /**
+   * Respond (judged) to a top-level message that says the agent's name without an @mention. OFF by default. An explicit domain wins for its channels; an unassigned channel reads the `org` pseudo-domain's flag.
+   * Externally-shared or unconfirmable channels never name-drop wake, whatever this flag says (fail-closed).
+   */
+  readonly nameDropWake?: boolean;
+  /**
+   * Does an UNADDRESSED message wake the standing seat? OFF by default, which makes the room ADDRESSED-ONLY; ambient talk then enters the seat's context on its NEXT wake.
+   * It does not decide whether a seat EXISTS — every channel has one. Single hop: an explicit domain wins for its channels, else the `org` pseudo-domain's flag.
+   */
+  readonly ambientSupervisor?: boolean;
+  /**
+   * Names an admission function (channels/seat-admission.ts); unset takes DEFAULT_ADMISSION, and an unknown name is refused fail-loud at config load.
+   * Admission decides what the seat READS on a wake it already takes. It never decides whether the seat wakes.
+   */
+  readonly admission?: string;
+  /**
+   * The DOMAIN OVERRIDE half of the `externalPolicy` settings block, resolved FIELD BY FIELD: a domain that declares only `roomGrain` keeps the org default's `authorGrain`.
+   * Single domain hop, as `ambientSupervisor` does it: an explicit domain's declaration wins for its channels, else the `org` pseudo-domain's.
+   */
+  readonly externalPolicy?: ExternalPolicyOverride;
+  /**
+   * `"solo"` (the default) is one window per CHANNEL; `"unified"` is ONE window for the whole domain. Consulted only when windowTopologyEnabled() holds, and inert with the gate off.
+   * FORBIDDEN on the `org`/`public`/`dm` pseudo-domains, enforced fail-loud by assertUnifiedDomainTrust — which is what makes every undeclared channel's seat solo.
+   */
+  readonly mode?: WindowMode;
+  /**
+   * A channel takes the most specific group that admits it (windowGroupFor); a channel no group admits falls through to the `mode` residue, so `windows` is purely additive.
+   * Same gate and chain as `mode`: only when windowTopologyEnabled() holds, never on a pseudo-domain (assertUnifiedDomainTrust); names and overlap are proved by assertWindowGroupExclusivity.
+   */
+  readonly windows?: readonly WindowGroup[];
+  /**
+   * INHERITS like `models`: explicit domain, then the `org` pseudo-domain, then the per-platform default (GitHub `reserved`, everything else `neutral`).
+   * Only meaningful where `ambientSupervisor` is on; inert otherwise.
+   */
+  readonly engagementTier?: EngagementTier;
+  /** INHERITS field by field: an explicit domain's route overlays the `org` pseudo-domain's, which overlays the agent.ts static model config. */
+  readonly models?: ModelRoutes;
+  /**
+   * The maximum reasoning effort a route in this domain may resolve to. INHERITS like `models`: org policy default, `org` domain, dm/public criteria, explicit domain.
+   * A domain may RAISE or LOWER it. Only meaningful when a model policy is configured; with none there is no clamp at all.
+   */
+  readonly reasoningCeiling?: ModelReasoning;
+  /** INHERITS like `models`: framework defaults, the `org` pseudo-domain's list, then the explicit domain's. Each layer EXTENDS what it inherited or REPLACES it wholesale (see `statusVerbsMode`). */
+  readonly statusVerbs?: readonly string[];
+  /** How this domain's `statusVerbs` combine with the inherited list. Default "extend". */
+  readonly statusVerbsMode?: "extend" | "replace";
+  /**
+   * Anything the domain sets explicitly WINS over the role's value, field by field. An unknown role name throws at config load (roles/role.ts applyRoleDefaults).
+   * The layered knobs take the role as its own rung: framework, org, role, domain.
+   */
+  readonly role?: string;
+  /** A role can preset it; the domain's own value wins. */
+  readonly sandbox?: SandboxPreset;
+  /**
+   * QUALIFIED principal keys — `platform/<principal-id>`, plus the WORKSPACE rung on a tenant-scoped platform ("slack/T0AB1CD2E/U0EXUSER002"). A bare id is refused fail-loud at config load, and a `linkSet:<id>` reference is deliberately refused: admin standing must be static and diff-auditable, with no runtime link-set read on the highest-privilege gate.
+   * This does NOT inherit — an explicit domain's admins come only from its own list — but an org admin is also a domain admin everywhere (access/roles.ts roleForBinding).
+   */
+  readonly admins?: readonly string[];
+  /**
+   * Marks this explicit domain's channels as the org's admin/governance venue. A WIDENING flag, so it lives in config-as-code behind a PR, never a runtime toggle.
+   * Fail-loud at config load (assertGovernanceDomains): a `reach` domain, a non-empty `admins` roster, at most GOVERNANCE_CHANNEL_MAX channels, and every channel operator-vouched-internal.
+   */
+  readonly governance?: boolean;
+  /**
+   * Where a routine created anywhere in this domain posts when the creating surface cannot post proactively. It must be one of THIS domain's own exact `reach` entries, and only a domain with a `reach` may set it (assertReportChannels).
+   * Whether the named surface can actually be posted into is checked at routine-creation time, not here.
+   */
+  readonly reportChannel?: string;
+  /**
+   * ORG-LEVEL ONLY: set it on the `org` pseudo-domain — assertComplianceDomains fails loud anywhere else. DEFAULT OFF.
+   * On, access/connector-disclosure.ts requires the VERIFIED REQUESTOR of a direct-addressed turn to be entitled to the connector's resource before the credential resolves, and FAILS CLOSED when no entitlement signal is available.
+   */
+  readonly requestorEntitlementChecks?: boolean;
+  /**
+   * Set it on the `org` pseudo-domain ONLY; the lint rejects it anywhere else. Absent means `"channel"`: the gate engages only once a `governance: true` domain exists.
+   * `"dm-fallback"` engages the gate with NO governance domain configured, and delivers an org-grain read to the verified role-holder's DM instead of the room.
+   */
+  readonly governanceDelivery?: GovernanceDeliveryMode;
+  /**
+   * FALLBACK, NOT FAIL-CLOSED: a domain that declares nothing here uses the org default credential. An override is an addition, never a precondition.
+   * A DECLARED override naming a credential the provider does not carry is a config error refused at boot (access/domain-credentials.ts), never a fall back to the org credential.
+   */
+  readonly credentials?: readonly DomainCredentialOverride[];
+
+  /**
+   * Connector ids this domain's rooms may raise credential-grant asks for; each must name a CREDENTIAL_GRANT_ROLES entry (access/credential-grant.ts).
+   * FAIL-CLOSED: absent or empty admits no grant at all, and there is no org-wide default to fall back to. A connector this tree admits no grant role for is refused at boot.
+   */
+  readonly credentialGrants?: readonly string[];
+}
+
+export type GovernanceDeliveryMode = "channel" | "dm-fallback";
+
+export function memoryRefs(domain: Domain): string[] {
+  if (!domain.memory) return [];
+  return Array.isArray(domain.memory) ? [...domain.memory] : [domain.memory as string];
+}
+
+export function defineDomain(domain: Domain): Domain {
+  return domain;
+}
+
+/** How a surface reached its domain: `"roster"` when the winning `reach` entry is an EXACT key, `container:<entry>` when it is a container (the entry verbatim), `excluded:<domain>:<entry>` when an exclusion vetoed a domain that would have matched, and `"none"` when no domain reaches it. */
+export type DomainVia = "roster" | `container:${string}` | `excluded:${string}` | "none";
+
+export interface DomainRouting {
+  readonly domain: Domain | undefined;
+  readonly via: DomainVia;
+}
+
+/** A domain entry is a `tenant` or a `surface` entry. The grammar's GROUP rung (`teams/<tenant>/team:<id>`) is a TRUST-plane shape and is refused here by name (assertDomainsValid). */
+type ReachEntry = SurfaceKeyEntry;
+
+const parseReachEntry = parseSurfaceKeyEntry;
+
+const entryMatchesKey = surfaceKeyEntryMatches;
+
+/** Is every key of `inner` also a key of `outer`? Total on intersecting entries, because the grammar's sets are laminar. */
+const entryContains = surfaceKeyEntryContains;
+
+/** A line that does not parse is dropped here and reported by assertDomainsValid, which owns the malformed-entry message. */
+interface ParsedEntry {
+  readonly entry: string;
+  readonly parsed: ReachEntry;
+}
+
+function parseEntries(entries: readonly string[] | undefined): ParsedEntry[] {
+  const out: ParsedEntry[] = [];
+  for (const entry of entries ?? []) {
+    const parsed = parseReachEntry(entry);
+    if (parsed) out.push({ entry, parsed });
+  }
+  return out;
+}
+
+/**
+ * The grammar's sets are LAMINAR: when two entries intersect, one CONTAINS the other. So "narrowest" is a total order over the matching entries and this single pass finds it.
+ * Entries denoting the SAME set have no order. Within one domain the first is kept; across domains assertChannelExclusivity refuses the pair at config load.
+ */
+function mostSpecificMatch(entries: readonly ParsedEntry[], channelKey: string): ParsedEntry | undefined {
+  let best: ParsedEntry | undefined;
+  for (const candidate of entries) {
+    if (!entryMatchesKey(candidate.parsed, channelKey)) continue;
+    if (best === undefined || entryContains(best.parsed, candidate.parsed)) {
+      if (best !== undefined && surfaceKeyEntriesEquivalent(best.parsed, candidate.parsed)) continue;
+      best = candidate;
+    }
+  }
+  return best;
+}
+
+/**
+ * The EXACT keys of a `reach` list — the enumerable half. Container entries are deliberately absent: a container still admits surfaces created tomorrow, so no list can stand for it.
+ * Declaration order is preserved, because several callers take the FIRST entry as the domain's anchor surface.
+ */
+export function domainRoster(domain: { readonly reach?: readonly string[] }): string[] {
+  const out: string[] = [];
+  for (const entry of domain.reach ?? []) {
+    const parsed = parseReachEntry(entry);
+    if (parsed?.kind === "surface" && !parsed.glob) out.push(entry);
+  }
+  return out;
+}
+
+export function domainContainers(domain: { readonly reach?: readonly string[] }): string[] {
+  const out: string[] = [];
+  for (const entry of domain.reach ?? []) {
+    const parsed = parseReachEntry(entry);
+    if (parsed && (parsed.kind !== "surface" || parsed.glob)) out.push(entry);
+  }
+  return out;
+}
+
+/**
+ * One domain's verdict on one key: the MOST SPECIFIC matching `reach` entry, or the `exclude` entry that carved it back out — exclude ALWAYS wins.
+ * Exported so a vendor fence that re-walks the decision asks this same question; two implementations are how a fence and the router come to disagree about who owns a surface.
+ */
+export function domainReachVerdict(
+  domain: Domain,
+  channelKey: string,
+): { readonly kind: "admits" | "excluded"; readonly entry: string } | undefined {
+  const admits = mostSpecificMatch(parseEntries(domain.reach), channelKey);
+  if (admits === undefined) return undefined;
+  const excluded = mostSpecificMatch(parseEntries(domain.exclude), channelKey);
+  return excluded === undefined ? { kind: "admits", entry: admits.entry } : { kind: "excluded", entry: excluded.entry };
+}
+
+/**
+ * MOST SPECIFIC WINS: among the domains that admit the key, the one whose winning entry denotes the NARROWEST set takes it. Only explicit domains — the `match` pseudo-domains are selected from trust/mode, never by channel key.
+ * PURE and SYNCHRONOUS, and it stays that way: resolveAccess and EventScopeGrant.grantsRead sit downstream, so a fetch here would make EffectiveAccess time-varying.
+ */
+export function resolveDomainForChannel(channelKey: string, domains: readonly Domain[]): DomainRouting {
+  let winner: { readonly domain: Domain; readonly parsed: ReachEntry; readonly entry: string } | undefined;
+  let vetoed: DomainVia | undefined;
+  for (const d of domains) {
+    const verdict = domainReachVerdict(d, channelKey);
+    if (!verdict) continue;
+    if (verdict.kind === "excluded") {
+      // Carved out. Keep WHY for the provenance, and keep looking: another domain may reach it.
+      vetoed ??= `excluded:${d.name}:${verdict.entry}`;
+      continue;
+    }
+    const parsed = parseReachEntry(verdict.entry);
+    if (!parsed) continue;
+    if (winner === undefined || (entryContains(winner.parsed, parsed) && !surfaceKeyEntriesEquivalent(winner.parsed, parsed))) {
+      winner = { domain: d, parsed, entry: verdict.entry };
+    }
+  }
+  if (!winner) return { domain: undefined, via: vetoed ?? "none" };
+  const exact = winner.parsed.kind === "surface" && !winner.parsed.glob;
+  return { domain: winner.domain, via: exact ? "roster" : `container:${winner.entry}` };
+}
+
+export function domainForChannel(channelKey: string, domains: readonly Domain[]): Domain | undefined {
+  return resolveDomainForChannel(channelKey, domains).domain;
+}
+
+export function criteriaDomain(match: DomainMatch, domains: readonly Domain[]): Domain | undefined {
+  return domains.find((d) => d.match === match);
+}
+
+/** Mirrors the memory resolver's own classification (memory/resolve.ts's dm branch plus the trust gate). Never returns "org" — that layer is unconditional, and knobLayersFor adds it itself. */
+export function domainMatchFor(mode: SessionMode, trust: Trust): DomainMatch | undefined {
+  if (mode === "mpim") return undefined;
+  if (mode === "dm") return trust === "internal" ? "dm" : "public";
+  if (trust === "external") return "public";
+  return undefined;
+}
+
+export function nameDropWakeEnabled(channelKey: string, domains: readonly Domain[]): boolean {
+  const explicit = domainForChannel(channelKey, domains);
+  if (explicit) return explicit.nameDropWake === true;
+  return criteriaDomain("org", domains)?.nameDropWake === true;
+}
+
+/**
+ * `undefined` means NO DOMAIN OVERRIDE, which the caller resolves to the org default field by field. It is not a value.
+ * An ABSENT `channelKey` is a room the caller could not name, not a reason to skip the question: it returns the `org` pseudo-domain's declaration, and only an explicit domain needs the key.
+ */
+export function externalPolicyOverrideFor(channelKey: string | undefined, domains: readonly Domain[]): ExternalPolicyOverride | undefined {
+  const explicit = channelKey === undefined ? undefined : domainForChannel(channelKey, domains);
+  if (explicit) return explicit.externalPolicy;
+  return criteriaDomain("org", domains)?.externalPolicy;
+}
+
+/** An injectable sink, so a test captures the warning text instead of scraping stdout. */
+export interface SilentRoomGrainValidationDeps {
+  readonly warn?: (message: string) => void;
+}
+
+/**
+ * WARN ONLY, NEVER REFUSES BOOT: two of the three external-room legs (vendor-external, guest-present) are runtime facts, so a channel armed by one carries no `public` declaration and a refusal would be a false positive.
+ * `orgDefaultRoomGrain` and `declaredPublic` are PURE INPUTS, not the runtime singletons: the trust register is populated by a separate boot import, so reading it here would race boot order.
+ */
+export function warnSilentRoomGrainWithoutPublicSignal(
+  domains: readonly Domain[],
+  orgDefaultRoomGrain: ExternalRoomGrain,
+  declaredPublic: (workspaceKey: string, surfaceKey: string) => boolean,
+  deps: SilentRoomGrainValidationDeps = {},
+): void {
+  const warn = deps.warn ?? ((m: string) => console.warn(m));
+  const checked = new Set<string>();
+  for (const d of domains) {
+    for (const ch of domainRoster(d)) {
+      if (checked.has(ch)) continue;
+      checked.add(ch);
+      const override = externalPolicyOverrideFor(ch, domains);
+      const roomGrain = override?.roomGrain ?? orgDefaultRoomGrain;
+      if (roomGrain !== "silent") continue;
+      const segs = ch.split("/");
+      const workspaceKey = segs.slice(0, 2).join("/");
+      if (declaredPublic(workspaceKey, ch)) continue;
+      warn(
+        `[open-everywhere:external-policy] channel "${ch}" (domain "${d.name}") resolves ` +
+          `externalPolicy.roomGrain: "silent" but no "public" trust entry covers it in ` +
+          `agent/identity/surfaces.ts — the OPERATOR-DECLARED leg of the external-room class can ` +
+          `never arm here from static config. This is fine if a vendor-external (Slack Connect / ` +
+          `Teams shared channel) or guest-present signal is meant to arm it at runtime instead; if ` +
+          `the static declaration was meant to arm it, add a "public" surface entry for this channel.`,
+      );
+    }
+  }
+}
+
+/**
+ * Default everywhere is OFF, which is ADDRESSED-ONLY, never seatless.
+ * This is NOT the seat gate — the seat stands either way (windowedSupervisorEnabled). A refused ambient message enters the seat's context on its next wake.
+ */
+export function ambientSupervisorEnabled(channelKey: string, domains: readonly Domain[]): boolean {
+  const explicit = domainForChannel(channelKey, domains);
+  if (explicit) return explicit.ambientSupervisor === true;
+  return criteriaDomain("org", domains)?.ambientSupervisor === true;
+}
+
+/**
+ * `"no-domain"` is a deployer CONFIG GAP: the surface is in no domain and the `org` pseudo-domain does not opt in either. The fix is to add the surface to a domain's `reach`.
+ * `"domain-refused"` is deliberate: the surface is in a domain whose `ambientSupervisor` flag is off.
+ */
+export type AmbientSkip = "no-domain" | "domain-refused";
+
+/** Decides nothing and changes nothing about whether the supervisor runs. It only names the outcome so an ingress can record it (channels/ambient-skip.ts); `undefined` means the supervisor DID engage. */
+export function ambientSkipFor(
+  channelKey: string,
+  domains: readonly Domain[],
+): { readonly reason: AmbientSkip; readonly domain?: string; readonly via: DomainVia } | undefined {
+  const routing = resolveDomainForChannel(channelKey, domains);
+  if (routing.domain) {
+    if (routing.domain.ambientSupervisor === true) return undefined;
+    return { reason: "domain-refused", domain: routing.domain.name, via: routing.via };
+  }
+  if (criteriaDomain("org", domains)?.ambientSupervisor === true) return undefined;
+  return { reason: "no-domain", via: routing.via };
+}
+
+/** Returns the NAME, not the function: the resolver stays free of the registry, which is what lets the config-load validation and the wake path read the same answer. */
+export function admissionNameFor(channelKey: string, domains: readonly Domain[]): string {
+  const explicit = domainForChannel(channelKey, domains);
+  if (explicit) return explicit.admission ?? DEFAULT_ADMISSION;
+  return criteriaDomain("org", domains)?.admission ?? DEFAULT_ADMISSION;
+}
+
+/**
+ * True only when the code capability windowTopologyEnabled() holds (the one gate, default OFF, fail-closed) AND the channel resolves to a seat domain. Every channel the bot is in gets a seat.
+ * Gate off means false for every channel, so the caller keeps the native per-container `(org, surfaceKey)` grain unchanged.
+ */
+export function windowedSupervisorEnabled(channelKey: string, domains: readonly Domain[]): boolean {
+  if (!windowTopologyEnabled()) return false;
+  return standingSeatDomainFor(channelKey, domains) !== undefined;
+}
+
+/**
+ * Undefined only when the deployment declares NO `org` pseudo-domain and the channel is in no explicit domain; the channel then keeps the native per-container path. That is the one fail-closed arm.
+ * Ignores the capability gate on purpose, so a config-load check can ask which domain WOULD seat a channel.
+ */
+export function standingSeatDomainFor(channelKey: string, domains: readonly Domain[]): Domain | undefined {
+  return domainForChannel(channelKey, domains) ?? criteriaDomain("org", domains);
+}
+
+/** When defined, its `name` is the grain the seat's session, registry row and token are anchored by. Memory, access and trust stay DOMAIN-anchored under every topology. */
+export function windowedDomainFor(channelKey: string, domains: readonly Domain[]): Domain | undefined {
+  if (!windowedSupervisorEnabled(channelKey, domains)) return undefined;
+  return standingSeatDomainFor(channelKey, domains);
+}
+
+/**
+ * A channel with no explicit domain resolves `"solo"`, which gives that channel its OWN window, so an undeclared room never shares context with another.
+ * The SOLE reader of `mode`, consulted only after windowedSupervisorEnabled has confirmed the channel windows.
+ */
+export function windowModeFor(channelKey: string, domains: readonly Domain[]): WindowMode {
+  return domainForChannel(channelKey, domains)?.mode ?? "solo";
+}
+
+/**
+ * MOST SPECIFIC WINS, the same rule one grain up: the group whose winning entry denotes the narrowest set takes the key, whatever order the groups are declared in.
+ * A group that reaches the key but then excludes it does NOT capture it — the sweep continues, so another group can still take it.
+ */
+export function windowGroupFor(channelKey: string, domain: Domain): WindowGroup | undefined {
+  let winner: { readonly group: WindowGroup; readonly parsed: ReachEntry } | undefined;
+  for (const group of domain.windows ?? []) {
+    const admits = mostSpecificMatch(parseEntries(group.reach), channelKey);
+    if (admits === undefined) continue;
+    if (mostSpecificMatch(parseEntries(group.exclude), channelKey) !== undefined) continue;
+    if (winner === undefined || (entryContains(winner.parsed, admits.parsed) && !surfaceKeyEntriesEquivalent(winner.parsed, admits.parsed))) {
+      winner = { group, parsed: admits.parsed };
+    }
+  }
+  return winner?.group;
+}
+
+/**
+ * Undefined is the ordinary answer and means no group spoke: the caller keeps the `mode` residue untouched.
+ * Like windowModeFor it does NOT re-check windowedSupervisorEnabled; it is consulted only after the caller has confirmed the channel windows.
+ */
+export function windowIdFor(channelKey: string, domains: readonly Domain[]): string | undefined {
+  const domain = domainForChannel(channelKey, domains);
+  if (!domain) return undefined;
+  return windowGroupFor(channelKey, domain)?.name;
+}
+
+/** Everything decidable from one domain alone. Cross-domain problems — a name two domains share, a name that is also a domain name, two groups that can elect one key — belong to assertWindowGroupExclusivity. */
+function windowGroupShapeProblems(d: Domain): string[] {
+  const groups = d.windows ?? [];
+  const bad: string[] = [];
+  if (d.match !== undefined) {
+    bad.push(
+      `  "${d.name}" (match "${d.match}") must not set windows — a standing window is a TEAM-section feature, never a pseudo-domain (org=the "window everything" footgun; public/dm=external/personal surface)`,
+    );
+  }
+  if (groups.length === 0) {
+    bad.push(`  "${d.name}" declares an EMPTY windows list — that grants nothing and reads as if it did; name at least one group, or drop the field`);
+  }
+  const seen = new Set<string>();
+  for (const g of groups) {
+    if (!WINDOW_GROUP_NAME_RE.test(g.name)) {
+      bad.push(
+        `  "${d.name}" names the window group "${g.name}", which is not a legal window id — a group name is lowercase kebab (${String(WINDOW_GROUP_NAME_RE)}) because it travels as the windowId through the session registry key ("oe-domain::<name>") and the supervisor token ("oe-dom:<domain>:win:<name>:oe-sup:g<gen>"), where "/" and ":" are structure`,
+      );
+      continue; // an unusable name makes every further report about it noise
+    }
+    if (seen.has(g.name)) {
+      bad.push(`  "${d.name}" declares the window group "${g.name}" TWICE — a group name is the window id, so the second declaration could never be elected`);
+      continue;
+    }
+    seen.add(g.name);
+    if ((g.reach?.length ?? 0) === 0) {
+      bad.push(`  window group "${g.name}" of "${d.name}" names no members — give it a reach list, or drop it (an empty group elects nobody)`);
+    }
+    if ((g.exclude?.length ?? 0) > 0 && (g.reach?.length ?? 0) === 0) {
+      bad.push(`  window group "${g.name}" of "${d.name}" sets exclude with no reach — an exclusion carves out of a REACH, so this pair is dead config; delete it`);
+    }
+    // The "is this key a member of this domain" check needs the WHOLE roster, so it lives in assertWindowGroupExclusivity.
+    for (const entry of g.exclude ?? []) {
+      const parsed = parseReachEntry(entry);
+      if (!parsed || parsed.kind === "group") {
+        bad.push(`  window group "${g.name}" of "${d.name}" excludes "${entry}", which is not a legal exclusion entry (a surface key, or a same-level \`prefix*\` glob)`);
+        continue;
+      }
+      if (parsed.kind === "tenant") {
+        bad.push(`  window group "${g.name}" of "${d.name}" excludes the whole tenant "${entry}" — a tenant-wide exclusion either cancels the group's reach outright or means nothing; name the surfaces`);
+        continue;
+      }
+      // A group that names a key outright and then excludes it elects NOBODY for that key: it falls through to the `mode` residue, which is a different window from the one the operator wrote.
+      const ownExact = domainRoster(g).find((ch) => entryMatchesKey(parsed, ch));
+      if (ownExact !== undefined) {
+        bad.push(
+          `  window group "${g.name}" of "${d.name}" excludes "${entry}" but also reaches "${ownExact}" outright — an exclusion and the exact key it cancels are a contradiction, and the key would silently fall through to this domain's \`mode\` residue instead of the group: delete the reach entry, or the exclusion.`,
+        );
+      }
+    }
+    for (const entry of g.reach ?? []) {
+      const parsed = parseReachEntry(entry);
+      // The GROUP rung parses, so without this refusal it would land as silently dead config that reads like membership.
+      if (parsed?.kind === "group") {
+        bad.push(
+          `  window group "${g.name}" of "${d.name}" reaches "${entry}", which uses the GROUP rung (\`<marker>:<id>\`) — that shape belongs to the TRUST registry (agent/identity/surfaces.ts), never to a window group`,
+        );
+        continue;
+      }
+      if (!parsed) {
+        bad.push(`  window group "${g.name}" of "${d.name}" reaches "${entry}", which is not a legal reach entry (see Domain.reach)`);
+        continue;
+      }
+      // An EXACT key is checked for domain MEMBERSHIP one level up (it needs the whole roster). A CONTAINER must intersect one of the domain's own, because a window narrows WITHIN its domain and can never reach past it.
+      if (parsed.kind === "surface" && !parsed.glob) continue;
+      const withinDomainReach = domainContainers(d).some((own) => {
+        const ownParsed = parseReachEntry(own);
+        return ownParsed !== undefined && surfaceKeyEntriesIntersect(ownParsed, parsed);
+      });
+      if (!withinDomainReach) {
+        bad.push(
+          `  window group "${g.name}" of "${d.name}" reaches container "${entry}", which intersects none of that domain's own containers — a window narrows WITHIN its domain's reach and can never reach past it`,
+        );
+      }
+    }
+  }
+  return bad;
+}
+
+/**
+ * Refuses a `match` (org/public/dm) pseudo-domain that sets `mode` or `windows`, listing every problem at once — which is why a pseudo-domain seats every channel SOLO.
+ * Call it at the config-load seam beside assertDomainsValid, assertChannelExclusivity and assertWindowGroupExclusivity.
+ */
+export function assertUnifiedDomainTrust(domains: readonly Domain[]): void {
+  const bad: string[] = [];
+  for (const d of domains) {
+    if (d.windows !== undefined) bad.push(...windowGroupShapeProblems(d));
+    if (d.mode === undefined) continue;
+    const isPseudo = d.match !== undefined;
+    if (isPseudo) {
+      bad.push(
+        `  "${d.name}" (match "${d.match}") must not set mode — a standing window is a TEAM-section feature, never a pseudo-domain (org=the "window everything" footgun; public/dm=external/personal surface)`,
+      );
+    }
+  }
+  if (bad.length > 0) {
+    throw new Error(
+      "open-everywhere: invalid standing-window topology configuration:\n" +
+        bad.join("\n") +
+        "\n(memory/domain.ts assertUnifiedDomainTrust).",
+    );
+  }
+}
+
+/**
+ * Platforms whose binding TRUST VERDICT is authoritative: the mapper re-derives it from a live per-wake check (Slack's externally-shared test; local is internal by construction).
+ * On every OTHER platform `trust: "external"` means NOT DETERMINED, not "guests present" — so a guard that refuses on it alone refuses those platforms entirely on a deployment that has not vouched them.
+ */
+export const BINDING_TRUSTED_PLATFORMS: ReadonlySet<string> = new Set(["slack", "local"]);
+
+/**
+ * A PURE INPUT, injected by the caller: these assertions run at config load and the trust register is populated by a separate boot import, so reading the singleton here would race boot order.
+ * A predicate, not a key list, because the registry's most-specific-wins resolver honours a `public` carve-out under an internal tenant. The `readonly string[]` form still means a flat either-grain match with no carve-outs.
+ */
+export type VouchedInternalFor = (workspaceKey: string, surfaceKey: string) => boolean;
+
+function vouchedPredicate(vouched: readonly string[] | VouchedInternalFor): VouchedInternalFor {
+  if (typeof vouched === "function") return vouched;
+  const vset = new Set(vouched);
+  return (workspaceKey, surfaceKey) => vset.has(workspaceKey) || vset.has(surfaceKey);
+}
+
+/**
+ * The config-load twin of the live window election: a named `windows` group first, then the `mode` residue.
+ * ROSTER ONLY: a container-admitted surface is not enumerable without I/O.
+ */
+function windowMemberSets(d: Domain): ReadonlyMap<string, readonly string[]> {
+  const out = new Map<string, string[]>();
+  for (const ch of domainRoster(d)) {
+    const windowId = windowGroupFor(ch, d)?.name ?? (d.mode === "unified" ? d.name : ch);
+    const members = out.get(windowId);
+    if (members) members.push(ch);
+    else out.set(windowId, [ch]);
+  }
+  return out;
+}
+
+/**
+ * A standing WINDOW holding MORE THAN ONE member requires every register-gated member to be operator-vouched-internal, throwing at config load. A one-member window cannot bleed cross-context and is exempt.
+ * A source passes on an operator vouch, on `OE_TRUST=internal`, or on a BINDING_TRUSTED_PLATFORMS platform; everything else fails closed. Membership is read from EXACT `reach` entries only.
+ */
+export function assertWindowSourcesVouched(domains: readonly Domain[], vouched: readonly string[] | VouchedInternalFor): void {
+  const isInternal = vouchedPredicate(vouched);
+  const trustEnv = (process.env.OE_TRUST ?? "").trim().toLowerCase() === "internal";
+  const bad: string[] = [];
+  for (const d of domains) {
+    for (const [windowId, members] of windowMemberSets(d)) {
+      if (members.length <= 1) continue; // single-source window: cannot bleed cross-context
+      const where = windowId === d.name ? `domain "${d.name}"` : `window "${windowId}" of domain "${d.name}"`;
+      for (const ch of members) {
+        const segs = ch.split("/");
+        const platform = segs[0] ?? "";
+        if (BINDING_TRUSTED_PLATFORMS.has(platform)) continue; // trust is a binding fact, not the register
+        const workspaceKey = segs.slice(0, 2).join("/"); // `platform/workspace` (memory/partition.ts)
+        const okay = isInternal(workspaceKey, ch) || trustEnv;
+        if (!okay) {
+          bad.push(
+              `  ${where} includes UN-vouched source "${ch}" in a multi-source (${members.length}-channel) cross-surface window — vouch it in agent/identity/surfaces.ts (add "${ch}" or its workspace "${workspaceKey}"), or set OE_TRUST=internal for an internal-only deploy` +
+              // A Notion TRUST ROOT cannot satisfy this gate: the ancestor walk runs per delivery against the live Notion API, and config load has no delivery and no credential.
+              (platform === "notion"
+                ? `. A Notion TRUST ROOT does not satisfy this gate: the ancestor walk runs per delivery against the live Notion API, so config load cannot resolve it. Declare this page in the register as well`
+                : // 🔴 THIS GATE ACCEPTS A TEAMS TENANT ENTRY, and so does the single-window privacy
+                  // floor: isVouchedSurface walks the declaration rungs, so one tenant line serves both planes.
+                  // Keep this advice in sync with identity/trust-preflight.ts undeclaredSurfacesFix.
+                  platform === "teams"
+                  ? `. For TEAMS, this tenant entry is enough for a cross-surface SINGLE WINDOW member too: the window privacy floor walks the declaration rungs (OPE-1521), so a "teams/<tenantId>" declaration admits every room under the tenant. 🔴 Weigh that REACH — it covers rooms you never named, a cross-tenant Connect/shared channel among them, because an inbound Teams activity usually omits membershipType. Declare a "teams/<tenantId>/<threadId>" key to narrow it to one channel. See docs/deploy/surfaces/teams.md`
+                  : ``),
+          );
+        }
+      }
+    }
+  }
+  if (bad.length > 0) {
+    throw new Error(
+      "open-everywhere: multi-source cross-surface window has un-vouched source(s):\n" +
+        bad.join("\n") +
+        "\n(memory/domain.ts assertWindowSourcesVouched).",
+    );
+  }
+}
+
+/** Chosen below the design's stated smell threshold, which calls a 40-channel governance domain clearly wrong: the venue's safety story is a SMALL, uniformly-privileged audience. */
+export const GOVERNANCE_CHANNEL_MAX = 20;
+
+export function governanceDomains(domains: readonly Domain[]): Domain[] {
+  return domains.filter((d) => d.governance === true);
+}
+
+/** Config designation only — arming is the separate runtime floor check (access/audience-floor.ts). */
+export function isGovernanceChannel(channelKey: string, domains: readonly Domain[]): boolean {
+  return domainForChannel(channelKey, domains)?.governance === true;
+}
+
+/**
+ * The FIRST channel of the FIRST governance domain, else `fallback` — the legacy `OE_ACCESS_ADMIN_CHANNEL` alias, which has no roster, so nothing unlocks there.
+ * Undefined means no governance channel is configured at all: a read redirects to the requester's DM, and a write refuses.
+ */
+export function governanceChannelFor(domains: readonly Domain[], fallback?: string): string | undefined {
+  const first = governanceDomains(domains).flatMap((d) => domainRoster(d))[0];
+  return first ?? fallback;
+}
+
+/** Defaults to `"channel"` when absent or set anywhere the lint would have rejected. Fail-safe either way: the default never DM-delivers, and the opt-in only narrows what a room may hear. */
+export function governanceDeliveryMode(domains: readonly Domain[]): GovernanceDeliveryMode {
+  return criteriaDomain("org", domains)?.governanceDelivery === "dm-fallback" ? "dm-fallback" : "channel";
+}
+
+/**
+ * Config-load fail-loud lint: a governance domain must have an explicit `reach`, a non-empty `admins` roster, at most GOVERNANCE_CHANNEL_MAX channels, and every channel operator-vouched-internal.
+ * `vouched` is a PURE INPUT, never the runtime trust singleton, because the register is populated by a separate boot import.
+ */
+export function assertGovernanceDomains(domains: readonly Domain[], vouched: readonly string[] | VouchedInternalFor): void {
+  const isInternal = vouchedPredicate(vouched);
+  const trustEnv = (process.env.OE_TRUST ?? "").trim().toLowerCase() === "internal";
+  const bad: string[] = [];
+  for (const d of domains) {
+    // governanceDelivery is a single ORG-WIDE knob. Set on any other domain it would read as a per-domain policy that nothing implements, so it fails loud rather than being silently ignored.
+    if (d.governanceDelivery !== undefined && d.match !== "org") {
+      bad.push(
+        `  "${d.name}" sets governanceDelivery, but that is a single ORG-WIDE knob — move it to the "org" pseudo-domain (the { match: "org" } domain); there is deliberately no per-domain delivery policy`,
+      );
+    }
+    if (d.governance !== true) continue;
+    const channels = domainRoster(d);
+    if (d.match !== undefined || d.reach === undefined) {
+      bad.push(`  "${d.name}" is governance but has no reach — a governance venue must list concrete channels, never a match/pseudo-domain`);
+    }
+    if (!d.admins || d.admins.length === 0) {
+      bad.push(`  "${d.name}" is governance but has an empty admins roster — a governance venue with no admins unlocks nothing (add the org's admin principal ids to its admins list)`);
+    }
+    const governanceContainers = domainContainers(d);
+    if (governanceContainers.length > 0) {
+      // Not a confidentiality rule but a STRUCTURAL one: the channel cap and the per-channel vouch are decidable only over an enumerable roster.
+      // A same-level glob is narrower but still unbounded — it admits surfaces created tomorrow — so it is refused on the same grounds.
+      bad.push(`  "${d.name}" is governance but reaches container(s) [${governanceContainers.join(", ")}] — a governance venue is a SMALL, enumerated, individually-vouched audience, and neither the ${GOVERNANCE_CHANNEL_MAX}-channel cap nor the per-channel vouch can be decided over an unbounded container, whether it is a whole tenant or a \`prefix*\` glob (list the concrete channels, or drop governance from this domain)`);
+    }
+    if (d.exclude !== undefined) {
+      // A governance domain may not reach a container at all, so an exclusion here is dead config. It must not read as "this venue's membership is computed".
+      bad.push(`  "${d.name}" is governance but sets exclude [${d.exclude.join(", ")}] — an exclusion carves surfaces out of a CONTAINER, and a governance venue may not reach one at all; its audience is the exact keys of its \`reach\` and nothing else (drop exclude)`);
+    }
+    if (channels.length > GOVERNANCE_CHANNEL_MAX) {
+      bad.push(`  "${d.name}" is governance with ${channels.length} channels — that exceeds the ${GOVERNANCE_CHANNEL_MAX}-channel governance cap (a governance domain is a SMALL uniformly-privileged venue; split it or re-tag)`);
+    }
+    for (const ch of channels) {
+      const segs = ch.split("/");
+      const platform = segs[0] ?? "";
+      if (BINDING_TRUSTED_PLATFORMS.has(platform)) continue; // trust is a binding fact, confirmed per-wake
+      const workspaceKey = segs.slice(0, 2).join("/");
+      if (!(isInternal(workspaceKey, ch) || trustEnv)) {
+        bad.push(`  "${d.name}" is governance but its channel "${ch}" is not operator-vouched-internal — vouch it in agent/identity/surfaces.ts (add "${ch}" or its workspace "${workspaceKey}"), or set OE_TRUST=internal for an internal-only deploy`);
+      }
+    }
+  }
+  if (bad.length > 0) {
+    throw new Error(
+      "open-everywhere: invalid governance domain(s):\n" +
+        bad.join("\n") +
+        "\n(memory/domain.ts assertGovernanceDomains).",
+    );
+  }
+}
+
+/**
+ * The channel's OWN explicit domain's reportChannel, and nothing else. Deliberately not inherited and not org-wide: only the audience already sharing this domain's brain can be said to have agreed to the redirect.
+ * A channel in no explicit domain gets no redirect at all.
+ */
+export function reportChannelFor(channelKey: string, domains: readonly Domain[]): string | undefined {
+  return domainForChannel(channelKey, domains)?.reportChannel;
+}
+
+/**
+ * Two rules: reportChannel may only be set on a domain with a `reach`, and it must name one of THAT domain's own channels — a redirect out of the domain posts to an audience the domain never agreed to.
+ * Whether the surface can actually be posted into is NOT checked here (the dispatch registry's boot order is not guaranteed); it is checked at routine-creation time.
+ */
+export function assertReportChannels(domains: readonly Domain[]): void {
+  const bad: string[] = [];
+  for (const d of domains) {
+    const rc = d.reportChannel;
+    if (rc === undefined) continue;
+    if (d.reach === undefined || d.match !== undefined) {
+      bad.push(`  "${d.name}" sets reportChannel but has no reach — a report redirect must name a concrete room inside a concrete domain, never a match/pseudo-domain`);
+      continue;
+    }
+    const roster = domainRoster(d);
+    if (!roster.includes(rc)) {
+      bad.push(`  "${d.name}" sets reportChannel "${rc}", which is not one of its own exact reach entries — a routine may only be redirected INSIDE its domain, to a room config names outright (add "${rc}" to "${d.name}".reach, or point reportChannel at one of: ${roster.join(", ")})`);
+    }
+  }
+  if (bad.length > 0) {
+    throw new Error("open-everywhere: invalid domain reportChannel(s):\n" + bad.join("\n") + "\n(memory/domain.ts assertReportChannels — OPE-148).");
+  }
+}
+
+export function requestorEntitlementChecksEnabled(domains: readonly Domain[]): boolean {
+  return criteriaDomain("org", domains)?.requestorEntitlementChecks === true;
+}
+
+/** A doctrine guard, not a typo guard: `requestorEntitlementChecks` may appear ONLY on the `org` pseudo-domain. A per-room pre-check is the "different members of one room get different answers" shape the design rejected, so a misplacement is refused loudly instead of silently ignored. */
+export function assertComplianceDomains(domains: readonly Domain[]): void {
+  const bad = domains
+    .filter((d) => d.requestorEntitlementChecks !== undefined && d.match !== "org")
+    .map(
+      (d) =>
+        `  "${d.name}" sets requestorEntitlementChecks — that is an ORG-LEVEL compliance opt-in and ` +
+        `belongs on the \`org\` pseudo-domain (match: "org"), never on a room/criteria domain ` +
+        `(a per-room requestor pre-check is the per-user-answers-inside-a-room shape the design rejected)`,
+    );
+  if (bad.length > 0) {
+    throw new Error(
+      "open-everywhere: invalid compliance-mode config:\n" +
+        bad.join("\n") +
+        "\n(memory/domain.ts assertComplianceDomains).",
+    );
+  }
+}
+
+/** Platforms not listed default to `neutral`. Deliberately not extrapolated beyond the design's evidence: only GitHub has a stated non-neutral default. */
+const PLATFORM_ENGAGEMENT_TIER_DEFAULTS: Readonly<Record<string, EngagementTier>> = {
+  github: "reserved",
+};
+
+/** UNLIKE the behaviour opt-ins, this is a TUNING knob and INHERITS: explicit domain, `org` pseudo-domain, then the per-platform default. Total — it always yields a tier, so callers carry no unset case. */
+export function engagementTierFor(channelKey: string, domains: readonly Domain[]): EngagementTier {
+  const explicit = domainForChannel(channelKey, domains)?.engagementTier;
+  if (explicit) return explicit;
+  const org = criteriaDomain("org", domains)?.engagementTier;
+  if (org) return org;
+  const platform = channelKey.split("/")[0] ?? "";
+  return PLATFORM_ENGAGEMENT_TIER_DEFAULTS[platform] ?? "neutral";
+}
+
+/**
+ * Each domain expands to [its role, itself], so the order is framework, org, role, domain, and the domain's own fields win.
+ * Structural rather than the Role type itself, to keep this module role-agnostic at runtime.
+ */
+interface KnobLayer {
+  readonly statusVerbs?: readonly string[];
+  readonly statusVerbsMode?: "extend" | "replace";
+  readonly models?: ModelRoutes;
+  readonly reasoningCeiling?: ModelReasoning;
+}
+
+export interface NamedKnobLayer extends KnobLayer {
+  readonly name: string;
+}
+
+/**
+ * An unknown role name simply contributes no rung — fail-open here, because config load already failed loud on it (roles/role.ts applyRoleDefaults).
+ * `surfaceMatch` inserts the dm/public criteria domain BETWEEN `org` and `target`; precedence stays org, criteria, target.
+ */
+function knobLayersForDomain(
+  domains: readonly Domain[],
+  roles: readonly NamedKnobLayer[],
+  target: Domain | undefined,
+  surfaceMatch?: DomainMatch,
+): KnobLayer[] {
+  const layers: KnobLayer[] = [];
+  const rungs: (Domain | undefined)[] = [criteriaDomain("org", domains)];
+  if (surfaceMatch === "dm" || surfaceMatch === "public") {
+    rungs.push(criteriaDomain(surfaceMatch, domains));
+  }
+  rungs.push(target);
+  for (const d of rungs) {
+    if (!d) continue;
+    const role = d.role !== undefined ? roles.find((r) => r.name === d.role) : undefined;
+    if (role) layers.push(role);
+    layers.push(d);
+  }
+  return layers;
+}
+
+function knobLayersFor(
+  channelKey: string,
+  domains: readonly Domain[],
+  roles: readonly NamedKnobLayer[],
+  surfaceMatch?: DomainMatch,
+): KnobLayer[] {
+  return knobLayersForDomain(domains, roles, domainForChannel(channelKey, domains), surfaceMatch);
+}
+
+/**
+ * Merges FIELD BY FIELD over framework, org, role and domain, so a domain that sets only `reasoning` keeps the inherited model id.
+ * Returns {} when nothing routes: the caller falls through to the agent.ts static model and then to the model-policy envelope for tier resolution and clamping.
+ */
+export function modelRouteFor(
+  role: ModelRole,
+  channelKey: string,
+  domains: readonly Domain[],
+  roles: readonly NamedKnobLayer[] = [],
+  surfaceMatch?: DomainMatch,
+): ModelRoute {
+  const layers = knobLayersFor(channelKey, domains, roles, surfaceMatch);
+  let route: ModelRoute = {};
+  for (const d of layers) {
+    const r = d?.models?.[role];
+    if (!r) continue;
+    route = {
+      // id and tier are mutually exclusive per layer: setting one drops the OTHER field's inherited value. A layer that sets neither keeps both.
+      id: r.id !== undefined ? r.id : r.tier !== undefined ? undefined : route.id,
+      tier: r.tier !== undefined ? r.tier : r.id !== undefined ? undefined : route.tier,
+      // a pin follows its model: an overlay that changes `id` without `providers` DROPS the inherited pin
+      providers: r.providers ?? (r.id !== undefined && r.id !== route.id ? undefined : route.providers),
+      reasoning: r.reasoning ?? route.reasoning,
+    };
+  }
+  return route;
+}
+
+export const DEFAULT_STATUS_VERBS: readonly string[] = [
+  "Tinkering",
+  "Untangling",
+  "Sifting",
+  "Weaving",
+  "Whittling",
+  "Rummaging",
+  "Distilling",
+  "Plotting",
+  "Doodling",
+  "Juggling",
+];
+
+/** An empty result (for example `replace` with an empty list) falls back to the defaults — the status line must never go verb-less. Blank entries are dropped. */
+export function statusVerbsFor(
+  channelKey: string,
+  domains: readonly Domain[],
+  roles: readonly NamedKnobLayer[] = [],
+  surfaceMatch?: DomainMatch,
+): readonly string[] {
+  const layers = knobLayersFor(channelKey, domains, roles, surfaceMatch);
+  let verbs = [...DEFAULT_STATUS_VERBS];
+  for (const d of layers) {
+    const own = (d?.statusVerbs ?? []).map((v) => v.trim()).filter((v) => v.length > 0);
+    if (own.length === 0 && d?.statusVerbsMode !== "replace") continue;
+    verbs = d?.statusVerbsMode === "replace" ? own : [...verbs, ...own.filter((v) => !verbs.includes(v))];
+  }
+  return verbs.length > 0 ? verbs : DEFAULT_STATUS_VERBS;
+}
+
+/** `base` is the org policy default the caller passes. Each domain layer overrides it in order: `org`, dm/public criteria, explicit domain. A domain may raise or lower it. */
+export function reasoningCeilingFor(
+  channelKey: string,
+  domains: readonly Domain[],
+  roles: readonly NamedKnobLayer[] = [],
+  surfaceMatch: DomainMatch | undefined,
+  base: ModelReasoning,
+): ModelReasoning {
+  let ceiling = base;
+  for (const d of knobLayersFor(channelKey, domains, roles, surfaceMatch)) {
+    if (d?.reasoningCeiling !== undefined) ceiling = d.reasoningCeiling;
+  }
+  return ceiling;
+}
+
+/**
+ * The WRITE-TIME twin of reasoningCeilingFor, keyed by domain name because a set has no live channel to resolve from.
+ * The envelope re-clamps at call time regardless, so this is the friendlier refusal message, not the enforcement. An unknown name contributes no rung beyond `org`.
+ */
+export function reasoningCeilingForDomain(
+  domainName: string,
+  domains: readonly Domain[],
+  roles: readonly NamedKnobLayer[] = [],
+  base: ModelReasoning,
+): ModelReasoning {
+  const target = domains.find((d) => d.name === domainName);
+  let ceiling = base;
+  for (const d of knobLayersForDomain(domains, roles, target, undefined)) {
+    if (d?.reasoningCeiling !== undefined) ceiling = d.reasoningCeiling;
+  }
+  return ceiling;
+}
+
+/**
+ * At-most-one-domain holds by construction only if this question is decidable at config load, which is why the pattern language is a single trailing `*`: two prefixes overlap iff one is a prefix of the other.
+ * The sets form a LAMINAR family, so the intersection is never some third set nobody wrote, which is what lets an exclusion cancel it exactly.
+ */
+const entriesIntersect = surfaceKeyEntriesIntersect;
+
+/** Does one of this domain's exclusions cancel the WHOLE of `set`? (Exclude always wins.) */
+function exclusionCovering(domain: Domain, set: ReachEntry): string | undefined {
+  for (const entry of domain.exclude ?? []) {
+    const parsed = parseReachEntry(entry);
+    if (parsed && entryContains(parsed, set)) return entry;
+  }
+  return undefined;
+}
+
+/**
+ * Refuses only what specificity cannot order: two entries in DIFFERENT domains that denote the SAME set of keys, unless one of the two domains excludes the whole overlap.
+ * A strictly narrower entry beside a wider one is deliberately allowed; it is the ordinary way to hand a slice of a tenant to another domain.
+ */
+export function assertChannelExclusivity(domains: readonly Domain[]): void {
+  const clashes: string[] = [];
+  // The sweep is over domain PAIRS, so a domain's own overlapping entries (harmless) are never compared. A malformed entry is assertDomainsValid's report, not this one's.
+  const reach = domains.map((d) => ({ domain: d, entries: parseEntries(d.reach) }));
+  for (let i = 0; i < reach.length; i++) {
+    for (let j = i + 1; j < reach.length; j++) {
+      const a = reach[i]!;
+      const b = reach[j]!;
+      if (a.domain.name === b.domain.name) continue;
+      for (const ae of a.entries) {
+        for (const be of b.entries) {
+          if (!surfaceKeyEntriesEquivalent(ae.parsed, be.parsed)) continue;
+          if (exclusionCovering(a.domain, be.parsed) !== undefined) continue;
+          if (exclusionCovering(b.domain, ae.parsed) !== undefined) continue;
+          // A whole-tenant exclusion is itself refused (assertDomainsValid), so the tenant branch must not offer one as the remedy; the only fix there is to narrow one side.
+          clashes.push(
+            ae.parsed.kind === "surface" && !ae.parsed.glob
+              ? `  "${ae.entry}" is in the reach of both "${a.domain.name}" and "${b.domain.name}"`
+              : ae.parsed.kind === "tenant"
+                ? `  the tenant "${ae.entry}" is reached by both "${a.domain.name}" and "${b.domain.name}", so which domain owns a key under it would depend on declaration order — narrow one of them to a \`<prefix>*\` glob or to exact keys`
+                : `  the reach entries "${ae.entry}" ("${a.domain.name}") and "${be.entry}" ("${b.domain.name}") match exactly the SAME keys, so which domain owns them would depend on declaration order — narrow one of them, or add exclude: ["${be.entry}"] to the domain that should NOT get them`,
+          );
+        }
+      }
+    }
+  }
+  // AND AT LEAST ONE: every room a domain names OUTRIGHT must route back to that domain, or the only symptom is silence. An exact key wins by construction, and this proves it rather than assuming it.
+  // Container entries are deliberately not checked: their answer is unbounded, so there is no set of keys to round-trip.
+  for (const d of domains) {
+    for (const key of domainRoster(d)) {
+      const owner = resolveDomainForChannel(key, domains);
+      if (owner.domain?.name === d.name) continue;
+      clashes.push(
+        `  "${key}" is named by "${d.name}" but routes to ${owner.domain ? `"${owner.domain.name}"` : `NO domain (via: ${owner.via})`} — a room config names outright must land in the domain that named it, or it gets no memory, no bundle and no ambient supervisor, and says so only by staying silent`,
+      );
+    }
+  }
+  if (clashes.length > 0) {
+    throw new Error(
+      "open-everywhere: a channel belongs to at most one memory domain, and a room a domain names outright belongs to that one, but:\n" +
+        clashes.join("\n") +
+        "\nRemove the channel from all but one domain (docs/capabilities/memory.md).",
+    );
+  }
+}
+
+/**
+ * A window id keys the `channel_session` registry row GLOBALLY and carries no domain segment, so a group name must be unique across domains and must never equal a domain name; otherwise two domains share one standing context window.
+ * Also refuses two groups in one domain whose entries denote the SAME set, and a group member that config routes to another domain.
+ */
+export function assertWindowGroupExclusivity(domains: readonly Domain[]): void {
+  const clashes: string[] = [];
+  const domainNames = new Map<string, string>();
+  for (const d of domains) domainNames.set(d.name, d.name);
+  const groupOwner = new Map<string, string>();
+  for (const d of domains) {
+    for (const g of d.windows ?? []) {
+      if (domainNames.has(g.name)) {
+        clashes.push(
+          `  window group "${g.name}" of "${d.name}" has the same name as the domain "${g.name}" — a domain name is itself a window id (the id-equals-domain form), so the two would share the session registry row "oe-domain::${g.name}"`,
+        );
+      }
+      // A group may only slice what its domain already HOLDS, and holding is the resolver's answer: a key this domain merely reaches by container while another domain rosters it belongs to that other domain, so listing it here is dead config that reads as a grant.
+      for (const ch of domainRoster(g)) {
+        const owner = domainForChannel(ch, domains);
+        if (owner?.name !== d.name) {
+          clashes.push(
+            `  window group "${g.name}" of "${d.name}" lists "${ch}", which config routes to ${owner ? `domain "${owner.name}"` : "no domain"} — a window slices a domain it cannot widen, so add the key to "${d.name}".reach first (or list it in a group of the domain that does own it)`,
+          );
+        }
+      }
+      const prev = groupOwner.get(g.name);
+      if (prev !== undefined && prev !== d.name) {
+        clashes.push(
+          `  the window group name "${g.name}" is declared by both "${prev}" and "${d.name}" — a window id keys the session registry GLOBALLY ("oe-domain::${g.name}"), so the two domains would share one standing context window`,
+        );
+      } else {
+        groupOwner.set(g.name, d.name);
+      }
+    }
+    const groups = d.windows ?? [];
+    for (let i = 0; i < groups.length; i++) {
+      for (let j = i + 1; j < groups.length; j++) {
+        const a = groups[i]!;
+        const b = groups[j]!;
+        if (a.name === b.name) continue; // already reported as a duplicate by the shape check
+        for (const ae of parseEntries(a.reach)) {
+          for (const be of parseEntries(b.reach)) {
+            if (!surfaceKeyEntriesEquivalent(ae.parsed, be.parsed)) continue;
+            const covers = (g: WindowGroup, set: ReachEntry): boolean =>
+              parseEntries(g.exclude).some((x) => surfaceKeyEntryContains(x.parsed, set));
+            if (covers(a, be.parsed) || covers(b, ae.parsed)) continue;
+            clashes.push(
+              ae.parsed.kind === "surface" && !ae.parsed.glob
+                ? `  "${ae.entry}" is in the reach of both window groups "${a.name}" and "${b.name}" of "${d.name}"`
+                : `  the reach entries "${ae.entry}" (window group "${a.name}") and "${be.entry}" (window group "${b.name}") of "${d.name}" match exactly the SAME keys, so which WINDOW owns them would depend on declaration order — narrow one of them, or add exclude: ["${be.entry}"] to the group that should NOT get them`,
+            );
+          }
+        }
+      }
+    }
+  }
+  if (clashes.length > 0) {
+    throw new Error(
+      "open-everywhere: invalid standing-window group configuration:\n" +
+        clashes.join("\n") +
+        "\n(memory/domain.ts assertWindowGroupExclusivity — a window id keys one standing session).",
+    );
+  }
+}
+
+/**
+ * Config-load fail-loud validation of the structural rules: `reach` XOR `match`, the legal reach and exclude shapes, no reserved `oe-dm/` name, one domain per match value, includeOrg's requirements, and well-formed qualified admin keys.
+ * Each illegal shape is refused BY NAME rather than silently ignored, because dead config reads as a grant or a carve-out that does not exist.
+ */
+export function assertDomainsValid(domains: readonly Domain[]): void {
+  const bad: string[] = [];
+  const byMatch = new Map<DomainMatch, string>();
+  let hasOrg = false;
+  for (const d of domains) {
+    // `oe-dm/…` is the DM delegation anchor's reserved namespace (channels/window-key.ts). Its safety property is EXCLUSIVITY: no surface key may be recovered from a name an operator chose, and no anchor may resolve a real domain's channels.
+    if (d.name.startsWith(DM_ANCHOR_DOMAIN_PREFIX)) {
+      bad.push(
+        `  "${d.name}" starts with the RESERVED prefix "${DM_ANCHOR_DOMAIN_PREFIX}" — that namespace belongs to the DM delegation anchor (channels/window-key.ts dmAnchorDomain, OPE-306) and can never be a configured domain name. Rename it.`,
+      );
+    }
+    // SHAPE only here. Whether the named credentials exist is a provider-registry question, answered at boot by assertDomainCredentialsResolvable.
+    bad.push(...domainCredentialProblems(d));
+    // SHAPE and ADMISSION both, because the admitted connector list is a reviewed constant in this tree rather than a provider registry read at boot.
+    bad.push(...credentialGrantDeclarationProblems(d));
+    // An unknown name is refused LOUD here because the runtime resolver falls back to the default, which would otherwise turn a typo into a silently WIDER seat than the deployer wrote.
+    if (d.admission !== undefined && !isAdmissionFunctionName(d.admission)) {
+      bad.push(
+        `  "${d.name}" sets admission "${d.admission}", which is not a registered admission function — use one of: ${admissionFunctionNames().join(", ")} (channels/seat-admission.ts SEAT_ADMISSION_FUNCTIONS; a new policy is deterministic code added there by PR, never a config string)`,
+      );
+    }
+    const hasExplicit = d.reach !== undefined;
+    const hasMatch = d.match !== undefined;
+    if (hasExplicit === hasMatch) {
+      bad.push(`  "${d.name}" must have EITHER a reach list OR match (criteria), not ${hasExplicit ? "both" : "neither"}`);
+    }
+    const reachEntries: ParsedEntry[] = [];
+    for (const key of [...(d.reach ?? []), ...(d.exclude ?? [])]) {
+      // The GROUP rung parses, so without this refusal it would land as silently DEAD config: no memory key carries a colon, so the entry could never match anything.
+      const seg3 = key.split("/")[2];
+      if (seg3 !== undefined && isGroupSegment(seg3)) {
+        bad.push(
+          `  "${d.name}" names "${key}", which uses the GROUP rung (\`<marker>:<id>\`) — that shape belongs to the TRUST registry (agent/identity/surfaces.ts), never to a memory domain. A memory key is \`platform/<tenant>\` or \`platform/<tenant>/<surface>\`, and no surface segment can contain a colon, so this entry could never match anything.`,
+        );
+      }
+    }
+    for (const key of d.reach ?? []) {
+      const parsed = parseReachEntry(key);
+      if (parsed?.kind === "group") continue; // already reported above; do not also call it malformed
+      if (parsed) {
+        reachEntries.push({ entry: key, parsed });
+        continue;
+      }
+      const segs = key.split("/");
+      bad.push(
+        segs.length > 3
+          ? `  "${d.name}" reaches "${key}", but INTERMEDIATE containers are not supported — a reach entry is an exact surface key \`platform/<tenant>/<surface>\`, a two-segment tenant key \`platform/<tenant>\` (e.g. "github/acme", "linear/<orgId>", "notion/<workspaceId>"), or a three-segment same-level glob \`platform/<tenant>/<prefix>*\` (e.g. "github/acme/payments-*") — never a deeper path. A deeper container ("every row under this database") needs an ancestor walk the webhook payload cannot prove and an API call per level, so it is refused BY NAME rather than admitted with no reader. List the concrete surfaces instead.`
+          : `  "${d.name}" reaches "${key}", which is none of the three legal shapes: an exact surface key \`platform/<tenant>/<surface>\`, a tenant key \`platform/<tenant>\`, or a same-level glob \`platform/<tenant>/<prefix>*\`. The glob is deliberately ONE trailing \`*\` on the LAST segment — never \`**\`, never mid-string, never in the platform or tenant segment, never a regex — because overlap between two entries has to be decidable at config load (assertChannelExclusivity), and an undecidable overlap is an at-most-one-domain hole.`,
+      );
+    }
+    for (const key of d.exclude ?? []) {
+      const parsed = parseReachEntry(key);
+      if (parsed?.kind === "group") continue; // already reported above; do not also call it malformed
+      if (!parsed || parsed.kind === "tenant") {
+        bad.push(
+          parsed
+            ? `  "${d.name}" excludes "${key}", which is a WHOLE TENANT — an exclusion carves surfaces out of a domain's reach, so it is a three-segment surface key ("github/acme/payments-secrets") or a same-level glob ("github/acme/payments-secret-*"). A tenant-wide exclusion either cancels the reach outright or means nothing; drop the reach entry instead.`
+            : `  "${d.name}" excludes "${key}", which is not a surface key \`platform/<tenant>/<surface>\` nor a same-level glob \`platform/<tenant>/<prefix>*\` (one trailing \`*\` on the last segment only — see the reach rule)`,
+        );
+        continue;
+      }
+      // An exclusion against this domain's OWN EXACT key is a contradiction, not a carve-out: deleting one of the two lines says the same thing, and says it once.
+      const ownExact = domainRoster(d).find((ch) => entryMatchesKey(parsed, ch));
+      if (ownExact !== undefined) {
+        bad.push(
+          `  "${d.name}" excludes "${key}" but also reaches "${ownExact}" outright — an exclusion and the exact key it cancels are a contradiction: delete the reach entry, or the exclusion.`,
+        );
+        continue;
+      }
+      const cancels = reachEntries.find((c) => entryContains(parsed, c.parsed));
+      if (cancels) {
+        bad.push(
+          `  "${d.name}" excludes "${key}", which cancels the WHOLE of its reach entry "${cancels.entry}" — that pair is dead config (the reach can never admit anything). Delete both, or narrow the exclusion.`,
+        );
+        continue;
+      }
+      // A dead exclusion is the dangerous typo: it reads as a carve-out and grants everything.
+      if (!reachEntries.some((c) => entriesIntersect(parsed, c.parsed))) {
+        bad.push(
+          `  "${d.name}" excludes "${key}", but none of its \`reach\` entries [${(d.reach ?? []).join(", ") || "<none>"}] can match it — a dead exclusion reads like a carve-out and grants everything it was meant to withhold. Fix the key, or drop it.`,
+        );
+      }
+    }
+    if (d.approvalMode !== undefined) {
+      // The allowlist is APPROVE_ALL's restoration list. On any other mode it cannot mean anything, and a dead allowlist on DENY_ALL would read like an escape hatch that does not exist.
+      const mode = d.approvalMode.mode;
+      if (mode !== "DANGEROUSLY_BYPASS" && mode !== "APPROVE_ALL" && mode !== "DENY_ALL") {
+        bad.push(`  "${d.name}" sets approvalMode.mode "${String(mode)}" — must be DANGEROUSLY_BYPASS, APPROVE_ALL or DENY_ALL (access/approver-chain.ts)`);
+      }
+      if (d.approvalMode.allowlist !== undefined && mode !== "APPROVE_ALL") {
+        bad.push(`  "${d.name}" sets approvalMode.allowlist under ${mode} — the allowlist is APPROVE_ALL's restoration list and means nothing on any other mode (remove it, or it reads as an escape hatch that does not exist)`);
+      }
+      if (d.approvalMode.allowlist?.some((t) => t.trim() === "")) {
+        bad.push(`  "${d.name}" approvalMode.allowlist has an empty entry — every entry must name a tool`);
+      }
+    }
+    for (const entry of d.admins ?? []) {
+      if (isQualifiedPrincipalKey(entry)) continue;
+      bad.push(
+        `  "${d.name}" lists admin "${entry}", which is not a well-formed principal key \`platform/<principal-id>\` — or, on a tenant-scoped platform, \`platform/<tenant-id>/<principal-id>\` (e.g. "slack/T0AB1CD2E/U0EXUSER002", "discord/300000000000000104"). Admin standing is exact-id ONLY — static and diff-auditable, with no runtime link-set resolution on the highest-privilege gate. A bare vendor id names no namespace and can never match; a \`linkSet:<id>\` reference is deliberately refused here (use a \`principal\` credential binding or a person-group for link-set-keyed grants).${tenantRungRemedy(entry, domains)} (identity/principal-key.ts)`,
+      );
+    }
+    if (hasMatch) {
+      if (d.match === "org") hasOrg = true;
+      const prev = byMatch.get(d.match!);
+      if (prev) bad.push(`  match "${d.match}" is claimed by both "${prev}" and "${d.name}" (at most one per match value)`);
+      else byMatch.set(d.match!, d.name);
+      if (d.includeOrg && (d.match === "org" || d.match === "public")) {
+        bad.push(`  "${d.name}" (match "${d.match}") must not set includeOrg (${d.match === "org" ? "self-reference" : "would leak org memory to the external surface"})`);
+      }
+    }
+  }
+  for (const d of domains) {
+    if (d.includeOrg && !hasOrg) {
+      bad.push(`  "${d.name}" sets includeOrg but no { match: "org" } domain is defined to include`);
+    }
+  }
+  bad.push(...partitionTenantProblems(domains));
+  if (bad.length > 0) {
+    throw new Error(
+      "open-everywhere: invalid memory domain(s):\n" + bad.join("\n") + "\n(memory/domain.ts / docs/capabilities/memory.md)",
+    );
+  }
+}
+
+/**
+ * A Notion delivery's `workspace_id` is an unauthenticated payload field and no REST object carries one, so the partition's workspace segment comes from the matched `reach` entry instead.
+ * Every other platform names its tenant in a signed or vendor-verified envelope, so the delivery is the source there.
+ */
+const CONFIG_DERIVED_TENANT_PLATFORMS: ReadonlySet<string> = new Set(["notion"]);
+
+/**
+ * THE RULE: a domain may reach at most ONE tenant of such a platform BY CONTAINER. With two, the same surface id can key under either, decided by an unauthenticated payload field.
+ * An EXACT entry carries its own tenant and is never ambiguous, so cross-workspace domains stay expressible. The rule is per domain, not per deployment.
+ */
+export function partitionTenantProblems(domains: readonly Domain[]): string[] {
+  const bad: string[] = [];
+  for (const d of domains) {
+    const byPlatform = new Map<string, Set<string>>();
+    for (const entry of domainContainers(d)) {
+      const parsed = parseReachEntry(entry);
+      if (!parsed || !CONFIG_DERIVED_TENANT_PLATFORMS.has(parsed.platform)) continue;
+      const tenants = byPlatform.get(parsed.platform) ?? new Set<string>();
+      tenants.add(parsed.tenant);
+      byPlatform.set(parsed.platform, tenants);
+    }
+    for (const [platform, tenants] of [...byPlatform].sort(([a], [b]) => a.localeCompare(b))) {
+      if (tenants.size < 2) continue;
+      bad.push(
+        `  "${d.name}" reaches ${tenants.size} ${platform} tenants by container (${[...tenants].sort().map((t) => JSON.stringify(t)).join(", ")}) — on ${platform} the session partition's tenant segment comes from the matched \`reach\` entry, because the delivery's own tenant field is unauthenticated and no API call can confirm it. A container states no tenant for the surfaces it sweeps in, so with two of them one surface's history can key under either depending on what a payload says. Split this into one domain per ${platform} tenant, or name the surfaces outright (an exact entry carries its own tenant and is never ambiguous).`,
+      );
+    }
+  }
+  return bad;
+}